Question

I have a program running in C. This needs to execute an “iptables” command using system.

I tried

setuid(0); 
system("iptables .... ");

setuid and system do not coexist. from the system man page

Do not use system() from a program
with set-user-ID or set-group-ID
privileges, because strange values
for some
environment variables might be used to subvert system integrity.
Use the exec(3) family of functions
instead,
but not execlp(3) or execvp(3). system() will not, in fact, work
properly from programs with
set-user-ID or set-
group-ID privileges on systems on which /bin/sh is bash
version 2, since bash 2 drops
privileges on startup.
(Debian uses a modified bash which does not do this when invoked as
sh.)

how can I overcome my problem?

Thanks

Answer 1

Something like this might help. It’s untested but should work.

    char * const argv[] = {"/sbin/iptables", "-L", NULL};

    pid = fork();
    switch (pid) {
            case -1:
                    /* handle error */
            case 0:
                    execv("/sbin/iptables", argv);
                    /* handle error if you get here */
            break;
            default:
                    waitpid(pid, &status, 0);
                    /* check waitpid return code */
            break;
    }