diff options
-rw-r--r-- | README.md | 6 | ||||
-rw-r--r-- | RELNOTES | 16 | ||||
-rw-r--r-- | etc/disable-common.inc | 28 | ||||
-rw-r--r-- | etc/disable-programs.inc | 2 | ||||
-rw-r--r-- | etc/keepassx2.profile | 22 | ||||
-rw-r--r-- | platform/debian/conffiles | 1 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 2 | ||||
-rw-r--r-- | src/firejail/fs.c | 48 | ||||
-rwxr-xr-x | test/fcopy/dircopy.exp | 28 | ||||
-rwxr-xr-x | test/fs/private-whitelist.exp | 1 | ||||
-rwxr-xr-x | test/fs/whitelist-dev.exp | 12 | ||||
-rwxr-xr-x | test/utils/cpu-print.exp | 24 | ||||
-rwxr-xr-x | test/utils/trace.exp | 18 |
13 files changed, 141 insertions, 67 deletions
@@ -18,7 +18,7 @@ prefix your command with “firejail”: | |||
18 | 18 | ||
19 | ````` | 19 | ````` |
20 | $ firejail firefox # starting Mozilla Firefox | 20 | $ firejail firefox # starting Mozilla Firefox |
21 | $ firejail transmission-gtk # starting Transmission BitTorrent | 21 | $ firejail transmission-gtk # starting Transmission BitTorrent |
22 | $ firejail vlc # starting VideoLAN Client | 22 | $ firejail vlc # starting VideoLAN Client |
23 | $ sudo firejail /etc/init.d/nginx start | 23 | $ sudo firejail /etc/init.d/nginx start |
24 | ````` | 24 | ````` |
@@ -88,5 +88,5 @@ amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exifto | |||
88 | gjs, gnome-books, gnome-clocks, gnome-documents, gnome-maps, gnome-music, gnome-photos, gnome-weather, | 88 | gjs, gnome-books, gnome-clocks, gnome-documents, gnome-maps, gnome-music, gnome-photos, gnome-weather, |
89 | goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, | 89 | goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, |
90 | simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget, | 90 | simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget, |
91 | xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5, | 91 | xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5, |
92 | PDFSam, Pithos, Xonotic, wireshark | 92 | PDFSam, Pithos, Xonotic, wireshark, keepassx2 |
@@ -16,9 +16,9 @@ firejail (0.9.45) baseline; urgency=low | |||
16 | * feature: config support for firejail prompt in terminal | 16 | * feature: config support for firejail prompt in terminal |
17 | * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire, | 17 | * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire, |
18 | * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, | 18 | * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, |
19 | * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator, | 19 | * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator, |
20 | * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos, | 20 | * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos, |
21 | * new profies: Xonotic, wireshark | 21 | * new profies: Xonotic, wireshark, keepassx2 |
22 | * bugfixes | 22 | * bugfixes |
23 | -- netblue30 <netblue30@yahoo.com> Sun, 23 Oct 2016 08:00:00 -0500 | 23 | -- netblue30 <netblue30@yahoo.com> Sun, 23 Oct 2016 08:00:00 -0500 |
24 | 24 | ||
@@ -32,7 +32,7 @@ firejail (0.9.44) baseline; urgency=low | |||
32 | * feature: support starting/joining sandbox is a single command | 32 | * feature: support starting/joining sandbox is a single command |
33 | (--join-or-start) | 33 | (--join-or-start) |
34 | * feature: X11 detection support for --audit | 34 | * feature: X11 detection support for --audit |
35 | * feature: assign a name to the interface connected to the bridge | 35 | * feature: assign a name to the interface connected to the bridge |
36 | (--veth-name) | 36 | (--veth-name) |
37 | * feature: all user home directories are visible (--allusers) | 37 | * feature: all user home directories are visible (--allusers) |
38 | * feature: add files to sandbox container (--put) | 38 | * feature: add files to sandbox container (--put) |
@@ -265,7 +265,7 @@ firejail (0.9.24) baseline; urgency=low | |||
265 | * two build patches from Reiner Herman (tickets 11, 12) | 265 | * two build patches from Reiner Herman (tickets 11, 12) |
266 | * man page patch from Reiner Herman (ticket 13) | 266 | * man page patch from Reiner Herman (ticket 13) |
267 | * output patch (ticket 15) from sshirokov | 267 | * output patch (ticket 15) from sshirokov |
268 | 268 | ||
269 | -- netblue30 <netblue30@yahoo.com> Sun, 5 Apr 2015 08:00:00 -0500 | 269 | -- netblue30 <netblue30@yahoo.com> Sun, 5 Apr 2015 08:00:00 -0500 |
270 | 270 | ||
271 | firejail (0.9.22) baseline; urgency=low | 271 | firejail (0.9.22) baseline; urgency=low |
@@ -330,7 +330,7 @@ firejail (0.9.16) baseline; urgency=low | |||
330 | -- netblue30 <netblue30@yahoo.com> Tue, 4 Nov 2014 10:00:00 -0500 | 330 | -- netblue30 <netblue30@yahoo.com> Tue, 4 Nov 2014 10:00:00 -0500 |
331 | 331 | ||
332 | firejail (0.9.14) baseline; urgency=low | 332 | firejail (0.9.14) baseline; urgency=low |
333 | * Linux capabilities and seccomp filters are automatically enabled in | 333 | * Linux capabilities and seccomp filters are automatically enabled in |
334 | chroot mode (--chroot option) if the sandbox is started as regular user | 334 | chroot mode (--chroot option) if the sandbox is started as regular user |
335 | * Added support for user defined seccomp blacklists | 335 | * Added support for user defined seccomp blacklists |
336 | * Added syscall trace support | 336 | * Added syscall trace support |
@@ -382,7 +382,7 @@ firejail (0.9.8.1) baseline; urgency=low | |||
382 | * FIxed a number of bugs introduced in 0.9.8 | 382 | * FIxed a number of bugs introduced in 0.9.8 |
383 | 383 | ||
384 | -- netblue30 <netblue30@yahoo.com> Fri, 25 Jul 2014 07:25:00 -0500 | 384 | -- netblue30 <netblue30@yahoo.com> Fri, 25 Jul 2014 07:25:00 -0500 |
385 | 385 | ||
386 | firejail (0.9.8) baseline; urgency=low | 386 | firejail (0.9.8) baseline; urgency=low |
387 | * Implemented nowrap mode for firejail --list command option | 387 | * Implemented nowrap mode for firejail --list command option |
388 | * Added --top option in both firejail and firemon | 388 | * Added --top option in both firejail and firemon |
@@ -391,7 +391,7 @@ firejail (0.9.8) baseline; urgency=low | |||
391 | * bugfixes | 391 | * bugfixes |
392 | 392 | ||
393 | -- netblue30 <netblue30@yahoo.com> Tue, 24 Jul 2014 08:51:00 -0500 | 393 | -- netblue30 <netblue30@yahoo.com> Tue, 24 Jul 2014 08:51:00 -0500 |
394 | 394 | ||
395 | firejail (0.9.6) baseline; urgency=low | 395 | firejail (0.9.6) baseline; urgency=low |
396 | 396 | ||
397 | * Mounting tmpfs on top of /var/log, required by several server programs | 397 | * Mounting tmpfs on top of /var/log, required by several server programs |
@@ -430,7 +430,7 @@ firejail (0.9.2) baseline; urgency=low | |||
430 | * Added an expect-based testing framework for the project | 430 | * Added an expect-based testing framework for the project |
431 | * Added bash completion support | 431 | * Added bash completion support |
432 | * Added support for multiple networks | 432 | * Added support for multiple networks |
433 | 433 | ||
434 | -- netblue30 <netblue30@yahoo.com> Fri, 25 Apr 2014 08:00:00 -0500 | 434 | -- netblue30 <netblue30@yahoo.com> Fri, 25 Apr 2014 08:00:00 -0500 |
435 | 435 | ||
436 | firejail (0.9) baseline; urgency=low | 436 | firejail (0.9) baseline; urgency=low |
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index 2da44a67c..efe5c850d 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -39,19 +39,19 @@ blacklist /usr/share/applications/veracrypt.* | |||
39 | blacklist /usr/share/pixmaps/veracrypt.* | 39 | blacklist /usr/share/pixmaps/veracrypt.* |
40 | blacklist ${HOME}/.VeraCrypt | 40 | blacklist ${HOME}/.VeraCrypt |
41 | 41 | ||
42 | # TrueCrypt | 42 | # TrueCrypt |
43 | blacklist ${PATH}/truecrypt | 43 | blacklist ${PATH}/truecrypt |
44 | blacklist ${PATH}/truecrypt-uninstall.sh | 44 | blacklist ${PATH}/truecrypt-uninstall.sh |
45 | blacklist /usr/share/truecrypt | 45 | blacklist /usr/share/truecrypt |
46 | blacklist /usr/share/applications/truecrypt.* | 46 | blacklist /usr/share/applications/truecrypt.* |
47 | blacklist /usr/share/pixmaps/truecrypt.* | 47 | blacklist /usr/share/pixmaps/truecrypt.* |
48 | blacklist ${HOME}/.TrueCrypt | 48 | blacklist ${HOME}/.TrueCrypt |
49 | 49 | ||
50 | # zuluCrypt | 50 | # zuluCrypt |
51 | blacklist ${HOME}/.zuluCrypt | 51 | blacklist ${HOME}/.zuluCrypt |
52 | blacklist ${HOME}/.zuluCrypt-socket | 52 | blacklist ${HOME}/.zuluCrypt-socket |
53 | blacklist ${PATH}/zuluCrypt-cli | 53 | blacklist ${PATH}/zuluCrypt-cli |
54 | blacklist ${PATH}/zuluMount-cli | 54 | blacklist ${PATH}/zuluMount-cli |
55 | 55 | ||
56 | # var | 56 | # var |
57 | blacklist /var/spool/cron | 57 | blacklist /var/spool/cron |
@@ -154,7 +154,7 @@ blacklist /etc/ssh | |||
154 | blacklist /var/backup | 154 | blacklist /var/backup |
155 | blacklist /home/.ecryptfs | 155 | blacklist /home/.ecryptfs |
156 | 156 | ||
157 | # system directories | 157 | # system directories |
158 | blacklist /sbin | 158 | blacklist /sbin |
159 | blacklist /usr/sbin | 159 | blacklist /usr/sbin |
160 | blacklist /usr/local/sbin | 160 | blacklist /usr/local/sbin |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index a9ca487c5..279a65d6e 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -148,7 +148,7 @@ blacklist ${HOME}/.config/xreader | |||
148 | blacklist ${HOME}/.config/xviewer | 148 | blacklist ${HOME}/.config/xviewer |
149 | blacklist ${HOME}/.config/zathura | 149 | blacklist ${HOME}/.config/zathura |
150 | blacklist ${HOME}/.config/zoomus.conf | 150 | blacklist ${HOME}/.config/zoomus.conf |
151 | blacklist ${HOME}/.conkeror.mozdev.org | 151 | blacklist ${HOME}/.conkeror.mozdev.org |
152 | blacklist ${HOME}/.dillo | 152 | blacklist ${HOME}/.dillo |
153 | blacklist ${HOME}/.dosbox | 153 | blacklist ${HOME}/.dosbox |
154 | blacklist ${HOME}/.dropbox-dist | 154 | blacklist ${HOME}/.dropbox-dist |
diff --git a/etc/keepassx2.profile b/etc/keepassx2.profile new file mode 100644 index 000000000..d8621773f --- /dev/null +++ b/etc/keepassx2.profile | |||
@@ -0,0 +1,22 @@ | |||
1 | # keepassx password manager profile | ||
2 | noblacklist ${HOME}/.config/keepassx | ||
3 | noblacklist ${HOME}/.keepassx | ||
4 | noblacklist ${HOME}/keepassx.kdbx | ||
5 | |||
6 | include /etc/firejail/disable-common.inc | ||
7 | include /etc/firejail/disable-programs.inc | ||
8 | include /etc/firejail/disable-devel.inc | ||
9 | include /etc/firejail/disable-passwdmgr.inc | ||
10 | |||
11 | caps.drop all | ||
12 | nogroups | ||
13 | nonewprivs | ||
14 | noroot | ||
15 | nosound | ||
16 | protocol unix | ||
17 | seccomp | ||
18 | netfilter | ||
19 | shell none | ||
20 | |||
21 | private-tmp | ||
22 | private-dev | ||
diff --git a/platform/debian/conffiles b/platform/debian/conffiles index 97e7cf884..57657f208 100644 --- a/platform/debian/conffiles +++ b/platform/debian/conffiles | |||
@@ -111,6 +111,7 @@ | |||
111 | /etc/firejail/keepass.profile | 111 | /etc/firejail/keepass.profile |
112 | /etc/firejail/keepass2.profile | 112 | /etc/firejail/keepass2.profile |
113 | /etc/firejail/keepassx.profile | 113 | /etc/firejail/keepassx.profile |
114 | /etc/firejail/keepassx2.profile | ||
114 | /etc/firejail/kmail.profile | 115 | /etc/firejail/kmail.profile |
115 | /etc/firejail/konversation.profile | 116 | /etc/firejail/konversation.profile |
116 | /etc/firejail/less.profile | 117 | /etc/firejail/less.profile |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index c4f52e256..fe65a5077 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -190,6 +190,7 @@ ranger | |||
190 | keepass | 190 | keepass |
191 | keepass2 | 191 | keepass2 |
192 | keepassx | 192 | keepassx |
193 | keepassx2 | ||
193 | pluma | 194 | pluma |
194 | tracker | 195 | tracker |
195 | wireshark | 196 | wireshark |
@@ -204,4 +205,3 @@ gnome-weather | |||
204 | ark | 205 | ark |
205 | atool | 206 | atool |
206 | file-roller | 207 | file-roller |
207 | |||
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index adddf626b..890f281aa 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -532,29 +532,35 @@ void fs_proc_sys_dev_boot(void) { | |||
532 | disable_file(BLACKLIST_FILE, "/dev/port"); | 532 | disable_file(BLACKLIST_FILE, "/dev/port"); |
533 | 533 | ||
534 | 534 | ||
535 | // disable various ipc sockets | ||
536 | struct stat s; | ||
537 | 535 | ||
538 | // disable /run/user/{uid}/gnupg | 536 | // disable various ipc sockets in /run/user |
539 | char *fnamegpg; | 537 | struct stat s; |
540 | if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1) | 538 | |
541 | errExit("asprintf"); | 539 | char *fname; |
542 | if (stat(fnamegpg, &s) == -1) | 540 | if (asprintf(&fname, "/run/usr/%d", getuid()) == -1) |
543 | mkdir_attr(fnamegpg, 0700, getuid(), getgid()); | ||
544 | if (stat(fnamegpg, &s) == 0) | ||
545 | disable_file(BLACKLIST_FILE, fnamegpg); | ||
546 | free(fnamegpg); | ||
547 | |||
548 | // disable /run/user/{uid}/systemd | ||
549 | char *fnamesysd; | ||
550 | if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1) | ||
551 | errExit("asprintf"); | 541 | errExit("asprintf"); |
552 | if (stat(fnamesysd, &s) == -1) | 542 | if (is_dir(fname)) { // older distros don't have this directory |
553 | mkdir_attr(fnamesysd, 0755, getuid(), getgid()); | 543 | // disable /run/user/{uid}/gnupg |
554 | if (stat(fnamesysd, &s) == 0) | 544 | char *fnamegpg; |
555 | disable_file(BLACKLIST_FILE, fnamesysd); | 545 | if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1) |
556 | free(fnamesysd); | 546 | errExit("asprintf"); |
557 | 547 | if (stat(fnamegpg, &s) == -1) | |
548 | mkdir_attr(fnamegpg, 0700, getuid(), getgid()); | ||
549 | if (stat(fnamegpg, &s) == 0) | ||
550 | disable_file(BLACKLIST_FILE, fnamegpg); | ||
551 | free(fnamegpg); | ||
552 | |||
553 | // disable /run/user/{uid}/systemd | ||
554 | char *fnamesysd; | ||
555 | if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1) | ||
556 | errExit("asprintf"); | ||
557 | if (stat(fnamesysd, &s) == -1) | ||
558 | mkdir_attr(fnamesysd, 0755, getuid(), getgid()); | ||
559 | if (stat(fnamesysd, &s) == 0) | ||
560 | disable_file(BLACKLIST_FILE, fnamesysd); | ||
561 | free(fnamesysd); | ||
562 | } | ||
563 | free(fname); | ||
558 | 564 | ||
559 | // todo: investigate | 565 | // todo: investigate |
560 | #if 0 | 566 | #if 0 |
diff --git a/test/fcopy/dircopy.exp b/test/fcopy/dircopy.exp index 00b0204ae..dc8c80569 100755 --- a/test/fcopy/dircopy.exp +++ b/test/fcopy/dircopy.exp | |||
@@ -21,30 +21,58 @@ expect { | |||
21 | timeout {puts "TESTING ERROR 0\n";exit} | 21 | timeout {puts "TESTING ERROR 0\n";exit} |
22 | "dest/" | 22 | "dest/" |
23 | } | 23 | } |
24 | after 100 | ||
25 | |||
26 | send -- "find dest\r" | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 0\n";exit} | ||
29 | "dest/" | ||
30 | } | ||
31 | after 100 | ||
32 | |||
33 | send -- "find dest\r" | ||
24 | expect { | 34 | expect { |
25 | timeout {puts "TESTING ERROR 1\n";exit} | 35 | timeout {puts "TESTING ERROR 1\n";exit} |
26 | "dest/a" | 36 | "dest/a" |
27 | } | 37 | } |
38 | after 100 | ||
39 | |||
40 | send -- "find dest\r" | ||
28 | expect { | 41 | expect { |
29 | timeout {puts "TESTING ERROR 2\n";exit} | 42 | timeout {puts "TESTING ERROR 2\n";exit} |
30 | "dest/a/b" | 43 | "dest/a/b" |
31 | } | 44 | } |
45 | after 100 | ||
46 | |||
47 | send -- "find dest\r" | ||
32 | expect { | 48 | expect { |
33 | timeout {puts "TESTING ERROR 3\n";exit} | 49 | timeout {puts "TESTING ERROR 3\n";exit} |
34 | "dest/a/b/file4" | 50 | "dest/a/b/file4" |
35 | } | 51 | } |
52 | after 100 | ||
53 | |||
54 | send -- "find dest\r" | ||
36 | expect { | 55 | expect { |
37 | timeout {puts "TESTING ERROR 4\n";exit} | 56 | timeout {puts "TESTING ERROR 4\n";exit} |
38 | "dest/a/file3" | 57 | "dest/a/file3" |
39 | } | 58 | } |
59 | after 100 | ||
60 | |||
61 | send -- "find dest\r" | ||
40 | expect { | 62 | expect { |
41 | timeout {puts "TESTING ERROR 5\n";exit} | 63 | timeout {puts "TESTING ERROR 5\n";exit} |
42 | "dest/dircopy.exp" | 64 | "dest/dircopy.exp" |
43 | } | 65 | } |
66 | after 100 | ||
67 | |||
68 | send -- "find dest\r" | ||
44 | expect { | 69 | expect { |
45 | timeout {puts "TESTING ERROR 6\n";exit} | 70 | timeout {puts "TESTING ERROR 6\n";exit} |
46 | "dest/file2" | 71 | "dest/file2" |
47 | } | 72 | } |
73 | after 100 | ||
74 | |||
75 | send -- "find dest\r" | ||
48 | expect { | 76 | expect { |
49 | timeout {puts "TESTING ERROR 7\n";exit} | 77 | timeout {puts "TESTING ERROR 7\n";exit} |
50 | "dest/file1" | 78 | "dest/file1" |
diff --git a/test/fs/private-whitelist.exp b/test/fs/private-whitelist.exp index 4dadeacb1..6a1ad535c 100755 --- a/test/fs/private-whitelist.exp +++ b/test/fs/private-whitelist.exp | |||
@@ -34,6 +34,7 @@ expect { | |||
34 | "3" {puts "3\n"} | 34 | "3" {puts "3\n"} |
35 | "4" {puts "4\n"} | 35 | "4" {puts "4\n"} |
36 | "5" {puts "5\n"} | 36 | "5" {puts "5\n"} |
37 | "6" {puts "6\n"} | ||
37 | } | 38 | } |
38 | 39 | ||
39 | sleep 1 | 40 | sleep 1 |
diff --git a/test/fs/whitelist-dev.exp b/test/fs/whitelist-dev.exp index a19d5cedf..a2002bc0a 100755 --- a/test/fs/whitelist-dev.exp +++ b/test/fs/whitelist-dev.exp | |||
@@ -14,7 +14,7 @@ expect { | |||
14 | } | 14 | } |
15 | sleep 1 | 15 | sleep 1 |
16 | 16 | ||
17 | send -- "ls -l /dev | find /dev | wc -l\r" | 17 | send -- "find /dev | wc -l\r" |
18 | expect { | 18 | expect { |
19 | timeout {puts "TESTING ERROR 1\n";exit} | 19 | timeout {puts "TESTING ERROR 1\n";exit} |
20 | "2" | 20 | "2" |
@@ -23,17 +23,17 @@ after 100 | |||
23 | send -- "exit\r" | 23 | send -- "exit\r" |
24 | sleep 1 | 24 | sleep 1 |
25 | 25 | ||
26 | send -- "firejail --whitelist=/var/tmp --debug\r" | 26 | send -- "firejail --private-dev --debug\r" |
27 | expect { | 27 | expect { |
28 | timeout {puts "TESTING ERROR 0\n";exit} | 28 | timeout {puts "TESTING ERROR 2\n";exit} |
29 | "Child process initialized" | 29 | "Child process initialized" |
30 | } | 30 | } |
31 | sleep 1 | 31 | sleep 1 |
32 | 32 | ||
33 | send -- "ls -l /dev | find /dev | wc -l\r" | 33 | send -- "ls -l /dev | wc -l\r" |
34 | expect { | 34 | expect { |
35 | timeout {puts "TESTING ERROR 1\n";exit} | 35 | timeout {puts "TESTING ERROR 3\n";exit} |
36 | "2" | 36 | "13" |
37 | } | 37 | } |
38 | after 100 | 38 | after 100 |
39 | send -- "exit\r" | 39 | send -- "exit\r" |
diff --git a/test/utils/cpu-print.exp b/test/utils/cpu-print.exp index ca2e57313..0a6f46102 100755 --- a/test/utils/cpu-print.exp +++ b/test/utils/cpu-print.exp | |||
@@ -7,18 +7,34 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail --name=test --cpu=1,2\r" | 10 | send -- "firejail --name=test --cpu=0\r" |
11 | expect { | 11 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 12 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "Child process initialized" | 13 | "Child process initialized" |
14 | } | 14 | } |
15 | sleep 2 | 15 | sleep 1 |
16 | send -- "cat /proc/self/status | grep Cpus\r" | ||
17 | expect { | ||
18 | timeout {puts "TESTING ERROR 1\n";exit} | ||
19 | "Cpus_allowed_list: 0" | ||
20 | } | ||
21 | after 100 | ||
22 | send -- "exit\r" | ||
23 | sleep 1 | ||
24 | |||
25 | |||
26 | send -- "firejail --name=test --cpu=1\r" | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 1\n";exit} | ||
29 | "Child process initialized" | ||
30 | } | ||
31 | sleep 1 | ||
16 | 32 | ||
17 | spawn $env(SHELL) | 33 | spawn $env(SHELL) |
18 | send -- "firejail --cpu.print=test\r" | 34 | send -- "firejail --cpu.print=test\r" |
19 | expect { | 35 | expect { |
20 | timeout {puts "TESTING ERROR 1\n";exit} | 36 | timeout {puts "TESTING ERROR 2\n";exit} |
21 | "Cpus_allowed_list: 1-2" | 37 | "Cpus_allowed_list: 1" |
22 | } | 38 | } |
23 | after 100 | 39 | after 100 |
24 | puts "\nall done\n" | 40 | puts "\nall done\n" |
diff --git a/test/utils/trace.exp b/test/utils/trace.exp index 78a04b273..eedc0f23f 100755 --- a/test/utils/trace.exp +++ b/test/utils/trace.exp | |||
@@ -53,15 +53,15 @@ expect { | |||
53 | sleep 1 | 53 | sleep 1 |
54 | 54 | ||
55 | send -- "firejail --trace wget -q debian.org\r" | 55 | send -- "firejail --trace wget -q debian.org\r" |
56 | expect { | 56 | #expect { |
57 | timeout {puts "TESTING ERROR 8.1\n";exit} | 57 | # timeout {puts "TESTING ERROR 8.1\n";exit} |
58 | "Child process initialized" | 58 | # "Child process initialized" |
59 | } | 59 | #} |
60 | expect { | 60 | #expect { |
61 | timeout {puts "TESTING ERROR 8.2\n";exit} | 61 | # timeout {puts "TESTING ERROR 8.2\n";exit} |
62 | "bash:open /dev/tty" {puts "OK\n";} | 62 | # "bash:open /dev/tty" {puts "OK\n";} |
63 | "bash:open64 /dev/tty" {puts "OK\n";} | 63 | # "bash:open64 /dev/tty" {puts "OK\n";} |
64 | } | 64 | #} |
65 | expect { | 65 | expect { |
66 | timeout {puts "TESTING ERROR 8.3\n";exit} | 66 | timeout {puts "TESTING ERROR 8.3\n";exit} |
67 | "wget:fopen64 /etc/wgetrc" {puts "OK\n";} | 67 | "wget:fopen64 /etc/wgetrc" {puts "OK\n";} |