[Core, mod_commands] Interface allowlist

[andywolk]

Add an interface allowlist to control which module apps/APIs load

Motivation

FreeSWITCH's system, bg_system, spawn, and bgsystem commands execute arbitrary shell/binaries, and they're reachable from every API dispatch surface — the event socket,
XML-RPC, the fsapi/execute JSON gateways, scripting languages, and the dialplan. On a hardened or multi-tenant deployment that's a large, awkward-to-close attack surface,
and disabling it piecemeal (per module, per transport) is error-prone.

This adds a single, global mechanism to declare exactly which module interfaces a FreeSWITCH instance is allowed to expose. Anything not on the list is never registered,
so it cannot be dispatched from any surface.

What it does

A new optional section in switch.conf.xml gates the registration of application, api, json_api, and chat_application interfaces for every module,
enforced centrally in switch_loadable_module_process() (so it applies at boot and to runtime load).

• Presence-activated, allow-only. With no (or an empty one), nothing is enforced and everything loads as before — fully backward compatible. As soon
  as one entry exists, enforcement is on and anything not listed is refused.
• Load-time, not runtime. A refused interface is simply never inserted into the dispatch hashes. The owning module still loads normally and
  switch_loadable_module_process() still returns success — the interface just isn't exposed. This is more airtight than a per-call deny (the function pointer never enters
  the hash) and has no partial-init side effects, since the check runs after the module's load function has already returned.
• Three levels of precision — an interface is permitted if it matches any entry:
  • mod_commands — every interface in the module
  • mod_commands.system — any interface named system (all types)
  • mod_commands.system.api — only that interface type named system (types: app, api, json_api, chat_app)

This lets you, for example, permit the dialplan system app while still blocking the system API.

Companion API for building the config

interface_allowlist_dump [modules] [plain] (mod_commands) walks the loaded modules and prints their interfaces in the allowlist key format, so you can capture the current
state and prune it offline:

• default: XML <allow .../> entries, one fully-qualified module.name.type per interface, wrapped in
• modules: one per module
• plain: raw keys, no XML wrapper (for scripting)

The dump reflects module capabilities (everything a module registered), independent of what enforcement blocked — that's what makes it a useful starting point. Intended
workflow: boot with no allowlist → run the dump → delete the entries you want blocked → paste into switch.conf.xml → restart.

Example

Lock the box down to a known set, minus the shell-exec commands:

...

The vanilla switch.conf.xml ships the section commented out with documentation and a WARNING that enabling it is aggressive and system-wide (you must list every
module/interface you rely on, including management commands and dialplan apps).
Scope / limitations

This gates interface registration only, so it covers the system/spawn APIs, the system/bgsystem dialplan apps, and any other module command. It intentionally does not
touch:

• codecs, endpoints, timers, formats, and dialplan-parser interfaces (gating those would break media/routing, not restrict command surface);
• shell-exec paths that aren't interface registrations — , native scripting exec (os.execute, etc.), the mod_v8 system() global, and the raw
  system() spool-move in switch_core_file.c. Those need separate mitigation (e.g. gating the switch_system/switch_spawn core primitives).

Testing

New test_interface_allowlist FST test (in mod_commands/test, with its own conf_interface_allowlist/) boots the core with an active allowlist, loads mod_commands, and
verifies:

• listed commands register and run (status, version) while unlisted / shell-exec commands are refused (system, spawn, uptime) — refusal surfaces as switch_api_execute()
  returning FALSE with the command function never invoked;
• a module.name.type entry gates by type — the status API loads while the status JSON API stays blocked;
• interface_allowlist_dump produces the expected xml / modules / plain output.