diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-10-17 15:23:51 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2007-10-17 15:23:51 +0000 |
commit | 0e866456fe9d0aeec52ce65661d6779d6630e792 (patch) | |
tree | 09680265477d33278ba83fe78dea13d8bac86bfd | |
parent | 49f23cd5efd8f351ffbef376084a2929c1387208 (diff) |
When runuser/rungroup is specified, a remote console could only be attained by root
(Closes issue #9999)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@86066 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r-- | main/asterisk.c | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/main/asterisk.c b/main/asterisk.c index a5f013912..202a19086 100644 --- a/main/asterisk.c +++ b/main/asterisk.c @@ -2547,7 +2547,7 @@ int main(int argc, char *argv[]) FILE *f; sigset_t sigs; int num; - int is_child_of_nonroot = 0; + int isroot = 1; char *buf; char *runuser = NULL, *rungroup = NULL; @@ -2560,6 +2560,9 @@ int main(int argc, char *argv[]) _argv[x] = argv[x]; _argv[x] = NULL; + if (geteuid() != 0) + isroot = 0; + /* if the progname is rasterisk consider it a remote console */ if (argv[0] && (strstr(argv[0], "rasterisk")) != NULL) { ast_set_flag(&ast_options, AST_OPT_FLAG_NO_FORK | AST_OPT_FLAG_REMOTE); @@ -2573,11 +2576,7 @@ int main(int argc, char *argv[]) ast_builtins_init(); ast_utils_init(); tdd_init(); - /* When Asterisk restarts after it has dropped the root privileges, - * it can't issue setuid(), setgid(), setgroups() or set_priority() - */ - if (getenv("ASTERISK_ALREADY_NONROOT")) - is_child_of_nonroot=1; + if (getenv("HOME")) snprintf(filename, sizeof(filename), "%s/.asterisk_history", getenv("HOME")); /* Check for options */ @@ -2712,10 +2711,10 @@ int main(int argc, char *argv[]) #ifndef __CYGWIN__ - if (!is_child_of_nonroot) + if (isroot) ast_set_priority(ast_opt_high_priority); - if (!is_child_of_nonroot && rungroup) { + if (isroot && rungroup) { struct group *gr; gr = getgrnam(rungroup); if (!gr) { @@ -2734,13 +2733,17 @@ int main(int argc, char *argv[]) ast_verbose("Running as group '%s'\n", rungroup); } - if (!is_child_of_nonroot && runuser) { + if (runuser && !ast_test_flag(&ast_options, AST_OPT_FLAG_REMOTE)) { struct passwd *pw; pw = getpwnam(runuser); if (!pw) { ast_log(LOG_WARNING, "No such user '%s'!\n", runuser); exit(1); } + if (!isroot && pw->pw_uid != geteuid()) { + ast_log(LOG_ERROR, "Asterisk started as nonroot, but runuser '%s' requested.\n", runuser); + exit(1); + } if (!rungroup) { if (setgid(pw->pw_gid)) { ast_log(LOG_WARNING, "Unable to setgid to %d!\n", (int)pw->pw_gid); @@ -2755,7 +2758,6 @@ int main(int argc, char *argv[]) ast_log(LOG_WARNING, "Unable to setuid to %d (%s)\n", (int)pw->pw_uid, runuser); exit(1); } - setenv("ASTERISK_ALREADY_NONROOT", "yes", 1); if (option_verbose) ast_verbose("Running as user '%s'\n", runuser); } |