diff options
40 files changed, 457 insertions, 158 deletions
@@ -303,6 +303,9 @@ James Elford (https://github.com/jelford) | |||
303 | - blacklist sensitive cloud provider files in disable-common | 303 | - blacklist sensitive cloud provider files in disable-common |
304 | Jean Lucas (https://github.com/flacks) | 304 | Jean Lucas (https://github.com/flacks) |
305 | - fix Discord profile | 305 | - fix Discord profile |
306 | - add AnyDesk profile | ||
307 | - add WebStorm profile | ||
308 | - add XMind profile | ||
306 | Jericho (https://github.com/attritionorg) | 309 | Jericho (https://github.com/attritionorg) |
307 | - spelling | 310 | - spelling |
308 | Jesse Smith (https://github.com/slicer69) | 311 | Jesse Smith (https://github.com/slicer69) |
@@ -369,4 +369,5 @@ tilp, vivaldi-snapshot, bitcoin-qt, VS Code, falkon, gnome-builder, lobase, asun | |||
369 | gnome-recipes, akonadi_control, evince-previewer, evince-thumbnailer, blender-2.8, | 369 | gnome-recipes, akonadi_control, evince-previewer, evince-thumbnailer, blender-2.8, |
370 | thunderbird-beta, ncdu, gnome-logs, gcloud, musixmatch, gunzip, bunzip2, enchant, | 370 | thunderbird-beta, ncdu, gnome-logs, gcloud, musixmatch, gunzip, bunzip2, enchant, |
371 | enchant-2, enchant-lsmod, enchant-lsmod-2, Discord, acat, adiff, als, apack, arepack, | 371 | enchant-2, enchant-lsmod, enchant-lsmod-2, Discord, acat, adiff, als, apack, arepack, |
372 | aunpack profiles, ppsspp, scallion, clion, baloo_filemetadata_temp_extractor | 372 | aunpack profiles, ppsspp, scallion, clion, baloo_filemetadata_temp_extractor, |
373 | AnyDesk, webstorm, xmind | ||
@@ -43,7 +43,7 @@ firejail (0.9.53) baseline; urgency=low | |||
43 | * new profiles: musixmatch, gunzip, bunzip2, enchant-lsmod, enchant-lsmod-2, | 43 | * new profiles: musixmatch, gunzip, bunzip2, enchant-lsmod, enchant-lsmod-2, |
44 | * new profiles: enchant, enchant-2, Discord, acat, adiff, als, apack, | 44 | * new profiles: enchant, enchant-2, Discord, acat, adiff, als, apack, |
45 | * new profiles: arepack, aunpack profiles, ppsspp, scallion, clion, | 45 | * new profiles: arepack, aunpack profiles, ppsspp, scallion, clion, |
46 | * new profiles: baloo_filemetadata_temp_extractor | 46 | * new profiles: baloo_filemetadata_temp_extractor, AnyDesk, webstorm, xmind |
47 | -- netblue30 <netblue30@yahoo.com> Thu, 1 Mar 2018 08:00:00 -0500 | 47 | -- netblue30 <netblue30@yahoo.com> Thu, 1 Mar 2018 08:00:00 -0500 |
48 | 48 | ||
49 | firejail (0.9.52) baseline; urgency=low | 49 | firejail (0.9.52) baseline; urgency=low |
diff --git a/etc/XMind.profile b/etc/XMind.profile new file mode 100644 index 000000000..ff6258ca2 --- /dev/null +++ b/etc/XMind.profile | |||
@@ -0,0 +1,38 @@ | |||
1 | # Firejail profile for XMind | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include /etc/firejail/XMind.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.xmind | ||
9 | |||
10 | include /etc/firejail/disable-common.inc | ||
11 | include /etc/firejail/disable-devel.inc | ||
12 | include /etc/firejail/disable-interpreters.inc | ||
13 | include /etc/firejail/disable-passwdmgr.inc | ||
14 | include /etc/firejail/disable-programs.inc | ||
15 | |||
16 | mkdir ${HOME}/.xmind | ||
17 | whitelist ${HOME}/.xmind | ||
18 | whitelist ${DOWNLOADS} | ||
19 | include /etc/firejail/whitelist-common.inc | ||
20 | |||
21 | caps.drop all | ||
22 | netfilter | ||
23 | nodvd | ||
24 | nogroups | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | notv | ||
28 | protocol unix,inet,inet6 | ||
29 | seccomp | ||
30 | shell none | ||
31 | |||
32 | disable-mnt | ||
33 | private-bin XMind,sh,cp | ||
34 | private-tmp | ||
35 | private-dev | ||
36 | |||
37 | noexec ${HOME} | ||
38 | noexec /tmp | ||
diff --git a/etc/android-studio.profile b/etc/android-studio.profile index b87635ce3..5ff0b7c3a 100644 --- a/etc/android-studio.profile +++ b/etc/android-studio.profile | |||
@@ -32,7 +32,6 @@ protocol unix,inet,inet6 | |||
32 | seccomp | 32 | seccomp |
33 | shell none | 33 | shell none |
34 | 34 | ||
35 | private-dev | ||
36 | # private-tmp | 35 | # private-tmp |
37 | 36 | ||
38 | # noexec /tmp breaks 'Android Profiler' | 37 | # noexec /tmp breaks 'Android Profiler' |
diff --git a/etc/anydesk.profile b/etc/anydesk.profile new file mode 100644 index 000000000..17e083f4e --- /dev/null +++ b/etc/anydesk.profile | |||
@@ -0,0 +1,34 @@ | |||
1 | # Firejail profile for AnyDesk | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include /etc/firejail/anydesk.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.anydesk | ||
9 | |||
10 | include /etc/firejail/disable-common.inc | ||
11 | include /etc/firejail/disable-devel.inc | ||
12 | include /etc/firejail/disable-passwdmgr.inc | ||
13 | include /etc/firejail/disable-programs.inc | ||
14 | include /etc/firejail/disable-interpreters.inc | ||
15 | |||
16 | mkdir ${HOME}/.anydesk | ||
17 | whitelist ${HOME}/.anydesk | ||
18 | include /etc/firejail/whitelist-common.inc | ||
19 | |||
20 | caps.drop all | ||
21 | netfilter | ||
22 | nodvd | ||
23 | nogroups | ||
24 | nonewprivs | ||
25 | noroot | ||
26 | notv | ||
27 | protocol unix,inet,inet6 | ||
28 | seccomp | ||
29 | shell none | ||
30 | |||
31 | disable-mnt | ||
32 | private-bin anydesk | ||
33 | private-dev | ||
34 | private-tmp | ||
diff --git a/etc/baloo_filemetadata_temp_extractor.profile b/etc/baloo_filemetadata_temp_extractor.profile index 6d09ecf40..87f2949e6 100644 --- a/etc/baloo_filemetadata_temp_extractor.profile +++ b/etc/baloo_filemetadata_temp_extractor.profile | |||
@@ -1,11 +1,13 @@ | |||
1 | # Firejail profile for baloo_filemetadata_temp_extractor | 1 | # Firejail profile for baloo_filemetadata_temp_extractor |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | ||
4 | quiet | 3 | quiet |
4 | # Persistent local customizations | ||
5 | include /etc/firejail/baloo_filemetadata_temp_extractor.local | 5 | include /etc/firejail/baloo_filemetadata_temp_extractor.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include /etc/firejail/globals.local | 7 | include /etc/firejail/globals.local |
8 | 8 | ||
9 | ignore read-write | ||
10 | read-only ${HOME} | ||
9 | 11 | ||
10 | # Redirect | 12 | # Redirect |
11 | include /etc/firejail/baloo_file.profile | 13 | include /etc/firejail/baloo_file.profile |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index d3dc87089..ea334c289 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -23,10 +23,12 @@ blacklist ${HOME}/.Steampid | |||
23 | blacklist ${HOME}/.TelegramDesktop | 23 | blacklist ${HOME}/.TelegramDesktop |
24 | blacklist ${HOME}/.ViberPC | 24 | blacklist ${HOME}/.ViberPC |
25 | blacklist ${HOME}/.VirtualBox | 25 | blacklist ${HOME}/.VirtualBox |
26 | blacklist ${HOME}/.WebStorm* | ||
26 | blacklist ${HOME}/.Wolfram Research | 27 | blacklist ${HOME}/.Wolfram Research |
27 | blacklist ${HOME}/.ZAP | 28 | blacklist ${HOME}/.ZAP |
28 | blacklist ${HOME}/.aMule | 29 | blacklist ${HOME}/.aMule |
29 | blacklist ${HOME}/.android | 30 | blacklist ${HOME}/.android |
31 | blacklist ${HOME}/.anydesk | ||
30 | blacklist ${HOME}/.arduino15 | 32 | blacklist ${HOME}/.arduino15 |
31 | blacklist ${HOME}/.arm | 33 | blacklist ${HOME}/.arm |
32 | blacklist ${HOME}/.asunder_album_genre | 34 | blacklist ${HOME}/.asunder_album_genre |
@@ -346,7 +348,6 @@ blacklist ${HOME}/.kodi | |||
346 | blacklist ${HOME}/.linphone-history.db | 348 | blacklist ${HOME}/.linphone-history.db |
347 | blacklist ${HOME}/.linphonerc | 349 | blacklist ${HOME}/.linphonerc |
348 | blacklist ${HOME}/.lmmsrc.xml | 350 | blacklist ${HOME}/.lmmsrc.xml |
349 | blacklist ${HOME}/.local/lib/python2.7/site-packages | ||
350 | blacklist ${HOME}/.local/share/0ad | 351 | blacklist ${HOME}/.local/share/0ad |
351 | blacklist ${HOME}/.local/share/3909/PapersPlease | 352 | blacklist ${HOME}/.local/share/3909/PapersPlease |
352 | blacklist ${HOME}/.local/share/Empathy | 353 | blacklist ${HOME}/.local/share/Empathy |
@@ -504,6 +505,7 @@ blacklist ${HOME}/.wine | |||
504 | blacklist ${HOME}/.wireshark | 505 | blacklist ${HOME}/.wireshark |
505 | blacklist ${HOME}/.wine64 | 506 | blacklist ${HOME}/.wine64 |
506 | blacklist ${HOME}/.xiphos | 507 | blacklist ${HOME}/.xiphos |
508 | blacklist ${HOME}/.xmind | ||
507 | blacklist ${HOME}/.xmms | 509 | blacklist ${HOME}/.xmms |
508 | blacklist ${HOME}/.xmr-stak | 510 | blacklist ${HOME}/.xmr-stak |
509 | blacklist ${HOME}/.xonotic | 511 | blacklist ${HOME}/.xonotic |
diff --git a/etc/gajim.profile b/etc/gajim.profile index 02c818443..8e76352f4 100644 --- a/etc/gajim.profile +++ b/etc/gajim.profile | |||
@@ -9,9 +9,9 @@ noblacklist ${HOME}/.cache/gajim | |||
9 | noblacklist ${HOME}/.config/gajim | 9 | noblacklist ${HOME}/.config/gajim |
10 | noblacklist ${HOME}/.local/share/gajim | 10 | noblacklist ${HOME}/.local/share/gajim |
11 | 11 | ||
12 | # Allow python2.7 (blacklisted by disable-interpreters.inc) | 12 | # Allow Python (blacklisted by disable-interpreters.inc) |
13 | noblacklist ${PATH}/python2* | 13 | noblacklist ${PATH}/python3* |
14 | noblacklist /usr/lib/python2* | 14 | noblacklist /usr/lib/python3* |
15 | 15 | ||
16 | include /etc/firejail/disable-common.inc | 16 | include /etc/firejail/disable-common.inc |
17 | include /etc/firejail/disable-devel.inc | 17 | include /etc/firejail/disable-devel.inc |
@@ -21,12 +21,10 @@ include /etc/firejail/disable-programs.inc | |||
21 | 21 | ||
22 | mkdir ${HOME}/.cache/gajim | 22 | mkdir ${HOME}/.cache/gajim |
23 | mkdir ${HOME}/.config/gajim | 23 | mkdir ${HOME}/.config/gajim |
24 | mkdir ${HOME}/.local/lib/python2.7/site-packages/ | ||
25 | mkdir ${HOME}/.local/share/gajim | 24 | mkdir ${HOME}/.local/share/gajim |
26 | mkdir ${HOME}/Downloads | 25 | mkdir ${HOME}/Downloads |
27 | whitelist ${HOME}/.cache/gajim | 26 | whitelist ${HOME}/.cache/gajim |
28 | whitelist ${HOME}/.config/gajim | 27 | whitelist ${HOME}/.config/gajim |
29 | whitelist ${HOME}/.local/lib/python2.7/site-packages/ | ||
30 | whitelist ${HOME}/.local/share/gajim | 28 | whitelist ${HOME}/.local/share/gajim |
31 | whitelist ${HOME}/Downloads | 29 | whitelist ${HOME}/Downloads |
32 | include /etc/firejail/whitelist-common.inc | 30 | include /etc/firejail/whitelist-common.inc |
@@ -43,9 +41,7 @@ seccomp | |||
43 | shell none | 41 | shell none |
44 | 42 | ||
45 | disable-mnt | 43 | disable-mnt |
46 | private-bin python2.7,gajim | 44 | private-bin python,gajim |
47 | private-dev | 45 | private-dev |
48 | # private-etc fonts | 46 | private-etc alsa,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl |
49 | # private-tmp | 47 | private-tmp |
50 | # Allow the local python 2.7 site packages, in case any plugins are using these | ||
51 | read-only ${HOME}/.local/lib/python2.7/site-packages/ | ||
diff --git a/etc/kodi.profile b/etc/kodi.profile index 54d548291..85058da3e 100644 --- a/etc/kodi.profile +++ b/etc/kodi.profile | |||
@@ -19,6 +19,8 @@ include /etc/firejail/disable-interpreters.inc | |||
19 | include /etc/firejail/disable-passwdmgr.inc | 19 | include /etc/firejail/disable-passwdmgr.inc |
20 | include /etc/firejail/disable-programs.inc | 20 | include /etc/firejail/disable-programs.inc |
21 | 21 | ||
22 | include /etc/firejail/whitelist-var-common.inc | ||
23 | |||
22 | apparmor | 24 | apparmor |
23 | caps.drop all | 25 | caps.drop all |
24 | netfilter | 26 | netfilter |
diff --git a/etc/libreoffice.profile b/etc/libreoffice.profile index 4b3eb1ac7..18fcc59c6 100644 --- a/etc/libreoffice.profile +++ b/etc/libreoffice.profile | |||
@@ -23,20 +23,22 @@ include /etc/firejail/disable-programs.inc | |||
23 | 23 | ||
24 | include /etc/firejail/whitelist-var-common.inc | 24 | include /etc/firejail/whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | 26 | # Ubuntu 18.04 uses its own apparmor profile |
27 | # uncomment the next line if you are not on Ubuntu | ||
28 | #apparmor | ||
27 | caps.drop all | 29 | caps.drop all |
28 | machine-id | 30 | machine-id |
29 | netfilter | 31 | netfilter |
30 | nodbus | 32 | nodbus |
31 | nodvd | 33 | nodvd |
32 | nogroups | 34 | nogroups |
33 | nonewprivs | 35 | #nonewprivs - fix for Ubuntu 18.04/Debian 10 |
34 | noroot | 36 | noroot |
35 | notv | 37 | notv |
36 | protocol unix,inet,inet6 | 38 | #protocol unix,inet,inet6 - fix for Ubuntu 18.04/Debian 10 |
37 | seccomp | 39 | #seccomp - fix for Ubuntu 18.04/Debian 10 |
38 | shell none | 40 | shell none |
39 | tracelog | 41 | #tracelog - problems reported by Ubuntu 18.04 apparmor profile in /var/log/syslog |
40 | 42 | ||
41 | private-dev | 43 | private-dev |
42 | private-tmp | 44 | private-tmp |
diff --git a/etc/rhythmbox.profile b/etc/rhythmbox.profile index 38ccb886f..57e1ce5f0 100644 --- a/etc/rhythmbox.profile +++ b/etc/rhythmbox.profile | |||
@@ -8,7 +8,8 @@ include /etc/firejail/globals.local | |||
8 | 8 | ||
9 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-devel.inc | 10 | include /etc/firejail/disable-devel.inc |
11 | include /etc/firejail/disable-interpreters.inc | 11 | # rhythmbox is using Python |
12 | #include /etc/firejail/disable-interpreters.inc | ||
12 | include /etc/firejail/disable-passwdmgr.inc | 13 | include /etc/firejail/disable-passwdmgr.inc |
13 | include /etc/firejail/disable-programs.inc | 14 | include /etc/firejail/disable-programs.inc |
14 | 15 | ||
diff --git a/etc/vlc.profile b/etc/vlc.profile index 6b0bee7bd..9ccbb7310 100644 --- a/etc/vlc.profile +++ b/etc/vlc.profile | |||
@@ -17,7 +17,7 @@ include /etc/firejail/disable-programs.inc | |||
17 | 17 | ||
18 | include /etc/firejail/whitelist-var-common.inc | 18 | include /etc/firejail/whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | 20 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access |
21 | caps.drop all | 21 | caps.drop all |
22 | netfilter | 22 | netfilter |
23 | # nodbus - problems with KDE | 23 | # nodbus - problems with KDE |
diff --git a/etc/webstorm.profile b/etc/webstorm.profile new file mode 100644 index 000000000..6da71224f --- /dev/null +++ b/etc/webstorm.profile | |||
@@ -0,0 +1,36 @@ | |||
1 | # Firejail profile for WebStorm | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include /etc/firejail/webstorm.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.WebStorm* | ||
9 | noblacklist ${HOME}/.gitconfig | ||
10 | noblacklist ${HOME}/.java | ||
11 | noblacklist ${HOME}/.local/share/JetBrains | ||
12 | noblacklist ${HOME}/.ssh | ||
13 | noblacklist ${HOME}/.tooling | ||
14 | |||
15 | include /etc/firejail/disable-common.inc | ||
16 | include /etc/firejail/disable-passwdmgr.inc | ||
17 | include /etc/firejail/disable-programs.inc | ||
18 | include /etc/firejail/disable-devel.inc | ||
19 | include /etc/firejail/disable-interpreters.inc | ||
20 | |||
21 | caps.drop all | ||
22 | netfilter | ||
23 | nodvd | ||
24 | nogroups | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | notv | ||
28 | novideo | ||
29 | protocol unix,inet,inet6 | ||
30 | seccomp | ||
31 | shell none | ||
32 | |||
33 | private-dev | ||
34 | # private-tmp | ||
35 | |||
36 | noexec /tmp | ||
diff --git a/platform/rpm/firejail.spec b/platform/rpm/firejail.spec index 9fe35e528..76d19ba17 100644 --- a/platform/rpm/firejail.spec +++ b/platform/rpm/firejail.spec | |||
@@ -19,7 +19,7 @@ using Linux namespaces. It includes a sandbox profile for Mozilla Firefox. | |||
19 | %setup -q | 19 | %setup -q |
20 | 20 | ||
21 | %build | 21 | %build |
22 | %configure --disable-userns | 22 | %configure --disable-userns --disable-contrib-install |
23 | make %{?_smp_mflags} | 23 | make %{?_smp_mflags} |
24 | 24 | ||
25 | %install | 25 | %install |
@@ -46,4 +46,4 @@ rm -rf %{buildroot} | |||
46 | %{_mandir}/man5/__NAME__-login.5.gz | 46 | %{_mandir}/man5/__NAME__-login.5.gz |
47 | %{_mandir}/man5/__NAME__-profile.5.gz | 47 | %{_mandir}/man5/__NAME__-profile.5.gz |
48 | %{_mandir}/man5/__NAME__-users.5.gz | 48 | %{_mandir}/man5/__NAME__-users.5.gz |
49 | %config %{_sysconfdir}/__NAME__ | 49 | %config(noreplace) %{_sysconfdir}/__NAME__ |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 1835502a4..da8937717 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -15,12 +15,14 @@ Viber | |||
15 | VirtualBox | 15 | VirtualBox |
16 | Wire | 16 | Wire |
17 | Xephyr | 17 | Xephyr |
18 | XMind | ||
18 | abrowser | 19 | abrowser |
19 | akonadi_control | 20 | akonadi_control |
20 | akregator | 21 | akregator |
21 | amarok | 22 | amarok |
22 | amule | 23 | amule |
23 | android-studio | 24 | android-studio |
25 | anydesk | ||
24 | apktool | 26 | apktool |
25 | arch-audit | 27 | arch-audit |
26 | archaudit-report | 28 | archaudit-report |
@@ -273,7 +275,7 @@ musescore | |||
273 | musixmatch | 275 | musixmatch |
274 | mutt | 276 | mutt |
275 | natron | 277 | natron |
276 | nautilus | 278 | #nautilus - removed in order to let the application start in a new sandbox when clicking on icons in the file manager |
277 | ncdu | 279 | ncdu |
278 | netsurf | 280 | netsurf |
279 | neverball | 281 | neverball |
@@ -298,7 +300,7 @@ pdftotext | |||
298 | peek | 300 | peek |
299 | picard | 301 | picard |
300 | pidgin | 302 | pidgin |
301 | ping | 303 | #ping - disabled until we fix #1912 |
302 | pingus | 304 | pingus |
303 | pinta | 305 | pinta |
304 | pithos | 306 | pithos |
@@ -331,6 +333,7 @@ ristretto | |||
331 | rocketchat | 333 | rocketchat |
332 | rtorrent | 334 | rtorrent |
333 | runenpass.sh | 335 | runenpass.sh |
336 | scallion | ||
334 | scribus | 337 | scribus |
335 | sdat2img | 338 | sdat2img |
336 | seamonkey | 339 | seamonkey |
@@ -410,6 +413,7 @@ vym | |||
410 | w3m | 413 | w3m |
411 | warzone2100 | 414 | warzone2100 |
412 | waterfox | 415 | waterfox |
416 | webstorm | ||
413 | weechat | 417 | weechat |
414 | weechat-curses | 418 | weechat-curses |
415 | wesnoth | 419 | wesnoth |
diff --git a/src/firecfg/util.c b/src/firecfg/util.c index f0446ca8d..7ed86c36e 100644 --- a/src/firecfg/util.c +++ b/src/firecfg/util.c | |||
@@ -58,9 +58,15 @@ int which(const char *program) { | |||
58 | // use path2 to count the entries | 58 | // use path2 to count the entries |
59 | char *ptr = strtok(path2, ":"); | 59 | char *ptr = strtok(path2, ":"); |
60 | while (ptr) { | 60 | while (ptr) { |
61 | if (find(program, ptr)) { | 61 | // Ubuntu 18.04 is adding /snap/bin to PATH; |
62 | free(path2); | 62 | // they populate /snap/bin with simbolic links to /usr/bin/ programs; |
63 | return 1; | 63 | // most simlinked programs are not installed by default. |
64 | // Removing /snap/bin from our search | ||
65 | if (strcmp(ptr, "/snap/bin") != 0) { | ||
66 | if (find(program, ptr)) { | ||
67 | free(path2); | ||
68 | return 1; | ||
69 | } | ||
64 | } | 70 | } |
65 | ptr = strtok(NULL, ":"); | 71 | ptr = strtok(NULL, ":"); |
66 | } | 72 | } |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 0df832c09..14f87c36c 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -524,6 +524,16 @@ unsigned extract_timeout(const char *str); | |||
524 | void disable_file_or_dir(const char *fname); | 524 | void disable_file_or_dir(const char *fname); |
525 | void disable_file_path(const char *path, const char *file); | 525 | void disable_file_path(const char *path, const char *file); |
526 | 526 | ||
527 | // Get info regarding the last kernel mount operation. | ||
528 | // The return value points to a static area, and will be overwritten by subsequent calls. | ||
529 | // The function does an exit(1) if anything goes wrong. | ||
530 | typedef struct { | ||
531 | char *fsname; | ||
532 | char *dir; | ||
533 | } MountData; | ||
534 | MountData *get_last_mount(void); | ||
535 | |||
536 | |||
527 | // fs_var.c | 537 | // fs_var.c |
528 | void fs_var_log(void); // mounting /var/log | 538 | void fs_var_log(void); // mounting /var/log |
529 | void fs_var_lib(void); // various other fixes for software in /var directory | 539 | void fs_var_lib(void); // various other fixes for software in /var directory |
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c index d4cdbbe0a..b0ad35299 100644 --- a/src/firejail/fs_bin.c +++ b/src/firejail/fs_bin.c | |||
@@ -25,6 +25,8 @@ | |||
25 | #include <unistd.h> | 25 | #include <unistd.h> |
26 | #include <glob.h> | 26 | #include <glob.h> |
27 | 27 | ||
28 | static int prog_cnt = 0; | ||
29 | |||
28 | static char *paths[] = { | 30 | static char *paths[] = { |
29 | "/usr/local/bin", | 31 | "/usr/local/bin", |
30 | "/usr/bin", | 32 | "/usr/bin", |
@@ -191,6 +193,7 @@ static void duplicate(char *fname, FILE *fplist) { | |||
191 | // solving problems such as /bin/sh -> /bin/dash | 193 | // solving problems such as /bin/sh -> /bin/dash |
192 | // copy the real file pointed by symlink | 194 | // copy the real file pointed by symlink |
193 | sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, actual_path, RUN_BIN_DIR); | 195 | sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, actual_path, RUN_BIN_DIR); |
196 | prog_cnt++; | ||
194 | char *f = strrchr(actual_path, '/'); | 197 | char *f = strrchr(actual_path, '/'); |
195 | if (f && *(++f) !='\0') | 198 | if (f && *(++f) !='\0') |
196 | report_duplication(f); | 199 | report_duplication(f); |
@@ -201,6 +204,7 @@ static void duplicate(char *fname, FILE *fplist) { | |||
201 | 204 | ||
202 | // copy a file or a symlink | 205 | // copy a file or a symlink |
203 | sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR); | 206 | sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR); |
207 | prog_cnt++; | ||
204 | free(full_path); | 208 | free(full_path); |
205 | report_duplication(fname); | 209 | report_duplication(fname); |
206 | } | 210 | } |
@@ -256,6 +260,9 @@ void fs_private_bin_list(void) { | |||
256 | char *private_list = cfg.bin_private_keep; | 260 | char *private_list = cfg.bin_private_keep; |
257 | assert(private_list); | 261 | assert(private_list); |
258 | 262 | ||
263 | // start timetrace | ||
264 | timetrace_start(); | ||
265 | |||
259 | // create /run/firejail/mnt/bin directory | 266 | // create /run/firejail/mnt/bin directory |
260 | mkdir_attr(RUN_BIN_DIR, 0755, 0, 0); | 267 | mkdir_attr(RUN_BIN_DIR, 0755, 0, 0); |
261 | 268 | ||
@@ -298,4 +305,5 @@ void fs_private_bin_list(void) { | |||
298 | } | 305 | } |
299 | i++; | 306 | i++; |
300 | } | 307 | } |
308 | fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end()); | ||
301 | } | 309 | } |
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c index 8a105be97..363b48d1d 100644 --- a/src/firejail/fs_lib.c +++ b/src/firejail/fs_lib.c | |||
@@ -201,7 +201,7 @@ static char *valid_file(const char *lib) { | |||
201 | } | 201 | } |
202 | free(fname); | 202 | free(fname); |
203 | } | 203 | } |
204 | printf("not found %s\n", lib); | 204 | |
205 | fwarning("%s library not found, skipping...\n", lib); | 205 | fwarning("%s library not found, skipping...\n", lib); |
206 | return NULL; | 206 | return NULL; |
207 | } | 207 | } |
@@ -352,7 +352,7 @@ void fs_private_lib(void) { | |||
352 | fslib_copy_dir(name); | 352 | fslib_copy_dir(name); |
353 | free(name); | 353 | free(name); |
354 | 354 | ||
355 | // /usr/lib/x86_linux-gnu - debian & frriends | 355 | // /usr/lib/x86_linux-gnu - debian & friends |
356 | if (asprintf(&name, "/usr/lib/x86_64-linux-gnu/%s", ptr) == -1) | 356 | if (asprintf(&name, "/usr/lib/x86_64-linux-gnu/%s", ptr) == -1) |
357 | errExit("asprintf"); | 357 | errExit("asprintf"); |
358 | if (is_dir(name)) | 358 | if (is_dir(name)) |
@@ -377,20 +377,12 @@ void fs_private_lib(void) { | |||
377 | printf("*** Installing system libraries\n"); | 377 | printf("*** Installing system libraries\n"); |
378 | fslib_install_system(); | 378 | fslib_install_system(); |
379 | 379 | ||
380 | fmessage("Installed %d libraries and %d directories\n", lib_cnt, dir_cnt); | 380 | fmessage("Installed %d %s and %d %s\n", lib_cnt, (lib_cnt == 1)? "library": "libraries", |
381 | dir_cnt, (dir_cnt == 1)? "directory": "directories"); | ||
381 | 382 | ||
382 | // bring in firejail directory for --trace options | 383 | // bring in firejail directory for --trace and seccomp post exec |
383 | fslib_copy_dir(LIBDIR "/firejail"); | 384 | fslib_copy_dir(LIBDIR "/firejail"); |
384 | 385 | ||
385 | // ... and for sandbox in sandbox functionality | ||
386 | fslib_copy_libs(LIBDIR "/firejail/faudit"); | ||
387 | fslib_copy_libs(LIBDIR "/firejail/fbuilder"); | ||
388 | fslib_copy_libs(LIBDIR "/firejail/fcopy"); | ||
389 | fslib_copy_libs(LIBDIR "/firejail/fldd"); | ||
390 | fslib_copy_libs(LIBDIR "/firejail/fnet"); | ||
391 | fslib_copy_libs(LIBDIR "/firejail/fnetfilter"); | ||
392 | fslib_copy_libs(LIBDIR "/firejail/fseccomp"); | ||
393 | fslib_copy_libs(LIBDIR "/firejail/ftee"); | ||
394 | // mount lib filesystem | 386 | // mount lib filesystem |
395 | mount_directories(); | 387 | mount_directories(); |
396 | } | 388 | } |
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index d4c7de342..60bb0f6ed 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c | |||
@@ -317,6 +317,16 @@ static void whitelist_path(ProfileEntry *entry) { | |||
317 | if (mount(wfile, path, NULL, MS_BIND|MS_REC, NULL) < 0) | 317 | if (mount(wfile, path, NULL, MS_BIND|MS_REC, NULL) < 0) |
318 | errExit("mount bind"); | 318 | errExit("mount bind"); |
319 | 319 | ||
320 | // check the last mount operation | ||
321 | MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found | ||
322 | |||
323 | // No mounts are allowed on top level directories. A destination such as "/etc" is very bad! | ||
324 | // - there should be more than one '/' char in dest string | ||
325 | if (mptr->dir == strrchr(mptr->dir, '/')) { | ||
326 | fprintf(stderr, "Error: invalid mount on top of %s\n", mptr->dir); | ||
327 | exit(1); | ||
328 | } | ||
329 | |||
320 | free(wfile); | 330 | free(wfile); |
321 | return; | 331 | return; |
322 | 332 | ||
@@ -859,6 +869,15 @@ void fs_whitelist(void) { | |||
859 | fprintf(stderr, "Warning cannot create symbolic link %s\n", entry->link); | 869 | fprintf(stderr, "Warning cannot create symbolic link %s\n", entry->link); |
860 | else if (arg_debug || arg_debug_whitelists) | 870 | else if (arg_debug || arg_debug_whitelists) |
861 | printf("Created symbolic link %s -> %s\n", entry->link, entry->data + 10); | 871 | printf("Created symbolic link %s -> %s\n", entry->link, entry->data + 10); |
872 | |||
873 | // check again for files in /tmp directory | ||
874 | if (strncmp(entry->link, "/tmp/", 5) == 0) { | ||
875 | char *path = realpath(entry->link, NULL); | ||
876 | if (path == NULL || strncmp(path, "/tmp/", 5) != 0) { | ||
877 | fprintf(stderr, "Error: invalid symbolic link %s\n", entry->link); | ||
878 | exit(1); | ||
879 | } | ||
880 | } | ||
862 | } | 881 | } |
863 | } | 882 | } |
864 | } | 883 | } |
diff --git a/src/firejail/util.c b/src/firejail/util.c index a44e52e98..f441f283f 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -1029,3 +1029,39 @@ void disable_file_path(const char *path, const char *file) { | |||
1029 | free(fname); | 1029 | free(fname); |
1030 | } | 1030 | } |
1031 | 1031 | ||
1032 | #define MAX_BUF 4096 | ||
1033 | static char mbuf[MAX_BUF]; | ||
1034 | static MountData mdata; | ||
1035 | |||
1036 | // Get info regarding the last kernel mount operation. | ||
1037 | // The return value points to a static area, and will be overwritten by subsequent calls. | ||
1038 | // The function does an exit(1) if anything goes wrong. | ||
1039 | MountData *get_last_mount(void) { | ||
1040 | // open /proc/self/mounts | ||
1041 | FILE *fp = fopen("/proc/self/mounts", "r"); | ||
1042 | if (!fp) | ||
1043 | goto errexit; | ||
1044 | |||
1045 | mbuf[0] = '\0'; | ||
1046 | while (fgets(mbuf, MAX_BUF, fp)); | ||
1047 | fclose(fp); | ||
1048 | if (arg_debug || arg_debug_whitelists) | ||
1049 | printf("%s", mbuf); | ||
1050 | |||
1051 | // there should be no reason to have a new mount on top of a top level directory | ||
1052 | mdata.fsname = mbuf; | ||
1053 | mdata.dir = strstr(mbuf, " "); | ||
1054 | if (!mdata.dir) | ||
1055 | goto errexit; | ||
1056 | mdata.dir++; | ||
1057 | char *end = strstr(mdata.dir, " "); | ||
1058 | if (!end) | ||
1059 | goto errexit; | ||
1060 | *end = '\0'; | ||
1061 | |||
1062 | return &mdata; | ||
1063 | |||
1064 | errexit: | ||
1065 | fprintf(stderr, "Error: cannot read /proc/self/mounts"); | ||
1066 | exit(1); | ||
1067 | } | ||
diff --git a/src/fldd/main.c b/src/fldd/main.c index be4500d2a..4658e82fb 100644 --- a/src/fldd/main.c +++ b/src/fldd/main.c | |||
@@ -340,10 +340,8 @@ printf("\n"); | |||
340 | else { | 340 | else { |
341 | if (is_lib_64(argv[1])) | 341 | if (is_lib_64(argv[1])) |
342 | parse_elf(argv[1]); | 342 | parse_elf(argv[1]); |
343 | else { | 343 | else |
344 | fprintf(stderr, "Error fldd: %s is not a 64bit program/library\n", argv[1]); | 344 | fprintf(stderr, "Warning fldd: %s is not a 64bit program/library\n", argv[1]); |
345 | exit(1); | ||
346 | } | ||
347 | } | 345 | } |
348 | 346 | ||
349 | 347 | ||
diff --git a/src/lib/firejail_user.c b/src/lib/firejail_user.c index 09a4da0e7..0cc0ac6c1 100644 --- a/src/lib/firejail_user.c +++ b/src/lib/firejail_user.c | |||
@@ -47,7 +47,8 @@ int firejail_user_check(const char *name) { | |||
47 | return 1; | 47 | return 1; |
48 | 48 | ||
49 | // other system users will run the program as is | 49 | // other system users will run the program as is |
50 | if (getuid() < UID_MIN || strcmp(name, "nobody") == 0) | 50 | uid_t uid = getuid(); |
51 | if ((uid < UID_MIN && uid != 0) || strcmp(name, "nobody") == 0) | ||
51 | return 0; | 52 | return 0; |
52 | 53 | ||
53 | // check file existence | 54 | // check file existence |
diff --git a/test/apps-x11-xorg/apps-x11-xorg.sh b/test/apps-x11-xorg/apps-x11-xorg.sh index 32331f786..ea07d3713 100755 --- a/test/apps-x11-xorg/apps-x11-xorg.sh +++ b/test/apps-x11-xorg/apps-x11-xorg.sh | |||
@@ -6,7 +6,7 @@ | |||
6 | export MALLOC_CHECK_=3 | 6 | export MALLOC_CHECK_=3 |
7 | export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) | 7 | export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) |
8 | 8 | ||
9 | which firefox | 9 | which firefox 2>/dev/null |
10 | if [ "$?" -eq 0 ]; | 10 | if [ "$?" -eq 0 ]; |
11 | then | 11 | then |
12 | echo "TESTING: firefox x11 xorg" | 12 | echo "TESTING: firefox x11 xorg" |
@@ -15,7 +15,7 @@ else | |||
15 | echo "TESTING SKIP: firefox not found" | 15 | echo "TESTING SKIP: firefox not found" |
16 | fi | 16 | fi |
17 | 17 | ||
18 | which transmission-gtk | 18 | which transmission-gtk 2>/dev/null |
19 | if [ "$?" -eq 0 ]; | 19 | if [ "$?" -eq 0 ]; |
20 | then | 20 | then |
21 | echo "TESTING: transmission-gtk x11 xorg" | 21 | echo "TESTING: transmission-gtk x11 xorg" |
@@ -24,7 +24,7 @@ else | |||
24 | echo "TESTING SKIP: transmission-gtk not found" | 24 | echo "TESTING SKIP: transmission-gtk not found" |
25 | fi | 25 | fi |
26 | 26 | ||
27 | which thunderbird | 27 | which thunderbird 2>/dev/null |
28 | if [ "$?" -eq 0 ]; | 28 | if [ "$?" -eq 0 ]; |
29 | then | 29 | then |
30 | echo "TESTING: thunderbird x11 xorg" | 30 | echo "TESTING: thunderbird x11 xorg" |
diff --git a/test/apps-x11/apps-x11.sh b/test/apps-x11/apps-x11.sh index 2e0031dd9..c12b11f3e 100755 --- a/test/apps-x11/apps-x11.sh +++ b/test/apps-x11/apps-x11.sh | |||
@@ -10,20 +10,20 @@ echo "TESTING: no x11 (test/apps-x11/x11-none.exp)" | |||
10 | ./x11-none.exp | 10 | ./x11-none.exp |
11 | 11 | ||
12 | 12 | ||
13 | which xterm | 13 | which xterm 2>/dev/null |
14 | if [ "$?" -eq 0 ]; | 14 | if [ "$?" -eq 0 ]; |
15 | then | 15 | then |
16 | echo "TESTING: xterm x11 xorg" | 16 | echo "TESTING: xterm x11 xorg" |
17 | ./xterm-xorg.exp | 17 | ./xterm-xorg.exp |
18 | 18 | ||
19 | which xpra | 19 | which xpra 2>/dev/null |
20 | if [ "$?" -eq 0 ]; | 20 | if [ "$?" -eq 0 ]; |
21 | then | 21 | then |
22 | echo "TESTING: xterm x11 xpra" | 22 | echo "TESTING: xterm x11 xpra" |
23 | ./xterm-xpra.exp | 23 | ./xterm-xpra.exp |
24 | fi | 24 | fi |
25 | 25 | ||
26 | which Xephyr | 26 | which Xephyr 2>/dev/null |
27 | if [ "$?" -eq 0 ]; | 27 | if [ "$?" -eq 0 ]; |
28 | then | 28 | then |
29 | echo "TESTING: xterm x11 xephyr" | 29 | echo "TESTING: xterm x11 xephyr" |
@@ -34,13 +34,13 @@ else | |||
34 | fi | 34 | fi |
35 | 35 | ||
36 | # check xpra/xephyr | 36 | # check xpra/xephyr |
37 | which xpra | 37 | which xpra 2>/dev/null |
38 | if [ "$?" -eq 0 ]; | 38 | if [ "$?" -eq 0 ]; |
39 | then | 39 | then |
40 | echo "xpra found" | 40 | echo "xpra found" |
41 | else | 41 | else |
42 | echo "xpra not found" | 42 | echo "xpra not found" |
43 | which Xephyr | 43 | which Xephyr 2>/dev/null |
44 | if [ "$?" -eq 0 ]; | 44 | if [ "$?" -eq 0 ]; |
45 | then | 45 | then |
46 | echo "Xephyr found" | 46 | echo "Xephyr found" |
@@ -50,7 +50,7 @@ else | |||
50 | fi | 50 | fi |
51 | fi | 51 | fi |
52 | 52 | ||
53 | which firefox | 53 | which firefox 2>/dev/null |
54 | if [ "$?" -eq 0 ]; | 54 | if [ "$?" -eq 0 ]; |
55 | then | 55 | then |
56 | echo "TESTING: firefox x11" | 56 | echo "TESTING: firefox x11" |
@@ -59,7 +59,7 @@ else | |||
59 | echo "TESTING SKIP: firefox not found" | 59 | echo "TESTING SKIP: firefox not found" |
60 | fi | 60 | fi |
61 | 61 | ||
62 | which chromium | 62 | which chromium 2>/dev/null |
63 | if [ "$?" -eq 0 ]; | 63 | if [ "$?" -eq 0 ]; |
64 | then | 64 | then |
65 | echo "TESTING: chromium x11" | 65 | echo "TESTING: chromium x11" |
@@ -68,7 +68,7 @@ else | |||
68 | echo "TESTING SKIP: chromium not found" | 68 | echo "TESTING SKIP: chromium not found" |
69 | fi | 69 | fi |
70 | 70 | ||
71 | which transmission-gtk | 71 | which transmission-gtk 2>/dev/null |
72 | if [ "$?" -eq 0 ]; | 72 | if [ "$?" -eq 0 ]; |
73 | then | 73 | then |
74 | echo "TESTING: transmission-gtk x11" | 74 | echo "TESTING: transmission-gtk x11" |
@@ -77,7 +77,7 @@ else | |||
77 | echo "TESTING SKIP: transmission-gtk not found" | 77 | echo "TESTING SKIP: transmission-gtk not found" |
78 | fi | 78 | fi |
79 | 79 | ||
80 | which thunderbird | 80 | which thunderbird 2>/dev/null |
81 | if [ "$?" -eq 0 ]; | 81 | if [ "$?" -eq 0 ]; |
82 | then | 82 | then |
83 | echo "TESTING: thunderbird x11" | 83 | echo "TESTING: thunderbird x11" |
diff --git a/test/apps/apps.sh b/test/apps/apps.sh index 4e0a9cc08..a3d0c4dc7 100755 --- a/test/apps/apps.sh +++ b/test/apps/apps.sh | |||
@@ -10,7 +10,7 @@ LIST="firefox midori chromium opera transmission-qt qbittorrent uget-gtk filezil | |||
10 | LIST+="vlc fbreader deluge gnome-mplayer xchat wine kcalc ktorrent hexchat" | 10 | LIST+="vlc fbreader deluge gnome-mplayer xchat wine kcalc ktorrent hexchat" |
11 | 11 | ||
12 | for app in $LIST; do | 12 | for app in $LIST; do |
13 | which $app | 13 | which $app 2>/dev/null |
14 | if [ "$?" -eq 0 ]; | 14 | if [ "$?" -eq 0 ]; |
15 | then | 15 | then |
16 | echo "TESTING: $app" | 16 | echo "TESTING: $app" |
diff --git a/test/arguments/arguments.sh b/test/arguments/arguments.sh index 049236900..d9f2d4697 100755 --- a/test/arguments/arguments.sh +++ b/test/arguments/arguments.sh | |||
@@ -3,10 +3,8 @@ | |||
3 | if [ -f /etc/debian_version ]; then | 3 | if [ -f /etc/debian_version ]; then |
4 | libdir=$(dirname "$(dpkg -L firejail | grep faudit)") | 4 | libdir=$(dirname "$(dpkg -L firejail | grep faudit)") |
5 | export PATH="$PATH:$libdir" | 5 | export PATH="$PATH:$libdir" |
6 | else | ||
7 | export PATH="$PATH:/usr/lib/firejail" | ||
8 | fi | 6 | fi |
9 | export PATH="$PATH:/usr/lib/firejail" | 7 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" |
10 | 8 | ||
11 | echo "TESTING: 1. regular bash session" | 9 | echo "TESTING: 1. regular bash session" |
12 | ./bashrun.exp | 10 | ./bashrun.exp |
diff --git a/test/environment/environment.sh b/test/environment/environment.sh index 364a4b65b..97ba8ba58 100755 --- a/test/environment/environment.sh +++ b/test/environment/environment.sh | |||
@@ -38,7 +38,7 @@ echo "TESTING: environment variables (test/environment/env.exp)" | |||
38 | echo "TESTING: shell none(test/environment/shell-none.exp)" | 38 | echo "TESTING: shell none(test/environment/shell-none.exp)" |
39 | ./shell-none.exp | 39 | ./shell-none.exp |
40 | 40 | ||
41 | which dash | 41 | which dash 2>/dev/null |
42 | if [ "$?" -eq 0 ]; | 42 | if [ "$?" -eq 0 ]; |
43 | then | 43 | then |
44 | echo "TESTING: dash (test/environment/dash.exp)" | 44 | echo "TESTING: dash (test/environment/dash.exp)" |
@@ -47,7 +47,7 @@ else | |||
47 | echo "TESTING SKIP: dash not found" | 47 | echo "TESTING SKIP: dash not found" |
48 | fi | 48 | fi |
49 | 49 | ||
50 | which csh | 50 | which csh 2>/dev/null |
51 | if [ "$?" -eq 0 ]; | 51 | if [ "$?" -eq 0 ]; |
52 | then | 52 | then |
53 | echo "TESTING: csh (test/environment/csh.exp)" | 53 | echo "TESTING: csh (test/environment/csh.exp)" |
@@ -56,7 +56,7 @@ else | |||
56 | echo "TESTING SKIP: csh not found" | 56 | echo "TESTING SKIP: csh not found" |
57 | fi | 57 | fi |
58 | 58 | ||
59 | which zsh | 59 | which zsh 2>/dev/null |
60 | if [ "$?" -eq 0 ]; | 60 | if [ "$?" -eq 0 ]; |
61 | then | 61 | then |
62 | echo "TESTING: zsh (test/environment/zsh.exp)" | 62 | echo "TESTING: zsh (test/environment/zsh.exp)" |
@@ -68,7 +68,7 @@ fi | |||
68 | echo "TESTING: firejail in firejail - single sandbox (test/environment/firejail-in-firejail.exp)" | 68 | echo "TESTING: firejail in firejail - single sandbox (test/environment/firejail-in-firejail.exp)" |
69 | ./firejail-in-firejail.exp | 69 | ./firejail-in-firejail.exp |
70 | 70 | ||
71 | which aplay | 71 | which aplay 2>/dev/null |
72 | if [ "$?" -eq 0 ]; | 72 | if [ "$?" -eq 0 ]; |
73 | then | 73 | then |
74 | echo "TESTING: sound (test/environment/sound.exp)" | 74 | echo "TESTING: sound (test/environment/sound.exp)" |
@@ -83,7 +83,7 @@ echo "TESTING: nice (test/environment/nice.exp)" | |||
83 | echo "TESTING: quiet (test/environment/quiet.exp)" | 83 | echo "TESTING: quiet (test/environment/quiet.exp)" |
84 | ./quiet.exp | 84 | ./quiet.exp |
85 | 85 | ||
86 | which strace | 86 | which strace 2>/dev/null |
87 | if [ "$?" -eq 0 ]; | 87 | if [ "$?" -eq 0 ]; |
88 | then | 88 | then |
89 | echo "TESTING: --allow-debuggers (test/environment/allow-debuggers.exp)" | 89 | echo "TESTING: --allow-debuggers (test/environment/allow-debuggers.exp)" |
diff --git a/test/fcopy/fcopy.sh b/test/fcopy/fcopy.sh index 0e7cb2e5e..b225f9ea0 100755 --- a/test/fcopy/fcopy.sh +++ b/test/fcopy/fcopy.sh | |||
@@ -11,7 +11,7 @@ if [ -f /etc/debian_version ]; then | |||
11 | export PATH="$PATH:$libdir" | 11 | export PATH="$PATH:$libdir" |
12 | fi | 12 | fi |
13 | 13 | ||
14 | export PATH="$PATH:/usr/lib/firejail" | 14 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" |
15 | 15 | ||
16 | mkdir dest | 16 | mkdir dest |
17 | 17 | ||
diff --git a/test/filters/filters.sh b/test/filters/filters.sh index 97ecc8be0..d0a34ccc5 100755 --- a/test/filters/filters.sh +++ b/test/filters/filters.sh | |||
@@ -9,11 +9,9 @@ export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) | |||
9 | if [ -f /etc/debian_version ]; then | 9 | if [ -f /etc/debian_version ]; then |
10 | libdir=$(dirname "$(dpkg -L firejail | grep fseccomp)") | 10 | libdir=$(dirname "$(dpkg -L firejail | grep fseccomp)") |
11 | export PATH="$PATH:$libdir" | 11 | export PATH="$PATH:$libdir" |
12 | else | ||
13 | export PATH="$PATH:/usr/lib/firejail" | ||
14 | fi | 12 | fi |
13 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" | ||
15 | 14 | ||
16 | export PATH="$PATH:/usr/lib/firejail" | ||
17 | 15 | ||
18 | if [ "$(uname -m)" = "x86_64" ]; then | 16 | if [ "$(uname -m)" = "x86_64" ]; then |
19 | echo "TESTING: memory-deny-write-execute (test/filters/memwrexe.exp)" | 17 | echo "TESTING: memory-deny-write-execute (test/filters/memwrexe.exp)" |
@@ -79,7 +77,7 @@ echo "TESTING: seccomp errno (test/filters/seccomp-errno.exp)" | |||
79 | echo "TESTING: seccomp su (test/filters/seccomp-su.exp)" | 77 | echo "TESTING: seccomp su (test/filters/seccomp-su.exp)" |
80 | ./seccomp-su.exp | 78 | ./seccomp-su.exp |
81 | 79 | ||
82 | which strace | 80 | which strace 2>/dev/null |
83 | if [ $? -eq 0 ]; then | 81 | if [ $? -eq 0 ]; then |
84 | echo "TESTING: seccomp ptrace (test/filters/seccomp-ptrace.exp)" | 82 | echo "TESTING: seccomp ptrace (test/filters/seccomp-ptrace.exp)" |
85 | ./seccomp-ptrace.exp | 83 | ./seccomp-ptrace.exp |
diff --git a/test/fnetfilter/fnetfilter.sh b/test/fnetfilter/fnetfilter.sh index bae952ee9..aa2eb707a 100755 --- a/test/fnetfilter/fnetfilter.sh +++ b/test/fnetfilter/fnetfilter.sh | |||
@@ -11,7 +11,7 @@ if [ -f /etc/debian_version ]; then | |||
11 | export PATH="$PATH:$libdir" | 11 | export PATH="$PATH:$libdir" |
12 | fi | 12 | fi |
13 | 13 | ||
14 | export PATH="$PATH:/usr/lib/firejail" | 14 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" |
15 | 15 | ||
16 | chmod 400 outlocked | 16 | chmod 400 outlocked |
17 | 17 | ||
diff --git a/test/fs/invalid_filename.exp b/test/fs/invalid_filename.exp index e16798ab8..84abe74cd 100755 --- a/test/fs/invalid_filename.exp +++ b/test/fs/invalid_filename.exp | |||
@@ -7,11 +7,7 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail --debug-check-filename --noprofile --blacklist=\"bla&&bla\"\r" | 10 | send -- "firejail --noprofile --blacklist=\"bla&&bla\"\r" |
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 1.1\n";exit} | ||
13 | "Checking filename bla&&bla" | ||
14 | } | ||
15 | expect { | 11 | expect { |
16 | timeout {puts "TESTING ERROR 1.2\n";exit} | 12 | timeout {puts "TESTING ERROR 1.2\n";exit} |
17 | "Error:" | 13 | "Error:" |
@@ -22,11 +18,7 @@ expect { | |||
22 | } | 18 | } |
23 | after 100 | 19 | after 100 |
24 | 20 | ||
25 | send -- "firejail --debug-check-filename --noprofile --cgroup=\"bla&&bla\"\r" | 21 | send -- "firejail --noprofile --cgroup=\"bla&&bla\"\r" |
26 | expect { | ||
27 | timeout {puts "TESTING ERROR 2.1\n";exit} | ||
28 | "Checking filename bla&&bla" | ||
29 | } | ||
30 | expect { | 22 | expect { |
31 | timeout {puts "TESTING ERROR 2.2\n";exit} | 23 | timeout {puts "TESTING ERROR 2.2\n";exit} |
32 | "Error:" | 24 | "Error:" |
@@ -37,12 +29,7 @@ expect { | |||
37 | } | 29 | } |
38 | after 100 | 30 | after 100 |
39 | 31 | ||
40 | send -- "firejail --debug-check-filename --noprofile --chroot=\"bla&&bla\"\r" | 32 | send -- "firejail --noprofile --chroot=\"bla&&bla\"\r" |
41 | expect { | ||
42 | timeout {puts "TESTING ERROR 3.1\n";exit} | ||
43 | "Checking filename bla&&bla" {puts "normal system\n"} | ||
44 | "Error: --chroot option is not available on Grsecurity systems" { puts "\nall done\n"; exit} | ||
45 | } | ||
46 | expect { | 33 | expect { |
47 | timeout {puts "TESTING ERROR 3.2\n";exit} | 34 | timeout {puts "TESTING ERROR 3.2\n";exit} |
48 | "Error:" | 35 | "Error:" |
@@ -53,11 +40,7 @@ expect { | |||
53 | } | 40 | } |
54 | after 100 | 41 | after 100 |
55 | 42 | ||
56 | send -- "firejail --debug-check-filename --noprofile --netfilter=\"bla&&bla\"\r" | 43 | send -- "firejail --noprofile --netfilter=\"bla&&bla\"\r" |
57 | expect { | ||
58 | timeout {puts "TESTING ERROR 4.1\n";exit} | ||
59 | "Checking filename bla&&bla" | ||
60 | } | ||
61 | expect { | 44 | expect { |
62 | timeout {puts "TESTING ERROR 4.2\n";exit} | 45 | timeout {puts "TESTING ERROR 4.2\n";exit} |
63 | "Error:" | 46 | "Error:" |
@@ -68,22 +51,14 @@ expect { | |||
68 | } | 51 | } |
69 | after 100 | 52 | after 100 |
70 | 53 | ||
71 | send -- "firejail --debug-check-filename --noprofile --output=\"bla&&bla\"\r" | 54 | send -- "firejail --noprofile --output=\"bla&&bla\"\r" |
72 | expect { | ||
73 | timeout {puts "TESTING ERROR 5.2\n";exit} | ||
74 | "Error:" | ||
75 | } | ||
76 | expect { | 55 | expect { |
77 | timeout {puts "TESTING ERROR 5.3\n";exit} | 56 | timeout {puts "TESTING ERROR 5.3\n";exit} |
78 | "is an invalid filename" | 57 | "is an invalid filename" |
79 | } | 58 | } |
80 | after 100 | 59 | after 100 |
81 | 60 | ||
82 | send -- "firejail --debug-check-filename --noprofile --private=\"bla&&bla\"\r" | 61 | send -- "firejail --noprofile --private=\"bla&&bla\"\r" |
83 | expect { | ||
84 | timeout {puts "TESTING ERROR 6.1\n";exit} | ||
85 | "Checking filename bla&&bla" | ||
86 | } | ||
87 | expect { | 62 | expect { |
88 | timeout {puts "TESTING ERROR 6.2\n";exit} | 63 | timeout {puts "TESTING ERROR 6.2\n";exit} |
89 | "Error:" | 64 | "Error:" |
@@ -94,11 +69,7 @@ expect { | |||
94 | } | 69 | } |
95 | after 100 | 70 | after 100 |
96 | 71 | ||
97 | send -- "firejail --debug-check-filename --noprofile --private-bin=\"bla&&bla\"\r" | 72 | send -- "firejail --noprofile --private-bin=\"bla&&bla\"\r" |
98 | expect { | ||
99 | timeout {puts "TESTING ERROR 7.1\n";exit} | ||
100 | "Checking filename bla&&bla" | ||
101 | } | ||
102 | expect { | 73 | expect { |
103 | timeout {puts "TESTING ERROR 7.2\n";exit} | 74 | timeout {puts "TESTING ERROR 7.2\n";exit} |
104 | "Error:" | 75 | "Error:" |
@@ -109,11 +80,7 @@ expect { | |||
109 | } | 80 | } |
110 | after 100 | 81 | after 100 |
111 | 82 | ||
112 | send -- "firejail --debug-check-filename --noprofile --private-home=\"bla&&bla\"\r" | 83 | send -- "firejail --noprofile --private-home=\"bla&&bla\"\r" |
113 | expect { | ||
114 | timeout {puts "TESTING ERROR 8.1\n";exit} | ||
115 | "Checking filename bla&&bla" | ||
116 | } | ||
117 | expect { | 84 | expect { |
118 | timeout {puts "TESTING ERROR 8.2\n";exit} | 85 | timeout {puts "TESTING ERROR 8.2\n";exit} |
119 | "Error:" | 86 | "Error:" |
@@ -124,11 +91,7 @@ expect { | |||
124 | } | 91 | } |
125 | after 100 | 92 | after 100 |
126 | 93 | ||
127 | send -- "firejail --debug-check-filename --noprofile --private-etc=\"bla&&bla\"\r" | 94 | send -- "firejail --noprofile --private-etc=\"bla&&bla\"\r" |
128 | expect { | ||
129 | timeout {puts "TESTING ERROR 9.1\n";exit} | ||
130 | "Checking filename bla&&bla" | ||
131 | } | ||
132 | expect { | 95 | expect { |
133 | timeout {puts "TESTING ERROR 9.2\n";exit} | 96 | timeout {puts "TESTING ERROR 9.2\n";exit} |
134 | "Error:" | 97 | "Error:" |
@@ -139,11 +102,7 @@ expect { | |||
139 | } | 102 | } |
140 | after 100 | 103 | after 100 |
141 | 104 | ||
142 | send -- "firejail --debug-check-filename --profile=\"bla&&bla\"\r" | 105 | send -- "firejail --profile=\"bla&&bla\"\r" |
143 | expect { | ||
144 | timeout {puts "TESTING ERROR 10.1\n";exit} | ||
145 | "Checking filename bla&&bla" | ||
146 | } | ||
147 | expect { | 106 | expect { |
148 | timeout {puts "TESTING ERROR 10.2\n";exit} | 107 | timeout {puts "TESTING ERROR 10.2\n";exit} |
149 | "Error:" | 108 | "Error:" |
@@ -154,11 +113,7 @@ expect { | |||
154 | } | 113 | } |
155 | after 100 | 114 | after 100 |
156 | 115 | ||
157 | send -- "firejail --debug-check-filename --read-only=\"bla&&bla\"\r" | 116 | send -- "firejail --read-only=\"bla&&bla\"\r" |
158 | expect { | ||
159 | timeout {puts "TESTING ERROR 11.1\n";exit} | ||
160 | "Checking filename bla&&bla" | ||
161 | } | ||
162 | expect { | 117 | expect { |
163 | timeout {puts "TESTING ERROR 11.2\n";exit} | 118 | timeout {puts "TESTING ERROR 11.2\n";exit} |
164 | "Error:" | 119 | "Error:" |
@@ -169,11 +124,7 @@ expect { | |||
169 | } | 124 | } |
170 | after 100 | 125 | after 100 |
171 | 126 | ||
172 | send -- "firejail --debug-check-filename --shell=\"bla&&bla\"\r" | 127 | send -- "firejail --shell=\"bla&&bla\"\r" |
173 | expect { | ||
174 | timeout {puts "TESTING ERROR 12.1\n";exit} | ||
175 | "Checking filename bla&&bla" | ||
176 | } | ||
177 | expect { | 128 | expect { |
178 | timeout {puts "TESTING ERROR 12.2\n";exit} | 129 | timeout {puts "TESTING ERROR 12.2\n";exit} |
179 | "Error:" | 130 | "Error:" |
@@ -185,11 +136,7 @@ expect { | |||
185 | after 100 | 136 | after 100 |
186 | 137 | ||
187 | 138 | ||
188 | send -- "firejail --debug-check-filename --whitelist=\"bla&&bla\"\r" | 139 | send -- "firejail --whitelist=\"bla&&bla\"\r" |
189 | expect { | ||
190 | timeout {puts "TESTING ERROR 14.1\n";exit} | ||
191 | "Checking filename bla&&bla" | ||
192 | } | ||
193 | expect { | 140 | expect { |
194 | timeout {puts "TESTING ERROR 14.2\n";exit} | 141 | timeout {puts "TESTING ERROR 14.2\n";exit} |
195 | "Error:" | 142 | "Error:" |
diff --git a/test/overlay/overlay.sh b/test/overlay/overlay.sh index 6b7f779d7..9daf1f5f6 100755 --- a/test/overlay/overlay.sh +++ b/test/overlay/overlay.sh | |||
@@ -21,7 +21,7 @@ rm -fr ~/_firejail_test_* | |||
21 | ./fs-tmpfs.exp | 21 | ./fs-tmpfs.exp |
22 | rm -fr ~/_firejail_test_* | 22 | rm -fr ~/_firejail_test_* |
23 | 23 | ||
24 | which firefox | 24 | which firefox 2>/dev/null |
25 | if [ "$?" -eq 0 ]; | 25 | if [ "$?" -eq 0 ]; |
26 | then | 26 | then |
27 | echo "TESTING: overlay firefox" | 27 | echo "TESTING: overlay firefox" |
@@ -30,7 +30,7 @@ else | |||
30 | echo "TESTING SKIP: firefox not found" | 30 | echo "TESTING SKIP: firefox not found" |
31 | fi | 31 | fi |
32 | 32 | ||
33 | which firefox | 33 | which firefox 2>/dev/null |
34 | if [ "$?" -eq 0 ]; | 34 | if [ "$?" -eq 0 ]; |
35 | then | 35 | then |
36 | echo "TESTING: overlay firefox x11 xorg" | 36 | echo "TESTING: overlay firefox x11 xorg" |
@@ -41,13 +41,13 @@ fi | |||
41 | 41 | ||
42 | 42 | ||
43 | # check xpra/xephyr | 43 | # check xpra/xephyr |
44 | which xpra | 44 | which xpra 2>/dev/null |
45 | if [ "$?" -eq 0 ]; | 45 | if [ "$?" -eq 0 ]; |
46 | then | 46 | then |
47 | echo "xpra found" | 47 | echo "xpra found" |
48 | else | 48 | else |
49 | echo "xpra not found" | 49 | echo "xpra not found" |
50 | which Xephyr | 50 | which Xephyr 2>/dev/null |
51 | if [ "$?" -eq 0 ]; | 51 | if [ "$?" -eq 0 ]; |
52 | then | 52 | then |
53 | echo "Xephyr found" | 53 | echo "Xephyr found" |
@@ -57,7 +57,7 @@ else | |||
57 | fi | 57 | fi |
58 | fi | 58 | fi |
59 | 59 | ||
60 | which firefox | 60 | which firefox 2>/dev/null |
61 | if [ "$?" -eq 0 ]; | 61 | if [ "$?" -eq 0 ]; |
62 | then | 62 | then |
63 | echo "TESTING: overlay firefox x11" | 63 | echo "TESTING: overlay firefox x11" |
diff --git a/test/private-lib/gedit.exp b/test/private-lib/gedit.exp new file mode 100755 index 000000000..00fa934e7 --- /dev/null +++ b/test/private-lib/gedit.exp | |||
@@ -0,0 +1,83 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2018 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firejail /usr/bin/gedit\r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 0\n";exit} | ||
13 | "Reading profile /etc/firejail/gedit.profile" | ||
14 | } | ||
15 | expect { | ||
16 | timeout {puts "TESTING ERROR 1\n";exit} | ||
17 | "Child process initialized" | ||
18 | } | ||
19 | sleep 3 | ||
20 | |||
21 | spawn $env(SHELL) | ||
22 | send -- "firejail --list\r" | ||
23 | expect { | ||
24 | timeout {puts "TESTING ERROR 3\n";exit} | ||
25 | ":firejail" | ||
26 | } | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 3.1\n";exit} | ||
29 | "gedit" | ||
30 | } | ||
31 | after 100 | ||
32 | |||
33 | # grsecurity exit | ||
34 | send -- "file /proc/sys/kernel/grsecurity\r" | ||
35 | expect { | ||
36 | timeout {puts "TESTING ERROR - grsecurity detection\n";exit} | ||
37 | "grsecurity: directory" {puts "grsecurity present, exiting...\n";exit} | ||
38 | "cannot open" {puts "grsecurity not present\n"} | ||
39 | } | ||
40 | |||
41 | send -- "firejail --name=blablabla\r" | ||
42 | expect { | ||
43 | timeout {puts "TESTING ERROR 4\n";exit} | ||
44 | "Child process initialized" | ||
45 | } | ||
46 | sleep 2 | ||
47 | |||
48 | spawn $env(SHELL) | ||
49 | send -- "firemon --seccomp\r" | ||
50 | expect { | ||
51 | timeout {puts "TESTING ERROR 5\n";exit} | ||
52 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} | ||
53 | ":firejail /usr/bin/gedit" | ||
54 | } | ||
55 | expect { | ||
56 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} | ||
57 | "Seccomp: 2" | ||
58 | } | ||
59 | expect { | ||
60 | timeout {puts "TESTING ERROR 5.1\n";exit} | ||
61 | "name=blablabla" | ||
62 | } | ||
63 | after 100 | ||
64 | send -- "firemon --caps\r" | ||
65 | expect { | ||
66 | timeout {puts "TESTING ERROR 6\n";exit} | ||
67 | ":firejail /usr/bin/gedit" | ||
68 | } | ||
69 | expect { | ||
70 | timeout {puts "TESTING ERROR 6.1\n";exit} | ||
71 | "CapBnd:" | ||
72 | } | ||
73 | expect { | ||
74 | timeout {puts "TESTING ERROR 6.2\n";exit} | ||
75 | "0000000000000000" | ||
76 | } | ||
77 | expect { | ||
78 | timeout {puts "TESTING ERROR 6.3\n";exit} | ||
79 | "name=blablabla" | ||
80 | } | ||
81 | after 100 | ||
82 | |||
83 | puts "\nall done\n" | ||
diff --git a/test/private-lib/pluma.exp b/test/private-lib/pluma.exp new file mode 100755 index 000000000..92ae0a345 --- /dev/null +++ b/test/private-lib/pluma.exp | |||
@@ -0,0 +1,83 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2018 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firejail pluma\r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 0\n";exit} | ||
13 | "Reading profile /etc/firejail/pluma.profile" | ||
14 | } | ||
15 | expect { | ||
16 | timeout {puts "TESTING ERROR 1\n";exit} | ||
17 | "Child process initialized" | ||
18 | } | ||
19 | sleep 3 | ||
20 | |||
21 | spawn $env(SHELL) | ||
22 | send -- "firejail --list\r" | ||
23 | expect { | ||
24 | timeout {puts "TESTING ERROR 3\n";exit} | ||
25 | ":firejail" | ||
26 | } | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 3.1\n";exit} | ||
29 | "pluma" | ||
30 | } | ||
31 | after 100 | ||
32 | |||
33 | # grsecurity exit | ||
34 | send -- "file /proc/sys/kernel/grsecurity\r" | ||
35 | expect { | ||
36 | timeout {puts "TESTING ERROR - grsecurity detection\n";exit} | ||
37 | "grsecurity: directory" {puts "grsecurity present, exiting...\n";exit} | ||
38 | "cannot open" {puts "grsecurity not present\n"} | ||
39 | } | ||
40 | |||
41 | send -- "firejail --name=blablabla\r" | ||
42 | expect { | ||
43 | timeout {puts "TESTING ERROR 4\n";exit} | ||
44 | "Child process initialized" | ||
45 | } | ||
46 | sleep 2 | ||
47 | |||
48 | spawn $env(SHELL) | ||
49 | send -- "firemon --seccomp\r" | ||
50 | expect { | ||
51 | timeout {puts "TESTING ERROR 5\n";exit} | ||
52 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} | ||
53 | ":firejail pluma" | ||
54 | } | ||
55 | expect { | ||
56 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} | ||
57 | "Seccomp: 2" | ||
58 | } | ||
59 | expect { | ||
60 | timeout {puts "TESTING ERROR 5.1\n";exit} | ||
61 | "name=blablabla" | ||
62 | } | ||
63 | after 100 | ||
64 | send -- "firemon --caps\r" | ||
65 | expect { | ||
66 | timeout {puts "TESTING ERROR 6\n";exit} | ||
67 | ":firejail pluma" | ||
68 | } | ||
69 | expect { | ||
70 | timeout {puts "TESTING ERROR 6.1\n";exit} | ||
71 | "CapBnd:" | ||
72 | } | ||
73 | expect { | ||
74 | timeout {puts "TESTING ERROR 6.2\n";exit} | ||
75 | "0000000000000000" | ||
76 | } | ||
77 | expect { | ||
78 | timeout {puts "TESTING ERROR 6.3\n";exit} | ||
79 | "name=blablabla" | ||
80 | } | ||
81 | after 100 | ||
82 | |||
83 | puts "\nall done\n" | ||
diff --git a/test/private-lib/private-lib.sh b/test/private-lib/private-lib.sh index 312fe502a..edf81917a 100755 --- a/test/private-lib/private-lib.sh +++ b/test/private-lib/private-lib.sh | |||
@@ -5,11 +5,11 @@ | |||
5 | 5 | ||
6 | export MALLOC_CHECK_=3 | 6 | export MALLOC_CHECK_=3 |
7 | export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) | 7 | export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) |
8 | LIST="evince galculator gnome-calculator leafpad mousepad transmission-gtk xcalc atril gpicview eom eog" | 8 | LIST="evince galculator gnome-calculator gedit leafpad mousepad pluma transmission-gtk xcalc atril gpicview eom eog" |
9 | 9 | ||
10 | 10 | ||
11 | for app in $LIST; do | 11 | for app in $LIST; do |
12 | which $app | 12 | which $app 2>/dev/null |
13 | if [ "$?" -eq 0 ]; | 13 | if [ "$?" -eq 0 ]; |
14 | then | 14 | then |
15 | echo "TESTING: private-lib $app" | 15 | echo "TESTING: private-lib $app" |
diff --git a/test/root/root.sh b/test/root/root.sh index 4f217b727..a20142c5f 100755 --- a/test/root/root.sh +++ b/test/root/root.sh | |||
@@ -7,7 +7,7 @@ | |||
7 | #******************************** | 7 | #******************************** |
8 | # firecfg | 8 | # firecfg |
9 | #******************************** | 9 | #******************************** |
10 | which less | 10 | which less 2>/dev/null |
11 | if [ "$?" -eq 0 ]; | 11 | if [ "$?" -eq 0 ]; |
12 | then | 12 | then |
13 | echo "TESTING: firecfg (test/root/firecfg.exp)" | 13 | echo "TESTING: firecfg (test/root/firecfg.exp)" |
diff --git a/test/sysutils/sysutils.sh b/test/sysutils/sysutils.sh index dd09e4533..6794af520 100755 --- a/test/sysutils/sysutils.sh +++ b/test/sysutils/sysutils.sh | |||
@@ -6,7 +6,7 @@ | |||
6 | export MALLOC_CHECK_=3 | 6 | export MALLOC_CHECK_=3 |
7 | export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) | 7 | export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) |
8 | 8 | ||
9 | which cpio | 9 | which cpio 2>/dev/null |
10 | if [ "$?" -eq 0 ]; | 10 | if [ "$?" -eq 0 ]; |
11 | then | 11 | then |
12 | echo "TESTING: cpio" | 12 | echo "TESTING: cpio" |
@@ -24,7 +24,7 @@ fi | |||
24 | # echo "TESTING SKIP: strings not found" | 24 | # echo "TESTING SKIP: strings not found" |
25 | #fi | 25 | #fi |
26 | 26 | ||
27 | which gzip | 27 | which gzip 2>/dev/null |
28 | if [ "$?" -eq 0 ]; | 28 | if [ "$?" -eq 0 ]; |
29 | then | 29 | then |
30 | echo "TESTING: gzip" | 30 | echo "TESTING: gzip" |
@@ -33,7 +33,7 @@ else | |||
33 | echo "TESTING SKIP: gzip not found" | 33 | echo "TESTING SKIP: gzip not found" |
34 | fi | 34 | fi |
35 | 35 | ||
36 | which xzdec | 36 | which xzdec 2>/dev/null |
37 | if [ "$?" -eq 0 ]; | 37 | if [ "$?" -eq 0 ]; |
38 | then | 38 | then |
39 | echo "TESTING: xzdec" | 39 | echo "TESTING: xzdec" |
@@ -42,7 +42,7 @@ else | |||
42 | echo "TESTING SKIP: xzdec not found" | 42 | echo "TESTING SKIP: xzdec not found" |
43 | fi | 43 | fi |
44 | 44 | ||
45 | which xz | 45 | which xz 2>/dev/null |
46 | if [ "$?" -eq 0 ]; | 46 | if [ "$?" -eq 0 ]; |
47 | then | 47 | then |
48 | echo "TESTING: xz" | 48 | echo "TESTING: xz" |
@@ -51,7 +51,7 @@ else | |||
51 | echo "TESTING SKIP: xz not found" | 51 | echo "TESTING SKIP: xz not found" |
52 | fi | 52 | fi |
53 | 53 | ||
54 | which less | 54 | which less 2>/dev/null |
55 | if [ "$?" -eq 0 ]; | 55 | if [ "$?" -eq 0 ]; |
56 | then | 56 | then |
57 | echo "TESTING: less" | 57 | echo "TESTING: less" |
@@ -60,7 +60,7 @@ else | |||
60 | echo "TESTING SKIP: less not found" | 60 | echo "TESTING SKIP: less not found" |
61 | fi | 61 | fi |
62 | 62 | ||
63 | which file | 63 | which file 2>/dev/null |
64 | if [ "$?" -eq 0 ]; | 64 | if [ "$?" -eq 0 ]; |
65 | then | 65 | then |
66 | echo "TESTING: file" | 66 | echo "TESTING: file" |
@@ -69,7 +69,7 @@ else | |||
69 | echo "TESTING SKIP: file not found" | 69 | echo "TESTING SKIP: file not found" |
70 | fi | 70 | fi |
71 | 71 | ||
72 | which tar | 72 | which tar 2>/dev/null |
73 | if [ "$?" -eq 0 ]; | 73 | if [ "$?" -eq 0 ]; |
74 | then | 74 | then |
75 | echo "TESTING: tar" | 75 | echo "TESTING: tar" |
@@ -78,7 +78,7 @@ else | |||
78 | echo "TESTING SKIP: tar not found" | 78 | echo "TESTING SKIP: tar not found" |
79 | fi | 79 | fi |
80 | 80 | ||
81 | which ping | 81 | which ping 2>/dev/null |
82 | if [ "$?" -eq 0 ]; | 82 | if [ "$?" -eq 0 ]; |
83 | then | 83 | then |
84 | echo "TESTING: ping" | 84 | echo "TESTING: ping" |
diff --git a/test/utils/utils.sh b/test/utils/utils.sh index 5438e11a8..d98e4c2e4 100755 --- a/test/utils/utils.sh +++ b/test/utils/utils.sh | |||
@@ -10,7 +10,7 @@ if [ -f /etc/debian_version ]; then | |||
10 | libdir=$(dirname "$(dpkg -L firejail | grep faudit)") | 10 | libdir=$(dirname "$(dpkg -L firejail | grep faudit)") |
11 | export PATH="$PATH:$libdir" | 11 | export PATH="$PATH:$libdir" |
12 | fi | 12 | fi |
13 | export PATH="$PATH:/usr/lib/firejail" | 13 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" |
14 | 14 | ||
15 | echo "testing" > ~/firejail-test-file-7699 | 15 | echo "testing" > ~/firejail-test-file-7699 |
16 | echo "testing" > /tmp/firejail-test-file-7699 | 16 | echo "testing" > /tmp/firejail-test-file-7699 |
@@ -39,7 +39,7 @@ echo "TESTING: version (test/utils/version.exp)" | |||
39 | echo "TESTING: help (test/utils/help.exp)" | 39 | echo "TESTING: help (test/utils/help.exp)" |
40 | ./help.exp | 40 | ./help.exp |
41 | 41 | ||
42 | which man | 42 | which man 2>/dev/null |
43 | if [ "$?" -eq 0 ]; | 43 | if [ "$?" -eq 0 ]; |
44 | then | 44 | then |
45 | echo "TESTING: man (test/utils/man.exp)" | 45 | echo "TESTING: man (test/utils/man.exp)" |