Lose the CAP_NET_ADMIN at every fork, instead of at startup. Otherwise, if

Asterisk runs as a non-root user and the administrator does a 'restart now', Asterisk loses the ability to set QOS on packets. (closes issue #14004) Reported by: nemo Patches: 20090105__bug14004.diff.txt uploaded by Corydon76 (license 14) Tested by: Corydon76 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@172438 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2025-09-23 14:44:28 +00:00 · 2009-01-29 22:54:29 +00:00
parent 3209942b7e
commit c257ffeed0
12 changed files with 179 additions and 21 deletions
--- a/apps/app_dahdiras.c
+++ b/apps/app_dahdiras.c
@@ -27,6 +27,7 @@

 /*** MODULEINFO
 	<depend>dahdi</depend>
+	<depend>working_fork</depend>
 ***/

 #include "asterisk.h"
@@ -48,6 +49,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <errno.h>
 #include <stdio.h>
 #include <fcntl.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */

 #include "asterisk/lock.h"
 #include "asterisk/file.h"
@@ -92,6 +96,9 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args)
 	int argc = 0;
 	char *stringp=NULL;
 	sigset_t fullset, oldset;
+#ifdef HAVE_CAP
+	cap_t cap;
+#endif

 	sigfillset(&fullset);
 	pthread_sigmask(SIG_BLOCK, &fullset, &oldset);
@@ -103,6 +110,16 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args)
 		return pid;
 	}

+#ifdef HAVE_CAP
+	cap = cap_from_text("cap_net_admin-eip");
+
+	if (cap_set_proc(cap)) {
+		/* Careful with order! Logging cannot happen after we close FDs */
+		ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+	}
+	cap_free(cap);
+#endif
+
 	/* Restore original signal handlers */
 	for (x=0;x<NSIG;x++)
 		signal(x, SIG_DFL);
--- a/apps/app_externalivr.c
+++ b/apps/app_externalivr.c
@@ -31,6 +31,10 @@
 * \ingroup applications
 */

+/*** MODULEINFO
+	<depend>working_fork</depend>
+ ***/
+
 #include "asterisk.h"

 ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
@@ -41,6 +45,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <unistd.h>
 #include <errno.h>
 #include <signal.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */

 #include "asterisk/lock.h"
 #include "asterisk/file.h"
@@ -317,6 +324,15 @@ static int app_exec(struct ast_channel *chan, void *data)
 	if (!pid) {
 		/* child process */
 		int i;
+#ifdef HAVE_CAP
+		cap_t cap = cap_from_text("cap_net_admin-eip");
+
+		if (cap_set_proc(cap)) {
+			/* Careful with order! Logging cannot happen after we close FDs */
+			ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+		}
+		cap_free(cap);
+#endif

 		signal(SIGPIPE, SIG_DFL);
 		pthread_sigmask(SIG_UNBLOCK, &fullset, NULL);
--- a/apps/app_festival.c
+++ b/apps/app_festival.c
@@ -25,6 +25,10 @@
 * \ingroup applications
 */

+/*** MODULEINFO
+	<depend>working_fork</depend>
+ ***/
+
 #include "asterisk.h"

 ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
@@ -46,6 +50,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <fcntl.h>
 #include <ctype.h>
 #include <errno.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */

 #include "asterisk/file.h"
 #include "asterisk/logger.h"
@@ -132,21 +139,33 @@ static int send_waveform_to_fd(char *waveform, int length, int fd) {
 	char c;
 #endif
 	sigset_t fullset, oldset;
+#ifdef HAVE_CAP
+	cap_t cap;
+#endif

 	sigfillset(&fullset);
 	pthread_sigmask(SIG_BLOCK, &fullset, &oldset);

-        res = fork();
-        if (res < 0)
-                ast_log(LOG_WARNING, "Fork failed\n");
-        if (res) {
+	res = fork();
+	if (res < 0)
+		ast_log(LOG_WARNING, "Fork failed\n");
+	if (res) {
 		pthread_sigmask(SIG_SETMASK, &oldset, NULL);
-                return res;
+		return res;
+	}
+#ifdef HAVE_CAP
+	cap = cap_from_text("cap_net_admin-eip");
+
+	if (cap_set_proc(cap)) {
+		/* Careful with order! Logging cannot happen after we close FDs */
+		ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+	}
+	cap_free(cap);
+#endif
+	for (x=0;x<256;x++) {
+		if (x != fd)
+			close(x);
 	}
-        for (x=0;x<256;x++) {
-                if (x != fd)
-                        close(x);
-        }
 	if (ast_opt_high_priority)
 		ast_set_priority(0);
 	signal(SIGPIPE, SIG_DFL);
--- a/apps/app_ices.c
+++ b/apps/app_ices.c
@@ -25,6 +25,10 @@
 * \ingroup applications
 */
 
+/*** MODULEINFO
+	<depend>working_fork</depend>
+ ***/
+
 #include "asterisk.h"

 ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
@@ -37,6 +41,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <fcntl.h>
 #include <sys/time.h>
 #include <errno.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */

 #include "asterisk/lock.h"
 #include "asterisk/file.h"
@@ -65,6 +72,9 @@ static int icesencode(char *filename, int fd)
 	int res;
 	int x;
 	sigset_t fullset, oldset;
+#ifdef HAVE_CAP
+	cap_t cap;
+#endif

 	sigfillset(&fullset);
 	pthread_sigmask(SIG_BLOCK, &fullset, &oldset);
@@ -81,6 +91,16 @@ static int icesencode(char *filename, int fd)
 	signal(SIGPIPE, SIG_DFL);
 	pthread_sigmask(SIG_UNBLOCK, &fullset, NULL);

+#ifdef HAVE_CAP
+	cap = cap_from_text("cap_net_admin-eip");
+
+	if (cap_set_proc(cap)) {
+		/* Careful with order! Logging cannot happen after we close FDs */
+		ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+	}
+	cap_free(cap);
+#endif
+
 	if (ast_opt_high_priority)
 		ast_set_priority(0);
 	dup2(fd, STDIN_FILENO);
--- a/apps/app_mp3.c
+++ b/apps/app_mp3.c
@@ -25,6 +25,10 @@
 * \ingroup applications
 */
 
+/*** MODULEINFO
+	<depend>working_fork</depend>
+ ***/
+
 #include "asterisk.h"

 ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
@@ -36,6 +40,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/time.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */

 #include "asterisk/lock.h"
 #include "asterisk/file.h"
@@ -65,6 +72,9 @@ static int mp3play(char *filename, int fd)
 	int res;
 	int x;
 	sigset_t fullset, oldset;
+#ifdef HAVE_CAP
+	cap_t cap;
+#endif

 	sigfillset(&fullset);
 	pthread_sigmask(SIG_BLOCK, &fullset, &oldset);
@@ -76,6 +86,15 @@ static int mp3play(char *filename, int fd)
 		pthread_sigmask(SIG_SETMASK, &oldset, NULL);
 		return res;
 	}
+#ifdef HAVE_CAP
+	cap = cap_from_text("cap_net_admin-eip");
+
+	if (cap_set_proc(cap)) {
+		/* Careful with order! Logging cannot happen after we close FDs */
+		ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+	}
+	cap_free(cap);
+#endif
 	if (ast_opt_high_priority)
 		ast_set_priority(0);
 	signal(SIGPIPE, SIG_DFL);
@@ -83,8 +102,7 @@ static int mp3play(char *filename, int fd)

 	dup2(fd, STDOUT_FILENO);
 	for (x=STDERR_FILENO + 1;x<256;x++) {
-		if (x != STDOUT_FILENO)
-			close(x);
+		close(x);
 	}
 	/* Execute mpg123, but buffer if it's a net connection */
 	if (!strncasecmp(filename, "http://", 7)) {
--- a/apps/app_nbscat.c
+++ b/apps/app_nbscat.c
@@ -25,6 +25,10 @@
 * \ingroup applications
 */
 
+/*** MODULEINFO
+	<depend>working_fork</depend>
+ ***/
+
 #include "asterisk.h"

 ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
@@ -37,6 +41,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <fcntl.h>
 #include <sys/time.h>
 #include <sys/socket.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */

 #include "asterisk/lock.h"
 #include "asterisk/file.h"
@@ -69,6 +76,9 @@ static int NBScatplay(int fd)
 	int res;
 	int x;
 	sigset_t fullset, oldset;
+#ifdef HAVE_CAP
+	cap_t cap;
+#endif

 	sigfillset(&fullset);
 	pthread_sigmask(SIG_BLOCK, &fullset, &oldset);
@@ -83,6 +93,15 @@ static int NBScatplay(int fd)
 	signal(SIGPIPE, SIG_DFL);
 	pthread_sigmask(SIG_UNBLOCK, &fullset, NULL);

+#ifdef HAVE_CAP
+	cap = cap_from_text("cap_net_admin-eip");
+
+	if (cap_set_proc(cap)) {
+		/* Careful with order! Logging cannot happen after we close FDs */
+		ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+	}
+	cap_free(cap);
+#endif
 	if (ast_opt_high_priority)
 		ast_set_priority(0);