diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-01-29 23:47:00 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-01-29 23:47:00 +0000 |
commit | b1aaf7ed30d4a31d4dcbe1387934dfdfa0560a8a (patch) | |
tree | 9ba9725bae9ac826c6f8a9b2a6a3be5709413369 /main/asterisk.c | |
parent | f9ca7af2a42504874b55683451eaf9d83b4936d3 (diff) |
Merged revisions 172441 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk
................
r172441 | tilghman | 2009-01-29 17:15:40 -0600 (Thu, 29 Jan 2009) | 16 lines
Merged revisions 172438 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4
........
r172438 | tilghman | 2009-01-29 16:54:29 -0600 (Thu, 29 Jan 2009) | 9 lines
Lose the CAP_NET_ADMIN at every fork, instead of at startup. Otherwise, if
Asterisk runs as a non-root user and the administrator does a 'restart now',
Asterisk loses the ability to set QOS on packets.
(closes issue #14004)
Reported by: nemo
Patches:
20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
Tested by: Corydon76
........
................
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.0@172503 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'main/asterisk.c')
-rw-r--r-- | main/asterisk.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/main/asterisk.c b/main/asterisk.c index 4c9aa4a3c..ffc85a9cf 100644 --- a/main/asterisk.c +++ b/main/asterisk.c @@ -873,6 +873,15 @@ int ast_safe_system(const char *s) #endif if (pid == 0) { +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif #ifdef HAVE_WORKING_FORK if (ast_opt_high_priority) ast_set_priority(0); @@ -897,7 +906,7 @@ int ast_safe_system(const char *s) } ast_unreplace_sigchld(); -#else +#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */ res = -1; #endif @@ -3197,7 +3206,7 @@ int main(int argc, char *argv[]) if (has_cap) { cap_t cap; - cap = cap_from_text("cap_net_admin=ep"); + cap = cap_from_text("cap_net_admin=eip"); if (cap_set_proc(cap)) ast_log(LOG_WARNING, "Unable to install capabilities.\n"); |