Make shared memory segments writable only by their rightful owners.

ui/base/x/x11_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file defines utility functions for X11 (Linux only). This code has been
 // ported from XCB since we can't use XCB on Ubuntu while its 32-bit support
 // remains woefully incomplete.
 
 #include "ui/base/x/x11_util.h"
 
 #include <ctype.h>
 #include <sys/ipc.h>
 #include <sys/shm.h>
 
 #include <list>
 #include <map>
+#include <utility>
 #include <vector>
 
 #include <X11/extensions/Xrandr.h>
 #include <X11/extensions/randr.h>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/singleton.h"
@@ skipping 132 matching lines @@
                                               flags & ui::EF_SHIFT_DOWN);
   // Tests assume the keycode for XK_less is equal to the one of XK_comma,
   // but XKeysymToKeycode returns 94 for XK_less while it returns 59 for
   // XK_comma. Here we convert the value for XK_less to the value for XK_comma.
   return (keysym == XK_less) ? 59 : XKeysymToKeycode(display, keysym);
 }
 
 // A process wide singleton that manages the usage of X cursors.
 class XCursorCache {
  public:
-   XCursorCache() {}
+  XCursorCache() {}
   ~XCursorCache() {
     Clear();
   }
 
   ::Cursor GetCursor(int cursor_shape) {
     // Lookup cursor by attempting to insert a null value, which avoids
     // a second pass through the map after a cache miss.
     std::pair<std::map<int, ::Cursor>::iterator, bool> it = cache_.insert(
         std::make_pair(cursor_shape, 0));
     if (it.second) {
@@ skipping 165 matching lines @@
   int allow_removed;
   size_t length = sizeof(allow_removed);
 
   if ((sysctlbyname("kern.ipc.shm_allow_removed", &allow_removed, &length,
       NULL, 0) < 0) || allow_removed < 1) {
     return SHARED_MEMORY_NONE;
   }
 #endif
 
   // Next we probe to see if shared memory will really work
-  int shmkey = shmget(IPC_PRIVATE, 1, 0666);
-  if (shmkey == -1)
+  int shmkey = shmget(IPC_PRIVATE, 1, 0600);
+  if (shmkey == -1) {
+    LOG(WARNING) << "Failed to get shared memory segment.";
     return SHARED_MEMORY_NONE;
+  } else {
+    VLOG(1) << "Got shared memory segment " << shmkey;
+  }
+
   void* address = shmat(shmkey, NULL, 0);
   // Mark the shared memory region for deletion
   shmctl(shmkey, IPC_RMID, NULL);
 
   XShmSegmentInfo shminfo;
   memset(&shminfo, 0, sizeof(shminfo));
   shminfo.shmid = shmkey;
 
   gdk_error_trap_push();
   bool result = XShmAttach(dpy, &shminfo);
+  if (result)
+    VLOG(1) << "X got shared memory segment " << shmkey;
+  else
+    LOG(WARNING) << "X failed to attach to shared memory segment " << shmkey;
   XSync(dpy, False);
   if (gdk_error_trap_pop())
     result = false;
   shmdt(address);
-  if (!result)
+  if (!result) {
+    LOG(WARNING) << "X failed to attach to shared memory segment " << shmkey;
     return SHARED_MEMORY_NONE;
+  }
+
+  VLOG(1) << "X attached to shared memory segment " << shmkey;
 
   XShmDetach(dpy, &shminfo);
   return pixmaps_supported ? SHARED_MEMORY_PIXMAP : SHARED_MEMORY_PUTIMAGE;
 }
 
 SharedMemorySupport QuerySharedMemorySupport(Display* dpy) {
   static SharedMemorySupport shared_memory_support = SHARED_MEMORY_NONE;
   static bool shared_memory_support_cached = false;
 
   if (shared_memory_support_cached)
@@ skipping 465 matching lines @@
 XSharedMemoryId AttachSharedMemory(Display* display, int shared_memory_key) {
   DCHECK(QuerySharedMemorySupport(display));
 
   XShmSegmentInfo shminfo;
   memset(&shminfo, 0, sizeof(shminfo));
   shminfo.shmid = shared_memory_key;
 
   // This function is only called if QuerySharedMemorySupport returned true. In
   // which case we've already succeeded in having the X server attach to one of
   // our shared memory segments.
-  if (!XShmAttach(display, &shminfo))
+  if (!XShmAttach(display, &shminfo)) {
+    LOG(WARNING) << "X failed to attach to shared memory segment "
+                 << shminfo.shmid;
     NOTREACHED();
+  } else {
+    VLOG(1) << "X attached to shared memory segment " << shminfo.shmid;
+  }
 
   return shminfo.shmseg;
 }
 
 void DetachSharedMemory(Display* display, XSharedMemoryId shmseg) {
   DCHECK(QuerySharedMemorySupport(display));
 
   XShmSegmentInfo shminfo;
   memset(&shminfo, 0, sizeof(shminfo));
   shminfo.shmseg = shmseg;
@@ skipping 573 matching lines @@
             "%s.%d", ext_list[i], error_event.minor_code);
         XGetErrorDatabaseText(
             dpy, "XRequest", msg.c_str(), "Unknown", request_str,
             sizeof(request_str));
         break;
       }
     }
     XFreeExtensionList(ext_list);
   }
 
-  LOG(ERROR) 
+  LOG(ERROR)
       << "X Error detected: "
       << "serial " << error_event.serial << ", "
       << "error_code " << static_cast<int>(error_event.error_code)
       << " (" << error_str << "), "
       << "request_code " << static_cast<int>(error_event.request_code) << ", "
       << "minor_code " << static_cast<int>(error_event.minor_code)
       << " (" << request_str << ")";
 }
 
 // ----------------------------------------------------------------------------
 // End of x11_util_internal.h
 
 
 }  // namespace ui