From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robin Jarry Subject: [PATCH] eal/linux: use more restrictive perms in hugedir Date: Wed, 10 Aug 2016 16:52:54 +0200 Message-ID: <1470840774-14793-1-git-send-email-robin.jarry@6wind.com> Cc: dev@dpdk.org To: sergio.gonzalez.monroy@intel.com Return-path: Received: from mail-wm0-f46.google.com (mail-wm0-f46.google.com [74.125.82.46]) by dpdk.org (Postfix) with ESMTP id CE3FF5908 for ; Wed, 10 Aug 2016 16:53:10 +0200 (CEST) Received: by mail-wm0-f46.google.com with SMTP id f65so95424448wmi.0 for ; Wed, 10 Aug 2016 07:53:10 -0700 (PDT) List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" There is no need for the page files to be readable (and executable) by other users. This can be exploited by non-privileged users to access the working memory of a DPDK app. Open the files with 0600. Signed-off-by: Robin Jarry --- lib/librte_eal/linuxapp/eal/eal_memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c index 41e0a9288765..3eb72657085c 100644 --- a/lib/librte_eal/linuxapp/eal/eal_memory.c +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c @@ -442,7 +442,7 @@ map_all_hugepages(struct hugepage_file *hugepg_tbl, #endif /* try to create hugepage file */ - fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0755); + fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(DEBUG, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); @@ -581,7 +581,7 @@ remap_all_hugepages(struct hugepage_file *hugepg_tbl, struct hugepage_info *hpi) hugepg_tbl[page_idx].file_id); /* try to create hugepage file */ - fd = open(filepath, O_CREAT | O_RDWR, 0755); + fd = open(filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(ERR, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); return -1; -- 2.1.4