fix: harden operations and configuration recovery

internal/execsafe/execsafe.go

@@ -0,0 +1,35 @@
+// Package execsafe resolves privileged system commands without consulting the
+// caller-controlled PATH.
+package execsafe
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+var systemDirectories = []string{"/usr/sbin", "/usr/bin", "/sbin", "/bin"}
+
+// LookPath resolves a bare command name only from standard system directories.
+func LookPath(name string) (string, error) {
+	if name == "" || filepath.Base(name) != name || strings.ContainsRune(name, filepath.Separator) {
+		return "", fmt.Errorf("unsafe system command name %q", name)
+	}
+	for _, directory := range systemDirectories {
+		candidate := filepath.Join(directory, name)
+		info, err := os.Stat(candidate)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			return "", fmt.Errorf("inspect trusted system command %s: %w", candidate, err)
+		}
+		if info.Mode().IsRegular() && info.Mode().Perm()&0o111 != 0 {
+			return candidate, nil
+		}
+	}
+	return "", fmt.Errorf("%w: trusted system command %s", exec.ErrNotFound, name)
+}