Question

I’ve got a program which accepts a set of rules in the form of a single rules file.

When one of the conditions are considered met by my program, I seek to treat the block of commands associated with the condition as an independent bash script which needs to be executed. I would rather not deal with storing these commands in files as that leaves an undesirable attack vector. Is there a way to feed a line delimited list of bash commands to bash as a single group? I want if conditions and other things from the bash script to function correctly, not just executing each line raw on its own.

Example rules file:

if CONDITION
some nice
bash commands
pkill some process
./launching something!
endif

I want to be able to run the four lines of bash code as a group of bash commands, not independently of each other, when CONDITION is true, as determined by my C program.

Obviously this is from Linux, using C as the programming language.

Answer 1

The simplest approach is probably to use sh -c "string containing commands to be executed". What’s tricky is the embedded newlines. If the commands themselves won’t contain single quotes, then you can wrap that multi-line string in single quotes. If it can contain single quotes, you’d want to escape the string to ensure that they are unchanged.

So:

• read the commands into a buffer
• do escape processing on the buffer; replace each ' with '\'' (remembering that the backslash must be in the output, so the string in C looks like "'\\''")
• format the command: snprintf(command, sizeof(command), "sh -c '%s'", escaped_buffer);
• ensure there was enough room
• run system(command);