Make shared memory segments writable only by their rightful owners.

content/browser/renderer_host/backing_store_gtk.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/backing_store_gtk.h"
 
 #include <cairo-xlib.h>
 #include <gtk/gtk.h>
 #include <stdlib.h>
 #include <sys/ipc.h>
@@ skipping 501 matching lines @@
       return false;
     }
     // Create the shared memory segment for the image and map it.
     if (image->bytes_per_line == 0 || image->height == 0 ||
         static_cast<size_t>(image->height) >
         (std::numeric_limits<size_t>::max() / image->bytes_per_line)) {
       XDestroyImage(image);
       return false;
     }
     shminfo.shmid = shmget(IPC_PRIVATE, image->bytes_per_line * image->height,
-                           IPC_CREAT|0666);
+                           IPC_CREAT|0600);
     if (shminfo.shmid == -1) {
       XDestroyImage(image);
+      LOG(WARNING) << "Failed to get shared memory segment. "

[Daniel Erat, 2012/09/13 22:04:39]

How frequently can this be logged?

[palmer, 2012/09/24 16:26:11]

This one, once. Some of the other logging statements happen more often, but I'd
like to leave them for now in case we do hit upon a real-life case where
XShmAttach fails during the canary/dev bug shake-out.

+                      "Performance may be degraded.";
       return false;
+    } else {
+      VLOG(1) << "Got shared memory segment " << shminfo.shmid;
     }
 
     void* mapped_memory = shmat(shminfo.shmid, NULL, SHM_RDONLY);
     shmctl(shminfo.shmid, IPC_RMID, 0);
     if (mapped_memory == (void*)-1) {
       XDestroyImage(image);
       return false;
     }
     shminfo.shmaddr = image->data = static_cast<char*>(mapped_memory);
 
     if (!XShmAttach(display_, &shminfo) ||
         !XShmGetImage(display_, pixmap_, image, rect.x(), rect.y(),
                       AllPlanes)) {
       DestroySharedImage(display_, image, &shminfo);
+      LOG(WARNING) << "X failed to get shared memory segment. "
+                      "Performance may be degraded.";
       return false;
     }
+
+    VLOG(1) << "Using X shared memory segment " << shminfo.shmid;
   } else {
+    LOG(WARNING) << "Not using X shared memory.";
     // Non-shared memory case just copy the image from the server.
     image = XGetImage(display_, pixmap_,
                       rect.x(), rect.y(), width, height,
                       AllPlanes, ZPixmap);
   }
 
   // TODO(jhawkins): Need to convert the image data if the image bits per pixel
   // is not 32.
   // Note that this also initializes the output bitmap as opaque.
   if (!output->initialize(width, height, true) ||
@@ skipping 106 matching lines @@
 
   cairo_identity_matrix(cr);
 
   cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
   cairo_fill(cr);
   cairo_destroy(cr);
 }
 #endif
 
 }  // namespace content