testing

15 files changed, 929 insertions, 0 deletions

diff --git a/test/fs/fs.sh b/test/fs/fs.sh
new file mode 100755
index 000000000..425af45a6
--- /dev/null
+++ b/test/fs/fs.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+export MALLOC_CHECK_=3
+export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
+
+echo "TESTING: kmsg access (test/fs/kmsg.exp)"
+./kmsg.exp
+
+echo "TESTING: read/write /var/tmp (test/fs/fs_var_tmp.exp)"
+./fs_var_tmp.exp
+
+echo "TESTING: read/write /var/lock (test/fs/fs_var_lock.exp)"
+./fs_var_lock.exp
+
+echo "TESTING: read/write /dev/shm (test/fs/fs_dev_shm.exp)"
+./fs_dev_shm.exp
+
+echo "TESTING: private (test/fs/private.exp)"
+./private.exp `whoami`
+
+echo "TESTING: private-etc (test/fs/private-etc.exp)"
+./private-etc.exp
+
+echo "TESTING: private-bin (test/fs/private-bin.exp)"
+./private-bin.exp
+
+echo "TESTING: whitelist empty (test/fs/whitelist-empty.exp)"
+./whitelist-empty.exp
+
+echo "TESTING: private whitelist (test/fs/private-whitelist.exp)"
+echo "TESTING:     (failing on OpenSUSE)"
+./private-whitelist.exp
+
+echo "TESTING: invalid filename (test/fs/invalid_filename.exp)"
+./invalid_filename.exp
+
+echo "TESTING: blacklist directory (test/fs/option_blacklist.exp)"
+./option_blacklist.exp
+
+echo "TESTING: blacklist file (test/fs/option_blacklist_file.exp)"
+./option_blacklist_file.exp
+
+echo "TESTING: bind as user (test/fs/option_bind_user.exp)"
+./option_bind_user.exp
+
+
+
diff --git a/test/fs/fs_dev_shm.exp b/test/fs/fs_dev_shm.exp
new file mode 100755
index 000000000..6d27978e2
--- /dev/null
+++ b/test/fs/fs_dev_shm.exp
@@ -0,0 +1,90 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+# testing read-write /dev/shm
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "echo mytest > /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "done"
+}
+
+send -- "cat /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "mytest"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "done"
+}
+
+send -- "rm /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "done"
+}
+
+send -- "cat /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "mytest" {puts "TESTING ERROR 6\n";exit}
+        "done"
+}
+
+sleep 1
+send -- "exit\r"
+sleep 1
+
+# redo the test with --private
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "echo mytest > /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "done"
+}
+
+send -- "cat /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "mytest"
+}
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "done"
+}
+
+send -- "rm /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "done"
+}
+
+send -- "cat /dev/shm/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 12\n";exit}
+        "mytest" {puts "TESTING ERROR 13\n";exit}
+        "done"
+}
+
+sleep 1
+
+puts "\nall done\n"
diff --git a/test/fs/fs_var_lock.exp b/test/fs/fs_var_lock.exp
new file mode 100755
index 000000000..0e2b3181a
--- /dev/null
+++ b/test/fs/fs_var_lock.exp
@@ -0,0 +1,90 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+# testing read-write /var/lock
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "echo mytest > /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "done"
+}
+
+send -- "cat /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "mytest"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "done"
+}
+
+send -- "rm /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "done"
+}
+
+send -- "cat /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "mytest" {puts "TESTING ERROR 6\n";exit}
+        "done"
+}
+
+sleep 1
+send -- "exit\r"
+sleep 1
+
+# redo the test with --private
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "echo mytest > /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "done"
+}
+
+send -- "cat /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "mytest"
+}
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "done"
+}
+
+send -- "rm /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "done"
+}
+
+send -- "cat /var/lock/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 12\n";exit}
+        "mytest" {puts "TESTING ERROR 13\n";exit}
+        "done"
+}
+
+sleep 1
+
+puts "\nall done\n"
diff --git a/test/fs/fs_var_tmp.exp b/test/fs/fs_var_tmp.exp
new file mode 100755
index 000000000..811baac68
--- /dev/null
+++ b/test/fs/fs_var_tmp.exp
@@ -0,0 +1,90 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+# testing read-write /var/tmp
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "echo mytest > /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "done"
+}
+
+send -- "cat /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "mytest"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "done"
+}
+
+send -- "rm /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "done"
+}
+
+send -- "cat /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "mytest" {puts "TESTING ERROR 6\n";exit}
+        "done"
+}
+
+sleep 1
+send -- "exit\r"
+sleep 1
+
+# redo the test with --private
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "echo mytest > /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "done"
+}
+
+send -- "cat /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "mytest"
+}
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "done"
+}
+
+send -- "rm /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "done"
+}
+
+send -- "cat /var/tmp/ttt;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 12\n";exit}
+        "mytest" {puts "TESTING ERROR 13\n";exit}
+        "done"
+}
+
+sleep 1
+
+puts "\nall done\n"
diff --git a/test/fs/invalid_filename.exp b/test/fs/invalid_filename.exp
new file mode 100755
index 000000000..1acc85491
--- /dev/null
+++ b/test/fs/invalid_filename.exp
@@ -0,0 +1,189 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --debug-check-filename --noprofile --blacklist=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 1.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --cgroup=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 2.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --chroot=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 3.1\n";exit}
+        "Checking filename bla&&bla" {puts "normal system\n"}
+        "Error: --chroot option is not available on Grsecurity systems" { puts "\nall done\n"; exit}
+}
+expect {
+        timeout {puts "TESTING ERROR 3.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --netfilter=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 4.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --output=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 5.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 5.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --private=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 6.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 6.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 6.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --private-bin=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 7.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 7.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 7.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --noprofile --private-etc=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 9.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 9.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 9.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --profile=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 10.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 10.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 10.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --read-only=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 11.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 11.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 11.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+send -- "firejail --debug-check-filename --shell=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 12.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 12.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 12.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+
+send -- "firejail --debug-check-filename --whitelist=\"bla&&bla\"\r"
+expect {
+        timeout {puts "TESTING ERROR 14.1\n";exit}
+        "Checking filename bla&&bla"
+}
+expect {
+        timeout {puts "TESTING ERROR 14.2\n";exit}
+        "Error:"
+}
+expect {
+        timeout {puts "TESTING ERROR 14.3\n";exit}
+        "is an invalid filename"
+}
+after 100
+
+puts "\nall done\n"
+
diff --git a/test/fs/kmsg.exp b/test/fs/kmsg.exp
new file mode 100755
index 000000000..abc711aee
--- /dev/null
+++ b/test/fs/kmsg.exp
@@ -0,0 +1,32 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "cat /dev/kmsg\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Permission denied"
+}
+after 100
+
+send -- "cat /proc/kmsg\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Permission denied"
+}
+after 100
+
+puts "\nall done\n"
+
diff --git a/test/fs/option_bind_user.exp b/test/fs/option_bind_user.exp
new file mode 100755
index 000000000..9d2d17d7f
--- /dev/null
+++ b/test/fs/option_bind_user.exp
@@ -0,0 +1,15 @@
+#!/usr/bin/expect -f
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --bind=/tmp/chroot,mntpoint\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "bind option is available only if running as root"
+}
+sleep 1
+
+puts "\n"
+
diff --git a/test/fs/option_blacklist.exp b/test/fs/option_blacklist.exp
new file mode 100755
index 000000000..38fd19237
--- /dev/null
+++ b/test/fs/option_blacklist.exp
@@ -0,0 +1,38 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --blacklist=/var\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l /var;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Permission denied"
+}
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "done"
+}
+send -- "cd /var;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Permission denied"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "done"
+}
+sleep 1
+
+puts "\n"
+
diff --git a/test/fs/option_blacklist_file.exp b/test/fs/option_blacklist_file.exp
new file mode 100755
index 000000000..846735d9e
--- /dev/null
+++ b/test/fs/option_blacklist_file.exp
@@ -0,0 +1,26 @@
+#!/usr/bin/expect -f
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --blacklist=/etc/passwd\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "cat /etc/passwd;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Permission denied"
+}
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "done"
+}
+sleep 1
+
+puts "\n"
+
diff --git a/test/fs/private-bin.exp b/test/fs/private-bin.exp
new file mode 100755
index 000000000..c19702e77
--- /dev/null
+++ b/test/fs/private-bin.exp
@@ -0,0 +1,71 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --private-bin=bash,ls,sh\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls /bin\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "bash"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "ls"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "sh"
+}
+
+send -- "ls /bin\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "ping" {puts "TESTING ERROR 6\n";exit}
+        "sh"
+}
+send -- "exit\r"
+sleep 1
+
+send -- "firejail --profile=private-bin.profile\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls /bin\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "bash"
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "ls"
+}
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "sh"
+}
+
+send -- "ls /bin\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "ping" {puts "TESTING ERROR 6\n";exit}
+        "sh"
+}
+send -- "exit\r"
+
+sleep 1
+puts "\nall done\n"
+
diff --git a/test/fs/private-bin.profile b/test/fs/private-bin.profile
new file mode 100644
index 000000000..24cf5929a
--- /dev/null
+++ b/test/fs/private-bin.profile
@@ -0,0 +1 @@
+private-bin bash,ls,sh
diff --git a/test/fs/private-etc.exp b/test/fs/private-etc.exp
new file mode 100755
index 000000000..e5a006585
--- /dev/null
+++ b/test/fs/private-etc.exp
@@ -0,0 +1,45 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+# directory with ~
+send -- "firejail --private-etc=passwd,group,resolv.conf,X11\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -al /etc\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "group"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "passwd"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "resolv.conf"
+}
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "X11"
+}
+
+send -- "ls -al /etc\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "shadow" {puts "TESTING ERROR 8\n";exit}
+        "X11"
+}
+
+sleep 1
+puts "\nall done\n"
+
diff --git a/test/fs/private-whitelist.exp b/test/fs/private-whitelist.exp
new file mode 100755
index 000000000..a3d60369a
--- /dev/null
+++ b/test/fs/private-whitelist.exp
@@ -0,0 +1,39 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --private --whitelist=/tmp/.X11-unix\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -al /tmp\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        ".X11-unix"
+}
+sleep 1
+
+send -- "ls -a /tmp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "3"
+}
+sleep 1
+
+send -- "ls -a ~ | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "5"
+}
+
+sleep 1
+puts "\nall done\n"
+
diff --git a/test/fs/private.exp b/test/fs/private.exp
new file mode 100755
index 000000000..01f04d3cb
--- /dev/null
+++ b/test/fs/private.exp
@@ -0,0 +1,100 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+if { $argc != 1 } {
+        puts "TESTING ERROR: argument missing"
+        puts "Usage: private.exp username"
+        puts "where username is the name of the current user"
+        exit
+}
+
+# testing profile and private
+send -- "firejail --private --profile=/etc/firejail/default.profile\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+send -- "exit\r"
+sleep 1
+
+send -- "firejail --private --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+
+sleep 1
+send -- "cd ~; ls -al; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        ".bashrc"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        [lindex $argv 0]
+}
+send -- "ls -al; echo done\r"
+expect {
+        timeout {
+                # OpenSUSE doesn't use .Xauthority from user done directory
+                send -- "env | grep XAUTHORITY\r"
+
+                expect {
+                        timeout {puts "TESTING ERROR 4\n";exit}
+                        "/run/lightdm/netblue/xauthority"
+                }
+        }
+        ".Xauthority"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        [lindex $argv 0]
+}
+
+
+# testing private only
+send -- "bash\r"
+sleep 1
+# owner /done/netblue
+send -- "ls -l /done;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        [lindex $argv 0]
+}
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        [lindex $argv 0]
+}
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        [lindex $argv 0]
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "done"
+}
+sleep 1
+
+# owner /tmp
+send -- "stat -c %U%a /tmp;echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "root777" {puts "version 1\n";}
+            "root1777" {puts "version 2\n";}
+        "nobody777" {puts "version 3\n";}
+            "nobody1777" {puts "version 4\n";}
+}
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "done"
+}
+sleep 1
+
+puts "all done\n"
diff --git a/test/fs/whitelist-empty.exp b/test/fs/whitelist-empty.exp
new file mode 100755
index 000000000..f44d4fb58
--- /dev/null
+++ b/test/fs/whitelist-empty.exp
@@ -0,0 +1,53 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2016 Firejail Authors
+# License GPL v2
+
+set timeout 30
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --whitelist=~/blablabla --whitelist=/tmp/blablabla --whitelist=/media/blablabla --whitelist=/var/blablabla --whitelist=/dev/blablabla --whitelist=/opt/blablabla\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l ~/ | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "0"
+}
+
+send -- "ls -l /tmp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "0"
+}
+
+send -- "ls -l /media | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "0"
+}
+
+send -- "ls -l /var | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "0"
+}
+
+send -- "ls -l /dev | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "0"
+}
+send -- "ls -l /opt | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "0"
+}
+
+
+puts "\nall done\n"