setusercontext resets PATH (which we want). but then it becomes impossible to access...

diff --git a/doas.c b/doas.c
index 5396df0d4657a23be99b48f2e304a50e1ed02788..28954ecb6c7aee7a3db12ebf871a6e5e00782528 100644 (file)
--- a/doas.c
+++ b/doas.c
@@ -257,6 +257,7 @@ main(int argc, char **argv)
        const char *confpath = NULL;
        char *shargv[] = { NULL, NULL };
        char *sh;
+       const char *p;
        const char *cmd;
        char cmdline[LINE_MAX];
 #ifdef __OpenBSD__
@@ -411,7 +412,24 @@ main(int argc, char **argv)
 # endif
        }
 
+       if ((p = getenv("PATH")) != NULL)
+               formerpath = strdup(p);
+       if (formerpath == NULL)
+               formerpath = "";
+
+# ifdef __OpenBSD__
+       if (unveil(_PATH_LOGIN_CONF, "r") == -1 ||
+           unveil(_PATH_LOGIN_CONF ".db", "r") == -1)
+               err(1, "unveil");
+# endif
+       if (rule->cmd) {
+               if (setenv("PATH", safepath, 1) == -1)
+                       err(1, "failed to set PATH '%s'", safepath);
+       }
 # ifdef __OpenBSD__
+       if (unveilcommands(getenv("PATH"), cmd) == 0)
+               goto fail;
+
        if (pledge("stdio rpath getpw exec id", NULL) == -1)
                err(1, "pledge");
 # endif

diff --git a/doas.h b/doas.h
index 3831dc7425f2e4cda6e45ea96157ce47af6cc26b..4a117be1e256656c5e30658a72bcadd06f53df2c 100644 (file)
--- a/doas.h
+++ b/doas.h
@@ -29,6 +29,8 @@ extern struct rule **rules;
 extern int nrules;
 extern int parse_errors;
 
+extern const char *formerpath;
+
 struct passwd;
 
 char **prepenv(const struct rule *, const struct passwd *,

diff --git a/env.c b/env.c
index f1fe45fbc83a6f51c7a2448209abe42b48f044f0..2090897ea1738601eb9b82efe25d37b8660a4541 100644 (file)
--- a/env.c
+++ b/env.c
@@ -29,6 +29,8 @@
 #include "doas.h"
 #include "includes.h"
 
+const char *formerpath;
+
 struct envnode {
        RB_ENTRY(envnode) node;
        const char *key;
@@ -199,8 +201,12 @@ fillenv(struct env *env, const char **envlist)
                /* assign value or inherit from environ */
                if (eq) {
                        val = eq + 1;
-                       if (*val == '$')
-                               val = getenv(val + 1);
+                       if (*val == '$') {
+                               if (strcmp(val + 1, "PATH") == 0)
+                                       val = formerpath;
+                               else
+                                       val = getenv(val + 1);
+                       }
                } else {
                        val = getenv(name);
                }