1 files changed, 19 insertions, 15 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index c262402fa..2a8ee3e0f 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -733,26 +733,30 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
         else if (strncmp(argv[i], "--join-or-start=", 16) == 0) {
                 // NOTE: this is first part of option handler,
                 //               sandbox name is set in other part
-                logargs(argc, argv);
+                if (checkcfg(CFG_JOIN) || getuid() == 0) {
+                        logargs(argc, argv);
 
-                if (arg_shell_none) {
-                        if (argc <= (i+1)) {
-                                fprintf(stderr, "Error: --shell=none set, but no command specified\n");
-                                exit(1);
+                        if (arg_shell_none) {
+                                if (argc <= (i+1)) {
+                                        fprintf(stderr, "Error: --shell=none set, but no command specified\n");
+                                        exit(1);
+                                }
+                                cfg.original_program_index = i + 1;
                         }
-                        cfg.original_program_index = i + 1;
-                }
 
-                // try to join by name only
-                pid_t pid;
-                if (!read_pid(argv[i] + 16, &pid)) {
-                        if (!cfg.shell && !arg_shell_none)
-                                cfg.shell = guess_shell();
+                        // try to join by name only
+                        pid_t pid;
+                        if (!read_pid(argv[i] + 16, &pid)) {
+                                if (!cfg.shell && !arg_shell_none)
+                                        cfg.shell = guess_shell();
 
-                        join(pid, argc, argv, i + 1);
-                        exit(0);
+                                join(pid, argc, argv, i + 1);
+                                exit(0);
+                        }
+                        // if there no such sandbox continue argument processing
                 }
-                // if there no such sandbox continue argument processing
+                else
+                        exit_err_feature("join");
         }
 #ifdef HAVE_NETWORK
         else if (strncmp(argv[i], "--join-network=", 15) == 0) {