23 files changed, 98 insertions, 48 deletions

diff --git a/README b/README
index d6258e8e4..fa7a1b651 100644
--- a/README
+++ b/README
@@ -360,6 +360,7 @@ SpotComms (https://github.com/SpotComms)
         - lots of profile tightening
         - added viking, youtube-dl, meld profiles
         - more profile tightening
+        - added Arduino profile
 SYN-cook (https://github.com/SYN-cook)
         - keepass/keepassx browser fixes
         - disable-common.inc fixes
diff --git a/README.md b/README.md
index ddc1a9639..5a0be0a7b 100644
--- a/README.md
+++ b/README.md
@@ -196,4 +196,4 @@ simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show,
 xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5,
 PDFSam, Pithos, Xonotic, wireshark, keepassx2, QupZilla, FossaMail, Uzbl browser, xmms, iridium browser,
 Kino, Thunar, Geeqie, Engrampa, Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView, baloo_file,
-Nylas, dino, BibleTime, viewnior, Kodi, viking, youtube-dl, meld
+Nylas, dino, BibleTime, viewnior, Kodi, viking, youtube-dl, meld, Arduino
diff --git a/RELNOTES b/RELNOTES
index 77a097506..f71859cf4 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -37,7 +37,7 @@ firejail (0.9.46-rc1) baseline; urgency=low
   * new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa,
   * new profiles: Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView,
   * new profiles: baloo_file, Nylas, dino, BibleTime, viewnior, Kodi, viking,
-  * new profiles: youtube-dl, meld
+  * new profiles: youtube-dl, meld, Arduino
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Fri, 7 Apr 2017 08:00:00 -0500
 
diff --git a/etc/arduino.profile b/etc/arduino.profile
new file mode 100644
index 000000000..e80222bb6
--- /dev/null
+++ b/etc/arduino.profile
@@ -0,0 +1,28 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include /etc/firejail/arduino.local
+
+# Firejail profile for arduino
+noblacklist ${HOME}/.arduino15
+noblacklist ${HOME}/Arduino
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-devel.inc
+
+caps.drop all
+netfilter
+no3d
+nogroups
+nonewprivs
+noroot
+nosound
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/qtox.profile b/etc/qtox.profile
index 40a959d05..f3158b206 100644
--- a/etc/qtox.profile
+++ b/etc/qtox.profile
@@ -3,7 +3,8 @@
 include /etc/firejail/qtox.local
 
 # qTox instant messaging profile
-noblacklist ${HOME}/.config/tox
+noblacklist ~/.config/tox
+noblacklist ~/.config/qt5ct
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
@@ -11,6 +12,8 @@ include /etc/firejail/disable-passwdmgr.inc
 
 mkdir ${HOME}/.config/tox
 whitelist ${HOME}/.config/tox
+mkdir ${HOME}/.config/qt5ct
+whitelist ${HOME}/.config/qt5ct
 whitelist ${DOWNLOADS}
 
 caps.drop all
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 0f1f14bf5..011f52657 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -6,6 +6,7 @@
 /etc/firejail/Wire.profile
 /etc/firejail/abrowser.profile
 /etc/firejail/amarok.profile
+/etc/firejail/arduino.profile
 /etc/firejail/ark.profile
 /etc/firejail/atom-beta.profile
 /etc/firejail/atom.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index a01c809fb..62490b1ec 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -208,6 +208,7 @@ flowblade
 eog
 
 # other
+arduino
 atom
 atom-beta
 baloo_file
diff --git a/test/environment/csh.exp b/test/environment/csh.exp
index bd0cf8c86..89de94b3c 100755
--- a/test/environment/csh.exp
+++ b/test/environment/csh.exp
@@ -14,7 +14,7 @@ expect {
 }
 sleep 1
 
-send -- "find /home\r"
+send -- "find ~\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         ".cshrc"
diff --git a/test/environment/zsh.exp b/test/environment/zsh.exp
index 4380f476c..1b6cdcdc5 100755
--- a/test/environment/zsh.exp
+++ b/test/environment/zsh.exp
@@ -14,7 +14,7 @@ expect {
 }
 sleep 1
 
-send -- "find /home\r"
+send -- "find ~\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         ".zshrc"
diff --git a/test/fcopy/fcopy.sh b/test/fcopy/fcopy.sh
index d122eff5d..362ed66e0 100755
--- a/test/fcopy/fcopy.sh
+++ b/test/fcopy/fcopy.sh
@@ -9,10 +9,10 @@ export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
 if [ -f /etc/debian_version ]; then
         libdir=$(dirname "$(dpkg -L firejail | grep fcopy)")
         export PATH="$PATH:$libdir"
-else
-        export PATH="$PATH:/usr/lib/firejail"
 fi
 
+export PATH="$PATH:/usr/lib/firejail"
+
 mkdir dest
 
 echo "TESTING: fcopy cmdline (test/fcopy/cmdline.exp)"
diff --git a/test/fs/mkdir_mkfile.exp b/test/fs/mkdir_mkfile.exp
index 28a5ae459..1faa913e0 100755
--- a/test/fs/mkdir_mkfile.exp
+++ b/test/fs/mkdir_mkfile.exp
@@ -16,11 +16,7 @@ expect {
 }
 sleep 1
 
-send -- "find ~\r"
-expect {
-        timeout {puts "TESTING ERROR 1\n";exit}
-        "_firejail_test_file"
-}
+send -- "find ~ | LC_ALL=C sort\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         "_firejail_test_dir"
@@ -41,6 +37,10 @@ expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         "_firejail_test_dir/dir1/dir2/dir3/file1"
 }
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "_firejail_test_file"
+}
 after 100
 send -- "exit\r"
 after 100
diff --git a/test/fs/private-home-dir.exp b/test/fs/private-home-dir.exp
index 77baeeb5f..9c97ff4ea 100755
--- a/test/fs/private-home-dir.exp
+++ b/test/fs/private-home-dir.exp
@@ -41,7 +41,11 @@ expect {
 }
 after 100
 
-send -- "ls -al ~\r"
+send -- "find ~ | LC_ALL=C sort\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        ".Xauthority"
+}
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
         ".asoundrc"
@@ -50,10 +54,6 @@ expect {
         timeout {puts "TESTING ERROR 3\n";exit}
         ".bashrc"
 }
-expect {
-        timeout {puts "TESTING ERROR 4\n";exit}
-        ".Xauthority"
-}
 after 100
 
 send -- "exit\r"
diff --git a/test/fs/private.exp b/test/fs/private.exp
index c7059079d..e522ca5a1 100755
--- a/test/fs/private.exp
+++ b/test/fs/private.exp
@@ -37,18 +37,18 @@ expect {
 }
 after 100
 
-send -- "ls -al ~\r"
+send -- "find ~ | LC_ALL=C sort\r"
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
-        ".asoundrc"
+        ".Xauthority"
 }
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
-        ".bashrc"
+        ".asoundrc"
 }
 expect {
         timeout {puts "TESTING ERROR 4\n";exit}
-        ".Xauthority"
+        ".bashrc"
 }
 after 100
 
diff --git a/test/fs/whitelist-double.exp b/test/fs/whitelist-double.exp
index dd2336ce1..ac6adc165 100755
--- a/test/fs/whitelist-double.exp
+++ b/test/fs/whitelist-double.exp
@@ -32,10 +32,10 @@ expect {
         "123"
 }
 
-send -- "rm /tmp/firejal-deleteme\r"
+send -- "rm -v /tmp/firejal-deleteme\r"
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
-        "0"
+        "removed"
 }
 after 100
 
diff --git a/test/fs/whitelist-downloads.exp b/test/fs/whitelist-downloads.exp
index f3eb0d6a2..a64197953 100755
--- a/test/fs/whitelist-downloads.exp
+++ b/test/fs/whitelist-downloads.exp
@@ -17,7 +17,7 @@ expect {
 }
 after 100
 
-send -- "firejail --force --profile=/etc/firejail/firefox.profile\r"
+send -- "firejail --force --ignore=shell --profile=/etc/firejail/firefox.profile\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         "cannot whitelist Downloads directory"
@@ -34,7 +34,7 @@ after 100
 send -- "cp /tmp/user-dirs.dirs ~/.config/.\r"
 after 100
 
-send -- "firejail --force --profile=/etc/firejail/firefox.profile\r"
+send -- "firejail --force --ignore=shell --profile=/etc/firejail/firefox.profile\r"
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
         "cannot whitelist Downloads directory"
diff --git a/test/fs/whitelist-empty.exp b/test/fs/whitelist-empty.exp
index e1c3ffb4a..9e4406263 100755
--- a/test/fs/whitelist-empty.exp
+++ b/test/fs/whitelist-empty.exp
@@ -14,36 +14,36 @@ expect {
 }
 sleep 1
 
-send -- "ls -l ~/ | wc -l\r"
+send -- "ls -l ~\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         "0"
 }
 
-send -- "ls -l /tmp | wc -l\r"
+send -- "ls -l /tmp\r"
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
         "0"
 }
 
-send -- "ls -l /media | wc -l\r"
+send -- "ls -l /media\r"
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
         "0"
 }
 
-send -- "ls -l /var | wc -l\r"
+send -- "ls -l /var\r"
 expect {
         timeout {puts "TESTING ERROR 4\n";exit}
         "0"
 }
 
-send -- "ls -l /dev | wc -l\r"
+send -- "ls -l /dev\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "0"
 }
-send -- "ls -l /opt | wc -l\r"
+send -- "ls -l /opt\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         "0"
diff --git a/test/network/4bridges_arp.exp b/test/network/4bridges_arp.exp
index 80760eb3a..e84ec719c 100755
--- a/test/network/4bridges_arp.exp
+++ b/test/network/4bridges_arp.exp
@@ -150,22 +150,26 @@ expect {
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.20.0/29 dev eth0  proto kernel  scope link"
+        "10.10.20.0/29 dev eth0  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.20.0/29 dev eth0 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.30.0/24 dev eth1  proto kernel  scope link"
+        "10.10.30.0/24 dev eth1  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.30.0/24 dev eth1 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.40.0/24 dev eth2  proto kernel  scope link"
+        "10.10.40.0/24 dev eth2  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.40.0/24 dev eth2 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.50.0/24 dev eth3  proto kernel  scope link"
+        "10.10.50.0/24 dev eth3  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.50.0/24 dev eth3 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "exit\r"
 after 100
diff --git a/test/network/4bridges_ip.exp b/test/network/4bridges_ip.exp
index 5e136926b..74a1e5d68 100755
--- a/test/network/4bridges_ip.exp
+++ b/test/network/4bridges_ip.exp
@@ -150,25 +150,29 @@ expect {
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.20.0/29 dev eth0  proto kernel  scope link"
+        "10.10.20.0/29 dev eth0  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.20.0/29 dev eth0 proto kernel scope link" {puts "new iproute2\n";}
 }
 
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.3\n";exit}
-        "10.10.30.0/24 dev eth1  proto kernel  scope link  src 10.10.30.50"
+        "10.10.30.0/24 dev eth1  proto kernel  scope link  src 10.10.30.50" {puts "old iproute2\n";}
+        "10.10.30.0/24 dev eth1 proto kernel scope link src 10.10.30.50" {puts "new iproute2\n";}
 }
 
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.4\n";exit}
-        "10.10.40.0/24 dev eth2  proto kernel  scope link  src 10.10.40.100"
+        "10.10.40.0/24 dev eth2  proto kernel  scope link  src 10.10.40.100" {puts "old iproute2\n";}
+        "10.10.40.0/24 dev eth2  proto kernel scope link src 10.10.40.100" {puts "new iproute2\n";}
 }
 
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.5\n";exit}
-        "10.10.50.0/24 dev eth3  proto kernel  scope link"
+        "10.10.50.0/24 dev eth3  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.50.0/24 dev eth3 proto kernel scope link" {puts "new iproute2\n";}
 }
 
 send -- "exit\r"
diff --git a/test/network/interface.exp b/test/network/interface.exp
index bd8777c33..638e6d32b 100755
--- a/test/network/interface.exp
+++ b/test/network/interface.exp
@@ -27,8 +27,9 @@ expect {
         "eth0.5"
 }
 expect {
-        timeout {puts "TESTING ERROR 2n";exit}
-        "Link"
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Link" {puts "old net-tools\n";}
+        "flags" {puts "new net-tools\n";}
 }
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
@@ -47,7 +48,8 @@ expect {
 }
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
-        "Link"
+        "Link" {puts "old net-tools\n";}
+        "flags" {puts "new net-tools\n";}
 }
 expect {
         timeout {puts "TESTING ERROR 7\n";exit}
diff --git a/test/network/net_defaultgw.exp b/test/network/net_defaultgw.exp
index c7178616a..763eee38e 100755
--- a/test/network/net_defaultgw.exp
+++ b/test/network/net_defaultgw.exp
@@ -41,7 +41,8 @@ expect {
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.20.0/29 dev eth0  proto kernel  scope link"
+        "10.10.20.0/29 dev eth0  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.20.0/29 dev eth0 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "exit\r"
 after 100
diff --git a/test/network/net_defaultgw2.exp b/test/network/net_defaultgw2.exp
index 088dfeee8..e7483c921 100755
--- a/test/network/net_defaultgw2.exp
+++ b/test/network/net_defaultgw2.exp
@@ -29,13 +29,15 @@ expect {
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.2\n";exit}
-        "10.10.20.0/29 dev eth0  proto kernel  scope link"
+        "10.10.20.0/29 dev eth0  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.20.0/29 dev eth0 proto kernel scope link" {puts "new iproute2\n";}
 }
 
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10.3\n";exit}
-        "10.10.30.0/24 dev eth1  proto kernel  scope link"
+        "10.10.30.0/24 dev eth1  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.30.0/24 dev eth1 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "exit\r"
 after 100
diff --git a/test/network/net_ip.exp b/test/network/net_ip.exp
index c6b84781c..8ec676dd1 100755
--- a/test/network/net_ip.exp
+++ b/test/network/net_ip.exp
@@ -67,7 +67,8 @@ expect {
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 10\n";exit}
-        "10.10.20.0/29 dev eth0  proto kernel  scope link"
+        "10.10.20.0/29 dev eth0  proto kernel  scope link" {puts "old iproute2\n";}
+        "10.10.20.0/29 dev eth0 proto kernel scope link" {puts "new iproute2\n";}
 }
 send -- "exit\r"
 after 100
diff --git a/test/network/net_profile.exp b/test/network/net_profile.exp
index febbcfcd7..b3bc9b441 100755
--- a/test/network/net_profile.exp
+++ b/test/network/net_profile.exp
@@ -38,13 +38,15 @@ sleep 1
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
-        "10.10.30.0/24 dev eth1  proto kernel  scope link  src 10.10.30.50"
+        "10.10.30.0/24 dev eth1  proto kernel  scope link  src 10.10.30.50" {puts "old iproute2\n";}
+        "10.10.30.0/24 dev eth1 proto kernel scope link src 10.10.30.50" {puts "new iproute2\n";}
 }
 
 send -- "ip route show\r"
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
-        "10.10.40.0/24 dev eth2  proto kernel  scope link  src 10.10.40.100"
+        "10.10.40.0/24 dev eth2  proto kernel  scope link  src 10.10.40.100" {puts "old iproute2\n";}
+        "10.10.40.0/24 dev eth2 proto kernel scope link src 10.10.40.100" {puts "new iproute2\n";}
 }