Rewrite prog stream support.

Two interfaces are provided: mu_prog_stream_create offers full control
over the program execution environment (i.e. running privileges, cwd,
resource limits) via a set of hints.
A simpler interface, mu_command_stream_create, runs the command in the
current environment.

mu_filter_prog_stream_create is removed, because its functionality can
be achieved by a correspondingly crafted set of hints to
mu_prog_stream_create.

* include/mailutils/prog.h: New file.
* include/mailutils/mailutils.h: Include mailutils/prog.h
* include/mailutils/Makefile.am (pkginclude_HEADERS): Add prog.h
* include/mailutils/stream.h (mu_prog_stream_create)
(mu_filter_prog_stream_create): Remove prototypes.
* include/mailutils/sys/prog_stream.h (_mu_prog_stream): Change structure.
(_mu_prog_limit_codes, _mu_prog_limit_flags): New externs.
* include/mailutils/util.h (mu_set_user_privileges)
(mu_switch_to_privs): New prototypes.

* lib/userprivs.c: Move to libmailutils/base.
* lib/Makefile.am (libmuaux_a_SOURCES): Remove userprivs.c
* libmailutils/base/Makefile.am (libbase_la_SOURCES): Add userprivs.c
* libmailutils/base/userprivs.c (mu_set_user_privileges): New function.
(mu_switch_to_privs): Rewrite as another entry point to mu_set_user_privileges.

* libmailutils/stream/prog_stream.c (_mu_prog_limit_flags)
(_mu_prog_limit_codes): New global variables.
(start_program_filter): Use hints to control execution environment.
(_prog_stream_create): Save hints.
(mu_prog_stream_create): Change signature.
(mu_command_stream_create): New function (corresponds to the prior
mu_prog_stream_create).
(mu_filter_prog_stream_create): Remove function.
* comsat/action.c (action_exec): Use new mu_prog_stream_create calling
convention.
* examples/murun.c: Rewrite.

* mh/mhn.c (show_internal): Use new mu_prog_stream_create calling
convention.
* mh/tests/mhn.at: Reflect changes to mhn.

* imap4d/preauth.c: Use mu_command_stream_create.
* libmu_sieve/extensions/pipe.c
* mail/decode.c
* mail/pipe.c
* mail/send.c
* mh/mhl.c
* mu/shell.c

* mail/mail.h: Include mailutils/prog.h
* mh/mh.h

* po/POTFILES.in: Add libmailutils/base/userprivs.c.

@@ -18,6 +18,7 @@
 #include "comsat.h"
 #include <mailutils/io.h>
 #include <mailutils/argcv.h>
+#include <mailutils/prog.h>
 #define obstack_chunk_alloc malloc
 #define obstack_chunk_free free
 #include <obstack.h>
@@ -225,7 +226,6 @@ action_exec (mu_stream_t tty, int argc, char **argv)
 {
   mu_stream_t pstream;
   struct stat stb;
-  char *command;
   int status;
   
   if (argc == 0)
@@ -249,25 +249,19 @@ action_exec (mu_stream_t tty, int argc, char **argv)
 
   if (stb.st_mode & (S_ISUID|S_ISGID))
     {
-      mu_diag_output (MU_DIAG_ERROR, _("will not execute set[ug]id programs"));
+      mu_diag_output (MU_DIAG_ERROR,
+		      _("will not execute set[ug]id programs"));
       return;
     }
 
-  /* FIXME: Redirect stderr to out */
-  /* FIXME: need this:
-     status = mu_prog_stream_create_argv (&pstream, argv[0], argv,
-                                          MU_STREAM_READ);
-  */
-  status = mu_argcv_join (argc, argv, " ", mu_argcv_escape_no, &command);
+  status = mu_prog_stream_create (&pstream,
+				  argv[0], argc, argv,
+				  MU_PROG_HINT_ERRTOOUT,
+				  NULL,
+				  MU_STREAM_READ);
   if (status)
     {
-      mu_diag_funcall (MU_DIAG_ERROR, "mu_argcv_join", NULL, status);
-      return;
-    }
-  status = mu_prog_stream_create (&pstream, command, MU_STREAM_READ);
-  if (status)
-    {
-      mu_diag_funcall (MU_DIAG_ERROR, "mu_prog_stream_create_argv", argv[0],
+      mu_diag_funcall (MU_DIAG_ERROR, "mu_prog_stream_create", argv[0],
 		       status);
       return;
     }

@@ -24,20 +24,7 @@
 #include <ctype.h>
 #include <string.h>
 #include <mailutils/mailutils.h>
-#include <mailutils/argcv.h>
-
-static void
-read_and_print (mu_stream_t in, mu_stream_t out)
-{
-  size_t size;
-  char buffer[128];
-  
-  while (mu_stream_readline (in, buffer, sizeof (buffer), &size) == 0
-	 && size > 0)
-    {
-      mu_stream_write (out, buffer, size, NULL);
-    }
-}
+#include <mailutils/sys/prog_stream.h>
 
 int
 main (int argc, char *argv[])
@@ -45,34 +32,154 @@ main (int argc, char *argv[])
   int rc;
   mu_stream_t stream, out;
   int read_stdin = 0;
-  int i = 1;
-  char *cmdline;
+  int i;
   int flags = MU_STREAM_READ;
-
-  if (argc > 1 && strcmp (argv[i], "--stdin") == 0)
+  struct mu_prog_hints hints;
+  int hint_flags = 0;
+  char *progname = NULL;
+  gid_t gid[20];
+  size_t gn = 0;
+  
+  for (i = 1; i < argc; i++)
     {
-      read_stdin = 1;
-      flags |= MU_STREAM_WRITE;
-      i++;
+      if (strcmp (argv[i], "--stdin") == 0)
+	{
+	  read_stdin = 1;
+	  flags |= MU_STREAM_WRITE;
+	}
+      else if (strcmp (argv[i], "--chdir") == 0)
+	{
+	  hints.mu_prog_workdir = argv[i+1];
+	  hint_flags |= MU_PROG_HINT_WORKDIR;
+	  i++;
+	}
+      else if (strncmp (argv[i], "--limit", 7) == 0
+	       && mu_isdigit (argv[i][7]))
+	{
+	  int n;
+
+	  if (i + 1 == argc)
+	    {
+	      fprintf (stderr, "%s requires argument\n", argv[i]);
+	      exit (1);
+	    }
+	  n = argv[i][7] - '0';
+	  if (!(_mu_prog_limit_flags & MU_PROG_HINT_LIMIT(n)))
+	    {
+	      fprintf (stderr, "%s is not supported\n", argv[i]+2);
+	      continue;
+	    }
+	  hint_flags |= MU_PROG_HINT_LIMIT(n);
+	  hints.mu_prog_limit[n] = strtoul (argv[i+1], NULL, 10);
+	  i++;
+	}
+      else if (strcmp (argv[i], "--prio") == 0)
+	{
+	  if (i + 1 == argc)
+	    {
+	      fprintf (stderr, "%s requires argument\n", argv[i]);
+	      exit (1);
+	    }
+	  hint_flags |= MU_PROG_HINT_PRIO;
+	  hints.mu_prog_prio = strtoul (argv[i+1], NULL, 10);
+	  i++;
+	}
+      else if (strcmp (argv[i], "--exec") == 0)
+	{
+	  if (i + 1 == argc)
+	    {
+	      fprintf (stderr, "%s requires argument\n", argv[i]);
+	      exit (1);
+	    }
+	  progname = argv[++i];
+	}
+      else if (strcmp (argv[i], "--errignore") == 0)
+	hint_flags |= MU_PROG_HINT_IGNOREFAIL;
+      else if (strcmp (argv[i], "--uid") == 0)
+	{
+	  if (i + 1 == argc)
+	    {
+	      fprintf (stderr, "%s requires argument\n", argv[i]);
+	      exit (1);
+	    }
+	  hint_flags |= MU_PROG_HINT_UID;
+	  hints.mu_prog_uid = strtoul (argv[i+1], NULL, 10);
+	  i++;
+	}
+      else if (strcmp (argv[i], "--gid") == 0)
+	{
+	  mu_list_t list;
+	  mu_iterator_t itr;
+	  
+	  if (i + 1 == argc)
+	    {
+	      fprintf (stderr, "%s requires argument\n", argv[i]);
+	      exit (1);
+	    }
+	  mu_list_create (&list);
+	  mu_list_set_destroy_item (list, mu_list_free_item);
+	  rc = mu_string_split (argv[++i], ",", list);
+	  if (mu_list_get_iterator (list, &itr) == 0)
+	    {
+	      char *p;
+	      
+	      for (mu_iterator_first (itr);
+		   !mu_iterator_is_done (itr); mu_iterator_next (itr))
+		{
+		  if (gn >= MU_ARRAY_SIZE (gid))
+		    {
+		      fprintf (stderr, "too many gids\n");
+		      exit (1);
+		    }
+		  gid[gn++] = strtoul (p, NULL, 10);
+		}
+	      mu_iterator_destroy (&itr);
+	    }
+	  else
+	    {
+	      mu_diag_funcall (MU_DIAG_ERROR, "mu_list_get_iterator", NULL,
+			       rc);
+	      exit (1);
+	    }
+	  mu_list_destroy (&list);
+	  hint_flags |= MU_PROG_HINT_GID;
+	}
+      else if (strcmp (argv[i], "--") == 0)
+	{
+	  i++;
+	  break;
+	}
+      else
+	break;
     }
   
   if (i == argc)
     {
-      fprintf (stderr, "Usage: %s [--stdin] progname [args]\n", argv[0]);
+      fprintf (stderr,
+	       "Usage: %s [--stdin] [--chdir dir] [--limit{0-9} lim] [--prio N]\n"
+	       "          [--exec progname] progname [args]\n", argv[0]);
       exit (1);
     }
 
-  MU_ASSERT (mu_argcv_string (argc - i, &argv[i], &cmdline));
+  argc -= i;
+  argv += i;
+
+  if (!progname)
+    progname = argv[0];
+  
   if (read_stdin)
     {
-      mu_stream_t in;
-      MU_ASSERT (mu_stdio_stream_create (&in, MU_STDIN_FD, 0));
-      rc = mu_filter_prog_stream_create (&stream, cmdline, in);
-      /* Make sure closing/destroying stream will close/destroy in */
-      mu_stream_unref (in);
+      MU_ASSERT (mu_stdio_stream_create (&hints.mu_prog_input,
+					 MU_STDIN_FD, 0));
+      hint_flags |= MU_PROG_HINT_INPUT;
     }
-  else
-    rc = mu_prog_stream_create (&stream, cmdline, flags);
+
+  rc = mu_prog_stream_create (&stream, progname, argc, argv,
+			      hint_flags, &hints, flags);
+  if (hint_flags & MU_PROG_HINT_INPUT)
+    /* Make sure closing/destroying stream will close/destroy input */
+    mu_stream_unref (hints.mu_prog_input);
+
   if (rc)
     {
       fprintf (stderr, "%s: cannot create program filter stream: %s\n",
@@ -81,8 +188,8 @@ main (int argc, char *argv[])
     }
   
   MU_ASSERT (mu_stdio_stream_create (&out, MU_STDOUT_FD, 0));
-  
-  read_and_print (stream, out);
+
+  mu_stream_copy (out, stream, 0, NULL);
   mu_stream_close (stream);
   mu_stream_destroy (&stream);
   mu_stream_close (out);

@@ -448,7 +448,7 @@ do_preauth_program (struct sockaddr *pcs, struct sockaddr *sa)
       return NULL;
     }
 
-  rc = mu_prog_stream_create (&str, ws.ws_wordv[0], MU_STREAM_READ);
+  rc = mu_command_stream_create (&str, ws.ws_wordv[0], MU_STREAM_READ);
   mu_wordsplit_free (&ws);
   if (rc)
     {

@@ -77,6 +77,7 @@ pkginclude_HEADERS = \
  pam.h\
  parse822.h\
  pop3.h\
+ prog.h\
  progmailer.h\
  property.h\
  python.h\

@@ -66,5 +66,6 @@
 #include <mailutils/wordsplit.h>
 #include <mailutils/log.h>
 #include <mailutils/stdstream.h>
+#include <mailutils/prog.h>
 
 /* EOF */

+/* GNU Mailutils -- a suite of utilities for electronic mail
+   Copyright (C) 2009 Free Software Foundation, Inc.
+
+   GNU Mailutils is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3, or (at your option)
+   any later version.
+
+   GNU Mailutils is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with GNU Mailutils.  If not, see <http://www.gnu.org/licenses/>. */
+
+#ifndef _MAILUTILS_PROG_H
+#define _MAILUTILS_PROG_H
+
+#include <sys/time.h>
+#include <sys/resource.h>
+#include <mailutils/types.h>
+
+#define MU_PROG_LIMIT_AS      0
+#define MU_PROG_LIMIT_CPU     1
+#define MU_PROG_LIMIT_DATA    2
+#define MU_PROG_LIMIT_FSIZE   3
+#define MU_PROG_LIMIT_NPROC   4
+#define MU_PROG_LIMIT_CORE    5
+#define MU_PROG_LIMIT_MEMLOCK 6
+#define MU_PROG_LIMIT_NOFILE  7
+#define MU_PROG_LIMIT_RSS     8
+#define MU_PROG_LIMIT_STACK   9
+
+#define _MU_PROG_LIMIT_MAX   10
+
+#define MU_PROG_HINT_WORKDIR     0x0001  /* Workdir is set */
+#define MU_PROG_HINT_PRIO        0x0002  /* Prio is set */
+#define MU_PROG_HINT_INPUT       0x0004  /* Input stream is set */
+#define MU_PROG_HINT_UID         0x0008  /* Uid is set */
+#define MU_PROG_HINT_GID         0x0010  /* Supplementary gids are set */
+#define MU_PROG_HINT_ERRTOOUT    0x0020  /* Redirect stderr to stdout */
+#define MU_PROG_HINT_ERRTOSTREAM 0x0040  /* Redirect stderr to errstream */
+#define MU_PROG_HINT_IGNOREFAIL  0x0080  /* Ignore hint setup failures */
+#define _MU_PROG_HINT_MASK       0x00ff
+#define MU_PROG_HINT_LIMIT(n) (0x100 << (n)) /* MU_PROG_LIMIT_n is set */
+
+struct mu_prog_hints
+{
+  char *mu_prog_workdir;                    /* Working directory */
+  uid_t mu_prog_uid;                        /* Run as this user */
+  gid_t *mu_prog_gidv;                      /* Array of supplementary gids */
+  size_t mu_prog_gidc;                      /* Number of elements in gidv */
+  rlim_t mu_prog_limit[_MU_PROG_LIMIT_MAX]; /* Limits */
+  int mu_prog_prio;                         /* Scheduling priority */
+  mu_stream_t mu_prog_input;                /* Input stream */
+  mu_stream_t mu_prog_error;                /* Error stream */       
+};
+
+int mu_prog_stream_create (mu_stream_t *pstream,
+			   const char *progname,
+			   size_t argc, char **argv,
+			   int hflags,
+			   struct mu_prog_hints *hints,
+			   int flags);
+int mu_command_stream_create (mu_stream_t *pstream, const char *command,
+			      int flags);
+
+#endif
+

@@ -250,9 +250,6 @@ int mu_fd_stream_create (mu_stream_t *pstream, char *filename, int fd,
 #define MU_STDERR_FD 2
 int mu_stdio_stream_create (mu_stream_t *pstream, int fd, int flags);
 
-int mu_prog_stream_create (mu_stream_t *pstream, const char *progname, int flags);
-int mu_filter_prog_stream_create (mu_stream_t *pstream, const char *progname,
-				  mu_stream_t input);
 int mu_memory_stream_create (mu_stream_t *pstream, int flags);
 int mu_static_memory_stream_create (mu_stream_t *pstream, const void *mem,
 				    size_t size);

@@ -18,18 +18,25 @@
 #define _MAILUTILS_SYS_PROG_STREAM_H
 
 #include <mailutils/sys/stream.h>
+#include <mailutils/prog.h>
 
 struct _mu_prog_stream
 {
-  struct _mu_stream stream;
+  struct _mu_stream stream;   /* Base stream */
+  char *progname;             /* Program name */
+  size_t argc;                /* Number of arguments */
+  char **argv;                /* Program arguments */
+  int hint_flags;             /* Hint flags */
+  struct mu_prog_hints hints; /* Invocation hints */
+  
   pid_t pid;
   int status;
   pid_t writer_pid;
-  int argc;
-  char **argv;
+  
   mu_stream_t in, out;
-
-  mu_stream_t input;
 };
 
+extern int _mu_prog_limit_flags;
+extern int _mu_prog_limit_codes[_MU_PROG_LIMIT_MAX];
+
 #endif

@@ -175,8 +175,10 @@ int mu_getpass (mu_stream_t in, mu_stream_t out, const char *prompt,
   /* ----------------------- */
 /* Get the host name, doing a gethostbyname() if possible. */
 int mu_get_host_name (char **host);
-int mu_spawnvp(const char *prog, char *av[], int *stat);
+int mu_spawnvp (const char *prog, char *av[], int *stat);
 int mu_scheme_autodetect_p (mu_url_t);
+int mu_set_user_privileges (uid_t uid, gid_t *gidv, size_t gidc);
+int mu_switch_to_privs (uid_t uid, gid_t gid, mu_list_t retain_groups);
 
 struct timeval; 
 int mu_fd_wait (int fd, int *pflags, struct timeval *tvp);

@@ -27,7 +27,6 @@ libmuaux_a_SOURCES += \
  signal.c\
  strexit.c\
  tcpwrap.c\
- userprivs.c\
  mu_umaxtostr.c\
  mu_umaxtostr.h
 

@@ -63,6 +63,7 @@ libbase_la_SOURCES = \
  tempfile.c\
  ticket.c\
  tilde.c\
+ userprivs.c\
  usremail.c\
  version.c\
  wicket.c

@@ -29,75 +29,90 @@
 #include <mailutils/nls.h>
 #include <mailutils/list.h>
 #include <mailutils/iterator.h>
-#include <xalloc.h>
 
 /* Switch to the given UID/GID */
 int
-mu_switch_to_privs (uid_t uid, gid_t gid, mu_list_t retain_groups)
+mu_set_user_privileges (uid_t uid, gid_t *gidv, size_t gidc)
 {
   int rc = 0;
-  gid_t *emptygidset;
-  size_t size = 1, j = 1;
-  mu_iterator_t itr;
+  gid_t gid;
 
+  if (getuid ())
+    return EACCES;
+  
   if (uid == 0)
     return 0;
 
-  /* Create a list of supplementary groups */
-  mu_list_count (retain_groups, &size);
-  size++;
-  emptygidset = xmalloc (size * sizeof emptygidset[0]);
-  emptygidset[0] = gid ? gid : getegid ();
-
-  if (mu_list_get_iterator (retain_groups, &itr) == 0)
+  /* Reset group permissions */
+  if (gidv && gidc)
     {
-      for (mu_iterator_first (itr);
-	   !mu_iterator_is_done (itr); mu_iterator_next (itr)) 
-	mu_iterator_current (itr,
-			     (void **)(emptygidset + j++));
-      mu_iterator_destroy (&itr);
+      if (geteuid () == 0 && setgroups (gidc, gidv))
+	{
+	  mu_error(_("setgroups(1, %lu) failed: %s"),
+		   (unsigned long) gidv[0], mu_strerror (errno));
+	  return errno;
+	}
+      gid = gidv[0];
     }
-
-  /* Reset group permissions */
-  if (geteuid () == 0 && setgroups (j, emptygidset))
+  else
     {
-      mu_error(_("setgroups(1, %lu) failed: %s"),
-	       (unsigned long) emptygidset[0], mu_strerror (errno));
-      rc = 1;
+      struct passwd *pwd = getpwuid (uid);
+      if (pwd)
+	gid = pwd->pw_gid;
+      else
+	gid = getegid ();
     }
-  free (emptygidset);
-	
+
   /* Switch to the user's gid. On some OSes the effective gid must
      be reset first */
 
 #if defined(HAVE_SETEGID)
-  if ((rc = setegid (gid)) < 0)
-    mu_error (_("setegid(%lu) failed: %s"),
-	      (unsigned long) gid, mu_strerror (errno));
+  if (setegid (gid) < 0)
+    {
+      rc = errno;
+      mu_error (_("setegid(%lu) failed: %s"),
+		(unsigned long) gid, mu_strerror (rc));
+    }
 #elif defined(HAVE_SETREGID)
-  if ((rc = setregid (gid, gid)) < 0)
-    mu_error (_("setregid(%lu,%lu) failed: %s"),
-	      (unsigned long) gid, (unsigned long) gid,
-	      mu_strerror (errno));
+  if (setregid (gid, gid) < 0)
+    {
+      rc = errno;
+      mu_error (_("setregid(%lu,%lu) failed: %s"),
+		(unsigned long) gid, (unsigned long) gid,
+		mu_strerror (rc));
+    }
 #elif defined(HAVE_SETRESGID)
-  if ((rc = setresgid (gid, gid, gid)) < 0)
-    mu_error (_("setresgid(%lu,%lu,%lu) failed: %s"),
-	      (unsigned long) gid,
-	      (unsigned long) gid,
-	      (unsigned long) gid,
-	      mu_strerror (errno));
+  if (setresgid (gid, gid, gid) < 0)
+    {
+      rc = errno;
+      mu_error (_("setresgid(%lu,%lu,%lu) failed: %s"),
+		(unsigned long) gid,
+		(unsigned long) gid,
+		(unsigned long) gid,
+		mu_strerror (rc));
+    }
 #endif
 
   if (rc == 0 && gid != 0)
     {
-      if ((rc = setgid (gid)) < 0 && getegid () != gid) 
-	mu_error (_("setgid(%lu) failed: %s"),
-		  (unsigned long) gid, mu_strerror (errno));
+      if (setgid (gid) < 0)
+	{
+	  rc = errno;
+	  mu_error (_("setgid(%lu) failed: %s"),
+		    (unsigned long) gid, mu_strerror (rc));
+	}
+      else if (getegid () != gid)
+	{
+	  rc = MU_ERR_FAILURE;
+	  mu_error (_("setgid(%lu) failed: %s"),
+		    (unsigned long) gid, mu_strerror (rc));
+	}
+      
       if (rc == 0 && getegid () != gid)
 	{
 	  mu_error (_("Cannot set effective gid to %lu"),
 		    (unsigned long) gid);
-	  rc = 1;
+	  rc = MU_ERR_FAILURE;
 	}
     }
 
@@ -114,24 +129,24 @@ mu_switch_to_privs (uid_t uid, gid_t gid, mu_list_t retain_groups)
 	    {
 	      if (setreuid (uid, -1) < 0)
 		{
+		  rc = errno;
 		  mu_error (_("setreuid(%lu,-1) failed: %s"),
 			    (unsigned long) uid,
-			    mu_strerror (errno));
-		  rc = 1;
+			    mu_strerror (rc));
 		}
 	      if (setuid (uid) < 0)
 		{
+		  rc = errno;
 		  mu_error (_("second setuid(%lu) failed: %s"),
-			    (unsigned long) uid, mu_strerror (errno));
-		  rc = 1;
+			    (unsigned long) uid, mu_strerror (rc));
 		}
 	    } else
 #endif
 	        {
+		  rc = errno;
 		  mu_error (_("setuid(%lu) failed: %s"),
 			    (unsigned long) uid,
-			    mu_strerror (errno));
-		  rc = 1;
+			    mu_strerror (rc));
 		}
 	}
 	
@@ -139,15 +154,46 @@ mu_switch_to_privs (uid_t uid, gid_t gid, mu_list_t retain_groups)
       if (uid != 0 && setuid (0) == 0)
 	{
 	  mu_error (_("seteuid(0) succeeded when it should not"));
-	  rc = 1;
+	  rc = MU_ERR_FAILURE;
 	}
       else if (uid != euid && setuid (euid) == 0)
 	{
 	  mu_error (_("Cannot drop non-root setuid privileges"));
-	  rc = 1;
+	  rc = MU_ERR_FAILURE;
 	}
     }
   return rc;
 }
 
+int
+mu_switch_to_privs (uid_t uid, gid_t gid, mu_list_t retain_groups)
+{
+  int rc = 0;
+  gid_t *emptygidset;
+  size_t size = 1, j = 1;
+  mu_iterator_t itr;
+
+  if (uid == 0)
+    return 0;
+
+  /* Create a list of supplementary groups */
+  mu_list_count (retain_groups, &size);
+  size++;
+  emptygidset = malloc (size * sizeof emptygidset[0]);
+  if (!emptygidset)
+    return ENOMEM;
+  emptygidset[0] = gid ? gid : getegid ();
+
+  if (mu_list_get_iterator (retain_groups, &itr) == 0)
+    {
+      for (mu_iterator_first (itr);
+	   !mu_iterator_is_done (itr); mu_iterator_next (itr)) 
+	mu_iterator_current (itr,
+			     (void **)(emptygidset + j++));
+      mu_iterator_destroy (&itr);
+    }
+  rc = mu_set_user_privileges (uid, emptygidset, j);
+  free (emptygidset);
+  return rc;
+}
 

@@ -39,6 +39,7 @@
 #include <signal.h>
 #include <regex.h>
 #include <mailutils/sieve.h>
+#include <mailutils/prog.h>
 
 int
 sieve_action_pipe (mu_sieve_machine_t mach, mu_list_t args, mu_list_t tags)
@@ -86,7 +87,7 @@ sieve_action_pipe (mu_sieve_machine_t mach, mu_list_t args, mu_list_t tags)
       rc = mu_message_get_streamref (msg, &mstr);
       ONERR (rc, _("cannot get message stream"), NULL);
 
-      rc = mu_prog_stream_create (&pstr, cmd, MU_STREAM_WRITE);
+      rc = mu_command_stream_create (&pstr, cmd, MU_STREAM_WRITE);
       ONERR (rc, _("cannot create command stream"), cmd);
 
       if (mu_sieve_tag_lookup (tags, "envelope", &val))

@@ -409,10 +409,11 @@ run_metamail (const char *mailcap_cmd, mu_message_t mesg)
 	      break;
 	    }
 
-	  status = mu_prog_stream_create (&pstr, mailcap_cmd, MU_STREAM_WRITE);
+	  status = mu_command_stream_create (&pstr, mailcap_cmd,
+					     MU_STREAM_WRITE);
 	  if (status)
 	    {
-	      mu_error ("mu_prog_stream_create: %s", mu_strerror (status));
+	      mu_error ("mu_command_stream_create: %s", mu_strerror (status));
 	      break;
 	    }
 

@@ -82,6 +82,7 @@
 #include <mailutils/cstr.h>
 #include <mailutils/io.h>
 #include <mailutils/stdstream.h>
+#include <mailutils/prog.h>
 
 #ifdef __cplusplus
 extern "C" {

@@ -38,7 +38,7 @@ mail_pipe (int argc, char **argv)
   if (msgset_parse (argc, argv, MSG_NODELETED|MSG_SILENT, &list))
     return 1;
 
-  rc = mu_prog_stream_create (&outstr, cmd, MU_STREAM_WRITE);
+  rc = mu_command_stream_create (&outstr, cmd, MU_STREAM_WRITE);
   if (rc)
     {
       mu_error (_("cannot open `%s': %s"), cmd, mu_strerror (rc));

@@ -702,7 +702,7 @@ msg_to_pipe (const char *cmd, mu_message_t msg)
   mu_stream_t progstream, msgstream;
   int status, rc;
   
-  status = mu_prog_stream_create (&progstream, cmd, MU_STREAM_WRITE);
+  status = mu_command_stream_create (&progstream, cmd, MU_STREAM_WRITE);
   if (status)
     {
       util_error (_("Cannot pipe to %s: %s"), cmd, mu_strerror (status));

@@ -56,6 +56,7 @@
 #include <mailutils/mime.h>
 #include <mailutils/io.h>
 #include <mailutils/property.h>
+#include <mailutils/prog.h>
 #include <mailutils/mh.h>
 
 #include <mu_umaxtostr.h>

@@ -149,7 +149,7 @@ open_output ()
     moreproc = NULL;
 
   if (moreproc)
-    rc = mu_prog_stream_create (&output, moreproc, MU_STREAM_WRITE);
+    rc = mu_command_stream_create (&output, moreproc, MU_STREAM_WRITE);
   else
     rc = mu_stdio_stream_create (&output, MU_STDOUT_FD, MU_STREAM_WRITE);
 

@@ -1403,7 +1403,7 @@ show_internal (mu_message_t msg, msg_part_t part, char *encoding,
 int
 mhn_exec (mu_stream_t *str, const char *cmd, int flags)
 {
-  int rc = mu_prog_stream_create (str, cmd, MU_STREAM_WRITE);
+  int rc = mu_command_stream_create (str, cmd, MU_STREAM_WRITE);
   if (rc)
     {
       mu_error (_("cannot create proc stream (command %s): %s"),
@@ -1773,16 +1773,30 @@ store_handler (mu_message_t msg, msg_part_t part, char *type, char *encoding,
       break;
 
     case store_to_command:
-      /* FIXME: Change to homedir, reflect this in the message below.
-	 Chdir should better be implemented within mu_prog_stream_create
-	 Example message:
-	   storing msg 4 part 1 using command (cd /home/gray;  less)
-      */
-      printf (_("storing msg %s part %s using command %s\n"),
-	      prefix, partstr, name);
-      rc = mu_prog_stream_create (&out, name, MU_STREAM_WRITE);
-      if (rc)
-	mu_diag_funcall (MU_DIAG_ERROR, "mu_prog_stream_create", NULL, rc);
+      {
+	struct mu_prog_hints hints;
+	struct mu_wordsplit ws;
+      
+	hints.mu_prog_workdir = mu_get_homedir ();
+	ws.ws_comment = "#";
+	if (mu_wordsplit (name, &ws, MU_WRDSF_DEFFLAGS|MU_WRDSF_COMMENT))
+	  {
+	    mu_error (_("cannot split line `%s': %s"), name,
+		      mu_wordsplit_strerror (&ws));
+	    break;
+	  }
+	
+	printf (_("storing msg %s part %s using command (cd %s; %s)\n"),
+		prefix, partstr, hints.mu_prog_workdir, name);
+	rc = mu_prog_stream_create (&out,
+				    ws.ws_wordv[0],
+				    ws.ws_wordc, ws.ws_wordv,
+				    MU_PROG_HINT_WORKDIR,
+				    &hints, MU_STREAM_WRITE);
+	mu_wordsplit_free (&ws);
+	if (rc)
+	  mu_diag_funcall (MU_DIAG_ERROR, "mu_prog_stream_create", NULL, rc);
+      }
       break;
       
     case store_to_stdout:

@@ -247,7 +247,7 @@ mkdir Mail/inbox
 cp $abs_top_srcdir/testsuite/mh/mbox1/4 Mail/inbox
 echo "Current-Folder: inbox" > Mail/context
 echo "mhn-store-text: | $abs_top_srcdir/mh/tests/mhed -" >> $MH
-mhn +inbox -store -part 1 4 | sed "s|$abs_top_srcdir/mh/tests/||;s|  *$||" || exit $?
+mhn +inbox -store -part 1 4 | sed "s|$abs_top_srcdir/mh/tests/||;s|(cd \(.*\)\;|(cd home\;|;s|  *$||" || exit $?
 ],
 [0],
 [-- Editor invocation: -
@@ -263,7 +263,7 @@ But, now that I'm perfectly sure I have none,
 Why, I do it again and again.'
 
 -- Input file end
-storing msg 4 part 1 using command mhed -
+storing msg 4 part 1 using command (cd home; mhed -)
 ])
 
 dnl -------------------------------------------------------------------

@@ -240,7 +240,7 @@ mutool_open_pager ()
   if (mutool_shell_interactive && (pager = getenv ("PAGER")) != NULL)
     {
       mu_stream_t stream;
-      int rc = mu_prog_stream_create (&stream, pager, MU_STREAM_WRITE);
+      int rc = mu_command_stream_create (&stream, pager, MU_STREAM_WRITE);
       if (rc == 0)
 	return stream;
       mu_error (_("cannot start pager: %s"), mu_strerror (rc));

@@ -118,6 +118,7 @@ mail/unalias.c
 mail/util.c
 mail/z.c
 
+libmailutils/base/userprivs.c
 libmailutils/cfg/driver.c
 libmailutils/cfg/format.c
 libmailutils/cfg/lexer.l