c++ - 如何创建对其他进程只读的共享内存映射？

Question

我有一个分叉 setuid 程序，其中父进程创建一个匿名的只读共享内存映射。但是没有特权的子进程可以简单的改变内存保护，改变内存！（见下面的例子）

我如何禁止这样做？匿名映射有可能吗，还是我需要 shm_open/shmget？

编译并运行g++ -Wall -Wextra test.cpp && sudo ./a.out

#include <iostream>
#include <unistd.h>
#include <sys/types.h>
#include <sys/mman.h>
using namespace std;

int main()
{
    size_t len = 4096;
    char* data = (char*)mmap(NULL, len, PROT_READ, MAP_ANONYMOUS|MAP_SHARED, -1, 0);
    volatile unsigned* shared_value = (unsigned*)data;
    if (fork() > 0) { // Parent process
        cout << "[Parent] uid=" << getuid() << endl;
        usleep(2000000);
        cout << "[Parent] value is " << *shared_value << endl;
        usleep(2000000);
        cout << "[Parent] value is " << *shared_value << endl;
    } else { // Child process
        usleep(1000000);
        cout << "[Child]  uid=" << getuid() << endl;
        if (setuid(1000) < 0) {
            perror("setuid");
        }
        cout << "[Child]  uid=" << getuid() << endl;
        if (mprotect(data, len, PROT_READ|PROT_WRITE) < 0) {
            perror("mprotect");
        }
        usleep(2000000);
        *shared_value = 456;
        cout << "[Child]  changed value" << endl;
    }
}

输出是：

[Parent] uid=0
[Child]  uid=0
[Child]  uid=1000
[Parent] value is 0
[Child]  changed value
[Parent] value is 456

标签： c++linuxshared-memorymmap