From 7526e567cd80ceec483ce3546f6fe9897e6ffd48 Mon Sep 17 00:00:00 2001
From: netblue30 <netblue30@yahoo.com>
Date: Wed, 6 Apr 2016 20:40:45 -0400
Subject: --cpu.print

---
 src/firejail/cpu.c      | 78 +++++++++++++++++++++++++++++++++++++++++++++++++
 src/firejail/firejail.h |  2 ++
 src/firejail/main.c     | 10 +++++++
 src/firejail/usage.c    |  2 ++
 src/man/firejail.txt    | 28 ++++++++++++++++++
 test/cpu-print.exp      | 21 +++++++++++++
 test/test.sh            |  4 +++
 7 files changed, 145 insertions(+)
 create mode 100755 test/cpu-print.exp

diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index 23906ae48..1802ad5e1 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -139,3 +139,81 @@ void set_cpu_affinity(void) {
         			printf("CPU affinity not set\n");
         	}
 }
+
+static void print_cpu(int pid) {
+	char *file;
+	if (asprintf(&file, "/proc/%d/status", pid) == -1) {
+		errExit("asprintf");
+		exit(1);
+	}
+
+	EUID_ROOT();	// grsecurity
+	FILE *fp = fopen(file, "r");
+	EUID_USER();	// grsecurity
+	if (!fp) {
+		printf("  Error: cannot open %s\n", file);
+		free(file);
+		return;
+	}
+
+#define MAXBUF 4096	
+	char buf[MAXBUF];
+	while (fgets(buf, MAXBUF, fp)) {
+		if (strncmp(buf, "Cpus_allowed_list:", 18) == 0) {
+			printf("  %s", buf);
+			fflush(0);
+			free(file);
+			fclose(fp);
+			return;
+		}
+	}
+	fclose(fp);
+	free(file);
+}
+
+void cpu_print_filter_name(const char *name) {
+	EUID_ASSERT();
+	if (!name || strlen(name) == 0) {
+		fprintf(stderr, "Error: invalid sandbox name\n");
+		exit(1);
+	}
+	pid_t pid;
+	if (name2pid(name, &pid)) {
+		fprintf(stderr, "Error: cannot find sandbox %s\n", name);
+		exit(1);
+	}
+
+	cpu_print_filter(pid);
+}
+
+void cpu_print_filter(pid_t pid) {
+	EUID_ASSERT();
+	
+	// if the pid is that of a firejail  process, use the pid of the first child process
+	EUID_ROOT();	// grsecurity
+	char *comm = pid_proc_comm(pid);
+	EUID_USER();	// grsecurity
+	if (comm) {
+		if (strcmp(comm, "firejail") == 0) {
+			pid_t child;
+			if (find_child(pid, &child) == 0) {
+				pid = child;
+			}
+		}
+		free(comm);
+	}
+
+	// check privileges for non-root users
+	uid_t uid = getuid();
+	if (uid != 0) {
+		uid_t sandbox_uid = pid_get_uid(pid);
+		if (uid != sandbox_uid) {
+			fprintf(stderr, "Error: permission denied.\n");
+			exit(1);
+		}
+	}
+
+	print_cpu(pid);
+	exit(0);
+}
+
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index e50b22b4e..f43f31f02 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -438,6 +438,8 @@ void read_cpu_list(const char *str);
 void set_cpu_affinity(void);
 void load_cpu(const char *fname);
 void save_cpu(void);
+void cpu_print_filter_name(const char *name);
+void cpu_print_filter(pid_t pid);
 
 // cgroup.c
 void save_cgroup(void);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9df4653cd..c9954d8c7 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -437,6 +437,15 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
 		exit(0);
 	}
 #endif
+	else if (strncmp(argv[i], "--cpu.print=", 12) == 0) {
+		// join sandbox by pid or by name
+		pid_t pid;
+		if (read_pid(argv[i] + 12, &pid) == 0)		
+			cpu_print_filter(pid);
+		else
+			cpu_print_filter_name(argv[i] + 12);
+		exit(0);
+	}
 	else if (strncmp(argv[i], "--caps.print=", 13) == 0) {
 		// join sandbox by pid or by name
 		pid_t pid;
@@ -726,6 +735,7 @@ int main(int argc, char **argv) {
 			    strncmp(argv[i], "--dns.print=", 12) == 0 ||
 			    strncmp(argv[i], "--bandwidth=", 12) == 0 ||
 			    strncmp(argv[i], "--caps.print=", 13) == 0 ||
+			    strncmp(argv[i], "--cpu.print=", 12) == 0 ||
 //********************************************************************************
 // todo: fix the following problems
 			    strncmp(argv[i], "--join=", 7) == 0 ||
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 597005128..3e4a0d1c3 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -56,6 +56,8 @@ void usage(void) {
 	printf("    --chroot=dirname - chroot into directory.\n\n");
 #endif
 	printf("    --cpu=cpu-number,cpu-number - set cpu affinity.\n\n");
+	printf("    --cpu.print=name|pid - print the cup in use by the sandbox identified\n");
+	printf("\tby name or PID.\n\n");
 	printf("    --csh - use /bin/csh as default shell.\n\n");
 	
 	printf("    --debug - print sandbox debug messages.\n\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 509461f0d..54d2b1e73 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -220,6 +220,34 @@ Example:
 .br
 $ firejail \-\-cpu=0,1 handbrake
 
+.TP
+\fB\-\-cpu.print=name
+Print the CPU cores in use by the sandbox identified by name.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-name=mygame \-\-caps.drop=all warzone2100 &
+.br
+[...]
+.br
+$ firejail \-\-cpu.print=mygame
+
+.TP
+\fB\-\-caps.print=pid
+Print the CPU cores in use by the sandbox identified by PID.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-list
+.br
+3272:netblue:firejail \-\-private firefox
+.br
+$ firejail \-\-cpu.print=3272
+
 .TP
 \fB\-\-csh
 Use /bin/csh as default user shell.
diff --git a/test/cpu-print.exp b/test/cpu-print.exp
new file mode 100755
index 000000000..d8e3fbb04
--- /dev/null
+++ b/test/cpu-print.exp
@@ -0,0 +1,21 @@
+#!/usr/bin/expect -f
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --name=test --cpu=1,2\r"
+expect {
+	timeout {puts "TESTING ERROR 0\n";exit}
+	"Child process initialized"
+}
+sleep 2
+
+spawn $env(SHELL)
+send -- "firejail --cpu.print=test\r"
+expect {
+	timeout {puts "TESTING ERROR 1\n";exit}
+	"Cpus_allowed_list:	1-2"
+}
+sleep 1
+puts "\nall done\n"
diff --git a/test/test.sh b/test/test.sh
index ca2108bc5..96ef8f423 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -6,6 +6,10 @@
 
 ./fscheck.sh
 
+echo "TESTING: cpu.print (cpu-print.exp)"
+echo "TESTING:    failing under VirtualBox where there is only one CPU"
+./cpu-print.exp
+
 echo "TESTING: bandwidth (bandwidth.exp)"
 ./bandwidth.exp
 
-- 
cgit v1.2.3-54-g00ecf