Make shared memory segments writable only by their rightful owners.

ui/surface/transport_dib_linux.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/surface/transport_dib.h"
 
 #include <errno.h>
 #include <stdlib.h>
 #include <sys/ipc.h>
 #include <sys/shm.h>
@@ skipping 21 matching lines @@
   }
 
   if (x_shm_) {
     DCHECK(display_);
     ui::DetachSharedMemory(display_, x_shm_);
   }
 }
 
 // static
 TransportDIB* TransportDIB::Create(size_t size, uint32 sequence_num) {
-  // We use a mode of 0666 since the X server won't attach to memory which is
-  // 0600 since it can't know if it (as a root process) is being asked to map
-  // someone else's private shared memory region.
-  const int shmkey = shmget(IPC_PRIVATE, size, 0666);
+  const int shmkey = shmget(IPC_PRIVATE, size, 0600);
   if (shmkey == -1) {
     DLOG(ERROR) << "Failed to create SysV shared memory region"
                 << " errno:" << errno;
     return NULL;
+  } else {
+    VLOG(1) << "Created SysV shared memory region " << shmkey;
   }
 
   void* address = shmat(shmkey, NULL /* desired address */, 0 /* flags */);
   // Here we mark the shared memory for deletion. Since we attached it in the
   // line above, it doesn't actually get deleted but, if we crash, this means
   // that the kernel will automatically clean it up for us.
   shmctl(shmkey, IPC_RMID, 0);
   if (address == kInvalidAddress)
     return NULL;
 
@@ skipping 72 matching lines @@
 }
 
 XID TransportDIB::MapToX(Display* display) {
   if (!x_shm_) {
     x_shm_ = ui::AttachSharedMemory(display, key_.shmkey);
     display_ = display;
   }
 
   return x_shm_;
 }