[PATCH 2/5] hush: export source_script()

[Sascha Hauer]

C code that wants to source a shell script has to go through
run_command("source ..."), which parses the command line and looks the
script up in the PATH.

Export source_script() instead. As the simple parser can't source
scripts, it gets a stub returning -ENOSYS. Unlike its callers in hush,
source_script() can now be called directly, so check the security policy
in it, like run_command() and execute_script() do.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
---
 common/hush.c   | 17 +++++++++++++++--
 include/shell.h |  8 ++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/common/hush.c b/common/hush.c
index ac885fbfe7..c5809b32cd 100644
--- a/common/hush.c
+++ b/common/hush.c
@@ -329,7 +329,6 @@ static char **make_list_in(char **inp, char *name);
 static char *insert_var_value(char *inp);
 static int set_local_var(const char *s, int flg_export);
 static int execute_script(const char *path, int argc, char *argv[]);
-static int source_script(const char *path, int argc, char *argv[]);
 
 static int b_check_space(o_string *o, int len)
 {
@@ -1975,12 +1974,26 @@ static int execute_script(const char *path, int argc, char *argv[])
 	return ret;
 }
 
-static int source_script(const char *path, int argc, char *argv[])
+/**
+ * source_script - execute a shell script in the current environment
+ * @path: path of the script
+ * @argc: number of positional parameters, including $0
+ * @argv: positional parameters, starting with $0
+ *
+ * Unlike executing a script, variables set by it remain set in the current
+ * environment context after it returns.
+ *
+ * Return: exit status of the last command executed, or a negative error code
+ */
+int source_script(const char *path, int argc, char *argv[])
 {
 	struct p_context ctx = {};
 	char *script;
 	int ret;
 
+	if (!IS_ALLOWED(SCONFIG_SHELL))
+		return -EPERM;
+
 	initialize_context(&ctx, true);
 
 	ctx.global_argc = argc;
diff --git a/include/shell.h b/include/shell.h
index b399564ff3..a0c3414fa6 100644
--- a/include/shell.h
+++ b/include/shell.h
@@ -6,17 +6,25 @@
 #ifndef __SHELL_H__
 #define __SHELL_H__
 
+#include <linux/errno.h>
+
 int shell_get_last_return_code(void);
 
 int run_shell(void);
 
 #ifdef CONFIG_SHELL_HUSH
 char *shell_expand(char *str);
+int source_script(const char *path, int argc, char *argv[]);
 #else
 static inline char *shell_expand(char *str)
 {
 	return strdup(str);
 }
+
+static inline int source_script(const char *path, int argc, char *argv[])
+{
+	return -ENOSYS;
+}
 #endif
 
 #ifdef CONFIG_BAREBOX_CMDLINE

-- 
2.47.3