How to manipulate iptables rules from the web script - c

Question

I have a linux box with web serverthe has 2 running services:
web proxy (listens ports 80, 443)
apache (listens port 8080)
The users for proxy can register through web interface. I must give access to proxy only to the registered clients with certain IPs. Proxy is a handwritten script, and I have to use iptables to block the access. I wrote the following rules:
iptables -A INPUT -p tcp -m multiport --dports 80,443 -s <valid IP 1> -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -s <valid IP 2> -j ACCEPT
...
iptables -A INPUT -p tcp -m multiport --dports 80,443 -s <valid IP n> -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP
It works. But when a new user is added through web interface, Apache launches a script as a non-root user. And I have to run iptables as root.
I can't set suid bit for a program, written in a scripting language, so I created a C program updater.c:
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char* argv[])
{
int result = system("iptables -L");
printf("\nresult=%i", result);
return 0;
}
Then I compiled it:
# gcc -o updater ./updater.c
# chmod +s ./updater
When I run it as a non-priviledged user in shell it works correctly: prints all the iptables rules.
When I run it from the web, calling the program inside a shell script, it doesn't print anything. Despite the fact, that when I tried to create a file inside this C program, it was created with owner=root. system("ls -l"); also works - it prints the directory listing.
How can I manipulate iptables rules from the web script?

Answer 1

When you call system("iptables -L"); you may or may not be able to find iptables, depending on your PATH environment variable. You should prepend the path to where the binary is so that you know it will be found:
int result = system("/sbin/iptables -L");