Firejailed programs check script

netpumber · 05-26-2016, 04:10 AM

Hello.

I'm using firejail to run some apps like Chromium for example.

What I want to do now is to write a script that in a specific interval of time will check for example if all chromium processes are running through firejail. If this is not the case then it will inform me with a notify-send command.

So I'm wondering how can I achieve something like this and any idea will be thankful.

HMW · 05-26-2016, 05:44 AM

Quote:

Originally Posted by netpumber

What I want to do now is to write a script that in a specific interval of time will check for example if all chromium processes are running through firejail. If this is not the case then it will inform me with a notify-send command.

So I'm wondering how can I achieve something like this and any idea will be thankful.

Not that I have ever used firejail, but yes, this should be doable.
If you want your script to run at certain times, I would personally use either cron or an eternal loop with a sleep statement in the script, cron would be my first choice.

Using notify-send in a script is no problem as long as you don't run the script as root. The latter can be done (I actually do that in one of my scripts on my Arch box) but it requires a bit of extra work. As a normal user, you just:

Code:

notify-send "Hello"

In your script, that's it.

Best regards,
HMW

netpumber · 05-27-2016, 06:42 AM

Thank you very much for your answer but i was wondering on the part of the script that will check if the chromium's process runs through firejail.

For example i tried to implement that part of the script by checking if the parent pid of the chromium belongs to firejail process but for some reason that didn't work.

HMW · 05-27-2016, 07:28 AM

Quote:

Originally Posted by netpumber

Thank you very much for your answer but i was wondering on the part of the script that will check if the chromium's process runs through firejail.

For example i tried to implement that part of the script by checking if the parent pid of the chromium belongs to firejail process but for some reason that didn't work.

I've never used firejail, but why don't you share the part of your script that doesn't work?

netpumber · 05-28-2016, 12:51 PM

Finally i fixed the problem with the script and now it can print out if the chromium is firejailed or not.

Here is the code :

Code:

#!/bin/bash

# Get chromium's first pid
pid=$(ps -A | grep -m1 chromium | awk '{ print $1 }')
# Get its parent pid
ppid=$(ps -o ppid= -p $pid)
# Get its parent process name
pname=$(ps -p $ppid -o comm=)

if [ "$pname" = "firejail" ]; then
    notify-send -u low "firejail-check" "Chromium is firejailed"
else
    notify-send -u critival "firejail-check" "Chromium isn't firejailed"
fi

I'm wondering now, if there is any way to run this script only when a chromium process is starting.

Any idea?

HMW · 05-28-2016, 01:22 PM

Great!

Just a hint, instead of doing

Code:

pid=$(ps -A | grep -m1 chromium | awk '{ print $1 }')

You can do

Code:

pid=$(pidof chromium)

Saves a couple of pipes, but your version works just as well.
Also, there is a slight error in your 2nd notify, you wrote "critival" instead or critical, so it might not work as expected.

As far as only running this when chromium starts you could use cron, I would!

Good work!
HMW

netpumber · 05-29-2016, 03:22 AM

Thank you very much for your notices

I also make some changes to the script and now ps returns a sorted list of chromium processes because i had a little problem with the previous version.

Here is the update :

Code:

 #!/bin/bash

# Get chromium's first pid
pid=$(ps -A --sort=start_time | grep -m1 chromium | awk '{ print $1 }')

if [ -n "$pid" ]; then

    # Get its parent pid
    ppid=$(ps -o ppid= -p $pid)
    # Get its parent process name
    pname=$(ps -p $ppid -o comm=)

    if [ "$pname" = "firejail" ]; then
        echo '<span foreground="#4285f4"></span>'
    else
        notify-send -u critical "firejail-check" "Chromium isn't firejailed"
        echo '<span foreground="#FF0000"> Chromium warning</span>'
    fi
fi

Actually I'm using i3 wm and i run it through i3blocks bar