我可以在两个进程之间保护内存吗

Question

I have mmaped shared memory (backed by /dev/shm) between two processes.

7ffff7ff3000-7ffff7ff7000 rw-s 00000000 00:16 176796                     /dev/shm/shdmem

One process is doing mprotect for first page of the memory and see proper configuration

7ffff7ff3000-7ffff7ff4000 ---s 00000000 00:16 176796                     /dev/shm/shdmem
7ffff7ff4000-7ffff7ff7000 rw-s 00001000 00:16 176796                     /dev/shm/shdmem

But second one still see only rw region:

7ffff7ff3000-7ffff7ff7000 rw-s 00000000 00:16 176796                     /dev/shm/shdmem

is it correct Linux behaviour? I was thinking that if I share the same memory region I can protect my memory against usage of different processes? (Of course process B can easily modify shared memory but process A which issued mprotect will get segfault)

Answer 1

Think about what happens when you do an mmap (an operating system neutral description).

The operating system has to create a shared memory region in which physical memory is mapped to some file (this could be the page files and on some systems user specified file).

To map the region to the first process, it's page tables must be altered to map some range of the process logical address space to the physical memory page frames used by the shared region (which may change over time). Those tables may be set to read, read/write, etc. depending up on how the region is created and how the mapping is done. In your case, you apparently made the region read/write.

A second process comes alone and maps to the shared region. It's process page tables are mapped to the the physical page frames. Again, it the protection in the mapping is set to how the region is created and how the the region is mapped. (generally you can map a read/write region as read only but cannot map a read only region as read/write).

Your first process has done mprotect to change some of the pages in the region to no access. You have not changed the protection on the region. You have only changed the protection settings in the page tables of the first process.

Apparently you are expecting the modification of the page tables in the first process to be reflected in other processes that map the region. That is not going to happen. An operating system is not going to allow page level modifications in one process to be propagated to another process. That would create all kinds of security holes.

The protection of the region is generally set by the protection of the file backing the region. That protection applies to the entire region.