Run the ProxyAutoDetect script in the sandbox again

The previous change moved running the proxy detection program from the
method to the main process, so it runs as root and not as _apt. This
brings it back into the sandbox.

Gbp-Dch: ignore

1 files changed, 10 insertions, 0 deletions

diff --git a/apt-pkg/contrib/fileutl.cc b/apt-pkg/contrib/fileutl.cc
index 72813f4c3..6cc7414b0 100644
--- a/apt-pkg/contrib/fileutl.cc
+++ b/apt-pkg/contrib/fileutl.cc
@@ -2913,6 +2913,11 @@ bool Popen(const char* Args[], FileFd &Fd, pid_t &Child, FileFd::OpenMode Mode)/
 									/*}}}*/
 bool Popen(const char* Args[], FileFd &Fd, pid_t &Child, FileFd::OpenMode Mode, bool CaptureStderr)/*{{{*/
 {
+   return Popen(Args, Fd, Child, Mode, CaptureStderr, false);
+}
+									/*}}}*/
+bool Popen(const char *Args[], FileFd &Fd, pid_t &Child, FileFd::OpenMode Mode, bool CaptureStderr, bool Sandbox) /*{{{*/
+{
    int fd;
    if (Mode != FileFd::ReadOnly && Mode != FileFd::WriteOnly)
       return _error->Error("Popen supports ReadOnly (x)or WriteOnly mode only");
@@ -2929,6 +2934,11 @@ bool Popen(const char* Args[], FileFd &Fd, pid_t &Child, FileFd::OpenMode Mode,
       return _error->Errno("fork", "Failed to fork");
    if(Child == 0)
    {
+      if (Sandbox && (getuid() == 0 || geteuid() == 0) && !DropPrivileges())
+      {
+	 _error->DumpErrors();
+	 _exit(1);
+      }
       if(Mode == FileFd::ReadOnly)
       {
          close(Pipe[0]);