summaryrefslogtreecommitdiff
path: root/linux
diff options
context:
space:
mode:
authorCédric Schieli <cschieli@gmail.com>2017-03-18 11:33:49 +0100
committerCédric Schieli <cschieli@gmail.com>2017-03-18 14:27:34 +0100
commit5d89eba8c7d2010100e372a286ff24fb0aadba6a (patch)
tree7d709fe1ff420bd54d32b11feeab2632566fbc69 /linux
parentbb7faafd1c8a9189881895269291d36e6a0e5193 (diff)
downloadjack2-5d89eba8c7d2010100e372a286ff24fb0aadba6a.tar.gz
Secure promiscuous mode for linux futexes
Adjusts the permissions of linux futexes when promiscuous mode is enabled.
Diffstat (limited to 'linux')
-rw-r--r--linux/JackLinuxFutex.cpp17
-rw-r--r--linux/JackLinuxFutex.h5
2 files changed, 19 insertions, 3 deletions
diff --git a/linux/JackLinuxFutex.cpp b/linux/JackLinuxFutex.cpp
index 6e897bc8..b724f191 100644
--- a/linux/JackLinuxFutex.cpp
+++ b/linux/JackLinuxFutex.cpp
@@ -22,6 +22,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
#include "JackTools.h"
#include "JackConstants.h"
#include "JackError.h"
+#include "promiscuous.h"
#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>
@@ -31,11 +32,18 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
namespace Jack
{
+JackLinuxFutex::JackLinuxFutex() : JackSynchro(), fSharedMem(-1), fFutex(NULL), fPrivate(false)
+{
+ const char* promiscuous = getenv("JACK_PROMISCUOUS_SERVER");
+ fPromiscuous = (promiscuous != NULL);
+ fPromiscuousGid = jack_group2gid(promiscuous);
+}
+
void JackLinuxFutex::BuildName(const char* client_name, const char* server_name, char* res, int size)
{
char ext_client_name[SYNC_MAX_NAME_SIZE + 1];
JackTools::RewriteName(client_name, ext_client_name);
- if (getenv("JACK_PROMISCUOUS_SERVER")) {
+ if (fPromiscuous) {
snprintf(res, size, "jack_sem.%s_%s", server_name, ext_client_name);
} else {
snprintf(res, size, "jack_sem.%d_%s_%s", JackTools::GetUID(), server_name, ext_client_name);
@@ -132,6 +140,13 @@ bool JackLinuxFutex::Allocate(const char* name, const char* server_name, int val
ftruncate(fSharedMem, sizeof(FutexData));
+ if (fPromiscuous && (jack_promiscuous_perms(fSharedMem, fName, fPromiscuousGid) < 0)) {
+ close(fSharedMem);
+ fSharedMem = -1;
+ shm_unlink(fName);
+ return false;
+ }
+
if ((fFutex = (FutexData*)mmap(NULL, sizeof(FutexData), PROT_READ|PROT_WRITE, MAP_SHARED|MAP_LOCKED, fSharedMem, 0)) == NULL) {
jack_error("Allocate: can't check in named futex name = %s err = %s", fName, strerror(errno));
close(fSharedMem);
diff --git a/linux/JackLinuxFutex.h b/linux/JackLinuxFutex.h
index 5c8a7006..559f1e63 100644
--- a/linux/JackLinuxFutex.h
+++ b/linux/JackLinuxFutex.h
@@ -53,6 +53,8 @@ class SERVER_EXPORT JackLinuxFutex : public detail::JackSynchro
int fSharedMem;
FutexData* fFutex;
bool fPrivate;
+ bool fPromiscuous;
+ int fPromiscuousGid;
protected:
@@ -60,8 +62,7 @@ class SERVER_EXPORT JackLinuxFutex : public detail::JackSynchro
public:
- JackLinuxFutex():JackSynchro(), fSharedMem(-1), fFutex(NULL), fPrivate(false)
- {}
+ JackLinuxFutex();
bool Signal();
bool SignalAll();