Posix: fix named SHM mappings permissions.

base/memory/shared_memory_posix.cc

Index: base/memory/shared_memory_posix.cc
diff --git a/base/memory/shared_memory_posix.cc b/base/memory/shared_memory_posix.cc
index 66f58487ab3ecc31bcc754706497ebbc4891fec5..0e3fb808b1dee9b5007817f66f276570fc9cf9b6 100644
--- a/base/memory/shared_memory_posix.cc
+++ b/base/memory/shared_memory_posix.cc
@@ -6,8 +6,11 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <fcntl.h>
 #include <sys/mman.h>
 #include <sys/stat.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include "base/file_util.h"
@@ -149,12 +152,22 @@ bool SharedMemory::Create(const SharedMemoryCreateOptions& options) {
     if (!FilePathForMemoryName(*options.name, &path))
       return false;
 
-    fp = file_util::OpenFile(path, "w+x");
-    if (fp == NULL && options.open_existing) {
-      // "w+" will truncate if it already exists.
-      fp = file_util::OpenFile(path, "a+");
+    // Make sure that we don't give permissions to access this file
+    // to other users on the system.
+    const mode_t file_mode = S_IRUSR | S_IWUSR;
+    int fd;
+    // First, try to create the file.
+    fd = open(path.value().c_str(), O_RDWR | O_CREAT | O_EXCL, file_mode);
+    if (fd == -1 && options.open_existing) {
+      // If this doesn't work, try again in append mode.
+      fd = open(path.value().c_str(), O_RDWR | O_APPEND, file_mode);

[Markus (顧孟勤), 2013/06/26 12:28:22]

Do not pass in file_mode. That's just misleading your reviewers.

The mode is ignored by open() unless you also set O_CREAT.

Having said that, now might be a good time to call fstat() to verify that the
permissions are set the way we would like them to be set. You might even want to
check the owner, if you are paranoid.

Otherwise, there is a race condition where somebody other than the owner could
create a world-writable file and trick you into using it for your shared memory.

[jln (very slow on Chromium), 2013/07/02 02:37:06]

Done.

       fix_size = false;
     }
+    fp = NULL;
+    if (fd >= 0) {
+      // "a+" is always appropriate: if it's a new file, a+ is similar to w+.
+      fp = fdopen(fd, "a+");
+    }
   }
   if (fp && fix_size) {
     // Get current size.