rc - Man Page

• Start listening on a specific port: rc -lp port
• Start a reverse shell: rc host port -r shell

tldr.sh

rc [-deiIlnopsvx] [-c command] [arguments]

rc is a command interpreter and programming language similar to sh(1). It is based on the AT&T Plan 9 shell of the same name. The shell offers a C-like syntax (much more so than the C shell), and a powerful mechanism for manipulating variables. It is reasonably small and reasonably fast, especially when compared to contemporary shells. Its use is intended to be interactive, but the language lends itself well to scripts.

-c

If -c is present, commands are executed from the immediately following argument. Any further arguments to rc are placed in $*. Thus:

rc -c 'echo $*' 1 2 3

prints out

1 2 3

-d

This flag causes rc not to ignore SIGQUIT or SIGTERM. Thus rc can be made to dump core if sent SIGQUIT. This flag is only useful for debugging rc.

-e

If the -e flag is present, then rc will exit if the exit status of a command is false (nonzero). rc will not exit, however, if a conditional fails, e.g., an if() command.

-i

If the -i flag is present or if the input to rc is from a terminal (as determined by isatty(3)) then rc will be in interactive mode. That is, a prompt (from $prompt(1)) will be printed before an input line is taken, and rc will ignore SIGINT.

-I

If the -I flag is present, or if the input to rc is not from a terminal, then rc will not be in interactive mode. No prompts will be printed, and SIGINT will cause rc to exit.

-l

If the -l flag is present, or if rc's argv[0][0] is a dash (-), then rc will behave as a login shell. That is, it will run commands from $home/.rcrc, if this file exists, before reading any other input.

-n

This flag causes rc to read its input and parse it, but not to execute any commands. This is useful for syntax checking on scripts. If used in combination with the -x flag, rc will print each command as it is parsed in a form similar to the one used for exporting functions into the environment.

-o

This flag prevents the usual practice of trying to open /dev/null on file descriptors 0, 1, and 2, if any of those descriptors are inherited closed.

-p

This flag prevents rc from initializing shell functions from the environment. This allows rc to run in a protected mode, whereby it becomes more difficult for an rc script to be subverted by placing false commands in the environment. (Note that the presence of this flag does not mean that it is safe to run setuid rc scripts; the usual caveats about the setuid bit still apply.)

-s

This flag causes rc to read from standard input. Any arguments are placed in $*.

-v

This flag causes rc to echo its input to standard error as it is read.

-x

This flag causes rc to print every command on standard error before it is executed. It can be useful for debugging rc scripts.

A simple command is a sequence of words, separated by white space (space and tab) characters that ends with a newline, semicolon (;), or ampersand (&). The first word of a command is the name of that command. If the name begins with /, ./, or ../, then the name is used as an absolute path name referring to an executable file. Otherwise, the name of the command is looked up in a table of shell functions, builtin commands, or as a file in the directories named by $path.

@ {cd ..; make}

# ; & | ^ $ = ` ' { } ( ) < >

echo 'What''s the plan, Stan?'

What's the plan, Stan?

for (i) {
    command
} | command

{for (i) command} | command

command > file

command < file

echo 1 2 3 > foo
> foo echo 1 2 3
echo 1 2 > foo 3

command >[2] file

command > file >[2=1]

command >[2=1] > file

command >[7=]

command > [2] file

command >> file

command << 'eof-marker'

$variable^follow

cat <<< 'this is a here string' | wc

command |[2] wc

cmp <{command} <{command}

echo hi there | tee >{sed 's/^/p1 /'} >{sed 's/^/p2 /'}

The following may be used for control flow in rc:

command && command

command || command

! command

There are two forms of pattern matching in rc. One is traditional shell globbing. This occurs in matching for file names in argument lists:

command argument argument ...

When the characters *, [ or ? occur in an argument or command, rc looks at the argument as a pattern for matching against files. (Contrary to the behavior other shells exhibit, rc will only perform pattern matching if a metacharacter occurs unquoted and literally in the input. Thus,

foo='*'
echo $foo

will always echo just a star. In order for non-literal metacharacters to be expanded, an eval statement must be used in order to rescan the input.) Pattern matching occurs according to the following rules: a * matches any number (including zero) of characters. A ? matches any single character, and a [ followed by a number of characters followed by a ] matches a single character in that class. The rules for character class matching are the same as those for ed(1), with the exception that character class negation is achieved with the tilde (~), not the caret (^), since the caret already means something else in rc.

rc also matches patterns against strings with the ~ command:

~ subject pattern pattern ...

~ sets $status to zero if and only if a supplied pattern matches any single element of the subject list. Thus

~ foo f*

sets status to zero, while

~ (bar baz) f*

sets status to one. The null list is matched by the null list, so

~ $foo ()

checks to see whether $foo is empty or not. This may also be achieved by the test

~ $#foo 0

Note that inside a ~ command rc does not match patterns against file names, so it is not necessary to quote the characters *, [ and ?. However, rc does expand the subject against filenames if it contains metacharacters. Thus, the command

~ * ?

returns true if any of the files in the current directory have a single-character name. If the ~ command is given a list as its first argument, then a successful match against any of the elements of that list will cause ~ to return true. For example:

~ (foo goo zoo) z*

is true.

The primary data structure in rc is the list, which is a sequence of words. Parentheses are used to group lists. The empty list is represented by (). Lists have no hierarchical structure; a list inside another list is expanded so the outer list contains all the elements of the inner list. Thus, the following are all equivalent

one two three

(one two three)

((one) () ((two three)))

Note that the null string, '', and the null list, (), are two very different things. Assigning the null string to a variable is a valid operation, but it does not remove its definition.

null = '' empty = () echo $#null $#empty

produces the output

1 0

echo (a- b- c-)^(1 2 3)

a-1 b-2 c-3

cc -^(O g c) (malloc alloca)^.c

cc -O -g -c malloc.c alloca.c

echo foo^bar

foobar

opts=(O g c) files=(malloc alloca) cc -$opts $files.c

var = list

$var

a = foo
b = a
echo $ $ b

foo

var=()

echo $'we$Ird:Variab!le'

a=foo b=bar ... command

path=. ifs=() {
    ...
}

$var(n)

a=(one two three)
echo $a(3 3 3)

three three three

$var(`{awk 'BEGIN{for(i=1;i<=10;i++)print i;exit; }'})

$#var

$^var

echo $^path.

$"var

`{ command }

fn src { echo *.[chy] }

wc `src

`` (ifs-list) { command }

`` ($nl :) {cat /etc/passwd}

Several variables are known to rc and are treated specially. In the following list, “default” indicates that rc gives the variable a default value on startup; “no-export” indicates that the variable is never exported; and “read-only” indicates that an attempt to set the variable will silently have no effect.

Also, “alias” means that the variable is aliased to the same name in capitals. For example, an assignment to $cdpath causes an automatic assignment to $CDPATH, and vice-versa. If $CDPATH is set when rc is started, its value is imported into $cdpath. $cdpath and $path are rc lists; $CDPATH and $PATH are colon-separated lists. Only the names spelt in capitals are exported into the environment.

* (no-export)

The argument list of rc. $1, $2, etc. are the same as $*(1), $*(2), etc.

The variable $0 holds the value of argv[0] with which rc was invoked. Additionally, $0 is set to the name of a function for the duration of the execution of that function, and $0 is also set to the name of the file being interpreted for the duration of a . command. $0 is not an element of $*, and is never treated as one.

apid (no-export)

The process ID of the last process started in the background.

apids (no-export read-only)

A list whose elements are the process IDs of all background processes which are still alive, or which have died and have not been waited for yet.

bqstatus (no-export)

The exit status of the rc forked to execute the most recent backquote substitution.  Note that, unlike $status, $bqstatus is always a single element list (see Exit Status below).  For example:

echo foo |grep bar; whatis status

prints

status=(0 1)

whereas

x=`{echo foo |grep bar}; whatis bqstatus

prints

bqstatus=1

cdpath (alias)

A list of directories to search for the target of a cd command. The empty string stands for the current directory. Note that if the $cdpath variable does not contain the current directory, then the current directory will not be searched; this allows directory searching to begin in a directory other than the current directory.

history

$history contains the name of a file to which commands are appended as rc reads them. This facilitates the use of a stand-alone history program (such as history(1)) which parses the contents of the history file and presents them to rc for reinterpretation. If $history is not set, then rc does not append commands to any file.

home (alias)

The default directory for the builtin cd command, and the directory in which rc looks to find its initialization file, .rcrc, if rc has been started up as a login shell.

ifs (default)

The internal field separator, used for splitting up the output of backquote commands for digestion as a list.  On startup, rc assigns the list containing the characters space, tab, and newline to $ifs.

path (alias)

This is a list of directories to search in for commands. The empty string stands for the current directory. If neither $PATH nor $path is set at startup time, $path assumes a default value suitable for your system. This is typically (/usr/local/bin /usr/bin /usr/ucb /bin .)

pid (default no-export)

On startup, $pid is initialized to the numeric process ID of the currently running rc.

prompt (default)

This variable holds the two prompts (in list form, of course) that rc prints. $prompt(1) is printed before each command is read, and $prompt(2) is printed when input is expected to continue on the next line. rc sets $prompt to ('; ' '') by default. The reason for this is that it enables an rc user to grab commands from previous lines using a mouse, and to present them to rc for re-interpretation; the semicolon prompt is simply ignored by rc. The null $prompt(2) also has its justification:  an rc script, when typed interactively, will not leave $prompt(2)'s on the screen, and can therefore be grabbed by a mouse and placed directly into a file for use as a shell script, without further editing being necessary.

prompt (function)

If this function is defined, then it gets executed every time rc is about to print $prompt(1).

status (no-export read-only)

The exit status of the last command. If the command exited with a numeric value, that number is the status. If the command died with a signal, the status is the name of that signal; if a core file was created, the string “+core” is appended. The value of $status for a pipeline is a list, with one entry, as above, for each process in the pipeline. For example, the command

ls | wc

usually sets $status to (0 0).

version (default)

On startup, the first element of this list variable is initialized to a string which identifies this version of rc. The second element is initialized to a string which can be found by ident(1) and the what command of sccs(1).

rc functions are identical to rc scripts, except that they are stored in memory and are automatically exported into the environment. A shell function is declared as:

fn name { commands }

rc scans the definition until the close-brace, so the function can span more than one line. The function definition may be removed by typing

fn name

(One or more names may be specified. With an accompanying definition, all names receive the same definition. This is sometimes useful for assigning the same signal handler to many signals. Without a definition, all named functions are deleted.) When a function is executed, $* is set to the arguments to that function for the duration of the command. Thus a reasonable definition for l, a shorthand for ls(1), could be:

fn l { ls -FC $* }

but not

fn l { ls -FC } # WRONG

rc recognizes a number of signals, and allows the user to define shell functions which act as signal handlers. rc by default traps SIGINT when it is in interactive mode. SIGQUIT and SIGTERM are ignored, unless rc has been invoked with the -d flag. However, user-defined signal handlers may be written for these and all other signals. The way to define a signal handler is to write a function by the name of the signal in lower case. Thus:

fn sighup { echo hangup; rm /tmp/rc$pid.*; exit }

In addition to Unix signals, rc recognizes the artificial signal SIGEXIT which occurs as rc is about to exit.

In order to remove a signal handler's definition, remove it as though it were a regular function. For example:

fn sigint

returns the handler of SIGINT to the default value. In order to ignore a signal, set the signal handler's value to {}. Thus:

fn sigint {}

causes SIGINT to be ignored by the shell. Only signals that are being ignored are passed on to programs run by rc; signal functions are not exported.

On System V-based Unix systems, rc will not allow you to trap SIGCLD.

Builtin commands execute in the context of the shell, but otherwise behave exactly like other commands. Although !, ~ and @ are not strictly speaking builtin commands, they can usually be used as such.

. [-i] file [arg ...]

Reads file as input to rc and executes its contents. With a -i flag, input is interactive. Thus from within a shell script,

. -i /dev/tty

does the “right thing”.

break

Breaks from the innermost for or while, as in C. It is an error to invoke break outside of a loop. (Note that there is no break keyword between commands in switch statements, unlike C.)

builtin command [arg ...]

Executes the command ignoring any function definition of the same name. This command is present to allow functions with the same names as builtins to use the underlying builtin or binary. For example:

fn ls { builtin ls -FC $* }

is a reasonable way to pass a default set of arguments to ls(1), whereas

fn ls { ls -FC $* } # WRONG

is a non-terminating recursion, which will cause rc to exhaust its stack space and (eventually) terminate if it is executed.

cd [directory]

Changes the current directory to directory. The variable $cdpath is searched for possible locations of directory, analogous to the searching of $path for executable files. With no argument, cd changes the current directory to $home.

echo [-n] [--] [arg ...]

Prints its arguments to standard output, terminated by a newline. Arguments are separated by spaces. If the first argument is -n no final newline is printed. If the first argument is --, then all other arguments are echoed literally. This is used for echoing a literal -n.

eval [list]

Concatenates the elements of list with spaces and feeds the resulting string to rc for re-scanning. This is the only time input is rescanned in rc.

exec [arg ...]

Replaces rc with the given command. If the exec contains only redirections, then these redirections apply to the current shell and the shell does not exit. For example,

exec >[2] err.out

places further output to standard error in the file err.out.

exit [status]

Cause the current shell to exit with the given exit status. If no argument is given, the current value of $status is used.

limit [-h] [resource [value]]

Similar to the csh(1) limit builtin, this command operates upon the BSD-style resource limits of a process. The -h flag displays/alters the hard limits. The resources which can be shown or altered are cputime, filesize, datasize, stacksize, coredumpsize, memoryuse, and, where supported, descriptors, memoryuse, memoryrss, maxproc, memorylocked, and filelocks. For example:

limit coredumpsize 0

disables core dumps. To set a soft limit equal to the hard limit:

limit `{limit -h datasize}

newpgrp

Puts rc into a new process group. This builtin is useful for making rc behave like a job-control shell in a hostile environment. One example is the NeXT Terminal program, which implicitly assumes that each shell it forks will put itself into a new process group.

return [n]

Returns from the current function, with status n, where n is a valid exit status, or a list of them. Thus it is legal to have

return (sigpipe 1 2 3)

(This is commonly used to allow a function to return with the exit status of a previously executed pipeline of commands.) If n is omitted, then $status is left unchanged. It is an error to invoke return when not inside a function.

shift [n]

Deletes n elements from the beginning of $* and shifts the other elements down by n. n defaults to 1.

umask [mask]

Sets the current umask (see umask(2)) to the octal mask. If no argument is present, the current mask value is printed.

wait [pid]

Waits for process with the specified pid, which must have been started by rc, to exit. If no pid is specified, rc waits for all its child processes to exit.

whatis [-b] [-f] [-p] [-s] [-v] [--] [name ...]

Prints a definition of the named objects. For builtins, builtin foo is printed; for functions, including signal handlers, their definitions are printed; for executable files, path names are printed; and for variables, their values are printed. The flags restrict output to builtins, functions, executable programs, signal handlers, and variables, respectively. If no names are specified, rc lists all objects of that type. (This is not permitted for -p.) Without arguments, whatis is equivalent to whatis -fv, and prints the values of all shell variables and functions.

Note that whatis output is suitable for input to rc; by saving the output of whatis in a file, it should be possible to recreate the state of rc by sourcing this file with a . command. Another note: whatis -s > file cannot be used to store the state of rc's signal handlers in a file, because builtins with redirections are run in a subshell, and rc always restores signal handlers to their default value after a fork().

Since whatis uses getopt(3) to parse its arguments, you can use the special argument -- to terminate its flags. This allows you to use names beginning with a dash, such as the history(1) commands. For example,

whatis -- -p

The shift builtin only shifts $*. This function can shift any variable (except $lshift).

fn lshift { lshift=$*; *=$$1; shift $lshift(2); $lshift(1)=$* }

With this definition in place,

walrus = (shoes ships sealing-wax cabbages kings)
lshift walrus 3
whatis walrus

prints

walrus=(cabbages kings)

The $^var operator flattens a list by separating each element with a space. This function allows the separator to be an arbitrary string.

fn lflat {
  lflat=$*; *=$$1
  while () {
    echo -n $1; shift
    ~ $#* 0 && break
    echo -n $lflat(2)
}

With this definition in place,

hops=(uunet mcvax ukc tlg)
lflat hops !

prints (with no final newline)

uunet!mcvax!ukc!tlg

The exit status of rc is normally the same as that of the last command executed. If the last command was a pipeline, rc exits if every command in the pipeline did; otherwise it exits 1.

rc can be made to exit with a particular status using the exit builtin.

Here is rc's grammar, edited to remove semantic actions.

%term ANDAND BACKBACK BANG CASE COUNT DUP ELSE END FLAT FN FOR IF IN
%term OROR PIPE REDIR SUB SUBSHELL SWITCH TWIDDLE WHILE WORD HUH

%left WHILE ')' ELSE
%left ANDAND OROR '\n'
%left BANG SUBSHELL
%left PIPE
%right '$'
%left SUB

%start rc

%%

rc: line end
	| error end

end: END /* EOF */ | '\n'

cmdsa: cmd ';' | cmd '&'

line: cmd | cmdsa line

body: cmd | cmdsan body

cmdsan: cmdsa | cmd '\n'

brace: '{' body '}'

paren: '(' body ')'

assign: first '=' word

epilog: /* empty */ | redir epilog

redir: DUP | REDIR word

case: CASE words ';' | CASE words '\n'

cbody: cmd | case cbody | cmdsan cbody

iftail: cmd	%prec ELSE
	| brace ELSE optnl cmd

cmd	: /* empty */	%prec WHILE
	| simple
	| brace epilog
	| IF paren optnl iftail
	| FOR '(' word IN words ')' optnl cmd
	| FOR '(' word ')' optnl cmd
	| WHILE paren optnl cmd	
	| SWITCH '(' word ')' optnl '{' cbody '}'
	| TWIDDLE optcaret word words
	| cmd ANDAND optnl cmd
	| cmd OROR optnl cmd
 	| cmd PIPE optnl cmd
	| redir cmd	%prec BANG
	| assign cmd	%prec BANG
	| BANG optcaret cmd
	| SUBSHELL optcaret cmd
	| FN words brace
	| FN words

optcaret: /* empty */ | '^'

simple: first | simple word | simple redir

first: comword | first '^' sword

sword: comword | keyword

word: sword | word '^' sword

comword: '$' sword
	| '$' sword SUB words ')'
	| COUNT sword
	| FLAT sword
	| '`' sword
	| '`' brace
	| BACKBACK word	brace | BACKBACK word sword
	| '(' words ')'
	| REDIR brace
	| WORD

keyword: FOR | IN | WHILE | IF | SWITCH
	| FN | ELSE | CASE | TWIDDLE | BANG | SUBSHELL

words: /* empty */ | words word

optnl: /* empty */ | optnl '\n'

$HOME/.rcrc, /tmp/rc*, /dev/null

rc was written by Byron Rakitzis, with valuable help from Paul Haahr, Hugh Redelmeier and David Sanderson. The design of this shell was copied from the rc that Tom Duff wrote at Bell Labs.

There is a compile-time limit on the number of ; separated commands in a line: usually 500. This is sometimes a problem for automatically generated scripts: substituting the newline character for ; avoids the limit.

On modern systems that support /dev/fd or /proc/self/fd, <{foo} style redirection is implemented that way. However, on older systems it is implemented with named pipes. Allegedly, it is sometimes possible to foil rc into removing the FIFO it places in /tmp prematurely, or it is even possible to cause rc to hang. (The current maintainer has never seen this, but then he doesn't use systems which lack /dev/fd any more. If anybody can reproduce this problem, please let the maintainer know.)

The echo command does not need to be a builtin.  It is one for reasons of performance and portability (of rc scripts).

There should be a way to avoid exporting a variable.

Extra parentheses around a ~ expression or a ! expression are a syntax error. Thus, this code is illegal.

while ((~ $1 -*) && (! ~ $1 --)) { ...

The redundant inner parentheses must be omitted.

Variable subscripting cannot be used in here documents.

The limit builtin silently ignores extra arguments.

Backquote substitution never produces empty strings - multiple consecutive occurrences of the separator are treated the same as a single occurrence.

ifs=! { x = `{echo -n a!!b}; whatis x }
x=(a b) # NOT x=(a '' b)

Bug reports should be mailed to
<toby@paccrat.org>.

Here is a list of features which distinguish this incarnation of rc from the one described in the Bell Labs manual pages:

The Tenth Edition rc does not have the else keyword. Instead, if is optionally followed by an if not clause which is executed if the preceding if test does not succeed.

Backquotes are slightly different in Tenth Edition rc: a backquote must always be followed by a left-brace. This restriction is not present for single-word commands in this rc.

For . file, the Tenth Edition rc searches $path for file. This rc does not, since it is not considered useful.

The list flattening operator, $^foo, is spelt $"foo in those versions of the Bell Labs rc which have it.

The following are all new with this version of rc: The -n flag, here strings (they facilitate exporting of functions with here documents into the environment), the return and break keywords, the echo builtin, the bqstatus and version variables, the support for the GNU readline(3) library, and the support for the prompt function. This rc also sets $0 to the name of a function being executed/file being sourced.

“rc — A Shell for Plan 9 and UNIX Systems”, Unix Research System, Tenth Edition, Volume 2. (Saunders College Publishing)

http://static.tobold.org/rc/rc-duff.html, an updated version of the above paper.

history(1)

surfraw-update-path(1), zsh(1), zshall(1).