diff options
author | netblue30 <netblue30@protonmail.com> | 2023-03-08 16:23:30 -0500 |
---|---|---|
committer | netblue30 <netblue30@protonmail.com> | 2023-03-08 16:23:30 -0500 |
commit | acf8efb878b84882a9df61eff51fdcaceb522a4c (patch) | |
tree | 88042e5d0723c36a10efc05774335bd0df52703a /test/filters | |
parent | Merge pull request #5717 from glitsj16/aa-examples (diff) | |
download | firejail-acf8efb878b84882a9df61eff51fdcaceb522a4c.tar.gz firejail-acf8efb878b84882a9df61eff51fdcaceb522a4c.tar.zst firejail-acf8efb878b84882a9df61eff51fdcaceb522a4c.zip |
testing
Diffstat (limited to 'test/filters')
-rwxr-xr-x | test/filters/caps-join.exp | 96 | ||||
-rwxr-xr-x | test/filters/caps-print.exp | 103 | ||||
-rwxr-xr-x | test/filters/caps.exp | 139 | ||||
-rw-r--r-- | test/filters/caps1.profile | 1 | ||||
-rw-r--r-- | test/filters/caps2.profile | 1 | ||||
-rw-r--r-- | test/filters/caps3.profile | 1 | ||||
-rwxr-xr-x | test/filters/filters.sh | 24 |
7 files changed, 12 insertions, 353 deletions
diff --git a/test/filters/caps-join.exp b/test/filters/caps-join.exp deleted file mode 100755 index 1830143fb..000000000 --- a/test/filters/caps-join.exp +++ /dev/null | |||
@@ -1,96 +0,0 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2023 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | match_max 100000 | ||
8 | spawn $env(SHELL) | ||
9 | set id1 $spawn_id | ||
10 | spawn $env(SHELL) | ||
11 | set id2 $spawn_id | ||
12 | |||
13 | send -- "stty -echo\r" | ||
14 | after 100 | ||
15 | |||
16 | # | ||
17 | # regular run | ||
18 | # | ||
19 | set spawn_id $id1 | ||
20 | send -- "firejail --name=jointesting\r" | ||
21 | expect { | ||
22 | timeout {puts "TESTING ERROR 0\n";exit} | ||
23 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
24 | } | ||
25 | sleep 1 | ||
26 | |||
27 | set spawn_id $id2 | ||
28 | |||
29 | send -- "firejail --join=jointesting cat /proc/self/status\r" | ||
30 | expect { | ||
31 | timeout {puts "TESTING ERROR 1\n";exit} | ||
32 | "CapBnd: 0000000000000000" | ||
33 | } | ||
34 | sleep 1 | ||
35 | |||
36 | set spawn_id $id1 | ||
37 | send -- "exit\r" | ||
38 | after 100 | ||
39 | |||
40 | # | ||
41 | # no caps | ||
42 | # | ||
43 | set spawn_id $id1 | ||
44 | send -- "firejail --name=jointesting --noprofile\r" | ||
45 | expect { | ||
46 | timeout {puts "TESTING ERROR 10\n";exit} | ||
47 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
48 | } | ||
49 | sleep 1 | ||
50 | |||
51 | set spawn_id $id2 | ||
52 | |||
53 | send -- "firejail --join=jointesting cat /proc/self/status\r" | ||
54 | expect { | ||
55 | timeout {puts "TESTING ERROR 11\n";exit} | ||
56 | "CapBnd:" | ||
57 | } | ||
58 | expect { | ||
59 | timeout {puts "TESTING ERROR 12\n";exit} | ||
60 | "fffffffff" | ||
61 | } | ||
62 | expect { | ||
63 | timeout {puts "TESTING ERROR 13\n";exit} | ||
64 | "CapAmb:" | ||
65 | } | ||
66 | sleep 1 | ||
67 | |||
68 | set spawn_id $id1 | ||
69 | send -- "exit\r" | ||
70 | after 100 | ||
71 | |||
72 | # | ||
73 | # no caps | ||
74 | # | ||
75 | set spawn_id $id1 | ||
76 | send -- "firejail --name=jointesting --noprofile --caps.keep=chown,fowner\r" | ||
77 | expect { | ||
78 | timeout {puts "TESTING ERROR20\n";exit} | ||
79 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
80 | } | ||
81 | sleep 1 | ||
82 | |||
83 | set spawn_id $id2 | ||
84 | |||
85 | send -- "firejail --join=jointesting cat /proc/self/status\r" | ||
86 | expect { | ||
87 | timeout {puts "TESTING ERROR 21\n";exit} | ||
88 | "CapBnd: 0000000000000009" | ||
89 | } | ||
90 | sleep 1 | ||
91 | |||
92 | set spawn_id $id1 | ||
93 | send -- "exit\r" | ||
94 | after 100 | ||
95 | |||
96 | puts "all done\n" | ||
diff --git a/test/filters/caps-print.exp b/test/filters/caps-print.exp deleted file mode 100755 index b403f9ffe..000000000 --- a/test/filters/caps-print.exp +++ /dev/null | |||
@@ -1,103 +0,0 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2023 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firejail --name=test --noprofile --caps --debug\r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 0\n";exit} | ||
13 | "Drop CAP_SYS_MODULE" | ||
14 | } | ||
15 | expect { | ||
16 | timeout {puts "TESTING ERROR 1\n";exit} | ||
17 | "Drop CAP_SYS_RAWIO" | ||
18 | } | ||
19 | expect { | ||
20 | timeout {puts "TESTING ERROR 2\n";exit} | ||
21 | "Drop CAP_SYS_BOOT" | ||
22 | } | ||
23 | expect { | ||
24 | timeout {puts "TESTING ERROR 3\n";exit} | ||
25 | "Drop CAP_SYS_NICE" | ||
26 | } | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 4\n";exit} | ||
29 | "Drop CAP_SYS_TTY_CONFIG" | ||
30 | } | ||
31 | expect { | ||
32 | timeout {puts "TESTING ERROR 5\n";exit} | ||
33 | "Drop CAP_SYSLOG" | ||
34 | } | ||
35 | expect { | ||
36 | timeout {puts "TESTING ERROR 6\n";exit} | ||
37 | "Drop CAP_MKNOD" | ||
38 | } | ||
39 | expect { | ||
40 | timeout {puts "TESTING ERROR 7\n";exit} | ||
41 | "Drop CAP_SYS_ADMIN" | ||
42 | } | ||
43 | expect { | ||
44 | timeout {puts "TESTING ERROR 8\n";exit} | ||
45 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
46 | } | ||
47 | sleep 1 | ||
48 | |||
49 | spawn $env(SHELL) | ||
50 | send -- "firejail --caps.print=test\r" | ||
51 | expect { | ||
52 | timeout {puts "TESTING ERROR 9\n";exit} | ||
53 | "chown - enabled" | ||
54 | } | ||
55 | expect { | ||
56 | timeout {puts "TESTING ERROR 10\n";exit} | ||
57 | "setgid - enabled" | ||
58 | } | ||
59 | expect { | ||
60 | timeout {puts "TESTING ERROR 11\n";exit} | ||
61 | "setuid - enabled" | ||
62 | } | ||
63 | expect { | ||
64 | timeout {puts "TESTING ERROR 12\n";exit} | ||
65 | "mknod - disabled" | ||
66 | } | ||
67 | expect { | ||
68 | timeout {puts "TESTING ERROR 13\n";exit} | ||
69 | "syslog - disabled" | ||
70 | } | ||
71 | after 100 | ||
72 | |||
73 | send -- "firejail --debug-caps\r" | ||
74 | expect { | ||
75 | timeout {puts "TESTING ERROR 9\n";exit} | ||
76 | "21 - sys_admin" | ||
77 | } | ||
78 | expect { | ||
79 | timeout {puts "TESTING ERROR 9\n";exit} | ||
80 | "22 - sys_boot" | ||
81 | } | ||
82 | expect { | ||
83 | timeout {puts "TESTING ERROR 9\n";exit} | ||
84 | "23 - sys_nice" | ||
85 | } | ||
86 | expect { | ||
87 | timeout {puts "TESTING ERROR 9\n";exit} | ||
88 | "24 - sys_resource" | ||
89 | } | ||
90 | after 100 | ||
91 | |||
92 | send -- "firejail --caps.keep=\"bla bla bla\"\r" | ||
93 | expect { | ||
94 | timeout {puts "TESTING ERROR 10\n";exit} | ||
95 | "capability" | ||
96 | } | ||
97 | expect { | ||
98 | timeout {puts "TESTING ERROR 11\n";exit} | ||
99 | "not found" | ||
100 | } | ||
101 | |||
102 | after 100 | ||
103 | puts "\nall done\n" | ||
diff --git a/test/filters/caps.exp b/test/filters/caps.exp deleted file mode 100755 index dbd63efda..000000000 --- a/test/filters/caps.exp +++ /dev/null | |||
@@ -1,139 +0,0 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2023 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firejail --caps.keep=chown,fowner --noprofile\r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 1\n";exit} | ||
13 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
14 | } | ||
15 | after 100 | ||
16 | |||
17 | send -- "cat /proc/self/status\r" | ||
18 | expect { | ||
19 | timeout {puts "TESTING ERROR 2\n";exit} | ||
20 | "CapBnd: 0000000000000009" | ||
21 | } | ||
22 | expect { | ||
23 | timeout {puts "TESTING ERROR 3\n";exit} | ||
24 | "Seccomp:" | ||
25 | } | ||
26 | send -- "exit\r" | ||
27 | sleep 1 | ||
28 | |||
29 | send -- "firejail --caps.drop=all --noprofile\r" | ||
30 | expect { | ||
31 | timeout {puts "TESTING ERROR 4\n";exit} | ||
32 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
33 | } | ||
34 | after 100 | ||
35 | |||
36 | send -- "cat /proc/self/status\r" | ||
37 | expect { | ||
38 | timeout {puts "TESTING ERROR 5\n";exit} | ||
39 | "CapBnd: 0000000000000000" | ||
40 | } | ||
41 | expect { | ||
42 | timeout {puts "TESTING ERROR 6\n";exit} | ||
43 | "Seccomp:" | ||
44 | } | ||
45 | send -- "exit\r" | ||
46 | sleep 1 | ||
47 | |||
48 | send -- "firejail --caps.drop=chown,dac_override,dac_read_search,fowner --noprofile\r" | ||
49 | expect { | ||
50 | timeout {puts "TESTING ERROR 7\n";exit} | ||
51 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
52 | } | ||
53 | after 100 | ||
54 | |||
55 | send -- "cat /proc/self/status\r" | ||
56 | expect { | ||
57 | timeout {puts "TESTING ERROR 8\n";exit} | ||
58 | "CapBnd:" | ||
59 | } | ||
60 | expect { | ||
61 | timeout {puts "TESTING ERROR 9\n";exit} | ||
62 | "fffffff0" | ||
63 | } | ||
64 | expect { | ||
65 | timeout {puts "TESTING ERROR 10\n";exit} | ||
66 | "Seccomp:" | ||
67 | } | ||
68 | send -- "exit\r" | ||
69 | sleep 1 | ||
70 | |||
71 | |||
72 | send -- "firejail --profile=caps1.profile --debug\r" | ||
73 | expect { | ||
74 | timeout {puts "TESTING ERROR 11\n";exit} | ||
75 | "Drop CAP_SYS_MODULE" | ||
76 | } | ||
77 | expect { | ||
78 | timeout {puts "TESTING ERROR 12\n";exit} | ||
79 | "Drop CAP_SYS_ADMIN" | ||
80 | } | ||
81 | expect { | ||
82 | timeout {puts "TESTING ERROR 13\n";exit} | ||
83 | "Drop CAP_" {puts "TESTING ERROR 14\n";exit} | ||
84 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
85 | } | ||
86 | after 100 | ||
87 | send -- "exit\r" | ||
88 | sleep 1 | ||
89 | |||
90 | |||
91 | ## tofix: possible problem with caps.keep in profile files | ||
92 | ##send -- "firejail --caps.keep=chown,fowner --noprofile\r" | ||
93 | #send -- "firejail --profile=caps2.profile\r" | ||
94 | #expect { | ||
95 | # timeout {puts "TESTING ERROR 15\n";exit} | ||
96 | # -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
97 | #} | ||
98 | #after 100 | ||
99 | # | ||
100 | #send -- "cat /proc/self/status\r" | ||
101 | #expect { | ||
102 | # timeout {puts "TESTING ERROR 16\n";exit} | ||
103 | # "CapBnd: 0000000000000009" | ||
104 | #} | ||
105 | #expect { | ||
106 | # timeout {puts "TESTING ERROR 17\n";exit} | ||
107 | # "Seccomp:" | ||
108 | #} | ||
109 | #send -- "exit\r" | ||
110 | #sleep 1 | ||
111 | |||
112 | #send -- "firejail --caps.drop=chown,dac_override,dac_read_search,fowner --noprofile\r" | ||
113 | send -- "firejail --profile=caps3.profile\r" | ||
114 | expect { | ||
115 | timeout {puts "TESTING ERROR 18\n";exit} | ||
116 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | ||
117 | } | ||
118 | after 100 | ||
119 | |||
120 | send -- "cat /proc/self/status\r" | ||
121 | expect { | ||
122 | timeout {puts "TESTING ERROR 19\n";exit} | ||
123 | "CapBnd:" | ||
124 | } | ||
125 | expect { | ||
126 | timeout {puts "TESTING ERROR 20\n";exit} | ||
127 | "fffffff0" | ||
128 | } | ||
129 | expect { | ||
130 | timeout {puts "TESTING ERROR 21\n";exit} | ||
131 | "Seccomp:" | ||
132 | } | ||
133 | send -- "exit\r" | ||
134 | sleep 1 | ||
135 | |||
136 | |||
137 | |||
138 | after 100 | ||
139 | puts "\nall done\n" | ||
diff --git a/test/filters/caps1.profile b/test/filters/caps1.profile deleted file mode 100644 index 8b0c3b340..000000000 --- a/test/filters/caps1.profile +++ /dev/null | |||
@@ -1 +0,0 @@ | |||
1 | caps | ||
diff --git a/test/filters/caps2.profile b/test/filters/caps2.profile deleted file mode 100644 index ad49719f1..000000000 --- a/test/filters/caps2.profile +++ /dev/null | |||
@@ -1 +0,0 @@ | |||
1 | caps.drop chown,dac_override,dac_read_search,fowner | ||
diff --git a/test/filters/caps3.profile b/test/filters/caps3.profile deleted file mode 100644 index ad49719f1..000000000 --- a/test/filters/caps3.profile +++ /dev/null | |||
@@ -1 +0,0 @@ | |||
1 | caps.drop chown,dac_override,dac_read_search,fowner | ||
diff --git a/test/filters/filters.sh b/test/filters/filters.sh index 2d115db1b..e19047e6f 100755 --- a/test/filters/filters.sh +++ b/test/filters/filters.sh | |||
@@ -57,18 +57,18 @@ echo "TESTING: noroot (test/filters/noroot.exp)" | |||
57 | ./noroot.exp | 57 | ./noroot.exp |
58 | 58 | ||
59 | 59 | ||
60 | if grep -q "^CapBnd:\\s0000003fffffffff" /proc/self/status; then | 60 | #if grep -q "^CapBnd:\\s0000003fffffffff" /proc/self/status; then |
61 | echo "TESTING: capabilities (test/filters/caps.exp)" | 61 | # echo "TESTING: capabilities (test/filters/caps.exp)" |
62 | ./caps.exp | 62 | # ./caps.exp |
63 | else | 63 | #else |
64 | echo "TESTING SKIP: other capabilities than expected (test/filters/caps.exp)" | 64 | # echo "TESTING SKIP: other capabilities than expected (test/filters/caps.exp)" |
65 | fi | 65 | #fi |
66 | 66 | # | |
67 | echo "TESTING: capabilities print (test/filters/caps-print.exp)" | 67 | #echo "TESTING: capabilities print (test/filters/caps-print.exp)" |
68 | ./caps-print.exp | 68 | #./caps-print.exp |
69 | 69 | # | |
70 | echo "TESTING: capabilities join (test/filters/caps-join.exp)" | 70 | #echo "TESTING: capabilities join (test/filters/caps-join.exp)" |
71 | ./caps-join.exp | 71 | #./caps-join.exp |
72 | 72 | ||
73 | rm -f seccomp-test-file | 73 | rm -f seccomp-test-file |
74 | if [[ $(uname -m) == "x86_64" ]]; then | 74 | if [[ $(uname -m) == "x86_64" ]]; then |