[asterisk-commits] tilghman: branch 1.6.1 r172504 - in /branches/1.6.1: ./ apps/ autoconf/ main/

[SVN commits to the Asterisk project]

Author: tilghman
Date: Thu Jan 29 17:53:12 2009
New Revision: 172504

URL: http://svn.digium.com/svn-view/asterisk?view=rev&rev=172504
Log:
Merged revisions 172441 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r172441 | tilghman | 2009-01-29 17:15:40 -0600 (Thu, 29 Jan 2009) | 16 lines
  
  Merged revisions 172438 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r172438 | tilghman | 2009-01-29 16:54:29 -0600 (Thu, 29 Jan 2009) | 9 lines
    
    Lose the CAP_NET_ADMIN at every fork, instead of at startup.  Otherwise, if
    Asterisk runs as a non-root user and the administrator does a 'restart now',
    Asterisk loses the ability to set QOS on packets.
    (closes issue #14004)
     Reported by: nemo
     Patches: 
           20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
     Tested by: Corydon76
  ........
................

Modified:
    branches/1.6.1/   (props changed)
    branches/1.6.1/apps/app_rpt.c
    branches/1.6.1/autoconf/ast_func_fork.m4
    branches/1.6.1/configure
    branches/1.6.1/main/app.c
    branches/1.6.1/main/asterisk.c

Propchange: branches/1.6.1/
------------------------------------------------------------------------------
Binary property 'trunk-merged' - no diff available.

Modified: branches/1.6.1/apps/app_rpt.c
URL: http://svn.digium.com/svn-view/asterisk/branches/1.6.1/apps/app_rpt.c?view=diff&rev=172504&r1=172503&r2=172504
==============================================================================
--- branches/1.6.1/apps/app_rpt.c (original)
+++ branches/1.6.1/apps/app_rpt.c Thu Jan 29 17:53:12 2009
@@ -359,6 +359,8 @@
 #include "asterisk/cdr.h"
 #include "asterisk/options.h"
 #include "asterisk/manager.h"
+#include "asterisk/app.h"
+
 #include <termios.h>
 
 #ifdef	NEW_ASTERISK
@@ -1966,7 +1968,7 @@
 	sprintf(str,"%s?node=%s&time=%u&seqno=%u",myrpt->p.statpost_url,
 		myrpt->name,(unsigned int) now,seq);
 	if (pairs) sprintf(str + strlen(str),"&%s",pairs);
-	if (!(pid = fork()))
+	if (!(pid = ast_safe_fork(0)))
 	{
 		execv(astrs[0],astrs);
 		ast_log(LOG_ERROR, "exec of %s failed.\n", astrs[0]);

Modified: branches/1.6.1/autoconf/ast_func_fork.m4
URL: http://svn.digium.com/svn-view/asterisk/branches/1.6.1/autoconf/ast_func_fork.m4?view=diff&rev=172504&r1=172503&r2=172504
==============================================================================
--- branches/1.6.1/autoconf/ast_func_fork.m4 (original)
+++ branches/1.6.1/autoconf/ast_func_fork.m4 Thu Jan 29 17:53:12 2009
@@ -39,6 +39,8 @@
 fi
 if test "x$ac_cv_func_fork_works" = xyes; then
   AC_DEFINE(HAVE_WORKING_FORK, 1, [Define to 1 if `fork' works.])
+  PBX_WORKING_FORK=1
+  AC_SUBST(PBX_WORKING_FORK)
 fi
 ])# AST_FUNC_FORK
 

Modified: branches/1.6.1/main/app.c
URL: http://svn.digium.com/svn-view/asterisk/branches/1.6.1/main/app.c?view=diff&rev=172504&r1=172503&r2=172504
==============================================================================
--- branches/1.6.1/main/app.c (original)
+++ branches/1.6.1/main/app.c Thu Jan 29 17:53:12 2009
@@ -33,6 +33,9 @@
 #include <regex.h>
 #include <sys/file.h> /* added this to allow to compile, sorry! */
 #include <signal.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */
 
 #include "asterisk/paths.h"	/* use ast_config_AST_DATA_DIR */
 #include "asterisk/channel.h"
@@ -1870,6 +1873,14 @@
 		return pid;
 	} else {
 		/* Child */
+#ifdef HAVE_CAP
+		cap_t cap = cap_from_text("cap_net_admin-eip");
+
+		if (cap_set_proc(cap)) {
+			ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+		}
+		cap_free(cap);
+#endif
 
 		/* Before we unblock our signals, return our trapped signals back to the defaults */
 		signal(SIGHUP, SIG_DFL);

Modified: branches/1.6.1/main/asterisk.c
URL: http://svn.digium.com/svn-view/asterisk/branches/1.6.1/main/asterisk.c?view=diff&rev=172504&r1=172503&r2=172504
==============================================================================
--- branches/1.6.1/main/asterisk.c (original)
+++ branches/1.6.1/main/asterisk.c Thu Jan 29 17:53:12 2009
@@ -873,6 +873,15 @@
 #endif	
 
 	if (pid == 0) {
+#ifdef HAVE_CAP
+		cap_t cap = cap_from_text("cap_net_admin-eip");
+
+		if (cap_set_proc(cap)) {
+			/* Careful with order! Logging cannot happen after we close FDs */
+			ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+		}
+		cap_free(cap);
+#endif
 #ifdef HAVE_WORKING_FORK
 		if (ast_opt_high_priority)
 			ast_set_priority(0);
@@ -896,7 +905,7 @@
 	}
 
 	ast_unreplace_sigchld();
-#else
+#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */
 	res = -1;
 #endif
 
@@ -3223,7 +3232,7 @@
 		if (has_cap) {
 			cap_t cap;
 
-			cap = cap_from_text("cap_net_admin=ep");
+			cap = cap_from_text("cap_net_admin=eip");
 
 			if (cap_set_proc(cap))
 				ast_log(LOG_WARNING, "Unable to install capabilities.\n");