diff options
-rw-r--r-- | apps/app_dahdiras.c | 17 | ||||
-rw-r--r-- | apps/app_externalivr.c | 16 | ||||
-rw-r--r-- | apps/app_festival.c | 19 | ||||
-rw-r--r-- | apps/app_ices.c | 20 | ||||
-rw-r--r-- | apps/app_mp3.c | 22 | ||||
-rw-r--r-- | apps/app_nbscat.c | 19 | ||||
-rw-r--r-- | autoconf/ast_func_fork.m4 | 2 | ||||
-rw-r--r-- | build_tools/menuselect-deps.in | 1 | ||||
-rwxr-xr-x | configure | 8 | ||||
-rw-r--r-- | main/asterisk.c | 13 | ||||
-rw-r--r-- | res/res_agi.c | 17 | ||||
-rw-r--r-- | res/res_musiconhold.c | 26 |
12 files changed, 169 insertions, 11 deletions
diff --git a/apps/app_dahdiras.c b/apps/app_dahdiras.c index 9c7c7b717..4d2082ace 100644 --- a/apps/app_dahdiras.c +++ b/apps/app_dahdiras.c @@ -27,6 +27,7 @@ /*** MODULEINFO <depend>dahdi</depend> + <depend>working_fork</depend> ***/ #include "asterisk.h" @@ -42,6 +43,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #endif /* __linux__ */ #include <fcntl.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include <dahdi/user.h> @@ -76,6 +80,9 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args) int argc = 0; char *stringp=NULL; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -87,6 +94,16 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args) return pid; } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + /* Restore original signal handlers */ for (x=0;x<NSIG;x++) signal(x, SIG_DFL); diff --git a/apps/app_externalivr.c b/apps/app_externalivr.c index 687ed68eb..828f23632 100644 --- a/apps/app_externalivr.c +++ b/apps/app_externalivr.c @@ -31,11 +31,18 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <signal.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -362,6 +369,15 @@ static int app_exec(struct ast_channel *chan, void *data) if (!pid) { /* child process */ int i; +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &fullset, NULL); diff --git a/apps/app_festival.c b/apps/app_festival.c index 4e1e47e8a..d4d3eab02 100644 --- a/apps/app_festival.c +++ b/apps/app_festival.c @@ -27,6 +27,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -39,6 +43,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <fcntl.h> #include <ctype.h> #include <errno.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/file.h" #include "asterisk/channel.h" @@ -123,6 +130,9 @@ static int send_waveform_to_fd(char *waveform, int length, int fd) char c; #endif sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -134,6 +144,15 @@ static int send_waveform_to_fd(char *waveform, int length, int fd) pthread_sigmask(SIG_SETMASK, &oldset, NULL); return res; } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif for (x = 0; x < 256; x++) { if (x != fd) close(x); diff --git a/apps/app_ices.c b/apps/app_ices.c index 60828eb69..9c539281f 100644 --- a/apps/app_ices.c +++ b/apps/app_ices.c @@ -27,6 +27,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -34,6 +38,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <signal.h> #include <fcntl.h> #include <sys/time.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/paths.h" /* use ast_config_AST_CONFIG_DIR */ #include "asterisk/lock.h" @@ -64,6 +71,9 @@ static int icesencode(char *filename, int fd) int res; int x; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -80,6 +90,16 @@ static int icesencode(char *filename, int fd) signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &fullset, NULL); +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + if (ast_opt_high_priority) ast_set_priority(0); dup2(fd, STDIN_FILENO); diff --git a/apps/app_mp3.c b/apps/app_mp3.c index d2f2f5c0e..4d68b287f 100644 --- a/apps/app_mp3.c +++ b/apps/app_mp3.c @@ -25,12 +25,19 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <sys/time.h> #include <signal.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -58,6 +65,9 @@ static int mp3play(char *filename, int fd) int res; int x; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -69,6 +79,15 @@ static int mp3play(char *filename, int fd) pthread_sigmask(SIG_SETMASK, &oldset, NULL); return res; } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif if (ast_opt_high_priority) ast_set_priority(0); signal(SIGPIPE, SIG_DFL); @@ -76,8 +95,7 @@ static int mp3play(char *filename, int fd) dup2(fd, STDOUT_FILENO); for (x=STDERR_FILENO + 1;x<256;x++) { - if (x != STDOUT_FILENO) - close(x); + close(x); } /* Execute mpg123, but buffer if it's a net connection */ if (!strncasecmp(filename, "http://", 7)) { diff --git a/apps/app_nbscat.c b/apps/app_nbscat.c index 4e7203319..4b0a03eb1 100644 --- a/apps/app_nbscat.c +++ b/apps/app_nbscat.c @@ -25,6 +25,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -33,6 +37,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <sys/time.h> #include <sys/socket.h> #include <signal.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -63,6 +70,9 @@ static int NBScatplay(int fd) int res; int x; sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); @@ -77,6 +87,15 @@ static int NBScatplay(int fd) signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &fullset, NULL); +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif if (ast_opt_high_priority) ast_set_priority(0); diff --git a/autoconf/ast_func_fork.m4 b/autoconf/ast_func_fork.m4 index 37bf0c397..a5c0835ff 100644 --- a/autoconf/ast_func_fork.m4 +++ b/autoconf/ast_func_fork.m4 @@ -39,6 +39,8 @@ else fi if test "x$ac_cv_func_fork_works" = xyes; then AC_DEFINE(HAVE_WORKING_FORK, 1, [Define to 1 if `fork' works.]) + PBX_WORKING_FORK=1 + AC_SUBST(PBX_WORKING_FORK) fi ])# AST_FUNC_FORK diff --git a/build_tools/menuselect-deps.in b/build_tools/menuselect-deps.in index 1cd18701e..ba27668fc 100644 --- a/build_tools/menuselect-deps.in +++ b/build_tools/menuselect-deps.in @@ -47,4 +47,5 @@ USB=@PBX_USB@ VORBIS=@PBX_VORBIS@ VPBAPI=@PBX_VPB@ WINARCH=@WINARCH@ +WORKING_VFORK=@WORKING_VFORK@ ZLIB=@PBX_ZLIB@ @@ -1,5 +1,5 @@ #! /bin/sh -# From configure.ac Revision: 163169 . +# From configure.ac Revision: 164265 . # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.61 for asterisk 1.6. # @@ -951,6 +951,7 @@ ZLIB_DIR PBX_ZLIB ALLOCA LIBOBJS +PBX_WORKING_FORK POW_LIB HAS_POLL PBX_PTHREAD_RWLOCK_INITIALIZER @@ -12902,6 +12903,8 @@ cat >>confdefs.h <<\_ACEOF #define HAVE_WORKING_FORK 1 _ACEOF + PBX_WORKING_FORK=1 + fi { echo "$as_me:$LINENO: checking for _LARGEFILE_SOURCE value needed for large files" >&5 @@ -50538,6 +50541,7 @@ ZLIB_DIR!$ZLIB_DIR$ac_delim PBX_ZLIB!$PBX_ZLIB$ac_delim ALLOCA!$ALLOCA$ac_delim LIBOBJS!$LIBOBJS$ac_delim +PBX_WORKING_FORK!$PBX_WORKING_FORK$ac_delim POW_LIB!$POW_LIB$ac_delim HAS_POLL!$HAS_POLL$ac_delim PBX_PTHREAD_RWLOCK_INITIALIZER!$PBX_PTHREAD_RWLOCK_INITIALIZER$ac_delim @@ -50575,7 +50579,7 @@ CURL_CONFIG!$CURL_CONFIG$ac_delim LTLIBOBJS!$LTLIBOBJS$ac_delim _ACEOF - if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 76; then + if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 77; then break elif $ac_last_try; then { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 diff --git a/main/asterisk.c b/main/asterisk.c index 4c9aa4a3c..ffc85a9cf 100644 --- a/main/asterisk.c +++ b/main/asterisk.c @@ -873,6 +873,15 @@ int ast_safe_system(const char *s) #endif if (pid == 0) { +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif #ifdef HAVE_WORKING_FORK if (ast_opt_high_priority) ast_set_priority(0); @@ -897,7 +906,7 @@ int ast_safe_system(const char *s) } ast_unreplace_sigchld(); -#else +#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */ res = -1; #endif @@ -3197,7 +3206,7 @@ int main(int argc, char *argv[]) if (has_cap) { cap_t cap; - cap = cap_from_text("cap_net_admin=ep"); + cap = cap_from_text("cap_net_admin=eip"); if (cap_set_proc(cap)) ast_log(LOG_WARNING, "Unable to install capabilities.\n"); diff --git a/res/res_agi.c b/res/res_agi.c index ece9c0bbe..76924d5c4 100644 --- a/res/res_agi.c +++ b/res/res_agi.c @@ -23,6 +23,10 @@ * \author Mark Spencer <markster@digium.com> */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -33,6 +37,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <sys/wait.h> #include <sys/stat.h> #include <pthread.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/paths.h" /* use many ast_config_AST_*_DIR */ #include "asterisk/network.h" @@ -667,6 +674,16 @@ static enum agi_result launch_script(struct ast_channel *chan, char *script, cha return AGI_RESULT_FAILURE; } if (!pid) { +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + /* Pass paths to AGI via environmental variables */ setenv("AST_CONFIG_DIR", ast_config_AST_CONFIG_DIR, 1); setenv("AST_CONFIG_FILE", ast_config_AST_CONFIG_FILE, 1); diff --git a/res/res_musiconhold.c b/res/res_musiconhold.c index 9656ae02b..3733fe701 100644 --- a/res/res_musiconhold.c +++ b/res/res_musiconhold.c @@ -28,6 +28,7 @@ /*** MODULEINFO <conflict>win32</conflict> <use>dahdi</use> + <depend>working_fork</depend> ***/ #include "asterisk.h" @@ -49,6 +50,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #ifdef HAVE_DAHDI #include <dahdi/user.h> #endif +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/lock.h" #include "asterisk/file.h" @@ -491,7 +495,15 @@ static int spawn_mp3(struct mohclass *class) return -1; } if (!class->pid) { + /* Child */ int x; +#ifdef HAVE_CAP + cap_t cap; +#endif + if (strcasecmp(class->dir, "nodir") && chdir(class->dir) < 0) { + ast_log(LOG_WARNING, "chdir() failed: %s\n", strerror(errno)); + _exit(1); + } if (ast_opt_high_priority) ast_set_priority(0); @@ -500,6 +512,14 @@ static int spawn_mp3(struct mohclass *class) signal(SIGPIPE, SIG_DFL); pthread_sigmask(SIG_UNBLOCK, &signal_set, NULL); +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif close(fds[0]); /* Stdout goes to pipe */ dup2(fds[1], STDOUT_FILENO); @@ -509,12 +529,8 @@ static int spawn_mp3(struct mohclass *class) close(x); } } - /* Child */ - if (strcasecmp(class->dir, "nodir") && chdir(class->dir) < 0) { - ast_log(LOG_WARNING, "chdir() failed: %s\n", strerror(errno)); - _exit(1); - } setpgid(0, getpid()); + if (ast_test_flag(class, MOH_CUSTOM)) { execv(argv[0], argv); } else { |