suricata: Change midstream policy to "pass-flow"

[people/pmueller/ipfire-2.x.git] / src / misc-progs / setuid.c

diff --git a/src/misc-progs/setuid.c b/src/misc-progs/setuid.c
index efd181ad8c51beb0e709dc4da0a5ac3a0a482436..9dc0a767b6df083df1ff27cf230504da01e3199a 100644 (file)
--- a/src/misc-progs/setuid.c
+++ b/src/misc-progs/setuid.c
@@ -46,7 +46,7 @@
 
 /* Trusted environment for executing commands */
 char * trusted_env[4] = {
-       "PATH=/usr/bin:/usr/sbin:/sbin:/bin",
+       "PATH=/usr/local/bin:/usr/local/sbin:/sbin:/usr/sbin:/bin:/usr/bin",
        "SHELL=/bin/sh",
        "TERM=dumb",
        NULL
@@ -61,10 +61,8 @@ static int system_core(char* command, char** args, uid_t uid, gid_t gid, char *e
        if(!command)
                return 1;
 
-#if 0
        // Add command as first element to argv
        argv[argc++] = command;
-#endif
 
        // Add all other arguments
        if (args) {
@@ -106,16 +104,20 @@ static int system_core(char* command, char** args, uid_t uid, gid_t gid, char *e
                }
 
                default: /* parent */
-                       do {
-                               if (waitpid(pid, &status, 0) == -1) {
-                                       if (errno != EINTR)
-                                               return -1;
-                                       } else {
-                                               return status;
-                                       }
-                       } while (1);
-       }
+                       // Wait until the child process has finished
+                       waitpid(pid, &status, 0);
+
+                       // The child was terminated by a signal
+                       if (WIFSIGNALED(status))
+                                return 128 + WTERMSIG(status);
 
+                       // Return the exit code if available
+                       if (WIFEXITED(status))
+                               return WEXITSTATUS(status);
+
+                       // Something unexpected happened, exiting with error
+                       return EXIT_FAILURE;
+       }
 }
 
 int run(char* command, char** argv) {
@@ -138,13 +140,20 @@ int safe_system(char* command) {
                NULL,
        };
 
-       return system_core(argv[0], argv, 0, 0, "safe_system");
+       return system_core(argv[0], argv + 1, 0, 0, "safe_system");
 }
 
 /* Much like safe_system but lets you specify a non-root uid and gid to run
  * the command as */
 int unpriv_system(char* command, uid_t uid, gid_t gid) {
-       return system_core(command, NULL, uid, gid, "unpriv_system");
+       char* argv[4] = {
+               "/bin/sh",
+               "-c",
+               command,
+               NULL,
+       };
+
+       return system_core(argv[0], argv + 1, uid, gid, "unpriv_system");
 }
 
 /* General routine to initialise a setuid root program, and put the