dect
/
asterisk
Archived
13
0
Fork 0
Code Releases Activity

Merged revisions 172438 via svnmerge from 

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
  r172438 | tilghman | 2009-01-29 16:54:29 -0600 (Thu, 29 Jan 2009) | 9 lines
  
  Lose the CAP_NET_ADMIN at every fork, instead of at startup.  Otherwise, if
  Asterisk runs as a non-root user and the administrator does a 'restart now',
  Asterisk loses the ability to set QOS on packets.
  (closes issue #14004)
   Reported by: nemo
   Patches: 
         20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
   Tested by: Corydon76
........


git-svn-id: http://svn.digium.com/svn/asterisk/trunk@172441 f38db490-d61c-443f-a65b-d21fe96a405b
This commit is contained in:
tilghman 2009-01-29 23:15:40 +00:00
parent 6f805da8ab
commit 68c38c68fb
5 changed files with 42 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/app_rpt.c
View File

@ -359,6 +359,8 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
#include "asterisk/cdr.h"
#include "asterisk/options.h"
#include "asterisk/manager.h"
#include "asterisk/app.h"
#include <termios.h>
#ifdef NEW_ASTERISK
@ -1966,7 +1968,7 @@ unsigned int seq;
sprintf(str,"%s?node=%s&time=%u&seqno=%u",myrpt->p.statpost_url,
myrpt->name,(unsigned int) now,seq);
if (pairs) sprintf(str + strlen(str),"&%s",pairs);
if (!(pid = fork()))
if (!(pid = ast_safe_fork(0)))
{
execv(astrs[0],astrs);
ast_log(LOG_ERROR, "exec of %s failed.\n", astrs[0]);

2
autoconf/ast_func_fork.m4
View File

@ -39,6 +39,8 @@ else
fi
if test "x$ac_cv_func_fork_works" = xyes; then
AC_DEFINE(HAVE_WORKING_FORK, 1, [Define to 1 if `fork' works.])
PBX_WORKING_FORK=1
AC_SUBST(PBX_WORKING_FORK)
fi
])# AST_FUNC_FORK

22
configure vendored
View File

@ -1,5 +1,5 @@
#! /bin/sh
# From configure.ac Revision: 168734 .
# From configure.ac Revision: 170112 .
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.61 for asterisk 1.6.
#
@ -972,6 +972,7 @@ TIMERFD_DIR
PBX_TIMERFD
ALLOCA
LIBOBJS
PBX_WORKING_FORK
POW_LIB
HAS_POLL
PBX_PTHREAD_RWLOCK_INITIALIZER
@ -13318,6 +13319,8 @@ cat >>confdefs.h <<\_ACEOF
#define HAVE_WORKING_FORK 1
_ACEOF
PBX_WORKING_FORK=1
fi
{ echo "$as_me:$LINENO: checking for _LARGEFILE_SOURCE value needed for large files" >&5
@ -13332,11 +13335,13 @@ _ACEOF
cat confdefs.h >>conftest.$ac_ext
cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#include <stdio.h>
#include <sys/types.h> /* for off_t */
#include <stdio.h>
int
main ()
{
return fseeko (stdin, 0, 0) && (fseeko) (stdin, 0, 0);
int (*fp) (FILE *, off_t, int) = fseeko;
return fseeko (stdin, 0, 0) && fp (stdin, 0, 0);
;
return 0;
}
@ -13376,11 +13381,13 @@ cat confdefs.h >>conftest.$ac_ext
cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h. */
#define _LARGEFILE_SOURCE 1
#include <stdio.h>
#include <sys/types.h> /* for off_t */
#include <stdio.h>
int
main ()
{
return fseeko (stdin, 0, 0) && (fseeko) (stdin, 0, 0);
int (*fp) (FILE *, off_t, int) = fseeko;
return fseeko (stdin, 0, 0) && fp (stdin, 0, 0);
;
return 0;
}
@ -53711,6 +53718,7 @@ TIMERFD_DIR!$TIMERFD_DIR$ac_delim
PBX_TIMERFD!$PBX_TIMERFD$ac_delim
ALLOCA!$ALLOCA$ac_delim
LIBOBJS!$LIBOBJS$ac_delim
PBX_WORKING_FORK!$PBX_WORKING_FORK$ac_delim
POW_LIB!$POW_LIB$ac_delim
HAS_POLL!$HAS_POLL$ac_delim
PBX_PTHREAD_RWLOCK_INITIALIZER!$PBX_PTHREAD_RWLOCK_INITIALIZER$ac_delim
@ -53745,7 +53753,6 @@ AIS_INCLUDE!$AIS_INCLUDE$ac_delim
AIS_LIB!$AIS_LIB$ac_delim
CONFIG_GMIME!$CONFIG_GMIME$ac_delim
EDITLINE_LIB!$EDITLINE_LIB$ac_delim
PBX_H323!$PBX_H323$ac_delim
_ACEOF
if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
@ -53787,6 +53794,7 @@ _ACEOF
ac_delim='%!_!# '
for ac_last_try in false false false false false :; do
cat >conf$$subs.sed <<_ACEOF
PBX_H323!$PBX_H323$ac_delim
PBX_IXJUSER!$PBX_IXJUSER$ac_delim
CONFIG_SDL!$CONFIG_SDL$ac_delim
CONFIG_GTK!$CONFIG_GTK$ac_delim
@ -53798,7 +53806,7 @@ PBX_GENERIC_ODBC!$PBX_GENERIC_ODBC$ac_delim
LTLIBOBJS!$LTLIBOBJS$ac_delim
_ACEOF
if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 9; then
if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 10; then
break
elif $ac_last_try; then
{ { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5

11
main/app.c
View File

@ -36,6 +36,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
#include <sys/time.h> /* for getrlimit(2) */
#include <sys/resource.h> /* for getrlimit(2) */
#include <stdlib.h> /* for closefrom(3) */
#ifdef HAVE_CAP
#include <sys/capability.h>
#endif /* HAVE_CAP */
#include "asterisk/paths.h" /* use ast_config_AST_DATA_DIR */
#include "asterisk/channel.h"
@ -1883,6 +1886,14 @@ int ast_safe_fork(int stop_reaper)
return pid;
} else {
/* Child */
#ifdef HAVE_CAP
cap_t cap = cap_from_text("cap_net_admin-eip");
if (cap_set_proc(cap)) {
ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
}
cap_free(cap);
#endif
/* Before we unblock our signals, return our trapped signals back to the defaults */
signal(SIGHUP, SIG_DFL);

13
main/asterisk.c
View File

@ -1013,6 +1013,15 @@ int ast_safe_system(const char *s)
#endif
if (pid == 0) {
#ifdef HAVE_CAP
cap_t cap = cap_from_text("cap_net_admin-eip");
if (cap_set_proc(cap)) {
/* Careful with order! Logging cannot happen after we close FDs */
ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
}
cap_free(cap);
#endif
#ifdef HAVE_WORKING_FORK
if (ast_opt_high_priority)
ast_set_priority(0);
@ -1036,7 +1045,7 @@ int ast_safe_system(const char *s)
}
ast_unreplace_sigchld();
#else
#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */
res = -1;
#endif
@ -3380,7 +3389,7 @@ int main(int argc, char *argv[])
if (has_cap) {
cap_t cap;
cap = cap_from_text("cap_net_admin=ep");
cap = cap_from_text("cap_net_admin=eip");
if (cap_set_proc(cap))
ast_log(LOG_WARNING, "Unable to install capabilities.\n");