Detection and control of unauthorized reading of shared memory

Question

I was wondering - are there any known methods for controlling access to an object with shared memory from anywhere except an authorized program?

For example, you could say that I am creating a shared memory segment for use in the program P accessed by Q, and I am doing it Read-Write. I can access it using Q, because I gave him (Q) the necessary permissions for this (works as a specific user with groups, etc.).

However, I assume that there are times when someone can potentially access this shared memory from program R - just connect to it and change it. To stop this, you can make the memory segment read-only, but now the R program can still read what was in memory.

My question in parts is

• Is there any way

  a) allow only Q to access shared memory?

  b) indicate whether it was read by someone other than Q, and who did it? [Is this possible?] For bonus points, can this be made cross-platform? [Probably not, but not trying any harm :)]

• Under what circumstances can a fraud program connect to shared memory? I assume that one way is that the user can use the holes in the OS and become the user who launched the program. Any others?

Answer 1

POSIX , . ipcs, :

$ ipcs -m
IPC status from <running system> as of Tue Jul 14 23:21:25 BST 2009
T     ID     KEY        MODE       OWNER    GROUP
Shared Memory:
m  65536 0x07021999 --rw-r--r--     root    wheel
m  65537 0x60022006 --rw-r--r--     root    wheel

1a) UNIX, / . shmctl:

struct ipc_perm perms;
perms.uid = 100;
perms.giu = 200;
perms.mode = 0660; // Allow read/write only by 
                   // uid '100' or members of group '200'
shmctl(shmid, IPC_SET, &perms);

1b), , - .

, , / shm root, - . - * ix; , , .