--cpu.print

5 files changed, 120 insertions, 0 deletions

diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index 23906ae48..1802ad5e1 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -139,3 +139,81 @@ void set_cpu_affinity(void) {
                                 printf("CPU affinity not set\n");
                 }
 }
+
+static void print_cpu(int pid) {
+        char *file;
+        if (asprintf(&file, "/proc/%d/status", pid) == -1) {
+                errExit("asprintf");
+                exit(1);
+        }
+
+        EUID_ROOT();    // grsecurity
+        FILE *fp = fopen(file, "r");
+        EUID_USER();    // grsecurity
+        if (!fp) {
+                printf("  Error: cannot open %s\n", file);
+                free(file);
+                return;
+        }
+
+#define MAXBUF 4096     
+        char buf[MAXBUF];
+        while (fgets(buf, MAXBUF, fp)) {
+                if (strncmp(buf, "Cpus_allowed_list:", 18) == 0) {
+                        printf("  %s", buf);
+                        fflush(0);
+                        free(file);
+                        fclose(fp);
+                        return;
+                }
+        }
+        fclose(fp);
+        free(file);
+}
+
+void cpu_print_filter_name(const char *name) {
+        EUID_ASSERT();
+        if (!name || strlen(name) == 0) {
+                fprintf(stderr, "Error: invalid sandbox name\n");
+                exit(1);
+        }
+        pid_t pid;
+        if (name2pid(name, &pid)) {
+                fprintf(stderr, "Error: cannot find sandbox %s\n", name);
+                exit(1);
+        }
+
+        cpu_print_filter(pid);
+}
+
+void cpu_print_filter(pid_t pid) {
+        EUID_ASSERT();
+        
+        // if the pid is that of a firejail  process, use the pid of the first child process
+        EUID_ROOT();    // grsecurity
+        char *comm = pid_proc_comm(pid);
+        EUID_USER();    // grsecurity
+        if (comm) {
+                if (strcmp(comm, "firejail") == 0) {
+                        pid_t child;
+                        if (find_child(pid, &child) == 0) {
+                                pid = child;
+                        }
+                }
+                free(comm);
+        }
+
+        // check privileges for non-root users
+        uid_t uid = getuid();
+        if (uid != 0) {
+                uid_t sandbox_uid = pid_get_uid(pid);
+                if (uid != sandbox_uid) {
+                        fprintf(stderr, "Error: permission denied.\n");
+                        exit(1);
+                }
+        }
+
+        print_cpu(pid);
+        exit(0);
+}
+
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index e50b22b4e..f43f31f02 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -438,6 +438,8 @@ void read_cpu_list(const char *str);
 void set_cpu_affinity(void);
 void load_cpu(const char *fname);
 void save_cpu(void);
+void cpu_print_filter_name(const char *name);
+void cpu_print_filter(pid_t pid);
 
 // cgroup.c
 void save_cgroup(void);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9df4653cd..c9954d8c7 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -437,6 +437,15 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 exit(0);
         }
 #endif
+        else if (strncmp(argv[i], "--cpu.print=", 12) == 0) {
+                // join sandbox by pid or by name
+                pid_t pid;
+                if (read_pid(argv[i] + 12, &pid) == 0)          
+                        cpu_print_filter(pid);
+                else
+                        cpu_print_filter_name(argv[i] + 12);
+                exit(0);
+        }
         else if (strncmp(argv[i], "--caps.print=", 13) == 0) {
                 // join sandbox by pid or by name
                 pid_t pid;
@@ -726,6 +735,7 @@ int main(int argc, char **argv) {
                             strncmp(argv[i], "--dns.print=", 12) == 0 ||
                             strncmp(argv[i], "--bandwidth=", 12) == 0 ||
                             strncmp(argv[i], "--caps.print=", 13) == 0 ||
+                            strncmp(argv[i], "--cpu.print=", 12) == 0 ||
 //********************************************************************************
 // todo: fix the following problems
                             strncmp(argv[i], "--join=", 7) == 0 ||
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 597005128..3e4a0d1c3 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -56,6 +56,8 @@ void usage(void) {
         printf("    --chroot=dirname - chroot into directory.\n\n");
 #endif
         printf("    --cpu=cpu-number,cpu-number - set cpu affinity.\n\n");
+        printf("    --cpu.print=name|pid - print the cup in use by the sandbox identified\n");
+        printf("\tby name or PID.\n\n");
         printf("    --csh - use /bin/csh as default shell.\n\n");
         
         printf("    --debug - print sandbox debug messages.\n\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 509461f0d..54d2b1e73 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -221,6 +221,34 @@ Example:
 $ firejail \-\-cpu=0,1 handbrake
 
 .TP
+\fB\-\-cpu.print=name
+Print the CPU cores in use by the sandbox identified by name.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
+.br
+[...]
+.br
+$ firejail \-\-cpu.print=mygame
+
+.TP
+\fB\-\-caps.print=pid
+Print the CPU cores in use by the sandbox identified by PID.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-list
+.br
+3272:netblue:firejail \-\-private firefox
+.br
+$ firejail \-\-cpu.print=3272
+
+.TP
 \fB\-\-csh
 Use /bin/csh as default user shell.
 .br