[dpdk-stable] [17.11] eal: tighten permissions on shared memory files

[dpdk-stable] [17.11] eal: tighten permissions on shared memory files

[Bruce Richardson]

When creating files on disk, e.g. for EAL configuration or shared memory
locks, etc., there is no need to grant any permissions on those files to
other users. All directories are already created with 0700 permissions, so
we should create all files with 0600 permissions.

Cc: stable@dpdk.org

Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
---
 lib/librte_eal/bsdapp/eal/eal.c               | 2 +-
 lib/librte_eal/bsdapp/eal/eal_hugepage_info.c | 2 +-
 lib/librte_eal/linuxapp/eal/eal.c             | 2 +-
 lib/librte_eal/linuxapp/eal/eal_memory.c      | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/librte_eal/bsdapp/eal/eal.c b/lib/librte_eal/bsdapp/eal/eal.c
index 369a682a8..f5d8a77f6 100644
--- a/lib/librte_eal/bsdapp/eal/eal.c
+++ b/lib/librte_eal/bsdapp/eal/eal.c
@@ -180,7 +180,7 @@ rte_eal_config_create(void)
 		return;
 
 	if (mem_cfg_fd < 0){
-		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0660);
+		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0600);
 		if (mem_cfg_fd < 0)
 			rte_panic("Cannot open '%s' for rte_mem_config\n", pathname);
 	}
diff --git a/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c b/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c
index 8a33c30c5..80b221071 100644
--- a/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c
+++ b/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c
@@ -51,7 +51,7 @@ static void *
 create_shared_memory(const char *filename, const size_t mem_size)
 {
 	void *retval;
-	int fd = open(filename, O_CREAT | O_RDWR, 0666);
+	int fd = open(filename, O_CREAT | O_RDWR, 0600);
 	if (fd < 0)
 		return NULL;
 	if (ftruncate(fd, mem_size) < 0) {
diff --git a/lib/librte_eal/linuxapp/eal/eal.c b/lib/librte_eal/linuxapp/eal/eal.c
index e6a733138..c6308a1ca 100644
--- a/lib/librte_eal/linuxapp/eal/eal.c
+++ b/lib/librte_eal/linuxapp/eal/eal.c
@@ -198,7 +198,7 @@ rte_eal_config_create(void)
 		rte_mem_cfg_addr = NULL;
 
 	if (mem_cfg_fd < 0){
-		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0660);
+		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0600);
 		if (mem_cfg_fd < 0)
 			rte_panic("Cannot open '%s' for rte_mem_config\n", pathname);
 	}
diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c
index f1938ecfc..f3635373b 100644
--- a/lib/librte_eal/linuxapp/eal/eal_memory.c
+++ b/lib/librte_eal/linuxapp/eal/eal_memory.c
@@ -740,7 +740,7 @@ static void *
 create_shared_memory(const char *filename, const size_t mem_size)
 {
 	void *retval;
-	int fd = open(filename, O_CREAT | O_RDWR, 0666);
+	int fd = open(filename, O_CREAT | O_RDWR, 0600);
 	if (fd < 0)
 		return NULL;
 	if (ftruncate(fd, mem_size) < 0) {
-- 
2.21.0

Re: [dpdk-stable] [17.11] eal: tighten permissions on shared memory files

[Yongseok Koh]

> On Jul 23, 2019, at 3:54 AM, Bruce Richardson <bruce.richardson@intel.com> wrote:
> 
> When creating files on disk, e.g. for EAL configuration or shared memory
> locks, etc., there is no need to grant any permissions on those files to
> other users. All directories are already created with 0700 permissions, so
> we should create all files with 0600 permissions.
> 
> Cc: stable@dpdk.org
> 
> Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
> ---

Applied to stable/17.11.

Bruce, did you receive my email requesting backport and then send this backport?
I can't see the mail I sent, either in my mailbox or community archive.
Looks it is being blocked or missing.
I'll have to send it out again...


Thanks,
Yongseok

> lib/librte_eal/bsdapp/eal/eal.c               | 2 +-
> lib/librte_eal/bsdapp/eal/eal_hugepage_info.c | 2 +-
> lib/librte_eal/linuxapp/eal/eal.c             | 2 +-
> lib/librte_eal/linuxapp/eal/eal_memory.c      | 2 +-
> 4 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/lib/librte_eal/bsdapp/eal/eal.c b/lib/librte_eal/bsdapp/eal/eal.c
> index 369a682a8..f5d8a77f6 100644
> --- a/lib/librte_eal/bsdapp/eal/eal.c
> +++ b/lib/librte_eal/bsdapp/eal/eal.c
> @@ -180,7 +180,7 @@ rte_eal_config_create(void)
> 		return;
> 
> 	if (mem_cfg_fd < 0){
> -		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0660);
> +		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0600);
> 		if (mem_cfg_fd < 0)
> 			rte_panic("Cannot open '%s' for rte_mem_config\n", pathname);
> 	}
> diff --git a/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c b/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c
> index 8a33c30c5..80b221071 100644
> --- a/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c
> +++ b/lib/librte_eal/bsdapp/eal/eal_hugepage_info.c
> @@ -51,7 +51,7 @@ static void *
> create_shared_memory(const char *filename, const size_t mem_size)
> {
> 	void *retval;
> -	int fd = open(filename, O_CREAT | O_RDWR, 0666);
> +	int fd = open(filename, O_CREAT | O_RDWR, 0600);
> 	if (fd < 0)
> 		return NULL;
> 	if (ftruncate(fd, mem_size) < 0) {
> diff --git a/lib/librte_eal/linuxapp/eal/eal.c b/lib/librte_eal/linuxapp/eal/eal.c
> index e6a733138..c6308a1ca 100644
> --- a/lib/librte_eal/linuxapp/eal/eal.c
> +++ b/lib/librte_eal/linuxapp/eal/eal.c
> @@ -198,7 +198,7 @@ rte_eal_config_create(void)
> 		rte_mem_cfg_addr = NULL;
> 
> 	if (mem_cfg_fd < 0){
> -		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0660);
> +		mem_cfg_fd = open(pathname, O_RDWR | O_CREAT, 0600);
> 		if (mem_cfg_fd < 0)
> 			rte_panic("Cannot open '%s' for rte_mem_config\n", pathname);
> 	}
> diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c
> index f1938ecfc..f3635373b 100644
> --- a/lib/librte_eal/linuxapp/eal/eal_memory.c
> +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c
> @@ -740,7 +740,7 @@ static void *
> create_shared_memory(const char *filename, const size_t mem_size)
> {
> 	void *retval;
> -	int fd = open(filename, O_CREAT | O_RDWR, 0666);
> +	int fd = open(filename, O_CREAT | O_RDWR, 0600);
> 	if (fd < 0)
> 		return NULL;
> 	if (ftruncate(fd, mem_size) < 0) {
> -- 
> 2.21.0
>