#!/bin/sh
# direct <command> [args...]: run a command that talks to the internet in group fvdirect (gid 9912), the one group passwall2 exempts.
# passwall2's "Localhost Proxy" (its default) captures every socket the router itself opens, root's included, and hands it to a proxy
# node that may be dead: the updater's feed fetches then fail with "Operation not permitted" (found 2026-10-17). The daemon is in
# fvdirect already (forestvpn.init); this puts the updater's, the reinstaller's and the start-time check's network calls there too.
# Only the uid stays 0 and only the gid changes, through BusyBox's start-stop-daemon (every OpenWrt image has it; checked 21.02 to
# 25.12). Without passwall2, or without the group (the init adds it at the first start), it is a plain exec: nothing changes.
# `-n fvdirect-exec` matches no process: BusyBox 1.37 (25.12) otherwise REFUSES to start when another process runs the same
# program ("/bin/sh is already running", status 1), so a fetch would fail whenever the same program happened to run twice.
# Wrap a fetch, or an install BY NAME (it fetches); never the install of a file the updater already verified. Test seams: FVPN_DIRECT_ETC, FVPN_DIRECT_SSD.
ETC=${FVPN_DIRECT_ETC:-/etc}
SSD=${FVPN_DIRECT_SSD:-/sbin/start-stop-daemon}
if [ -e "$ETC/init.d/passwall2" ] && grep -q '^fvdirect:' "$ETC/group" 2>/dev/null && [ -x "$SSD" ]; then
	p=$(command -v "$1")
	case $p in /*) shift; exec "$SSD" -S -c root:fvdirect -n fvdirect-exec -x "$p" -- "$@" ;; esac
fi
exec "$@"
