From da5d107207910fc318862579e7b588481c72c668 Mon Sep 17 00:00:00 2001 From: Robin Jarry Date: Wed, 10 Aug 2016 16:52:54 +0200 Subject: [PATCH] mem: use more restrictive permissions on hugepages There is no need for the page files to be readable (and executable) by other users. This can be exploited by non-privileged users to access the working memory of a DPDK app. Open the files with 0600. Signed-off-by: Robin Jarry --- lib/librte_eal/linuxapp/eal/eal_memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c index 992a1b142c..612626c6b6 100644 --- a/lib/librte_eal/linuxapp/eal/eal_memory.c +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c @@ -442,7 +442,7 @@ map_all_hugepages(struct hugepage_file *hugepg_tbl, #endif /* try to create hugepage file */ - fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0755); + fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(DEBUG, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); @@ -581,7 +581,7 @@ remap_all_hugepages(struct hugepage_file *hugepg_tbl, struct hugepage_info *hpi) hugepg_tbl[page_idx].file_id); /* try to create hugepage file */ - fd = open(filepath, O_CREAT | O_RDWR, 0755); + fd = open(filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(ERR, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); return -1; -- 2.20.1