program calls rcmd() twice, _second_ call works for root but notnormal users

I have a hacked up version of rsh based on inetutils-1.4.2 which accepts
a list of hosts and runs the same command on each of them
(sequentially). In other words, it does this in a loop:

rem = rcmd (&host, sp->s_port, pw->pw_name, user, args, &rfd2);

where the host part changes but the other parts don't. This is so
that I can do:

rsh host1,host2,host3 whatever
or
rsh -f list_of_hosts whatever

instead of

rsh host1 whatever
rsh host2 whatever
rsh host3 whatever

Now the odd part: this modified rsh works just fine for root but for any
other user the rcmd call works once (for the first host) and
then gives a

rcmd: socket: Permission denied

when it attempts a second rcmd call. This is true even if host in
the second rcmd is the same as it was in the first rcmd.
Yes, the modified rsh is suid root, otherwise it wouldn't
even do the first rcmd call.

I tried adding

shutstat=shutdown(rem, SHUT_RDWR);

so that the socket would be closed the second time around but it
made no difference.

Additionally, the exact same behavior is observed when rsh runs
on Mandrake 10.0 or Solaris 8. It seems to be intrinsic somehow
in rcmd.

Can somebody please explain what is going on here???

Thanks,

David Mathog
(E-Mail Removed)

David Mathog wrote:

> Now the odd part: this modified rsh works just fine for root but for any
> other user the rcmd call works once (for the first host) and
> then gives a
>
> rcmd: socket: Permission denied
>
> when it attempts a second rcmd call.

I figured it out. Carried over from the original inetutils/rsh.c
code were two lines

seteuid (uid);
setuid (uid);

just before the signal stuff was set up but after the rcmd() call.
All of this was within the loop over target hosts. Removing these
two lines fixed the problem so that any user could run multiple
rcmd(). It's not clear to me what the purpose of these lines was
in the first place since rsh runs perfectly well without it in the
limited tests I performed.

On the other hand,

rsh -l someotheruser targetnode 'ls'

apparently doesn't work with either my modified code or with
the original code. It just hangs on the sending machine. My
code is based on inetutils 1.4.2


Thanks,

David Mathog
(E-Mail Removed)