diff options
Diffstat (limited to 'apps/app_festival.c')
-rw-r--r-- | apps/app_festival.c | 37 |
1 files changed, 28 insertions, 9 deletions
diff --git a/apps/app_festival.c b/apps/app_festival.c index ab05824f5..5650d983b 100644 --- a/apps/app_festival.c +++ b/apps/app_festival.c @@ -25,6 +25,10 @@ * \ingroup applications */ +/*** MODULEINFO + <depend>working_fork</depend> + ***/ + #include "asterisk.h" ASTERISK_FILE_VERSION(__FILE__, "$Revision$") @@ -46,6 +50,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <fcntl.h> #include <ctype.h> #include <errno.h> +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/file.h" #include "asterisk/logger.h" @@ -132,21 +139,33 @@ static int send_waveform_to_fd(char *waveform, int length, int fd) { char c; #endif sigset_t fullset, oldset; +#ifdef HAVE_CAP + cap_t cap; +#endif sigfillset(&fullset); pthread_sigmask(SIG_BLOCK, &fullset, &oldset); - res = fork(); - if (res < 0) - ast_log(LOG_WARNING, "Fork failed\n"); - if (res) { + res = fork(); + if (res < 0) + ast_log(LOG_WARNING, "Fork failed\n"); + if (res) { pthread_sigmask(SIG_SETMASK, &oldset, NULL); - return res; + return res; + } +#ifdef HAVE_CAP + cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif + for (x=0;x<256;x++) { + if (x != fd) + close(x); } - for (x=0;x<256;x++) { - if (x != fd) - close(x); - } if (ast_opt_high_priority) ast_set_priority(0); signal(SIGPIPE, SIG_DFL); |