9 files changed, 168 insertions, 6 deletions

diff --git a/README.md b/README.md
index 6f1c892aa..7edad942a 100644
--- a/README.md
+++ b/README.md
@@ -174,6 +174,15 @@ Check the status of the latest build here: https://travis-ci.org/netblue30/firej
               amd64, i386 and x32 system calls are blocked as well as  chang‐
               ing the execution domain with personality(2) system call.
 
+       --profile.print=name|pid
+              Print  the  name of the profile file for the sandbox identified
+              by name or or PID.
+
+              Example:
+              $ firejail --profile.print=browser
+              /etc/firejail/firefox.profile
+
+
 `````
 
 ## /etc/firejail/firejail.config
diff --git a/RELNOTES b/RELNOTES
index a54438411..43ec0a142 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -6,6 +6,7 @@ firejail (0.9.50~rc1) baseline; urgency=low
   * feature: private /lib directory (--private-lib)
   * feature: disable CDROM/DVD drive (--nodvd)
   * feature: disable DVB devices (--notv)
+  * feature: --profile.print
   * enhancement: print all seccomp filters under --debug
   * enhancement: /proc/sys mounting
   * enhancement: rework IP address assingment for --net options
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 60a43a600..75450fe0f 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -34,6 +34,7 @@
 #define RUN_FIREJAIL_X11_DIR    "/run/firejail/x11"
 #define RUN_FIREJAIL_NETWORK_DIR        "/run/firejail/network"
 #define RUN_FIREJAIL_BANDWIDTH_DIR      "/run/firejail/bandwidth"
+#define RUN_FIREJAIL_PROFILE_DIR                "/run/firejail/profile"
 #define RUN_NETWORK_LOCK_FILE   "/run/firejail/firejail.lock"
 #define RUN_RO_DIR      "/run/firejail/firejail.ro.dir"
 #define RUN_RO_FILE     "/run/firejail/firejail.ro.file"
@@ -410,6 +411,7 @@ void net_config_interface(const char *dev, uint32_t ip, uint32_t mask, int mtu);
 // preproc.c
 void preproc_build_firejail_dir(void);
 void preproc_mount_mnt_dir(void);
+void preproc_clean_run(void);
 
 // fs.c
 // blacklist files or directoies by mounting empty files on top of them
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 3f805a7e0..c317aa477 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -130,15 +130,22 @@ unsigned long long start_timestamp;
 
 static void set_name_file(pid_t pid);
 static void delete_name_file(pid_t pid);
+static void delete_profile_file(pid_t pid);
 static void delete_x11_file(pid_t pid);
 
 void clear_run_files(pid_t pid) {
         bandwidth_del_run_file(pid);            // bandwidth file
         network_del_run_file(pid);              // network map file
         delete_name_file(pid);
+        delete_profile_file(pid);
         delete_x11_file(pid);
 }
 
+static void clear_atexit(void) {
+        EUID_ROOT();
+        clear_run_files(getpid());
+}
+
 static void myexit(int rv) {
         logmsg("exiting...");
         if (!arg_command && !arg_quiet)
@@ -465,6 +472,26 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 exit(0);
         }
 #endif
+        else if (strncmp(argv[i], "--profile.print=", 16) == 0) {
+                pid_t pid = read_pid(argv[i] + 16);
+
+                // print /run/firejail/profile/<PID> file
+                char *fname;
+                if (asprintf(&fname, RUN_FIREJAIL_PROFILE_DIR "/%d", pid) == -1)
+                        errExit("asprintf");
+                FILE *fp = fopen(fname, "r");
+                if (!fp) {
+                        fprintf(stderr, "Error: sandbox %s not found\n", argv[i] + 16);
+                        exit(1);
+                }
+#define MAXBUF 4096
+                char buf[MAXBUF];
+                if (fgets(buf, MAXBUF, fp))
+                        printf("%s", buf);
+                fclose(fp);
+                exit(0);
+                
+        }
         else if (strncmp(argv[i], "--cpu.print=", 12) == 0) {
                 // join sandbox by pid or by name
                 pid_t pid = read_pid(argv[i] + 12);
@@ -738,6 +765,15 @@ static void delete_name_file(pid_t pid) {
         free(fname);
 }
 
+static void delete_profile_file(pid_t pid) {
+        char *fname;
+        if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_PROFILE_DIR, pid) == -1)
+                errExit("asprintf");
+        int rv = unlink(fname);
+        (void) rv;
+        free(fname);
+}
+
 void set_x11_file(pid_t pid, int display) {
         char *fname;
         if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_X11_DIR, pid) == -1)
@@ -825,12 +861,14 @@ int main(int argc, char **argv) {
         char *custom_profile_dir = NULL; // custom profile directory
 
 
+        atexit(clear_atexit);
+
         // get starting timestamp
         start_timestamp = getticks();
 
-
         // build /run/firejail directory structure
         preproc_build_firejail_dir();
+        preproc_clean_run();
 
         if (check_arg(argc, argv, "--quiet"))
                 arg_quiet = 1;
@@ -2554,14 +2592,10 @@ int main(int argc, char **argv) {
                 close(lockfd);
         }
 
-        // create name file under /run/firejail
-
-
         // handle CTRL-C in parent
         signal (SIGINT, my_handler);
         signal (SIGTERM, my_handler);
 
-
         // wait for the child to finish
         EUID_USER();
         int status = 0;
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index 0b447e03b..42502008e 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -20,6 +20,8 @@
 #include "firejail.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
+#include <sys/types.h>
+#include <dirent.h>
 
 static int tmpfs_mounted = 0;
 
@@ -48,6 +50,10 @@ void preproc_build_firejail_dir(void) {
                 create_empty_dir_as_root(RUN_FIREJAIL_NAME_DIR, 0755);
         }
 
+        if (stat(RUN_FIREJAIL_PROFILE_DIR, &s)) {
+                create_empty_dir_as_root(RUN_FIREJAIL_PROFILE_DIR, 0755);
+        }
+
         if (stat(RUN_FIREJAIL_X11_DIR, &s)) {
                 create_empty_dir_as_root(RUN_FIREJAIL_X11_DIR, 0755);
         }
@@ -98,3 +104,77 @@ void preproc_mount_mnt_dir(void) {
                         errExit("set_perms");
         }
 }
+
+// clean run directory
+void preproc_clean_run(void) {
+        int max_pids=32769;
+        int start_pid = 100;
+        // extract real max_pids
+        FILE *fp = fopen("/proc/sys/kernel/pid_max", "r");
+        if (fp) {
+                int val;
+                if (fscanf(fp, "%d", &val) == 1) {
+                        if (val >= max_pids)
+                                max_pids = val + 1;
+                }
+                fclose(fp);
+        }
+        int *pidarr = malloc(max_pids * sizeof(int));
+        if (!pidarr)
+                errExit("malloc");
+
+        memset(pidarr, 0, max_pids * sizeof(int));
+
+        // open /proc directory
+        DIR *dir;
+        if (!(dir = opendir("/proc"))) {
+                // sleep 2 seconds and try again
+                sleep(2);
+                if (!(dir = opendir("/proc"))) {
+                        fprintf(stderr, "Error: cannot open /proc directory\n");
+                        exit(1);
+                }
+        }
+
+        // read /proc and populate pidarr with all active processes
+        struct dirent *entry;
+        char *end;
+        while ((entry = readdir(dir)) != NULL) {
+                pid_t pid = strtol(entry->d_name, &end, 10);
+                pid %= max_pids;
+                if (end == entry->d_name || *end)
+                        continue;
+        
+                if (pid < start_pid)
+                        continue;
+                pidarr[pid] = 1;
+        }
+        closedir(dir);
+
+        // open /run/firejail/profile directory
+        if (!(dir = opendir(RUN_FIREJAIL_PROFILE_DIR))) {
+                // sleep 2 seconds and try again
+                sleep(2);
+                if (!(dir = opendir(RUN_FIREJAIL_PROFILE_DIR))) {
+                        fprintf(stderr, "Error: cannot open %s directory\n", RUN_FIREJAIL_PROFILE_DIR);
+                        exit(1);
+                }
+        }
+
+        // read /run/firejail/profile directory and clean leftover files
+        while ((entry = readdir(dir)) != NULL) {
+                pid_t pid = strtol(entry->d_name, &end, 10);
+                pid %= max_pids;
+                if (end == entry->d_name || *end)
+                        continue;
+        
+                if (pid < start_pid)
+                        continue;
+                if (pidarr[pid] == 0)
+                        clear_run_files(pid);
+        }
+        closedir(dir);
+
+        free(pidarr);
+}
+
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index fc390c83a..e61f59f46 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1193,6 +1193,29 @@ void profile_read(const char *fname) {
                 exit(1);
         }
 
+        // save the name of the file for --profile.print option
+        if (include_level == 0) {
+                char *runfile;
+                if (asprintf(&runfile, "%s/%d", RUN_FIREJAIL_PROFILE_DIR, getpid()) == -1)
+                        errExit("asprintf");
+
+                EUID_ROOT();
+                // the file is deleted first
+                FILE *fp = fopen(runfile, "w");
+                if (!fp) {
+                        fprintf(stderr, "Error: cannot create %s\n", runfile);
+                        exit(1);
+                }
+                fprintf(fp, "%s\n", fname);
+
+                // mode and ownership
+                SET_PERMS_STREAM(fp, 0, 0, 0644);
+                fclose(fp);
+                EUID_USER();
+                free(runfile);
+        }
+
+
         int msg_printed = 0;
 
         // read the file line by line
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 10e6ab687..fc7dbd69c 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -159,6 +159,7 @@ void usage(void) {
         printf("    --private-tmp - mount a tmpfs on top of /tmp directory.\n");
         printf("    --private-opt=file,directory - build a new /opt in a temporary filesystem.\n");
         printf("    --profile=filename - use a custom profile.\n");
+        printf("    --profile.print=name|pid - print the name of profile file.\n");
         printf("    --profile-path=directory - use this directory to look for profile files.\n");
         printf("    --protocol=protocol,protocol,protocol - enable protocol filter.\n");
         printf("    --protocol.print=name|pid - print the protocol filter.\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 9ae5d6782..a70f662fd 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1424,6 +1424,19 @@ Example:
 $ firejail \-\-profile=myprofile
 
 .TP
+\fB\-\-profile.print=name|pid
+Print the name of the profile file for the sandbox identified by name or or PID.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-profile.print=browser
+.br
+/etc/firejail/firefox.profile
+.br
+
+.TP
 \fB\-\-profile-path=directory
 Use this directory to look for profile files. Use an absolute path or a path in the home directory starting with ~/.
 For more information, see \fBSECURITY PROFILES\fR section below and \fBRELOCATING PROFILE FILES\fR in
diff --git a/test/profiles/test-profile.exp b/test/profiles/test-profile.exp
index 6bc47f33f..63fb3a150 100755
--- a/test/profiles/test-profile.exp
+++ b/test/profiles/test-profile.exp
@@ -18,6 +18,5 @@ expect {
         timeout {puts "TESTING ERROR 0\n";exit}
         "done"
 }
-send -- "exit\r"
 after 100
 puts "\n"