Change shared memory ownership and permission
We know that we can use ipcs to view shared memory segment information,we can use ipcrm to delete a segment.
But wait. Assume that you first run a program as root user, which creates a shared memory segment of 40GB size. Then you realize that for security resaon, we should use as less privilege as possible, so you decide to run it as the nobody user. However, because the segment was created with perm 0600, the nobody user can’t access it. You definitely don’t want to dump the whole memory and recreate a new segment and recover. It would be nice if we can simply change the ownership and permission of the segment.
So I created the tool called chshm for this purpose,
But wait. Assume that you first run a program as root user, which creates a shared memory segment of 40GB size. Then you realize that for security resaon, we should use as less privilege as possible, so you decide to run it as the nobody user. However, because the segment was created with perm 0600, the nobody user can’t access it. You definitely don’t want to dump the whole memory and recreate a new segment and recover. It would be nice if we can simply change the ownership and permission of the segment.
So I created the tool called chshm for this purpose,
Usage: ./chshm [Options] shmid ... Options: -u|--user change owner to -g|--group change group to -m|--mode change mode to in octal eg: ./chshm -u nobody -m 0660 65535 This will change shm id 65535's owner to nobody, mode to 0660
Comments
Post a Comment