|
 |
50440f |
From 95064291fe13d4ed98e195946d931fe779f8a48f Mon Sep 17 00:00:00 2001
|
|
|
50440f |
From: Joy Latten <jmlatten@linux.vnet.ibm.com>
|
|
|
50440f |
Date: Fri, 17 Jan 2014 10:33:19 -0600
|
|
|
50440f |
Subject: [PATCH] Problem: A regular user in pkcs11 group cannot issue pkcsconf
|
|
|
50440f |
-t. When shm_open() creates shared memory object, it honors umask of the
|
|
|
50440f |
caller. This patch ensures the shared memory has expected permissions when it
|
|
|
50440f |
is created.
|
|
|
50440f |
MIME-Version: 1.0
|
|
|
50440f |
Content-Type: text/plain; charset=UTF-8
|
|
|
50440f |
Content-Transfer-Encoding: 8bit
|
|
|
50440f |
|
|
|
50440f |
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
|
|
|
50440f |
Signed-off-by: Dan Horák <dan@danny.cz>
|
|
|
50440f |
---
|
|
|
50440f |
usr/lib/pkcs11/common/shared_memory.c | 27 ++++++++++++++++++++++-----
|
|
|
50440f |
1 file changed, 22 insertions(+), 5 deletions(-)
|
|
|
50440f |
|
|
|
50440f |
diff --git a/usr/lib/pkcs11/common/shared_memory.c b/usr/lib/pkcs11/common/shared_memory.c
|
|
|
50440f |
index a8710c5..bf0411d 100644
|
|
|
50440f |
--- a/usr/lib/pkcs11/common/shared_memory.c
|
|
|
50440f |
+++ b/usr/lib/pkcs11/common/shared_memory.c
|
|
|
50440f |
@@ -161,12 +161,29 @@ sm_open(const char *sm_name, int mode, void **p_addr, size_t len, int force)
|
|
|
50440f |
goto done;
|
|
|
50440f |
}
|
|
|
50440f |
|
|
|
50440f |
- fd = shm_open(name, O_RDWR | O_CREAT, mode);
|
|
|
50440f |
+ /* try and open first... */
|
|
|
50440f |
+ fd = shm_open(name, O_RDWR, mode);
|
|
|
50440f |
if (fd < 0) {
|
|
|
50440f |
- rc = -errno;
|
|
|
50440f |
- SYS_ERROR(errno, "Failed to open shared memory \"%s\".\n",
|
|
|
50440f |
- name);
|
|
|
50440f |
- goto done;
|
|
|
50440f |
+ /* maybe it needs to be created ... */
|
|
|
50440f |
+ fd = shm_open(name, O_RDWR | O_CREAT, mode);
|
|
|
50440f |
+ if (fd < 0) {
|
|
|
50440f |
+ rc = -errno;
|
|
|
50440f |
+ SYS_ERROR(errno,
|
|
|
50440f |
+ "Failed to open shared memory \"%s\".\n",
|
|
|
50440f |
+ name);
|
|
|
50440f |
+ goto done;
|
|
|
50440f |
+ } else {
|
|
|
50440f |
+ /* umask may have altered permissions if we created
|
|
|
50440f |
+ * the shared memory in above call, so set proper
|
|
|
50440f |
+ * permissions just in case.
|
|
|
50440f |
+ */
|
|
|
50440f |
+ if (fchmod(fd, mode) == -1) {
|
|
|
50440f |
+ rc = -errno;
|
|
|
50440f |
+ SYS_ERROR(errno, "fchmod(%s): %s\n",
|
|
|
50440f |
+ name, strerror(errno));
|
|
|
50440f |
+ goto done;
|
|
|
50440f |
+ }
|
|
|
50440f |
+ }
|
|
|
50440f |
}
|
|
|
50440f |
|
|
|
50440f |
/*
|
|
|
50440f |
--
|
|
|
50440f |
1.8.1.4
|
|
|
50440f |
|