--oom (#5122)

4 files changed, 22 insertions, 4 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index de11b438d..38408b534 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -922,4 +922,7 @@ void selinux_relabel_path(const char *path, const char *inside_path);
 // ids.c
 void run_ids(int argc, char **argv);
 
+// oom.c
+void oom_set(const char *oom_string);
+
 #endif
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 1d90b9fc5..1bcec667e 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1031,10 +1031,6 @@ int main(int argc, char **argv, char **envp) {
 
         // sanity check for arguments
         for (i = 0; i < argc; i++) {
-//              if (*argv[i] == 0) { // see #4395 - bug reported by Debian
-//                      fprintf(stderr, "Error: too short arguments: argv[%d] is empty\n", i);
-//                      exit(1);
-//              }
                 if (strlen(argv[i]) >= MAX_ARG_LEN) {
                         fprintf(stderr, "Error: too long arguments: argv[%d] len (%zu) >= MAX_ARG_LEN (%d)\n", i, strlen(argv[i]), MAX_ARG_LEN);
                         exit(1);
@@ -1280,6 +1276,10 @@ int main(int argc, char **argv, char **envp) {
         if (checkcfg(CFG_FORCE_NONEWPRIVS))
                 arg_nonewprivs = 1;
 
+        // check oom
+        if ((i = check_arg(argc, argv, "--oom=", 0)) != 0)
+                oom_set(argv[i] + 6);
+
         // parse arguments
         for (i = 1; i < argc; i++) {
                 run_cmd_and_exit(i, argc, argv); // will exit if the command is recognized
@@ -2719,6 +2719,9 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--appimage") == 0) {
                         // already handled
                 }
+                else if (strncmp(argv[i], "--oom=", 6) == 0) {
+                        // already handled
+                }
                 else if (strcmp(argv[i], "--shell=none") == 0) {
                         arg_shell_none = 1;
                         if (cfg.shell) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 2dd913b5e..7a545982b 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -173,6 +173,7 @@ static char *usage_str =
         "    --novideo - disable video devices.\n"
         "    --nou2f - disable U2F devices.\n"
         "    --nowhitelist=filename - disable whitelist for file or directory.\n"
+        "    --oom=value - configure OutOfMemory killer for the sandbox\n"
 #ifdef HAVE_OUTPUT
         "    --output=logfile - stdout logging and log rotation.\n"
         "    --output-stderr=logfile - stdout and stderr logging and log rotation.\n"
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index cf80ab25c..366a4e061 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1783,6 +1783,17 @@ Disable video devices.
 \fB\-\-nowhitelist=dirname_or_filename
 Disable whitelist for this directory or file.
 
+.TP
+\fB\-\-oom=value
+Configure kernel's OutOfMemory-killer score for this sandbox. The acceptable score values are between 0 and 1000
+for regular users, and -1000 to 1000 for root. For more information on OOM kernel feature see \fBman choom\fR.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-oom=300 firefox
+
 #ifdef HAVE_OUTPUT
 .TP
 \fB\-\-output=logfile