Lose the CAP_NET_ADMIN at every fork, instead of at startup. Otherwise, if

Asterisk runs as a non-root user and the administrator does a 'restart now',
Asterisk loses the ability to set QOS on packets.
(closes issue #14004)
 Reported by: nemo
 Patches: 
       20090105__bug14004.diff.txt uploaded by Corydon76 (license 14)
 Tested by: Corydon76


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@172438 65c4cc65-6c06-0410-ace0-fbb531ad65f3

apps/app_dahdiras.c

@@ -27,6 +27,7 @@
 
 /*** MODULEINFO
 	<depend>dahdi</depend>
+	<depend>working_fork</depend>
  ***/
 
 #include "asterisk.h"
@@ -48,6 +49,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
 #include <errno.h>
 #include <stdio.h>
 #include <fcntl.h>
+#ifdef HAVE_CAP
+#include <sys/capability.h>
+#endif /* HAVE_CAP */
 
 #include "asterisk/lock.h"
 #include "asterisk/file.h"
@@ -92,6 +96,9 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args)
 	int argc = 0;
 	char *stringp=NULL;
 	sigset_t fullset, oldset;
+#ifdef HAVE_CAP
+	cap_t cap;
+#endif
 
 	sigfillset(&fullset);
 	pthread_sigmask(SIG_BLOCK, &fullset, &oldset);
@@ -103,6 +110,16 @@ static pid_t spawn_ras(struct ast_channel *chan, char *args)
 		return pid;
 	}
 
+#ifdef HAVE_CAP
+	cap = cap_from_text("cap_net_admin-eip");
+
+	if (cap_set_proc(cap)) {
+		/* Careful with order! Logging cannot happen after we close FDs */
+		ast_log(LOG_WARNING, "Unable to remove capabilities.\n");
+	}
+	cap_free(cap);
+#endif
+
 	/* Restore original signal handlers */
 	for (x=0;x<NSIG;x++)
 		signal(x, SIG_DFL);