[asterisk-bugs] [Asterisk 0009999]: runasuser/runasgroup used even for -r means reconnecting users must be root

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=9999 
====================================================================== 
Reported By:                stuarth
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   9999
Category:                   Core/Configuration
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.4 
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        No 
Request Review:              
====================================================================== 
Date Submitted:             06-18-2007 05:26 CDT
Last Modified:              08-31-2007 16:12 CDT
====================================================================== 
Summary:                    runasuser/runasgroup used even for -r means
reconnecting users must be root
Description: 
When runasuser/runasgroup are configured in asterisk.conf, they are used
whenever Asterisk is started, including when reconnecting to a running
instance. This means that it's not possible to just use filesystem
permissions on asterisk.ctl to restrict access, since without being root
the setuid/setgid calls will fail.

Wrapping the setuid block in main/asterisk.c with "if(!ast_opt_remote) {
... }" would makes things easier.
====================================================================== 

---------------------------------------------------------------------- 
 stuarth - 08-31-07 16:12  
---------------------------------------------------------------------- 
No, you misunderstand. The socket is already created with the relevant
permissions; the problem is that when runasuser is set, asterisk always
tries to setuid(). When you are a non-root user, this always fails.

If you have set runasuser in asterisk.conf, you cannot use -r to reconnect
to a running instance of Asterisk, even if you have permissions to access
the socket, unless you are root (i.e. are able to setuid(_runasuser_)). 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
08-31-07 16:12  stuarth        Note Added: 0069803                          
======================================================================