hotplug-dispatch: fix filter disallowing setting PATH
authorDaniel Golle <daniel@makrotopia.org>
Fri, 6 Feb 2026 11:01:29 +0000 (11:01 +0000)
committerDaniel Golle <daniel@makrotopia.org>
Mon, 9 Feb 2026 11:37:13 +0000 (11:37 +0000)
commite08cdc8562f55b9ac228a21f3f7605a18c522b81
tree90a3b27f7255b03a149aa1a2fabb815333dcdfa4
parentafa4391d9cbb0706bbae9c8345436fa6d99c3013
hotplug-dispatch: fix filter disallowing setting PATH

Due to a bug in hotplug-dispatch, the PATH env variable wasn't
filtered, allowing authrorized callers the execution of commands
via PATH environment variable filter bypass.

Replace the call to strcmp with strncmp and limit the comparision
to 5 characters to account for each character in "PATH=".

Fixes: TOB-OWRT-4
Fixes: 08938fe ("procd: add hotplug-call dispatcher")
Reported-by: Trail of Bits (@trailofbits)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
hotplug-dispatch.c