feature test

8 files changed, 578 insertions, 0 deletions

diff --git a/test/features/1.1.exp b/test/features/1.1.exp
new file mode 100755
index 000000000..41443a080
--- /dev/null
+++ b/test/features/1.1.exp
@@ -0,0 +1,69 @@
+#!/usr/bin/expect -f
+#
+# new /boot
+#
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+#
+# N
+#
+send -- "firejail --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /boot | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "1"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+#
+# O
+#
+send -- "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /boot | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "1"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+#
+# C
+#
+send -- "firejail --noprofile --chroot=/tmp/chroot\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /boot | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "1"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+puts "\nall done\n"
diff --git a/test/features/1.2.exp b/test/features/1.2.exp
new file mode 100755
index 000000000..399e9948b
--- /dev/null
+++ b/test/features/1.2.exp
@@ -0,0 +1,141 @@
+#!/usr/bin/expect -f
+#
+# new /proc
+#
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+#
+# N
+#
+send -- "firejail --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "cat /proc/mounts | grep proc\r"
+expect {
+        timeout {puts "TESTING ERROR 1.1\n";exit}
+        "proc /proc proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.2\n";exit}
+        "proc /proc proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.3\n";exit}
+        "proc /proc/sys proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.4\n";exit}
+        "proc /proc/sysrq-trigger proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.5\n";exit}
+        "proc /proc/sys/kernel/hotplug"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.6\n";exit}
+        "proc /proc/irq proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.7\n";exit}
+        "proc /proc/bus proc"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+#
+# O
+#
+send -- "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "cat /proc/mounts | grep proc\r"
+expect {
+        timeout {puts "TESTING ERROR 3.1\n";exit}
+        "proc /proc proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.2\n";exit}
+        "proc /proc proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.3\n";exit}
+        "proc /proc/sys proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.4\n";exit}
+        "proc /proc/sysrq-trigger proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.5\n";exit}
+        "proc /proc/sys/kernel/hotplug"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.6\n";exit}
+        "proc /proc/irq proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.7\n";exit}
+        "proc /proc/bus proc"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+#
+# C
+#
+send -- "firejail --noprofile --chroot=/tmp/chroot\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "cat /proc/mounts | grep proc\r"
+expect {
+        timeout {puts "TESTING ERROR 5.1\n";exit}
+        "proc /proc proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.2\n";exit}
+        "proc /proc proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.3\n";exit}
+        "proc /proc/sys proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.4\n";exit}
+        "proc /proc/sysrq-trigger proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.5\n";exit}
+        "proc /proc/sys/kernel/hotplug"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.6\n";exit}
+        "proc /proc/irq proc"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.7\n";exit}
+        "proc /proc/bus proc"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+puts "\nall done\n"
diff --git a/test/features/1.5.exp b/test/features/1.5.exp
new file mode 100755
index 000000000..d722c5811
--- /dev/null
+++ b/test/features/1.5.exp
@@ -0,0 +1,69 @@
+#!/usr/bin/expect -f
+#
+# PID namespace
+#
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+#
+# N
+#
+send -- "firejail --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ps aux | wc -l \r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "5"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+#
+# O
+#
+send -- "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ps aux | wc -l \r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "5"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+#
+# C
+#
+send -- "firejail --noprofile --chroot=/tmp/chroot\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ps aux | wc -l \r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "5"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+puts "\nall done\n"
diff --git a/test/features/1.6.exp b/test/features/1.6.exp
new file mode 100755
index 000000000..a9c8f2a19
--- /dev/null
+++ b/test/features/1.6.exp
@@ -0,0 +1,69 @@
+#!/usr/bin/expect -f
+#
+# new /var/log
+#
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+#
+# N
+#
+send -- "firejail --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/log/syslog | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+#
+# O
+#
+send -- "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/log/syslog | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+#
+# C
+#
+send -- "firejail --noprofile --chroot=/tmp/chroot\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/log/syslog | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+puts "\nall done\n"
diff --git a/test/features/1.7.exp b/test/features/1.7.exp
new file mode 100755
index 000000000..0de3e224d
--- /dev/null
+++ b/test/features/1.7.exp
@@ -0,0 +1,71 @@
+#!/usr/bin/expect -f
+#
+# new /var/tmp
+#
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+#
+# N
+#
+send -- "touch /var/tmp/somefile\r"
+sleep 1
+send -- "firejail --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/tmp/somefile | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+#
+# O
+#
+send -- "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/tmp/somefile | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+#
+# C
+#
+send -- "firejail --noprofile --chroot=/tmp/chroot\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/tmp/somefile | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+puts "\nall done\n"
diff --git a/test/features/1.8.exp b/test/features/1.8.exp
new file mode 100755
index 000000000..514dd3b81
--- /dev/null
+++ b/test/features/1.8.exp
@@ -0,0 +1,71 @@
+#!/usr/bin/expect -f
+#
+# disable /etc/firejail and ~/.config/firejail
+#
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+#
+# N
+#
+send -- "touch /var/tmp/somefile\r"
+sleep 1
+send -- "firejail --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/tmp/somefile | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+#
+# O
+#
+send -- "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/tmp/somefile | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+#
+# C
+#
+send -- "firejail --noprofile --chroot=/tmp/chroot\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var/tmp/somefile | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "0"
+}
+after 100
+send -- "exit\r"
+sleep 1
+
+
+puts "\nall done\n"
diff --git a/test/features/features.txt b/test/features/features.txt
new file mode 100644
index 000000000..a95eeef37
--- /dev/null
+++ b/test/features/features.txt
@@ -0,0 +1,64 @@
+Firejail Feature Testing
+
+N - normal user filesystem
+O - overlay filesystem
+C - chroot filesystem
+
+
+
+1. Default features (tesing with --noprofile)
+
+1.1 new /boot
+        - N, O, C
+
+1.2 new /proc
+        - N, O, C
+
+1.3 new /sys
+        - N, O fails remount, C fails remount
+
+1.4 mask other users
+        - home directory: N, O, C
+        - /etc/passwd: N, O, C to test
+        - /etc/group: N, O, C to test
+
+1.5 PID namespace
+        - N, O, C
+
+1.6 new /var/log
+        - N, O, C
+
+1.7 new /var/tmp
+        -N, O, C
+
+1.8 disable /etc/firejail and ~/.config/firejail
+
+
+
+2. Networking features
+
+2.1 Hostname (use --hostname=bing, do a ping and cat /etc/hostname)
+        - N, O, C
+        - ping disabled for C by default seccomp filter, use "getent hosts bingo"
+
+2.2 DNS (use --dns=4.2.2.1, use "dig google.com")
+        - N, O, C
+
+2.3 mac-vlan (use --net=eth0 and --noprofile; run ifconfig and dig google.com)
+        - N, O, C
+
+2.4 bridge (use --net=br0 and --noprofile; run ifconfig, netstat -rn, ping default gw)
+        - N, O, C
+        - ping disabled for C by default seccomp filter
+
+2.5 IP address (--noprofile --net=eth0 --ip=192.168.1.226 --net=br0 --ip=10.10.20.3, run ifconfig and netstat -rn)
+        - N, O, C
+        
+2.6 Default gw (--noprofile --net=eth0 --defaultgw=192.168.1.10, run netstat -rn)
+        - N, O, C
+
+
+
+3. Filesystem features (use --noprofile)
+
+        
\ No newline at end of file
diff --git a/test/features/test.sh b/test/features/test.sh
new file mode 100755
index 000000000..b4ef6503a
--- /dev/null
+++ b/test/features/test.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+#
+# Feature testing
+#
+
+echo "TESTING: 1.1. new /boot"
+./1.1.exp
+
+echo "TESTING: 1.2. new /proc"
+./1.2.exp
+
+echo "TESTING: 1.5. PID namespace"
+./1.5.exp
+
+echo "TESTING: 1.6 new /var/log"
+./1.6.exp
+
+echo "TESTING: 1.7 new /var/tmp"
+./1.7.exp
+
+#echo "TESTING: "
+#./1..exp
+