Subject: [417] wu-ftpd and Sun Solaris 2.x: shell script change needed

From: "Nelson H. F. Beebe" <[email-masked]>
Date: Fri, 02 Sep 1994 10:41:54 -0600 (MDT)

During the last 3 days, we have completed the move of
ftp.math.utah.edu from an overloaded, and aging, Sun 4/380 server to
one of four new SPARC 20/512 two-processor systems.  The old machine
runs SunOS 4.1.3, and the new ones, Solaris 2.3 (== SunOS 5.3).  We
spent many hours tracking down and fixing two problems that showed up.

(1) On the new system, the protection of ~ftp/etc was accidentally set
incorrectly.  The effect of this was that a bare `ls' command in an
ftp client would list files (it is handled by special code inside ftpd
itself), but a `dir' or `ls -switches' command would fail (that
requires invocation of /bin/ls).  At least if it happens in the
future, we'll know where to look; other sites can learn the lesson
from our experience.

(2) The `quote site index' command failed to work, returning as its
output a string like "cannot open /dev/fd/10", instead of the expected
list of matching file names.  This one took much longer to track down,
and required attaching the dbx debugger to the ftpd process after it
had started.  It turns out that in Solaris 2.x, when a file executed
by the exec*() family of systems calls is found to begin with

#!/bin/sh

the kernel knows that the indicated program, /bin/sh, must be started
with the script file itself as the input to the program.  Presumably,
in SunOS 4.x, this was done by simply opening the file, and then
duplicating the file descriptor of the file's handle to 0, that of
standard input.

In Solaris 2.x, there is a new file system called /dev/fd, (fd == file
descriptor); its files are named by numbers, and correspond to file
descriptors of running processes.  Thus, /dev/fd/10 is a file that is
equivalent to that currently open on file descriptor 10.

What the Solaris 2.x exec*() system call now does is start /bin/sh,
passing it the name of its input file on the command line, followed by
the command arguments.  The result of this is that the shell is
invoked as

/bin/sh /dev/fd/nnn arg1 arg2 ....

This is transparent to ordinary shell scripts, because /dev/fd/nnn
exists, and is equivalent to a link to the the shell script file
itself, and /bin/sh is able to open it.

However, in the context of a process that issues a chroot system call,
as ftpd does to isolate its file system for security reasons, there is
then no /dev/fd directory, nor can one make such a directory under
~ftp/dev/fd, because the /dev/fd is magically mounted for each
process, and only one such mount can be in effect at one time.

The fix that restored `quote site index' to working order was to
change the ~ftp/bin/ftp-exec/index script from the normal UNIX one:

#!/bin/sh
if [ $# -eq 1 ]
then
        egrep -i $1 /INDEX | head -20 # 20 results in *** TRUNCATED *** message
else
        echo "Usage: QUOTE SITE INDEX egrep-pattern"
        echo "Regular-expression pattern matching is done on a list of"
        echo "files in the /pub anonymous ftp tree."
fi

to this version which gets an explicit input file name (its own in the
chroot'ed ftp file system) as its first argument:

#!/bin/sh /usr/bin/ftp-exec/index
shift
if [ $# -eq 1 ]
then
        egrep -i $1 /INDEX | head -20 # 20 results in *** TRUNCATED *** message
else
        echo "Usage: QUOTE SITE INDEX egrep-pattern"
        echo "Regular-expression pattern matching is done on a list of"
        echo "files in the /pub anonymous ftp tree."
fi

On entry to the shell script, the arguments will then be

	/dev/fd/10 string-to-find

and the shift command discards the unwanted /dev/fd/10, leaving
string-to-find as the argument to be passed to egrep for the search.

This change in behavior between SunOS 4.x and Solaris 2.x may be a
bug, or a feature, but in either case, I believe that Sun Microsystems 
needs to either fix it, or document it in the man pages for exec(2).

========================================================================
Nelson H. F. Beebe                      Tel: +1 801 581 5254
Center for Scientific Computing         FAX: +1 801 581 4148
Department of Mathematics, 105 JWB      Internet: [email-masked]
University of Utah
Salt Lake City, UT 84112, USA
========================================================================