[asterisk-bugs] [Asterisk 0009999]: runasuser/runasgroup used even for -r means reconnecting users must be root

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=9999 
====================================================================== 
Reported By:                stuarth
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   9999
Category:                   Core/Configuration
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.4 
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        No 
Request Review:              
====================================================================== 
Date Submitted:             06-18-2007 05:26 CDT
Last Modified:              08-31-2007 17:36 CDT
====================================================================== 
Summary:                    runasuser/runasgroup used even for -r means
reconnecting users must be root
Description: 
When runasuser/runasgroup are configured in asterisk.conf, they are used
whenever Asterisk is started, including when reconnecting to a running
instance. This means that it's not possible to just use filesystem
permissions on asterisk.ctl to restrict access, since without being root
the setuid/setgid calls will fail.

Wrapping the setuid block in main/asterisk.c with "if(!ast_opt_remote) {
... }" would makes things easier.
====================================================================== 

---------------------------------------------------------------------- 
 stuarth - 08-31-07 17:36  
---------------------------------------------------------------------- 
Corydon76: yes, that works.

tzafrir: I like this approach, though you have set can_drop_privs=1 in
lines 2563 and 2671 where you mean =0. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
08-31-07 17:36  stuarth        Note Added: 0069811                          
======================================================================