title: Explain how doit() function works in rshd.c
body: <p>I want to know how rsh runs any command. I am using <strong>netkit-rsh-0.17</strong> package. My OS is <strong>centOS</strong>.</p>
  
  <p>In rshd directory, <code>rshd.c</code> performs the task to run any command on server.
  In this file, <code>doit()</code> is the main function who performs all the task.</p>
  
  <p><strong>Questions</strong>,</p>
  
  <ol>
  <li>What <code>pwd-&gt;pw_dir</code>, <code>pwd-&gt;pw_uid</code>, <code>pwd-&gt;pw_shell</code> means in this code?</li>
  <li>What <code>pv</code> does in this.</li>
  </ol>
  
  <p>Explain me by using <code>rsh localhost ulimit -n</code> command.</p>
  
  <p><strong>doit()</strong></p>
  
  <pre class="lang-c prettyprint-override"><code>static void
  doit(struct sockaddr_in *fromp)
  {
      char cmdbuf[ARG_MAX+1];
      const char *theshell, *shellname;
      char locuser[16], remuser[16];
      struct passwd *pwd;
      int sock = -1;
      const char *hostname;
      u_short port;
      int pv[2], pid, ifd;
  
      signal(SIGINT, SIG_DFL);
      signal(SIGQUIT, SIG_DFL);
      signal(SIGTERM, SIG_DFL);
  
      alarm(60);
      port = getint();
      alarm(0);
  
      if (port != 0) {
          int lport = IPPORT_RESERVED - 1;
          sock = rresvport(&amp;lport);
          if (sock &lt; 0) {
              syslog(LOG_ERR, "can't get stderr port: %m");
              exit(1);
          }
          if (port &gt;= IPPORT_RESERVED) {
              syslog(LOG_ERR, "2nd port not reserved\n");
              exit(1);
          }
          fromp-&gt;sin_port = htons(port);
          if (connect(sock, (struct sockaddr *)fromp,
                  sizeof(*fromp)) &lt; 0) {
              syslog(LOG_INFO, "connect second port: %m");
              exit(1);
          }
      }
  
  #if 0
      /* We're running from inetd; socket is already on 0, 1, 2 */
      dup2(f, 0);
      dup2(f, 1);
      dup2(f, 2);
  #endif
  
      getstr(remuser, sizeof(remuser), "remuser");
      getstr(locuser, sizeof(locuser), "locuser");
      getstr(cmdbuf, sizeof(cmdbuf), "command");
      if (!strcmp(locuser, "root")) paranoid = 1;
  
      hostname = findhostname(fromp, remuser, locuser, cmdbuf);
  
      setpwent();
      pwd = doauth(remuser, hostname, locuser);
      if (pwd == NULL) {
          fail("Permission denied.\n", 
               remuser, hostname, locuser, cmdbuf);
      }
  
      if (chdir(pwd-&gt;pw_dir) &lt; 0) {
          chdir("/");
          /*
           * error("No remote directory.\n");
           * exit(1);
           */
      }
  
  
      if (pwd-&gt;pw_uid != 0 &amp;&amp; !access(_PATH_NOLOGIN, F_OK)) {
          error("Logins currently disabled.\n");
          exit(1);
      }
  
      (void) write(2, "\0", 1);
      sent_null = 1;
  
      if (port) {
          if (pipe(pv) &lt; 0) {
              error("Can't make pipe.\n");
              exit(1);
          }
          pid = fork();
          if (pid == -1)  {
              error("Can't fork; try again.\n");
              exit(1);
          }
          if (pid) {
              close(0); 
              close(1);
              close(2); 
              close(pv[1]);
              stderr_parent(sock, pv[0], pid);
              /* NOTREACHED */
          }
          setpgrp();
          close(sock); 
          close(pv[0]);
          dup2(pv[1], 2);
          close(pv[1]);
      }
      theshell = pwd-&gt;pw_shell;
      if (!theshell || !*theshell) {
          /* shouldn't we deny access? */
          theshell = _PATH_BSHELL;
      }
  
  #if BSD &gt; 43
      if (setlogin(pwd-&gt;pw_name) &lt; 0) {
          syslog(LOG_ERR, "setlogin() failed: %m");
      }
  #endif
  #ifndef USE_PAM
      /* if PAM, already done */
      if (setgid(pwd-&gt;pw_gid)) {
          syslog(LOG_ERR, "setgid: %m");
          exit(1);
      }
      if (initgroups(pwd-&gt;pw_name, pwd-&gt;pw_gid)) {
          syslog(LOG_ERR, "initgroups: %m");
          exit(1);
      }
  #endif
      if (setuid(pwd-&gt;pw_uid)) {
          syslog(LOG_ERR, "setuid: %m");
          exit(1);
      }
      environ = envinit;
  
      strncat(homedir, pwd-&gt;pw_dir, sizeof(homedir)-6);
      homedir[sizeof(homedir)-1] = 0;
  
      strcat(path, _PATH_DEFPATH);
  
      strncat(shell, theshell, sizeof(shell)-7);
      shell[sizeof(shell)-1] = 0;
  
      strncat(username, pwd-&gt;pw_name, sizeof(username)-6);
      username[sizeof(username)-1] = 0;
  
      shellname = strrchr(theshell, '/');
      if (shellname) shellname++;
      else shellname = theshell;
  
      endpwent();
      if (paranoid) {
          syslog(LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%s'",
             remuser, hostname, locuser, cmdbuf);
      }
  
      /*
       * Close all fds, in case libc has left fun stuff like 
       * /etc/shadow open.
       */
      for (ifd = getdtablesize()-1; ifd &gt; 2; ifd--) close(ifd);
  
      execl(theshell, shellname, "-c", cmdbuf, 0);
      perror(theshell);
      exit(1);
  }
  </code></pre>