C code that wants to source a shell script has to go through
run_command("source ..."), which parses the command line and looks the
script up in the PATH.Export source_script() instead. As the simple parser can't source scripts, it gets a stub returning -ENOSYS. Unlike its callers in hush, source_script() can now be called directly, so check the security policy in it, like run_command() and execute_script() do. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Sascha Hauer <[email protected]> --- common/hush.c | 17 +++++++++++++++-- include/shell.h | 8 ++++++++ 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/common/hush.c b/common/hush.c index ac885fbfe7..c5809b32cd 100644 --- a/common/hush.c +++ b/common/hush.c @@ -329,7 +329,6 @@ static char **make_list_in(char **inp, char *name); static char *insert_var_value(char *inp); static int set_local_var(const char *s, int flg_export); static int execute_script(const char *path, int argc, char *argv[]); -static int source_script(const char *path, int argc, char *argv[]); static int b_check_space(o_string *o, int len) { @@ -1975,12 +1974,26 @@ static int execute_script(const char *path, int argc, char *argv[]) return ret; } -static int source_script(const char *path, int argc, char *argv[]) +/** + * source_script - execute a shell script in the current environment + * @path: path of the script + * @argc: number of positional parameters, including $0 + * @argv: positional parameters, starting with $0 + * + * Unlike executing a script, variables set by it remain set in the current + * environment context after it returns. + * + * Return: exit status of the last command executed, or a negative error code + */ +int source_script(const char *path, int argc, char *argv[]) { struct p_context ctx = {}; char *script; int ret; + if (!IS_ALLOWED(SCONFIG_SHELL)) + return -EPERM; + initialize_context(&ctx, true); ctx.global_argc = argc; diff --git a/include/shell.h b/include/shell.h index b399564ff3..a0c3414fa6 100644 --- a/include/shell.h +++ b/include/shell.h @@ -6,17 +6,25 @@ #ifndef __SHELL_H__ #define __SHELL_H__ +#include <linux/errno.h> + int shell_get_last_return_code(void); int run_shell(void); #ifdef CONFIG_SHELL_HUSH char *shell_expand(char *str); +int source_script(const char *path, int argc, char *argv[]); #else static inline char *shell_expand(char *str) { return strdup(str); } + +static inline int source_script(const char *path, int argc, char *argv[]) +{ + return -ENOSYS; +} #endif #ifdef CONFIG_BAREBOX_CMDLINE -- 2.47.3
