From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f46.google.com (mail-wm0-f46.google.com [74.125.82.46]) by dpdk.org (Postfix) with ESMTP id CE3FF5908 for ; Wed, 10 Aug 2016 16:53:10 +0200 (CEST) Received: by mail-wm0-f46.google.com with SMTP id f65so95424448wmi.0 for ; Wed, 10 Aug 2016 07:53:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=NAb9JUWC/cDZJdI9HDmj2MGXm+AExwPmNEPu833Pe5I=; b=wZtKCJFds18B7E/RevpTi7fdYWvQ4060z8eDxXH7fWyRzN6rs7ijb6TLTHDQF6ttqS 6G8ZjdjPQLA7Pp6Z2H7CQO8bWVi5GPg2MVARbZfg60f3/NGjfkngoiF3r1RJtR77brQQ P7OGaHbH3IatjSXHEsg9pv07DFyeNWf8xXwonbVB2+ngRLsKHnOPmXI79Mh4XR4++9M7 yoMFgQrVtKLoJ2QCUMmzLiZX+tz+Pa8X3B/1+aZLL51ZxixQt6eK6jWMFHUUuP0bFewX 2/5yasN1VoOAuIUA3cFuBMHQqAXc17O4lQwg7Jvgc4GC+WQsboCVUIiUkbPXFX5i94F6 KzWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=NAb9JUWC/cDZJdI9HDmj2MGXm+AExwPmNEPu833Pe5I=; b=IaNPI8YRqlL89Xb5xMRIWumNuXt461tF9V9w8FVweqjmECMWSaAXg9/C3oCGbc9Afa dgBKDvLdD2DxbBXkj7TWQUUJQC9r8G/7kTzt93o9/aVltxvh6dqwXPb2zk2+/B4FQMoo Lkfb7uFEaWo6sYiG2oriJV+BYlysnmWw7T/D8RlpEQsFry2o5lDOrV/2MliGpimucg7e 8Qc9aPrP5C6HjIBreTvOHAS9uNE9j56BMYPnQUfIbdVSaEzr5DVRt4zCFqKLXMDxy8Al tSrvNFiwG7mzxCeWhc+Rn0VdPiJIziTf4XXU84Uv/RpKDj63yfZHuboug9C0yDhVfH4J KLNQ== X-Gm-Message-State: AEkoouu9qs77tC/aujF3N6guRt/DVj273dWOfJDNHYkHXEHypRcPUjBQXal1RLuNFdg6rzfq X-Received: by 10.194.144.33 with SMTP id sj1mr5457049wjb.150.1470840789162; Wed, 10 Aug 2016 07:53:09 -0700 (PDT) Received: from tom.dev.6wind.com (guy78-3-82-239-227-177.fbx.proxad.net. [82.239.227.177]) by smtp.gmail.com with ESMTPSA id d62sm8802673wmd.7.2016.08.10.07.53.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 10 Aug 2016 07:53:08 -0700 (PDT) From: Robin Jarry To: sergio.gonzalez.monroy@intel.com Cc: dev@dpdk.org Date: Wed, 10 Aug 2016 16:52:54 +0200 Message-Id: <1470840774-14793-1-git-send-email-robin.jarry@6wind.com> X-Mailer: git-send-email 2.1.4 Subject: [dpdk-dev] [PATCH] eal/linux: use more restrictive perms in hugedir X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Aug 2016 14:53:11 -0000 There is no need for the page files to be readable (and executable) by other users. This can be exploited by non-privileged users to access the working memory of a DPDK app. Open the files with 0600. Signed-off-by: Robin Jarry --- lib/librte_eal/linuxapp/eal/eal_memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c index 41e0a9288765..3eb72657085c 100644 --- a/lib/librte_eal/linuxapp/eal/eal_memory.c +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c @@ -442,7 +442,7 @@ map_all_hugepages(struct hugepage_file *hugepg_tbl, #endif /* try to create hugepage file */ - fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0755); + fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(DEBUG, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); @@ -581,7 +581,7 @@ remap_all_hugepages(struct hugepage_file *hugepg_tbl, struct hugepage_info *hpi) hugepg_tbl[page_idx].file_id); /* try to create hugepage file */ - fd = open(filepath, O_CREAT | O_RDWR, 0755); + fd = open(filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(ERR, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); return -1; -- 2.1.4