[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: Logging repository accesses other than commits

From: Nico Kadel-Garcia <nkadel_at_gmail.com>
Date: Sat, 2 Apr 2011 12:23:15 -0400

[ This conversation was accidentally in private email for a bit, I'm
restoring it to the Subversion mailing list. ]

On Sat, Apr 2, 2011 at 9:11 AM, Daniel Shahaf <d.s_at_daniel.shahaf.name> wrote:
> Nico Kadel-Garcia wrote on Sat, Apr 02, 2011 at 08:48:39 -0400:
>> On Sat, Apr 2, 2011 at 1:24 AM, Daniel Shahaf <d.s_at_daniel.shahaf.name> wrote:
>> > Nico Kadel-Garcia wrote on Sat, Apr 02, 2011 at 01:00:46 -0400:
>> >> On Sat, Apr 2, 2011 at 12:52 AM, Daniel Shahaf <d.s_at_daniel.shahaf.name> wrote:
>> >> > Nico Kadel-Garcia wrote on Fri, Apr 01, 2011 at 23:46:16 -0400:
>> >> >> Modern versions of OpenSSH (such as the version 5 in RHEL 6 and
>> >> >> contemporary Debian releases) does not read your .bashrc for non-login
>> >> >> sessions. (This is actually standards compliant behavior, which
>> >> >> OpenSSH version 4 did not follow.)
>> >> >
>> >> > Are you describing a change in sshd or in bash?
>> >>
>> >> sshd. I ran headlong into this in RHEL 5 to RHEL 6 migration.
>> >> Environment variables like aliases and PATH were not being picked up,
>> >> due to this behaviorial change.
>> >>
>> >
>> > Thanks for the details.
>> >
>> > I assume the difference is that sshd stopped running $SHELL as a login
>> > shell, which in turn caused bash to not read .bashrc?
>>
>> I understand that it violated POSIX spec, and people didn't notice or
>> make a big deal of it for some time. Amusingly, as I dig through
>> Google for references to it, I see that I'm the one who keeps
>> referring to this issue as a problem and showing up in various
>> threads, and am having difficulty finding the spec.
>>
>
> Isn't it supposed to live on opengroup.org?

Have you ever tried reading through those with a particular small
question in mind? It takes a while.

Here's the Red Hat published bug report on it, that goes into more
detail and workaround attempts, back at Fedora 9 and the change from
OpenSSH 5.0p1 to OpenSSH 5.1p1.

    https://bugzilla.redhat.com/show_bug.cgi?id=458839

The key is here:

      The .bashrc should be read by bash only when the shell is
interactive or when the stdin is a socket. In the 5.0p1 and older
versions the stdin was socket but that caused other problems. Now the
stdin is pipe and thus the .bashrc is not read

This looks like a consequence of a reasonable change in sshd, but it's
caused issues. And the funky flipping workarounds proposed to restore
this behavior quietly ignore the basic principle of "do *NOT* read
.bashrc for non-login sessions" which is right in the bash
documentation.

>> But you can find the details of how and when .bashrc is read with the
>> 'info bash' command, and it is explicitly *not* supposed to read
>> .bashrc for non-login shells. In theory, one might be able to
>> manipulate hte sshd_config daemon settings to use
>> PermitUserEnvironment, or enable that for specific users such as a
>> designated 'svn' user for shared svn+ssh access, but this is getting
>> seriously arcane.
>
> Thanks for the reply, but it doesn't answer my question: I know how to
> 'man bash' myself [1], but I simply asked if you knew what change was
> made to sshd...

See above.

> IOW, I understand that some change in the way sshd invokes $SHELL caused
> bash to stop reading its .bashrc, but I don't know what that change is.
>
> (I don't see any relevant mentions of 'login shell' in openssh's ChangeLog)
>
>
>
> [1] Incidentally, I read just that section of it that the other day
> in response to someone's question about scp and umask in their rc file.
>
Received on 2011-04-02 18:23:49 CEST

This is an archived mail posted to the Subversion Users mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.