Prevent script paths from being parsed as options

Author: ConnorNelson

README.md

@@ -82,8 +82,24 @@ See [https://docs.python.org/3/using/cmdline.html#cmdoption-I](https://docs.pyth
 
 See [https://www.man7.org/linux/man-pages/man1/bash.1.html#INVOCATION](https://www.man7.org/linux/man-pages/man1/bash.1.html#INVOCATION)
 
+### PHP
+
+PHP expects the script path to immediately follow its `-f` option, so the implicit interpreter separator must be disabled:
+
+```
+#!/usr/bin/exec-suid --no-interpreter-separator -- /usr/bin/php -f
+```
+
+See [https://www.php.net/manual/en/features.commandline.options.php](https://www.php.net/manual/en/features.commandline.options.php).
+
 ## Options
 
+### Interpreter Separator (`--no-interpreter-separator`)
+
+By default, `exec-suid` inserts `--` between the configured interpreter arguments and the script path. This prevents an option-like script path from being interpreted as an interpreter argument.
+
+Some interpreters instead require the script path to immediately follow an option. Use `--no-interpreter-separator` for these command forms so that `exec-suid` does not insert `--` before the script path. See the [PHP interpreter](#php) example.
+
 ### Effective vs Real (`--real`)
 
 By default, `exec-suid` will elevate only the effective user id (and saved user id), but not the real id.

src/main.rs

@@ -37,8 +37,12 @@ fn main() {
     // Deprecated: kept temporarily for compatibility. New scripts should rely on the safe default and --env overrides.
     opts.optopt("", "environ", "Environment policy: safe (default), none, or all", "MODE");
     opts.optmulti("", "env", "Set an environment variable in the invoked script", "KEY=VALUE");
+    opts.optflag("", "no-interpreter-separator", "Do not insert -- before the script path");
     let matches = opts.parse(&exec_argv[1..]).unwrap();
 
+    if !matches.opt_present("no-interpreter-separator") {
+        script_argv.push("--".to_string());
+    }
     script_argv.push(path.to_str().unwrap().to_string());
     script_argv.extend_from_slice(&args[if args.len() == 2 { 2.. } else { 3.. }]);
 

tests/test_interpreters.py

@@ -28,3 +28,26 @@ def test_sh(run_program):
         id -u
         """,
     )) == 0
+
+
+def test_option_like_script_path(run_program):
+    assert run_program(
+        """
+        #!/usr/bin/exec-suid -- /usr/bin/python3 -I
+
+        print("script")
+        """,
+        script_path="-cprint('injected')",
+        executable="/usr/bin/exec-suid",
+        args=["/usr/bin/exec-suid", "-cprint('injected')"],
+        cwd="/tests",
+    ) == "script"
+
+
+def test_no_interpreter_separator(run_program):
+    assert run_program(
+        """
+        #!/usr/bin/exec-suid --no-interpreter-separator -- /usr/bin/python3 -I -c print(__import__('sys').argv[1])
+        """,
+        executable="/tests/test_no_interpreter_separator",
+    ) == "/tests/test_no_interpreter_separator"