fix --bandwidth, --cpu.print

2 files changed, 12 insertions, 9 deletions

diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index d7764682a..d0487d49a 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -338,6 +338,16 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
                 exit(1);
         }
 
+        // check privileges for non-root users
+        uid_t uid = getuid();
+        if (uid != 0) {
+                uid_t sandbox_uid = pid_get_uid(pid);
+                if (uid != sandbox_uid) {
+                        fprintf(stderr, "Error: permission is denied to join a sandbox created by a different user.\n");
+                        exit(1);
+                }
+        }
+
         EUID_ROOT();
         if (join_namespace(child, "net")) {
                 fprintf(stderr, "Error: cannot join the network namespace\n");
diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index a92562e67..e2517ddd7 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -162,6 +162,7 @@ static void print_cpu(int pid) {
         free(file);
 }
 
+// allow any user to run --cpu.print
 void cpu_print_filter(pid_t pid) {
         EUID_ASSERT();
 
@@ -174,15 +175,7 @@ void cpu_print_filter(pid_t pid) {
                 exit(1);
         }
 
-        // check privileges for non-root users
-        uid_t uid = getuid();
-        if (uid != 0) {
-                uid_t sandbox_uid = pid_get_uid(pid);
-                if (uid != sandbox_uid) {
-                        fprintf(stderr, "Error: permission denied.\n");
-                        exit(1);
-                }
-        }
+
 
         print_cpu(pid);
         exit(0);