From: Robin Jarry Date: Wed, 10 Aug 2016 14:52:54 +0000 (+0200) Subject: mem: use more restrictive permissions on hugepages X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=da5d107207910fc318862579e7b588481c72c668;p=dpdk.git mem: use more restrictive permissions on hugepages There is no need for the page files to be readable (and executable) by other users. This can be exploited by non-privileged users to access the working memory of a DPDK app. Open the files with 0600. Signed-off-by: Robin Jarry --- diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c index 992a1b142c..612626c6b6 100644 --- a/lib/librte_eal/linuxapp/eal/eal_memory.c +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c @@ -442,7 +442,7 @@ map_all_hugepages(struct hugepage_file *hugepg_tbl, #endif /* try to create hugepage file */ - fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0755); + fd = open(hugepg_tbl[i].filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(DEBUG, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); @@ -581,7 +581,7 @@ remap_all_hugepages(struct hugepage_file *hugepg_tbl, struct hugepage_info *hpi) hugepg_tbl[page_idx].file_id); /* try to create hugepage file */ - fd = open(filepath, O_CREAT | O_RDWR, 0755); + fd = open(filepath, O_CREAT | O_RDWR, 0600); if (fd < 0) { RTE_LOG(ERR, EAL, "%s(): open failed: %s\n", __func__, strerror(errno)); return -1;