su: detect inability to raise privilege

When privilege has been dropped by the 'drop' applet, the 'su'
applet is unable to raise it again because ShellExecuteEx()
thinks it unnecessary.

Detect this situation, report an error and return exit code 2.

Costs 72-112 bytes.

(GitHub issue #437)

1 files changed, 10 insertions, 0 deletions

diff --git a/loginutils/suw32.c b/loginutils/suw32.c
index edf42177b..a0afe5bb7 100644
--- a/loginutils/suw32.c
+++ b/loginutils/suw32.c
@@ -44,6 +44,16 @@ int suw32_main(int argc UNUSED_PARAM, char **argv)
         char *bb_path, *cwd, *realcwd, *q, *args;
         DECLARE_PROC_ADDR(BOOL, ShellExecuteExA, SHELLEXECUTEINFOA *);
 
+#if ENABLE_DROP || ENABLE_CDROP || ENABLE_PDROP
+        // If privilege has been dropped (ELEVATED_PRIVILEGE but not
+        // ADMIN_ENABLED) ShellExecuteEx() thinks we already have elevated
+        // privilege and doesn't raise privilege.  In that case, give up.
+        if (elevation_state() == ELEVATED_PRIVILEGE) {
+                xfunc_error_retval = 2;
+                bb_error_msg_and_die("unable to restore privilege");
+        }
+#endif
+
         opt = getopt32(argv, "c:NW", &opt_command);
         argv += optind;
         if (argv[0]) {