]> git.ipfire.org Git - thirdparty/asterisk.git/commit
security: Inhibit execution of privilege escalating functions
authorDavid M. Lee <dlee@digium.com>
Mon, 16 Dec 2013 18:31:27 +0000 (18:31 +0000)
committerDavid M. Lee <dlee@digium.com>
Mon, 16 Dec 2013 18:31:27 +0000 (18:31 +0000)
commit66ee458f07834dda981674ec64b7ddeb5c3003e0
tree80e10accf78caddac36a9e5886c7f8260a4ba2eb
parent3a3c7d088bc491318089a9994b9a2940e5b4aea1
security: Inhibit execution of privilege escalating functions

This patch allows individual dialplan functions to be marked as
'dangerous', to inhibit their execution from external sources.

A 'dangerous' function is one which results in a privilege escalation.
For example, if one were to read the channel variable SHELL(rm -rf /)
Bad Things(TM) could happen; even if the external source has only read
permissions.

Execution from external sources may be enabled by setting
'live_dangerously' to 'yes' in the [options] section of asterisk.conf.
Although doing so is not recommended.

Also, the ABI was changed to something more reasonable, since Asterisk
12 does not yet have a public release.

(closes issue ASTERISK-22905)
Review: http://reviewboard.digium.internal/r/432/
........

Merged revisions 403913 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 403917 from http://svn.asterisk.org/svn/asterisk/branches/11

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@403959 65c4cc65-6c06-0410-ace0-fbb531ad65f3
12 files changed:
README-SERIOUSLY.bestpractices.txt
UPGRADE.txt
configs/asterisk.conf.sample
funcs/func_db.c
funcs/func_env.c
funcs/func_lock.c
funcs/func_realtime.c
funcs/func_shell.c
include/asterisk/pbx.h
main/asterisk.c
main/pbx.c
main/tcptls.c