diff options
| -rw-r--r-- | apps/app_rpt.c | 4 | ||||
| -rw-r--r-- | autoconf/ast_func_fork.m4 | 2 | ||||
| -rwxr-xr-x | configure | 8 | ||||
| -rw-r--r-- | main/app.c | 11 | ||||
| -rw-r--r-- | main/asterisk.c | 13 |
5 files changed, 33 insertions, 5 deletions
diff --git a/apps/app_rpt.c b/apps/app_rpt.c index 1c2dbd4e1..7e0fef1de 100644 --- a/apps/app_rpt.c +++ b/apps/app_rpt.c @@ -359,6 +359,8 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include "asterisk/cdr.h" #include "asterisk/options.h" #include "asterisk/manager.h" +#include "asterisk/app.h" + #include <termios.h> #ifdef NEW_ASTERISK @@ -1966,7 +1968,7 @@ unsigned int seq; sprintf(str,"%s?node=%s&time=%u&seqno=%u",myrpt->p.statpost_url, myrpt->name,(unsigned int) now,seq); if (pairs) sprintf(str + strlen(str),"&%s",pairs); - if (!(pid = fork())) + if (!(pid = ast_safe_fork(0))) { execv(astrs[0],astrs); ast_log(LOG_ERROR, "exec of %s failed.\n", astrs[0]); diff --git a/autoconf/ast_func_fork.m4 b/autoconf/ast_func_fork.m4 index 37bf0c397..a5c0835ff 100644 --- a/autoconf/ast_func_fork.m4 +++ b/autoconf/ast_func_fork.m4 @@ -39,6 +39,8 @@ else fi if test "x$ac_cv_func_fork_works" = xyes; then AC_DEFINE(HAVE_WORKING_FORK, 1, [Define to 1 if `fork' works.]) + PBX_WORKING_FORK=1 + AC_SUBST(PBX_WORKING_FORK) fi ])# AST_FUNC_FORK @@ -1,5 +1,5 @@ #! /bin/sh -# From configure.ac Revision: 163170 . +# From configure.ac Revision: 164266 . # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.61 for asterisk 1.6. # @@ -959,6 +959,7 @@ ZLIB_DIR PBX_ZLIB ALLOCA LIBOBJS +PBX_WORKING_FORK POW_LIB HAS_POLL PBX_PTHREAD_RWLOCK_INITIALIZER @@ -12973,6 +12974,8 @@ cat >>confdefs.h <<\_ACEOF #define HAVE_WORKING_FORK 1 _ACEOF + PBX_WORKING_FORK=1 + fi { echo "$as_me:$LINENO: checking for _LARGEFILE_SOURCE value needed for large files" >&5 @@ -51485,6 +51488,7 @@ ZLIB_DIR!$ZLIB_DIR$ac_delim PBX_ZLIB!$PBX_ZLIB$ac_delim ALLOCA!$ALLOCA$ac_delim LIBOBJS!$LIBOBJS$ac_delim +PBX_WORKING_FORK!$PBX_WORKING_FORK$ac_delim POW_LIB!$POW_LIB$ac_delim HAS_POLL!$HAS_POLL$ac_delim PBX_PTHREAD_RWLOCK_INITIALIZER!$PBX_PTHREAD_RWLOCK_INITIALIZER$ac_delim @@ -51526,7 +51530,7 @@ CURL_CONFIG!$CURL_CONFIG$ac_delim LTLIBOBJS!$LTLIBOBJS$ac_delim _ACEOF - if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 88; then + if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 89; then break elif $ac_last_try; then { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 diff --git a/main/app.c b/main/app.c index 24a1de13e..5b66646ae 100644 --- a/main/app.c +++ b/main/app.c @@ -33,6 +33,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <regex.h> #include <sys/file.h> /* added this to allow to compile, sorry! */ #include <signal.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/paths.h" /* use ast_config_AST_DATA_DIR */ #include "asterisk/channel.h" @@ -1870,6 +1873,14 @@ int ast_safe_fork(int stop_reaper) return pid; } else { /* Child */ +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif /* Before we unblock our signals, return our trapped signals back to the defaults */ signal(SIGHUP, SIG_DFL); diff --git a/main/asterisk.c b/main/asterisk.c index f3bb6af81..b8cd0ad9a 100644 --- a/main/asterisk.c +++ b/main/asterisk.c @@ -873,6 +873,15 @@ int ast_safe_system(const char *s) #endif if (pid == 0) { +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif #ifdef HAVE_WORKING_FORK if (ast_opt_high_priority) ast_set_priority(0); @@ -896,7 +905,7 @@ int ast_safe_system(const char *s) } ast_unreplace_sigchld(); -#else +#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */ res = -1; #endif @@ -3223,7 +3232,7 @@ int main(int argc, char *argv[]) if (has_cap) { cap_t cap; - cap = cap_from_text("cap_net_admin=ep"); + cap = cap_from_text("cap_net_admin=eip"); if (cap_set_proc(cap)) ast_log(LOG_WARNING, "Unable to install capabilities.\n"); |