Merged revisions 172441 via svnmerge from

https://origsvn.digium.com/svn/asterisk/trunk

................
  r172441 | tilghman | 2009-01-29 17:15:40 -0600 (Thu, 29 Jan 2009) | 16 lines
  
  Merged revisions 172438 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r172438 | tilghman | 2009-01-29 16:54:29 -0600 (Thu, 29 Jan 2009) | 9 lines
    
    Lose the CAP_NET_ADMIN at every fork, instead of at startup.  Otherwise, if
    Asterisk runs as a non-root user and the administrator does a 'restart now',
    Asterisk loses the ability to set QOS on packets.
    (closes issue #14004)
     Reported by: nemo
     Patches: 
           20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
     Tested by: Corydon76
  ........
................


git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.0@172503 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 11 insertions, 2 deletions

diff --git a/main/asterisk.c b/main/asterisk.c
index 4c9aa4a3c..ffc85a9cf 100644
--- a/main/asterisk.c
+++ b/main/asterisk.c
@@ -873,6 +873,15 @@ int ast_safe_system(const char *s)
 #endif	
 
 	if (pid == 0) {
+#ifdef HAVE_CAP
+		cap_t cap = cap_from_text("cap_net_admin-eip");
+
+		if (cap_set_proc(cap)) {
+			/* Careful with order! Logging cannot happen after we close FDs */
+			ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+		}
+		cap_free(cap);
+#endif
 #ifdef HAVE_WORKING_FORK
 		if (ast_opt_high_priority)
 			ast_set_priority(0);
@@ -897,7 +906,7 @@ int ast_safe_system(const char *s)
 	}
 
 	ast_unreplace_sigchld();
-#else
+#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */
 	res = -1;
 #endif
 
@@ -3197,7 +3206,7 @@ int main(int argc, char *argv[])
 		if (has_cap) {
 			cap_t cap;
 
-			cap = cap_from_text("cap_net_admin=ep");
+			cap = cap_from_text("cap_net_admin=eip");
 
 			if (cap_set_proc(cap))
 				ast_log(LOG_WARNING, "Unable to install capabilities.\n");