10 files changed, 398 insertions, 49 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index ab2fedbd8..e79cc4a2c 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -107,6 +107,13 @@ typedef struct config_t {
         uint32_t dns2;
         uint32_t dns3;
 
+        // seccomp
+        char *seccomp_list;//  optional seccomp list on top of default filter
+        char *seccomp_list_drop;        // seccomp drop list
+        char *seccomp_list_keep;        // seccomp keep list
+        char **seccomp_list_errno;      // seccomp errno[nr] lists
+        char *protocol;                 // protocol list
+
         // rlimits
         unsigned rlimit_nofile;
         unsigned rlimit_nproc;
@@ -152,10 +159,6 @@ extern int arg_zsh;		// use zsh as default shell
 extern int arg_csh;             // use csh as default shell
 
 extern int arg_seccomp; // enable default seccomp filter
-extern char *arg_seccomp_list;//  optional seccomp list on top of default filter
-extern char *arg_seccomp_list_drop;             // seccomp drop list
-extern char *arg_seccomp_list_keep;             // seccomp keep list
-extern char **arg_seccomp_list_errno;           // seccomp errno[nr] lists
 
 extern int arg_caps_default_filter;     // enable default capabilities filter
 extern int arg_caps_drop;               // drop list
@@ -355,7 +358,7 @@ void caps_print_filter_name(const char *name);
 const char *syscall_find_nr(int nr);
 // return -1 if error, 0 if no error
 int syscall_check_list(const char *slist, void (*callback)(int syscall, int arg), int arg);
-// print all available syscalls
+// print all available syscallsseccomp
 void syscall_print(void);
 
 // fs_trace.c
@@ -425,5 +428,11 @@ void pulseaudio_disable(void);
 void fs_check_bin_list(void);
 void fs_private_bin_list(void);
 
+// protocol.c
+void protocol_list();
+void protocol_print_filter_name(const char *name);
+void protocol_print_filter(pid_t pid);
+void protocol_store(const char *prlist);
+void protocol_filter(void);
 #endif
 
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 8d11caef3..e39a41502 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -58,10 +58,6 @@ int arg_zsh = 0;				// use zsh as default shell
 int arg_csh = 0;                                // use csh as default shell
 
 int arg_seccomp = 0;                            // enable default seccomp filter
-char *arg_seccomp_list = NULL;          // optional seccomp list on top of default filter
-char *arg_seccomp_list_drop = NULL;             // seccomp drop list
-char *arg_seccomp_list_keep = NULL;             // seccomp keep list
-char **arg_seccomp_list_errno = NULL;           // seccomp errno[nr] lists
 
 int arg_caps_default_filter = 0;                        // enable default capabilities filter
 int arg_caps_drop = 0;                          // drop list
@@ -312,7 +308,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 exit(0);
         }
         else if (strncmp(argv[i], "--seccomp.print=", 16) == 0) {
-                // join sandbox by pid or by name
+                // print seccomp filter for a sandbox specified by pid or by name
                 pid_t pid;
                 if (read_pid(argv[i] + 16, &pid) == 0)          
                         seccomp_print_filter(pid);
@@ -320,6 +316,19 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                         seccomp_print_filter_name(argv[i] + 16);
                 exit(0);
         }
+        else if (strcmp(argv[i], "--debug-protocols") == 0) {
+                protocol_list();
+                exit(0);
+        }
+        else if (strncmp(argv[i], "--protocol.print=", 17) == 0) {
+                // print seccomp filter for a sandbox specified by pid or by name
+                pid_t pid;
+                if (read_pid(argv[i] + 17, &pid) == 0)          
+                        protocol_print_filter(pid);
+                else
+                        protocol_print_filter_name(argv[i] + 17);
+                exit(0);
+        }
 #endif
         else if (strncmp(argv[i], "--caps.print=", 13) == 0) {
                 // join sandbox by pid or by name
@@ -455,6 +464,8 @@ int main(int argc, char **argv) {
                 // filtering
                 //*************************************
 #ifdef HAVE_SECCOMP
+                else if (strncmp(argv[i], "--protocol=", 11) == 0) 
+                        protocol_store(argv[i] + 11);
                 else if (strcmp(argv[i], "--seccomp") == 0) {
                         if (arg_seccomp) {
                                 fprintf(stderr, "Error: seccomp already enabled\n");
@@ -468,8 +479,8 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                         arg_seccomp = 1;
-                        arg_seccomp_list = strdup(argv[i] + 10);
-                        if (!arg_seccomp_list)
+                        cfg.seccomp_list = strdup(argv[i] + 10);
+                        if (!cfg.seccomp_list)
                                 errExit("strdup");
                 }
                 else if (strncmp(argv[i], "--seccomp.drop=", 15) == 0) {
@@ -478,8 +489,8 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                         arg_seccomp = 1;
-                        arg_seccomp_list_drop = strdup(argv[i] + 15);
-                        if (!arg_seccomp_list_drop)
+                        cfg.seccomp_list_drop = strdup(argv[i] + 15);
+                        if (!cfg.seccomp_list_drop)
                                 errExit("strdup");
                 }
                 else if (strncmp(argv[i], "--seccomp.keep=", 15) == 0) {
@@ -488,12 +499,12 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                         arg_seccomp = 1;
-                        arg_seccomp_list_keep = strdup(argv[i] + 15);
-                        if (!arg_seccomp_list_keep)
+                        cfg.seccomp_list_keep = strdup(argv[i] + 15);
+                        if (!cfg.seccomp_list_keep)
                                 errExit("strdup");
                 }
                 else if (strncmp(argv[i], "--seccomp.e", 11) == 0 && strchr(argv[i], '=')) {
-                        if (arg_seccomp && !arg_seccomp_list_errno) {
+                        if (arg_seccomp && !cfg.seccomp_list_errno) {
                                 fprintf(stderr, "Error: seccomp already enabled\n");
                                 exit(1);
                         }
@@ -506,17 +517,17 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
 
-                        if (!arg_seccomp_list_errno)
-                                arg_seccomp_list_errno = calloc(highest_errno+1, sizeof(arg_seccomp_list_errno[0]));
+                        if (!cfg.seccomp_list_errno)
+                                cfg.seccomp_list_errno = calloc(highest_errno+1, sizeof(cfg.seccomp_list_errno[0]));
 
-                        if (arg_seccomp_list_errno[nr]) {
+                        if (cfg.seccomp_list_errno[nr]) {
                                 fprintf(stderr, "Error: errno %s already configured\n", errnoname);
                                 free(errnoname);
                                 exit(1);
                         }
                         arg_seccomp = 1;
-                        arg_seccomp_list_errno[nr] = strdup(eq+1);
-                        if (!arg_seccomp_list_errno[nr])
+                        cfg.seccomp_list_errno[nr] = strdup(eq+1);
+                        if (!cfg.seccomp_list_errno[nr])
                                 errExit("strdup");
                         free(errnoname);
                 }
@@ -1393,10 +1404,10 @@ int main(int argc, char **argv) {
 
         // free globals
 #ifdef HAVE_SECCOMP
-        if (arg_seccomp_list_errno) {
+        if (cfg.seccomp_list_errno) {
                 for (i = 0; i < highest_errno; i++)
-                        free(arg_seccomp_list_errno[i]);
-                free(arg_seccomp_list_errno);
+                        free(cfg.seccomp_list_errno[i]);
+                free(cfg.seccomp_list_errno);
         }
 #endif
 
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 3edeabee9..1fadab1fa 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -160,8 +160,8 @@ int profile_check_line(char *ptr, int lineno) {
         if (strncmp(ptr, "seccomp ", 8) == 0) {
                 arg_seccomp = 1;
 #ifdef HAVE_SECCOMP
-                arg_seccomp_list = strdup(ptr + 8);
-                if (!arg_seccomp_list)
+                cfg.seccomp_list = strdup(ptr + 8);
+                if (!cfg.seccomp_list)
                         errExit("strdup");
 #endif
                 return 0;
@@ -171,8 +171,8 @@ int profile_check_line(char *ptr, int lineno) {
         if (strncmp(ptr, "seccomp.drop ", 13) == 0) {
                 arg_seccomp = 1;
 #ifdef HAVE_SECCOMP
-                arg_seccomp_list_drop = strdup(ptr + 13);
-                if (!arg_seccomp_list_drop)
+                cfg.seccomp_list_drop = strdup(ptr + 13);
+                if (!cfg.seccomp_list_drop)
                         errExit("strdup");
 #endif
                 return 0;
@@ -182,8 +182,8 @@ int profile_check_line(char *ptr, int lineno) {
         if (strncmp(ptr, "seccomp.keep ", 13) == 0) {
                 arg_seccomp = 1;
 #ifdef HAVE_SECCOMP
-                arg_seccomp_list_keep= strdup(ptr + 13);
-                if (!arg_seccomp_list_keep)
+                cfg.seccomp_list_keep= strdup(ptr + 13);
+                if (!cfg.seccomp_list_keep)
                         errExit("strdup");
 #endif
                 return 0;
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
new file mode 100644
index 000000000..098661339
--- /dev/null
+++ b/src/firejail/protocol.c
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2014, 2015 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifdef HAVE_SECCOMP
+#include "firejail.h"
+#include "seccomp.h"
+#include <sys/types.h>
+#include <sys/socket.h>
+
+static char *protocol[] = {
+        "unix",
+        "inet",
+        "inet6",
+        "netlink",
+        "packet",
+        NULL
+};
+
+static struct sock_filter protocol_filter_command[] = {
+        WHITELIST(AF_UNIX),
+        WHITELIST(AF_INET),
+        WHITELIST(AF_INET6),
+        WHITELIST(AF_NETLINK),
+        WHITELIST(AF_PACKET)
+};
+// Note: protocol[] and protocol_filter_command are synchronized
+
+// command length
+struct sock_filter whitelist[] = {
+        WHITELIST(AF_UNIX)
+};
+unsigned whitelist_len = sizeof(whitelist) / sizeof(struct sock_filter);
+
+
+
+static int is_protocol(const char *p) {
+        int i = 0;
+        while (protocol[i] != NULL) {
+                if (strcmp(protocol[i], p) == 0)
+                        return 1;
+                i++;
+        }
+
+        return 0;
+}       
+
+static struct sock_filter *find_protocol_domain(const char *p) {
+        int i = 0;
+        while (protocol[i] != NULL) {
+                if (strcmp(protocol[i], p) == 0)
+                        return &protocol_filter_command[i * whitelist_len];
+                i++;
+        }
+
+        return NULL;
+}       
+
+// --debug-protocols
+void protocol_list(void) {
+        int i = 0;
+        while (protocol[i] != NULL) {
+                printf("%s, ", protocol[i]);
+                i++;
+        }
+        printf("\n");
+}
+
+// --protocol.print
+void protocol_print_filter_name(const char *name) {
+        (void) name;
+//todo
+}
+
+// --protocol.print
+void protocol_print_filter(pid_t pid) {
+        (void) pid;
+//todo
+}
+
+// check protocol list and store it in cfg structure
+void protocol_store(const char *prlist) {
+        assert(prlist);
+        
+        // temporary list
+        char *tmplist = strdup(prlist);
+        if (!tmplist)
+                errExit("strdup");
+        
+        // check list
+        char *token = strtok(tmplist, ",");
+        if (!token)
+                goto errout;
+                
+        while (token) {
+                if (!is_protocol(token))
+                        goto errout;
+                token = strtok(NULL, ",");
+        }       
+        free(tmplist);
+        
+        // store list
+        cfg.protocol = strdup(prlist);
+        if (!cfg.protocol)
+                errExit("strdup");
+        return;
+                
+errout:
+        fprintf(stderr, "Error: invalid protocol list\n");
+        exit(1);
+}       
+
+// install protocol filter
+void protocol_filter(void) {
+        assert(cfg.protocol);
+        
+        // build the filter
+        
+        struct sock_filter filter[32];  // big enough
+        memset(&filter[0], 0, sizeof(filter));
+        uint8_t *ptr = (uint8_t *) &filter[0];
+        
+        // header
+        struct sock_filter filter_start[] = {
+                VALIDATE_ARCHITECTURE,
+                EXAMINE_SYSCALL,
+                ONLY(SYS_socket),
+                EXAMINE_ARGUMENT(0)
+        };
+        memcpy(ptr, &filter_start[0], sizeof(filter_start));
+        ptr += sizeof(filter_start);
+
+#if 0
+printf("entries %u\n", (unsigned) (sizeof(filter_start) / sizeof(struct sock_filter)));
+{
+        unsigned j;
+        unsigned char *ptr2 = (unsigned char *) &filter[0];
+        for (j = 0; j < sizeof(filter); j++, ptr2++) {
+                if ((j % (sizeof(struct sock_filter))) == 0)
+                        printf("\n%u: ", 1 + (unsigned) (j / (sizeof(struct sock_filter))));
+                printf("%02x, ", (*ptr2) & 0xff);
+        }
+        printf("\n");
+}
+#endif
+
+printf("whitelist_len %u, struct sock_filter len %u\n", whitelist_len, (unsigned) sizeof(struct sock_filter));
+
+        // parse list and add commands
+        char *tmplist = strdup(cfg.protocol);
+        if (!tmplist)
+                errExit("strdup");
+        char *token = strtok(tmplist, ",");
+        if (!token)
+                errExit("strtok");
+                
+        while (token) {
+                struct sock_filter *domain = find_protocol_domain(token);
+                assert(domain);
+                memcpy(ptr, domain, whitelist_len * sizeof(struct sock_filter));
+                ptr += whitelist_len * sizeof(struct sock_filter);
+                token = strtok(NULL, ",");
+
+#if 0
+printf("entries %u\n",  (unsigned) ((uint64_t) ptr - (uint64_t) (filter)) / (unsigned) sizeof(struct sock_filter));
+{
+        unsigned j;
+        unsigned char *ptr2 = (unsigned char *) &filter[0];
+        for (j = 0; j < sizeof(filter); j++, ptr2++) {
+                if ((j % (sizeof(struct sock_filter))) == 0)
+                        printf("\n%u: ", 1 + (unsigned) (j / (sizeof(struct sock_filter))));
+                printf("%02x, ", (*ptr2) & 0xff);
+        }
+        printf("\n");
+}
+#endif
+
+
+        }       
+        free(tmplist);
+
+        // add end of filter
+        struct sock_filter filter_end[] = {
+                RETURN_ERRNO(ENOTSUP)
+        };
+        memcpy(ptr, &filter_end[0], sizeof(filter_end));
+        ptr += sizeof(filter_end);
+
+#if 0
+printf("entries %u\n",  (unsigned) ((uint64_t) ptr - (uint64_t) (filter)) / (unsigned) sizeof(struct sock_filter));
+{
+        unsigned j;
+        unsigned char *ptr2 = (unsigned char *) &filter[0];
+        for (j = 0; j < sizeof(filter); j++, ptr2++) {
+                if ((j % (sizeof(struct sock_filter))) == 0)
+                        printf("\n%u: ", 1 + (unsigned) (j / (sizeof(struct sock_filter))));
+                printf("%02x, ", (*ptr2) & 0xff);
+        }
+        printf("\n");
+}
+#endif  
+
+        // install filter
+        unsigned short entries = (unsigned short) ((uint64_t) ptr - (uint64_t) (filter)) / (unsigned) sizeof(struct sock_filter);
+        struct sock_fprog prog = {
+                .len = entries,
+                .filter = filter,
+        };
+
+        if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) || prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+                fprintf(stderr, "Warning: seccomp disabled, it requires a Linux kernel version 3.5 or newer.\n");
+                return;
+        }
+        else if (arg_debug) {
+                printf("seccomp protocol filter enabled\n");
+        }
+
+#if defined(__x86_64__)
+        
+#endif
+        
+}
+
+#endif
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 3c5a176e6..427b3fc09 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -190,13 +190,13 @@ int sandbox(void* sandbox_arg) {
                         // force default seccomp inside the chroot, no keep or drop list
                         // the list build on top of the default drop list is kept intact
                         arg_seccomp = 1;
-                        if (arg_seccomp_list_drop) {
-                                free(arg_seccomp_list_drop);
-                                arg_seccomp_list_drop = NULL;
+                        if (cfg.seccomp_list_drop) {
+                                free(cfg.seccomp_list_drop);
+                                cfg.seccomp_list_drop = NULL;
                         }
-                        if (arg_seccomp_list_keep) {
-                                free(arg_seccomp_list_keep);
-                                arg_seccomp_list_keep = NULL;
+                        if (cfg.seccomp_list_keep) {
+                                free(cfg.seccomp_list_keep);
+                                cfg.seccomp_list_keep = NULL;
                         }
                         
                         // disable all capabilities
@@ -426,11 +426,16 @@ int sandbox(void* sandbox_arg) {
 
         // set seccomp
 #ifdef HAVE_SECCOMP
+        // install protocol filter
+        if (cfg.protocol) {
+                protocol_filter();              
+        }
+
         // if a keep list is available, disregard the drop list
         if (arg_seccomp == 1) {
-                if (arg_seccomp_list_keep)
+                if (cfg.seccomp_list_keep)
                         seccomp_filter_keep(); // this will also save the fmyilter to MNT_DIR/seccomp file
-                else if (arg_seccomp_list_errno)
+                else if (cfg.seccomp_list_errno)
                         seccomp_filter_errno(); // this will also save the filter to MNT_DIR/seccomp file
                 else
                         seccomp_filter_drop(); // this will also save the filter to MNT_DIR/seccomp file
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 29c87b18b..dd7b8d344 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -343,7 +343,7 @@ int seccomp_filter_drop(void) {
         filter_init();
         
         // default seccomp
-        if (arg_seccomp_list_drop == NULL) {
+        if (cfg.seccomp_list_drop == NULL) {
 #ifdef SYS_mount                
                 filter_add_blacklist(SYS_mount, 0);
 #endif
@@ -507,15 +507,15 @@ int seccomp_filter_drop(void) {
         }
 
         // default seccomp filter with additional drop list
-        if (arg_seccomp_list && arg_seccomp_list_drop == NULL) {
-                if (syscall_check_list(arg_seccomp_list, filter_add_blacklist, 0)) {
+        if (cfg.seccomp_list && cfg.seccomp_list_drop == NULL) {
+                if (syscall_check_list(cfg.seccomp_list, filter_add_blacklist, 0)) {
                         fprintf(stderr, "Error: cannot load seccomp filter\n");
                         exit(1);
                 }
         }
         // drop list
-        else if (arg_seccomp_list == NULL && arg_seccomp_list_drop) {
-                if (syscall_check_list(arg_seccomp_list_drop, filter_add_blacklist, 0)) {
+        else if (cfg.seccomp_list == NULL && cfg.seccomp_list_drop) {
+                if (syscall_check_list(cfg.seccomp_list_drop, filter_add_blacklist, 0)) {
                         fprintf(stderr, "Error: cannot load seccomp filter\n");
                         exit(1);
                 }
@@ -558,8 +558,8 @@ int seccomp_filter_keep(void) {
         filter_add_whitelist(SYS_dup, 0);
         
         // apply keep list
-        if (arg_seccomp_list_keep) {
-                if (syscall_check_list(arg_seccomp_list_keep, filter_add_whitelist, 0)) {
+        if (cfg.seccomp_list_keep) {
+                if (syscall_check_list(cfg.seccomp_list_keep, filter_add_whitelist, 0)) {
                         fprintf(stderr, "Error: cannot load seccomp filter\n");
                         exit(1);
                 }
@@ -599,8 +599,8 @@ int seccomp_filter_errno(void) {
         // apply errno list
 
         for (i = 0; i < higest_errno; i++) {
-                if (arg_seccomp_list_errno[i]) {
-                        if (syscall_check_list(arg_seccomp_list_errno[i], filter_add_errno, i)) {
+                if (cfg.seccomp_list_errno[i]) {
+                        if (syscall_check_list(cfg.seccomp_list_errno[i], filter_add_errno, i)) {
                                 fprintf(stderr, "Error: cannot load seccomp filter\n");
                                 exit(1);
                         }
diff --git a/src/firejail/seccomp.h b/src/firejail/seccomp.h
index 19684d4a9..b83fe87ce 100644
--- a/src/firejail/seccomp.h
+++ b/src/firejail/seccomp.h
@@ -92,15 +92,26 @@ struct seccomp_data {
 # define ARCH_NR        0
 #endif
 
-
 #define VALIDATE_ARCHITECTURE \
      BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))), \
      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
+#define VALIDATE_ARCHITECTURE_32_64 \
+     BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))), \
+     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
+     BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
+
 #define EXAMINE_SYSCALL BPF_STMT(BPF_LD+BPF_W+BPF_ABS,  \
                  (offsetof(struct seccomp_data, nr)))
 
+#define EXAMINE_ARGUMENT(nr) BPF_STMT(BPF_LD+BPF_W+BPF_ABS,     \
+                 (offsetof(struct seccomp_data, args[nr])))
+
+#define ONLY(syscall_nr)        \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, syscall_nr, 1, 0),      \
+        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
+
 #define BLACKLIST(syscall_nr)   \
         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, syscall_nr, 0, 1),      \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
@@ -116,6 +127,9 @@ struct seccomp_data {
 #define RETURN_ALLOW \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
+#define RETURN_ERRNO(nr) \
+        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO | nr)
+
 #define KILL_PROCESS \
         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
 
diff --git a/src/tools/syscall_test b/src/tools/syscall_test
new file mode 100755
index 000000000..21db21ae0
--- /dev/null
+++ b/src/tools/syscall_test
diff --git a/src/tools/syscall_test.c b/src/tools/syscall_test.c
new file mode 100644
index 000000000..47c27978b
--- /dev/null
+++ b/src/tools/syscall_test.c
@@ -0,0 +1,70 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <linux/netlink.h>
+#include <net/ethernet.h>
+
+int main(int argc, char **argv) {
+        if (argc != 2) {
+                printf("Usage: test [sleep|socket|mkdir]\n");
+                return 1;
+        }
+
+        if (strcmp(argv[1], "sleep") == 0) {
+                printf("before sleep\n");
+                sleep(1);
+                printf("after sleep\n");
+        }
+        else if (strcmp(argv[1], "socket") == 0) {
+                int sock;
+
+                printf("testing socket AF_INET\n");
+                if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+                        perror("socket");
+                }
+                else
+                        close(sock);
+
+                printf("testing socket AF_INET6\n");
+                if ((sock = socket(AF_INET6, SOCK_STREAM, 0)) < 0) {
+                        perror("socket");
+                }
+                else
+                        close(sock);
+
+                printf("testing socket AF_NETLINK\n");
+                if ((sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE)) < 0) {
+                        perror("socket");
+                }
+                else
+                        close(sock);
+                        
+                printf("testing socket AF_UNIX\n");
+                if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+                        perror("socket");
+                }
+                else
+                        close(sock);
+                        
+                // root needed to be able to handle this
+                printf("testing socket AF_PACKETX\n");
+                if ((sock = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ARP))) < 0) {
+                        perror("socket");
+                }
+                else
+                        close(sock);
+                printf("after socket\n");
+        }
+        else if (strcmp(argv[1], "mkdir") == 0) {
+                printf("before mkdir\n");
+                mkdir("tmp", 0777);
+                printf("after mkdir\n");
+        }
+        else {
+                fprintf(stderr, "Error: invalid argument\n");
+                return 1;
+        }
+        return 0;
+}
diff --git a/src/tools/syscall_test32 b/src/tools/syscall_test32
new file mode 100755
index 000000000..5d027f5dd
--- /dev/null
+++ b/src/tools/syscall_test32