[asterisk-commits] tilghman: trunk r172441 - in /trunk: ./ apps/ autoconf/ main/

[SVN commits to the Asterisk project]

Author: tilghman
Date: Thu Jan 29 17:15:40 2009
New Revision: 172441

URL: http://svn.digium.com/svn-view/asterisk?view=rev&rev=172441
Log:
Merged revisions 172438 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
  r172438 | tilghman | 2009-01-29 16:54:29 -0600 (Thu, 29 Jan 2009) | 9 lines
  
  Lose the CAP_NET_ADMIN at every fork, instead of at startup.  Otherwise, if
  Asterisk runs as a non-root user and the administrator does a 'restart now',
  Asterisk loses the ability to set QOS on packets.
  (closes issue #14004)
   Reported by: nemo
   Patches: 
         20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
   Tested by: Corydon76
........

Modified:
    trunk/   (props changed)
    trunk/apps/app_rpt.c
    trunk/autoconf/ast_func_fork.m4
    trunk/configure
    trunk/main/app.c
    trunk/main/asterisk.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-1.4-merged' - no diff available.

Modified: trunk/apps/app_rpt.c
URL: http://svn.digium.com/svn-view/asterisk/trunk/apps/app_rpt.c?view=diff&rev=172441&r1=172440&r2=172441
==============================================================================
--- trunk/apps/app_rpt.c (original)
+++ trunk/apps/app_rpt.c Thu Jan 29 17:15:40 2009
@@ -359,6 +359,8 @@
 #include "asterisk/cdr.h"
 #include "asterisk/options.h"
 #include "asterisk/manager.h"
+#include "asterisk/app.h"
+
 #include <termios.h>
 
 #ifdef	NEW_ASTERISK
@@ -1966,7 +1968,7 @@
 	sprintf(str,"%s?node=%s&time=%u&seqno=%u",myrpt->p.statpost_url,
 		myrpt->name,(unsigned int) now,seq);
 	if (pairs) sprintf(str + strlen(str),"&%s",pairs);
-	if (!(pid = fork()))
+	if (!(pid = ast_safe_fork(0)))
 	{
 		execv(astrs[0],astrs);
 		ast_log(LOG_ERROR, "exec of %s failed.\n", astrs[0]);

Modified: trunk/autoconf/ast_func_fork.m4
URL: http://svn.digium.com/svn-view/asterisk/trunk/autoconf/ast_func_fork.m4?view=diff&rev=172441&r1=172440&r2=172441
==============================================================================
--- trunk/autoconf/ast_func_fork.m4 (original)
+++ trunk/autoconf/ast_func_fork.m4 Thu Jan 29 17:15:40 2009
@@ -39,6 +39,8 @@
 fi
 if test "x$ac_cv_func_fork_works" = xyes; then
   AC_DEFINE(HAVE_WORKING_FORK, 1, [Define to 1 if `fork' works.])
+  PBX_WORKING_FORK=1
+  AC_SUBST(PBX_WORKING_FORK)
 fi
 ])# AST_FUNC_FORK
 

Modified: trunk/main/app.c
URL: http://svn.digium.com/svn-view/asterisk/trunk/main/app.c?view=diff&rev=172441&r1=172440&r2=172441
==============================================================================
--- trunk/main/app.c (original)
+++ trunk/main/app.c Thu Jan 29 17:15:40 2009
@@ -36,6 +36,9 @@
 #include <sys/time.h>       /* for getrlimit(2) */
 #include <sys/resource.h>   /* for getrlimit(2) */
 #include <stdlib.h>         /* for closefrom(3) */
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */
 
 #include "asterisk/paths.h"	/* use ast_config_AST_DATA_DIR */
 #include "asterisk/channel.h"
@@ -1883,6 +1886,14 @@
 		return pid;
 	} else {
 		/* Child */
+#ifdef HAVE_CAP
+		cap_t cap = cap_from_text("cap_net_admin-eip");
+
+		if (cap_set_proc(cap)) {
+			ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+		}
+		cap_free(cap);
+#endif
 
 		/* Before we unblock our signals, return our trapped signals back to the defaults */
 		signal(SIGHUP, SIG_DFL);

Modified: trunk/main/asterisk.c
URL: http://svn.digium.com/svn-view/asterisk/trunk/main/asterisk.c?view=diff&rev=172441&r1=172440&r2=172441
==============================================================================
--- trunk/main/asterisk.c (original)
+++ trunk/main/asterisk.c Thu Jan 29 17:15:40 2009
@@ -1013,6 +1013,15 @@
 #endif	
 
 	if (pid == 0) {
+#ifdef HAVE_CAP
+		cap_t cap = cap_from_text("cap_net_admin-eip");
+
+		if (cap_set_proc(cap)) {
+			/* Careful with order! Logging cannot happen after we close FDs */
+			ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+		}
+		cap_free(cap);
+#endif
 #ifdef HAVE_WORKING_FORK
 		if (ast_opt_high_priority)
 			ast_set_priority(0);
@@ -1036,7 +1045,7 @@
 	}
 
 	ast_unreplace_sigchld();
-#else
+#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */
 	res = -1;
 #endif
 
@@ -3380,7 +3389,7 @@
 		if (has_cap) {
 			cap_t cap;
 
-			cap = cap_from_text("cap_net_admin=ep");
+			cap = cap_from_text("cap_net_admin=eip");
 
 			if (cap_set_proc(cap))
 				ast_log(LOG_WARNING, "Unable to install capabilities.\n");