Bug#619568: ssh: broken and unsufficiently-documented handling of "command" arg

[Yann Dirson <dirson@bertin.fr>]

Package: openssh-client
Version: 1:5.5p1-6

First note that the ssh manpage is not very explicit about its "command"
argument: I have always assumed that it was using exec(2) using the extra
arguments on its command line.

Thus, I am using "sh -c" to do more complex things (and kinda wonder why
I did not get bitten earlier):

$ ssh localhost sh -c 'cd /no/where && pwd'
/home/localadm

The behaviour does not change with the shell (zsh, bash, dash).
Also note that the printed cwd is the login dir of the user on the remote
machine, it does not change with the cwd of the shell launching ssh.  With another
ssh server than localhost, using "uname" instead of pwd shows that second part is
really run on the remote machine.


OTOH, it handles the following right (again, the manpage should have made this
explicit):

$ ssh localhost 'cd /no/where && pwd'
bash: line 0: cd: /no/where: No such file or directory


Now what command is it really running with "sh -c" ??  Let's ask our good friend:

$ ssh localhost strace -f -o /tmp/log
sh -c 'cd /no/where && pwd' /home/localadm
$ head -n1 /tmp/log
32395 execve("/bin/sh", ["sh", "-c", "cd", "/no/where"], [/* 13 vars */]) = 0


But then, who is interpretting the "&& pwd" bit ?  How in hell could that failing
cd (wrapped by whatever sh/ssh) ?  My only guess is that ssh is splitting that argument
at "&&" for any reason.

Note that it does the same for the first ";" too, and that the remaining of that arg is
indeed not split further:

$ ssh localhost sh -c 'pwd; cd /no/where && pwd'
/home/localadm
bash: line 0: cd: /no/where: No such file or directory


-- 
Yann Dirson - Bertin Technologies