diff options
Diffstat (limited to 'main')
| -rw-r--r-- | main/app.c | 11 | ||||
| -rw-r--r-- | main/asterisk.c | 13 |
2 files changed, 22 insertions, 2 deletions
diff --git a/main/app.c b/main/app.c index 2c2704483..789425fb7 100644 --- a/main/app.c +++ b/main/app.c @@ -36,6 +36,9 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$") #include <sys/time.h> /* for getrlimit(2) */ #include <sys/resource.h> /* for getrlimit(2) */ #include <stdlib.h> /* for closefrom(3) */ +#ifdef HAVE_CAP +#include <sys/capability.h> +#endif /* HAVE_CAP */ #include "asterisk/paths.h" /* use ast_config_AST_DATA_DIR */ #include "asterisk/channel.h" @@ -1883,6 +1886,14 @@ int ast_safe_fork(int stop_reaper) return pid; } else { /* Child */ +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif /* Before we unblock our signals, return our trapped signals back to the defaults */ signal(SIGHUP, SIG_DFL); diff --git a/main/asterisk.c b/main/asterisk.c index 25c08f44f..3567fbae5 100644 --- a/main/asterisk.c +++ b/main/asterisk.c @@ -1013,6 +1013,15 @@ int ast_safe_system(const char *s) #endif if (pid == 0) { +#ifdef HAVE_CAP + cap_t cap = cap_from_text("cap_net_admin-eip"); + + if (cap_set_proc(cap)) { + /* Careful with order! Logging cannot happen after we close FDs */ + ast_log(LOG_WARNING, "Unable to remove capabilities.\n"); + } + cap_free(cap); +#endif #ifdef HAVE_WORKING_FORK if (ast_opt_high_priority) ast_set_priority(0); @@ -1036,7 +1045,7 @@ int ast_safe_system(const char *s) } ast_unreplace_sigchld(); -#else +#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */ res = -1; #endif @@ -3380,7 +3389,7 @@ int main(int argc, char *argv[]) if (has_cap) { cap_t cap; - cap = cap_from_text("cap_net_admin=ep"); + cap = cap_from_text("cap_net_admin=eip"); if (cap_set_proc(cap)) ast_log(LOG_WARNING, "Unable to install capabilities.\n"); |