7 files changed, 196 insertions, 2 deletions

diff --git a/README.md b/README.md
index b94f11299..ebf005db7 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,7 @@ whitelist ~/.vimperator
 
 I intend to bring in all files and directories used by Firefox addons and plugins. So far I have
 [Video DownloadHelper](https://addons.mozilla.org/en-US/firefox/addon/video-downloadhelper/),
-[Zotero](https://www.zotero.org/download/) 
+[Zotero](https://www.zotero.org/download/), 
 [LastPass](https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/),
 and [Vimperator](https://addons.mozilla.org/en-US/firefox/addon/vimperator/)
 If you're using a anything else, please let me know.
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 1fadab1fa..05a8ece35 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -151,6 +151,11 @@ int profile_check_line(char *ptr, int lineno) {
                 return 0;
         }
         
+        if (strncmp(ptr, "protocol ", 9) == 0) {
+                protocol_store(ptr + 9);
+                return 0;
+        }
+        
         if (strncmp(ptr, "env ", 4) == 0) {
                 env_store(ptr + 4);
                 return 0;
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index 8e75277c2..ba784fc2e 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -177,9 +177,9 @@ printf("entries %u\n", (unsigned) (sizeof(filter_start) / sizeof(struct sock_fil
         }
         printf("\n");
 }
+printf("whitelist_len %u, struct sock_filter len %u\n", whitelist_len, (unsigned) sizeof(struct sock_filter));
 #endif
 
-printf("whitelist_len %u, struct sock_filter len %u\n", whitelist_len, (unsigned) sizeof(struct sock_filter));
 
         // parse list and add commands
         char *tmplist = strdup(cfg.protocol);
diff --git a/test/protocol.exp b/test/protocol.exp
new file mode 100755
index 000000000..018f4cd9b
--- /dev/null
+++ b/test/protocol.exp
@@ -0,0 +1,184 @@
+#!/usr/bin/expect -f
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --noprofile --protocol=unix ../src/tools/syscall_test socket\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.1\n";exit}
+        "socket AF_INET"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.2\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.3\n";exit}
+        "socket AF_INET6"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.4\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.5\n";exit}
+        "socket AF_NETLINK"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.6\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.7\n";exit}
+        "socket AF_UNIX"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.8\n";exit}
+        "socket AF_PACKETX"
+}
+expect {
+        timeout {puts "TESTING ERROR 1.9\n";exit}
+        "Operation not supported"
+}
+sleep 1
+
+send -- "firejail --noprofile --protocol=inet6,packet ../src/tools/syscall_test socket\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.1\n";exit}
+        "socket AF_INET"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.2\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.3\n";exit}
+        "socket AF_INET6"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.4\n";exit}
+        "socket AF_NETLINK"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.5\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.6\n";exit}
+        "socket AF_UNIX"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.7\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.8\n";exit}
+        "socket AF_PACKETX"
+}
+expect {
+        timeout {puts "TESTING ERROR 2.9\n";exit}
+        "after socket"
+}
+sleep 1
+
+# profile testing
+send -- "firejail --profile=protocol1.profile ../src/tools/syscall_test socket\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.1\n";exit}
+        "socket AF_INET"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.2\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.3\n";exit}
+        "socket AF_INET6"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.4\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.5\n";exit}
+        "socket AF_NETLINK"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.6\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.7\n";exit}
+        "socket AF_UNIX"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.8\n";exit}
+        "socket AF_PACKETX"
+}
+expect {
+        timeout {puts "TESTING ERROR 3.9\n";exit}
+        "Operation not supported"
+}
+sleep 1
+
+send -- "firejail --profile=protocol2.profile ../src/tools/syscall_test socket\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.1\n";exit}
+        "socket AF_INET"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.2\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.3\n";exit}
+        "socket AF_INET6"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.4\n";exit}
+        "socket AF_NETLINK"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.5\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.6\n";exit}
+        "socket AF_UNIX"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.7\n";exit}
+        "Operation not supported"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.8\n";exit}
+        "socket AF_PACKETX"
+}
+expect {
+        timeout {puts "TESTING ERROR 4.9\n";exit}
+        "after socket"
+}
+sleep 1
+
+
+
+
+
+puts "\nall done\n"
diff --git a/test/protocol1.profile b/test/protocol1.profile
new file mode 100644
index 000000000..3e1ea2a29
--- /dev/null
+++ b/test/protocol1.profile
@@ -0,0 +1 @@
+protocol unix
diff --git a/test/protocol2.profile b/test/protocol2.profile
new file mode 100644
index 000000000..b7eb4ab91
--- /dev/null
+++ b/test/protocol2.profile
@@ -0,0 +1 @@
+protocol inet6,packet
diff --git a/test/test.sh b/test/test.sh
index 406ef92a3..8e673911e 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -12,6 +12,9 @@ done
 
 ./fscheck.sh
 
+echo "TESTING: protocol"
+./protocol.exp
+
 echo "TESTING: invalid filename"
 ./invalid_filename.exp