Make shared memory segments writable only by their rightful owners.

content/browser/renderer_host/backing_store_gtk.cc

Index: content/browser/renderer_host/backing_store_gtk.cc
===================================================================
--- content/browser/renderer_host/backing_store_gtk.cc	(revision 155390)
+++ content/browser/renderer_host/backing_store_gtk.cc	(working copy)
@@ -519,10 +519,14 @@
       return false;
     }
     shminfo.shmid = shmget(IPC_PRIVATE, image->bytes_per_line * image->height,
-                           IPC_CREAT|0666);
+                           IPC_CREAT|0600);
     if (shminfo.shmid == -1) {
       XDestroyImage(image);
+      LOG(WARNING) << "Failed to get shared memory segment. "

[Daniel Erat, 2012/09/13 22:04:39]

How frequently can this be logged?

[palmer, 2012/09/24 16:26:11]

This one, once. Some of the other logging statements happen more often, but I'd
like to leave them for now in case we do hit upon a real-life case where
XShmAttach fails during the canary/dev bug shake-out.

+                      "Performance may be degraded.";
       return false;
+    } else {
+      VLOG(1) << "Got shared memory segment " << shminfo.shmid;
     }
 
     void* mapped_memory = shmat(shminfo.shmid, NULL, SHM_RDONLY);
@@ -537,9 +541,14 @@
         !XShmGetImage(display_, pixmap_, image, rect.x(), rect.y(),
                       AllPlanes)) {
       DestroySharedImage(display_, image, &shminfo);
+      LOG(WARNING) << "X failed to get shared memory segment. "
+                      "Performance may be degraded.";
       return false;
     }
+
+    VLOG(1) << "Using X shared memory segment " << shminfo.shmid;
   } else {
+    LOG(WARNING) << "Not using X shared memory.";
     // Non-shared memory case just copy the image from the server.
     image = XGetImage(display_, pixmap_,
                       rect.x(), rect.y(), width, height,