From 16c75df7976003305f57885639cbc4df4a6a12cf Mon Sep 17 00:00:00 2001 From: Dave Barach Date: Tue, 31 May 2016 14:05:46 -0400 Subject: VPP-83 Allow non-privileged clients to use the vpp binary API. Use the command line argument "api-segment { uid gid }" to configure shared memory segment file ownership. Defaults to uid = gid = 0. Shared-memory segments are explicitly set to 0770 mode, aka "rwxrwx---". Change-Id: Ic5d596b68139add61e7de6ace035c57dfd030111 Signed-off-by: Dave Barach --- svm/svm.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) (limited to 'svm/svm.c') diff --git a/svm/svm.c b/svm/svm.c index 62f317aa..b50aa820 100644 --- a/svm/svm.c +++ b/svm/svm.c @@ -391,6 +391,11 @@ void *svm_map_region (svm_map_region_args_t *a) svm_fd = shm_open((char *) shm_name, O_RDWR | O_CREAT | O_EXCL, 0777); if (svm_fd >= 0) { + if (fchmod (svm_fd, 0770) < 0) + clib_unix_warning ("segment chmod"); + /* This turns out to fail harmlessly if the client starts first */ + if (fchown (svm_fd, a->uid, a->gid) < 0) + clib_unix_warning ("segment chown [ok if client starts first]"); vec_free(shm_name); @@ -615,18 +620,19 @@ static void svm_mutex_cleanup (void) } } -static void svm_region_init_internal (char *root_path) +static void svm_region_init_internal (char *root_path, int uid, int gid) { svm_region_t *rp; - svm_map_region_args_t *a=0; + svm_map_region_args_t _a, *a=&_a; u64 ticks = clib_cpu_time_now(); uword randomize_baseva; /* guard against klutz calls */ - root_rp_refcount++; if (root_rp) return; + root_rp_refcount++; + atexit(svm_mutex_cleanup); /* Randomize the shared-VM base at init time */ @@ -635,12 +641,14 @@ static void svm_region_init_internal (char *root_path) else randomize_baseva = (ticks & 3) * MMAP_PAGESIZE; - vec_validate(a,0); + memset (a, 0, sizeof (*a)); a->root_path = root_path; a->name = SVM_GLOBAL_REGION_NAME; a->baseva = SVM_GLOBAL_REGION_BASEVA + randomize_baseva; a->size = SVM_GLOBAL_REGION_SIZE; a->flags = SVM_FLAGS_NODATA; + a->uid = uid; + a->gid = gid; rp = svm_map_region (a); ASSERT(rp); @@ -663,18 +671,22 @@ static void svm_region_init_internal (char *root_path) svm_pop_heap (oldheap); } region_unlock(rp); - vec_free (a); root_rp = rp; } void svm_region_init (void) { - svm_region_init_internal (0); + svm_region_init_internal (0, 0 /* uid */, 0 /* gid */); } void svm_region_init_chroot (char *root_path) { - svm_region_init_internal (root_path); + svm_region_init_internal (root_path, 0 /* uid */, 0 /* gid */); +} + +void svm_region_init_chroot_uid_gid (char *root_path, int uid, int gid) +{ + svm_region_init_internal (root_path, uid, gid); } void *svm_region_find_or_create (svm_map_region_args_t *a) -- cgit 1.2.3-korg