diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-01-29 22:54:29 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-01-29 22:54:29 +0000 |
commit | 0ff5ae8abf03b712c34e869948652f20dbd858f9 (patch) | |
tree | bbb253ebe3936896c27af17928c80ed7025d9244 /apps | |
parent | 2a514c914219bb3e8628021109b509d8087488d4 (diff) |
Lose the CAP_NET_ADMIN at every fork, instead of at startup. Otherwise, if
Asterisk runs as a non-root user and the administrator does a 'restart now',
Asterisk loses the ability to set QOS on packets.
(closes issue #14004)
Reported by: nemo
Patches:
20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
Tested by: Corydon76
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@172438 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'apps')
-rw-r--r-- | apps/app_dahdiras.c | 17 | ||||
-rw-r--r-- | apps/app_externalivr.c | 16 | ||||
-rw-r--r-- | apps/app_festival.c | 37 | ||||
-rw-r--r-- | apps/app_ices.c | 20 | ||||
-rw-r--r-- | apps/app_mp3.c | 22 | ||||
-rw-r--r-- | apps/app_nbscat.c | 19 |
6 files changed, 120 insertions, 11 deletions
diff --git a/apps/app_dahdiras.c b/apps/app_dahdiras.c index 4ac5daa3d..4ecaaa018 100644 --- a/apps/app_dahdiras.c +++ b/apps/app_dahdiras.c @@ -27,6 +27,7 @@ /*** MODULEINFO <depend>dahdi</depend> + <depend>working_fork</depend> ***/ #include "asterisk.h" @@ -48,6 +49,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <errno.h> #include <stdio.h> #include <fcntl.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -92,6 +96,9 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args) int argc = 0; char *stringp=NULL; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -103,6 +110,16 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args) return pid; } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + /* Restore original signal handlers */ for (x=0;x<NSIG;x++) signal(x, SIG_DFL); diff --git a/apps/app_externalivr.c b/apps/app_externalivr.c index 8004fecd1..42fd469c3 100644 --- a/apps/app_externalivr.c +++ b/apps/app_externalivr.c @@ -31,6 +31,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -41,6 +45,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <unistd.h> #include <errno.h> #include <signal.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -317,6 +324,15 @@ static int app_exec(struct ast_channel *chan, void *data) if (!pid) { /* child process */ int i; +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &fullset, NULL); diff --git a/apps/app_festival.c b/apps/app_festival.c index ab05824f5..5650d983b 100644 --- a/apps/app_festival.c +++ b/apps/app_festival.c @@ -25,6 +25,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -46,6 +50,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <fcntl.h> #include <ctype.h> #include <errno.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/file.h" #include "asterisk/logger.h" @@ -132,21 +139,33 @@ static int send_waveform_to_fd(char *waveform, int length, int fd) { char c; #endif sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); - res = fork(); - if (res < 0) - ast_log(LOG_WARNING, "Fork failed\n"); - if (res) { + res = fork(); + if (res < 0) + ast_log(LOG_WARNING, "Fork failed\n"); + if (res) { pthread_sigmask(SIG_SETMASK, &oldset, NULL); - return res; + return res; + } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + for (x=0;x<256;x++) { + if (x != fd) + close(x); } - for (x=0;x<256;x++) { - if (x != fd) - close(x); - } if (ast_opt_high_priority) ast_set_priority(0); signal(SIGPIPE, SIG_DFL); diff --git a/apps/app_ices.c b/apps/app_ices.c index eb5980f93..40fbfdb39 100644 --- a/apps/app_ices.c +++ b/apps/app_ices.c @@ -25,6 +25,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -37,6 +41,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <fcntl.h> #include <sys/time.h> #include <errno.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -65,6 +72,9 @@ static int icesencode(char *filename, int fd) int res; int x; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -81,6 +91,16 @@ static int icesencode(char *filename, int fd) signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &fullset, NULL); +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + if (ast_opt_high_priority) ast_set_priority(0); dup2(fd, STDIN_FILENO); diff --git a/apps/app_mp3.c b/apps/app_mp3.c index 55d50f011..7cacc1e77 100644 --- a/apps/app_mp3.c +++ b/apps/app_mp3.c @@ -25,6 +25,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -36,6 +40,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <unistd.h> #include <fcntl.h> #include <sys/time.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -65,6 +72,9 @@ static int mp3play(char *filename, int fd) int res; int x; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -76,6 +86,15 @@ static int mp3play(char *filename, int fd) pthread_sigmask(SIG_SETMASK, &oldset, NULL); return res; } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif if (ast_opt_high_priority) ast_set_priority(0); signal(SIGPIPE, SIG_DFL); @@ -83,8 +102,7 @@ static int mp3play(char *filename, int fd) dup2(fd, STDOUT_FILENO); for (x=STDERR_FILENO + 1;x<256;x++) { - if (x != STDOUT_FILENO) - close(x); + close(x); } /* Execute mpg123, but buffer if it's a net connection */ if (!strncasecmp(filename, "http://", 7)) { diff --git a/apps/app_nbscat.c b/apps/app_nbscat.c index 5f3000404..d9a2dd402 100644 --- a/apps/app_nbscat.c +++ b/apps/app_nbscat.c @@ -25,6 +25,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -37,6 +41,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <fcntl.h> #include <sys/time.h> #include <sys/socket.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -69,6 +76,9 @@ static int NBScatplay(int fd) int res; int x; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -83,6 +93,15 @@ static int NBScatplay(int fd) signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &fullset, NULL); +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif if (ast_opt_high_priority) ast_set_priority(0); |