kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-12 21:09:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Lose the CAP_NET_ADMIN at every fork, instead of at startup. Otherwise, if

Browse Source 
Asterisk runs as a non-root user and the administrator does a 'restart now',
Asterisk loses the ability to set QOS on packets.
(closes issue #14004)
 Reported by: nemo
 Patches: 
       20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
 Tested by: Corydon76


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@172438 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Tilghman Lesher
2009-01-29 22:54:29 +00:00
parent 3209942b7e
commit c257ffeed0
12 changed files with 179 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
main/asterisk.c
View File

@@ -818,6 +818,15 @@ int ast_safe_system(const char *s)
#endif
if (pid == 0) {
#ifdef HAVE_CAP
cap_t cap = cap_from_text("cap_net_admin-eip");
if (cap_set_proc(cap)) {
/* Careful with order! Logging cannot happen after we close FDs */
ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
}
cap_free(cap);
#endif
#ifdef HAVE_WORKING_FORK
if (ast_opt_high_priority)
ast_set_priority(0);
@@ -842,7 +851,7 @@ int ast_safe_system(const char *s)
}
ast_unreplace_sigchld();
#else
#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */
res = -1;
#endif
@@ -2914,7 +2923,7 @@ int main(int argc, char *argv[])
if (has_cap) {
cap_t cap;
cap = cap_from_text("cap_net_admin=ep");
cap = cap_from_text("cap_net_admin=eip");
if (cap_set_proc(cap))
ast_log(LOG_WARNING, "Unable to install capabilities.\n");