6 files changed, 31 insertions, 11 deletions

diff --git a/RELNOTES b/RELNOTES
index ccdff8dc8..02bceb2be 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,5 +1,6 @@
 firejail (0.9.59) baseline; urgency=low
   * work in progress
+  * enable/disable cgroup in firejail.config
  -- netblue30 <netblue30@yahoo.com>  Sun, 27 Jan 2019 08:00:00 -0500
 
 firejail (0.9.58) baseline; urgency=low
diff --git a/etc/firejail.config b/etc/firejail.config
index 00f2c1b5d..fc13451fb 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -18,6 +18,9 @@
 # Enable or disable bind support, default enabled.
 # bind yes
 
+# Enable or disable cgroup support, default enabled.
+# cgroup yes
+
 # Enable or disable chroot support, default enabled.
 # chroot yes
 
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 45e28fe40..6a9d017b7 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -130,6 +130,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // cgroup
+                        else if (strncmp(ptr, "cgroup ", 5) == 0) {
+                                if (strcmp(ptr + 5, "yes") == 0)
+                                        cfg_val[CFG_CGROUP] = 1;
+                                else if (strcmp(ptr + 5, "no") == 0)
+                                        cfg_val[CFG_CGROUP] = 0;
+                                else
+                                        goto errout;
+                        }
                         // user namespace
                         else if (strncmp(ptr, "userns ", 7) == 0) {
                                 if (strcmp(ptr + 7, "yes") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 03ad25f75..b861bf1fa 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -272,7 +272,6 @@ typedef struct config_t {
         int nice;
         char *cgroup;
 
-
         // command line
         char *command_line;
         char *window_title;
@@ -781,6 +780,7 @@ enum {
         CFG_APPARMOR,
         CFG_DBUS,
         CFG_PRIVATE_CACHE,
+        CFG_CGROUP,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 61f507f36..c262402fa 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1286,16 +1286,20 @@ int main(int argc, char **argv) {
                         arg_nice = 1;
                 }
                 else if (strncmp(argv[i], "--cgroup=", 9) == 0) {
-                        if (option_cgroup) {
-                                fprintf(stderr, "Error: only a cgroup can be defined\n");
-                                exit(1);
-                        }
+                        if (checkcfg(CFG_CGROUP)) {
+                                if (option_cgroup) {
+                                        fprintf(stderr, "Error: only a cgroup can be defined\n");
+                                        exit(1);
+                                }
 
-                        option_cgroup = 1;
-                        cfg.cgroup = strdup(argv[i] + 9);
-                        if (!cfg.cgroup)
-                                errExit("strdup");
-                        set_cgroup(cfg.cgroup);
+                                option_cgroup = 1;
+                                cfg.cgroup = strdup(argv[i] + 9);
+                                if (!cfg.cgroup)
+                                        errExit("strdup");
+                                set_cgroup(cfg.cgroup);
+                        }
+                        else
+                                exit_err_feature("cgroup");
                 }
 
                 //*************************************
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 83caef199..348b4e0ca 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -878,7 +878,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // cgroup
         if (strncmp(ptr, "cgroup ", 7) == 0) {
-                set_cgroup(ptr + 7);
+                if (checkcfg(CFG_CGROUP))
+                        set_cgroup(ptr + 7);
+                else
+                        warning_feature_disabled("cgroup");
                 return 0;
         }