10 files changed, 46 insertions, 112 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5c7f73fc1..e0cecda1b 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -1035,13 +1035,6 @@ int sandbox(void* sandbox_arg) {
                 int rv = unlink(RUN_SECCOMP_MDWX);
                 (void) rv;
         }
-
-        if (arg_debug) {
-                printf("\nSeccomp files:\n");
-                int rv = system("ls -l /run/firejail/mnt/seccomp*\n");
-                (void) rv;
-                printf("\n");
-        }
 #endif
 
         //****************************************
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index cc2b08542..53df20a54 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -153,13 +153,6 @@ int sbox_run(unsigned filter, int num, ...) {
                 for (i = 3; i < max; i++)
                         close(i); // close open files
 
-#if 0
-                if (arg_debug) {
-                        printf("sbox file descriptors:\n");
-                        int rv = system("ls -l /proc/self/fd");
-                        (void) rv;
-                }
-#endif
                 umask(027);
 
                 // apply filters
@@ -216,12 +209,5 @@ int sbox_run(unsigned filter, int num, ...) {
                 exit(1);
         }
 
-#if 0
-printf("** sbox run out *********************************\n");
-system("ls -l /run/firejail/mnt\n");
-system("ls -l /proc/self/fd");
-printf("** sbox run out *********************************\n");
-#endif
-
         return status;
 }
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 3903b4709..7040dea18 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -347,12 +347,6 @@ void x11_start_xvfb(int argc, char **argv) {
         }
         free(fname);
 
-        if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
-        }
-
         assert(display_str);
         setenv("DISPLAY", display_str, 1);
         // run attach command
@@ -582,12 +576,6 @@ void x11_start_xephyr(int argc, char **argv) {
         }
         free(fname);
 
-        if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
-        }
-
         assert(display_str);
         setenv("DISPLAY", display_str, 1);
         // run attach command
@@ -755,12 +743,6 @@ void x11_start_xpra_old(int argc, char **argv, int display, char *display_str) {
         }
         free(fname);
 
-        if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
-        }
-
         // build attach command
         char *attach_argv[] = { "xpra", "--title=\"firejail x11 sandbox\"", "attach", display_str, NULL };
 
diff --git a/test/environment/allow-debuggers.exp b/test/environment/allow-debuggers.exp
index 359f94db1..f92ec5ddf 100755
--- a/test/environment/allow-debuggers.exp
+++ b/test/environment/allow-debuggers.exp
@@ -5,36 +5,27 @@ cd /home
 spawn $env(SHELL)
 match_max 100000
 
-send -- "firejail --profile=/etc/firejail/firefox.profile --allow-debuggers strace ls\r"
+send -- "firejail --allow-debuggers\r"
 expect {
         timeout {puts "TESTING ERROR 0\n";exit}
         "Child process initialized" { puts "\n"}
         "is disabled on Linux kernels prior to 4.8" { puts "TESTING SKIP: kernel too old\n"; exit }
 }
-expect {
-        timeout {puts "TESTING ERROR 1\n";exit}
-        "ioctl"
-}
-expect {
-        timeout {puts "TESTING ERROR 2\n";exit}
-        "exit_group"
-}
 after 100
 
-send -- "firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace ls\r"
-expect {
-        timeout {puts "TESTING ERROR 3\n";exit}
-        "Child process initialized"
-}
+send -- "strace ls\r"
 expect {
-        timeout {puts "TESTING ERROR 4\n";exit}
-        "ioctl"
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "open"
 }
 expect {
-        timeout {puts "TESTING ERROR 5\n";exit}
+        timeout {puts "TESTING ERROR 2\n";exit}
         "exit_group"
 }
 after 100
+send -- "exit\r"
+sleep 1
+
 
 
 puts "\nall done\n"
diff --git a/test/environment/environment.sh b/test/environment/environment.sh
index b6688d484..364a4b65b 100755
--- a/test/environment/environment.sh
+++ b/test/environment/environment.sh
@@ -68,9 +68,6 @@ fi
 echo "TESTING: firejail in firejail - single sandbox (test/environment/firejail-in-firejail.exp)"
 ./firejail-in-firejail.exp
 
-echo "TESTING: firejail in firejail - force new sandbox (test/environment/firejail-in-firejail2.exp)"
-./firejail-in-firejail2.exp
-
 which aplay
 if [ "$?" -eq 0 ];
 then
diff --git a/test/environment/firejail-in-firejail2.exp b/test/environment/firejail-in-firejail2.exp
deleted file mode 100755
index 6528e45cd..000000000
--- a/test/environment/firejail-in-firejail2.exp
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/expect -f
-# This file is part of Firejail project
-# Copyright (C) 2014-2018 Firejail Authors
-# License GPL v2
-
-set timeout 10
-spawn $env(SHELL)
-match_max 100000
-
-send --  "firejail --noprofile\r"
-expect {
-        timeout {puts "TESTING ERROR 1\n";exit}
-        "Child process initialized"
-}
-sleep 1
-
-send --  "firejail\r"
-expect {
-        timeout {puts "TESTING ERROR 2\n";exit}
-        "Warning: an existing sandbox was detected"
-}
-after 100
-
-send --  "exit\r"
-after 100
-
-send --  "firejail --force\r"
-expect {
-        timeout {puts "TESTING ERROR 3\n";exit}
-        "Child process initialized"
-}
-after 100
-
-send --  "exit\r"
-after 100
-
-send --  "firejail --version\r"
-expect {
-        timeout {puts "TESTING ERROR 4\n";exit}
-        "firejail version"
-}
-after 100
-
-send --  "firejail --version --force\r"
-expect {
-        timeout {puts "TESTING ERROR 5\n";exit}
-        "firejail version"
-}
-after 100
-
-puts "\nall done\n"
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 12f13606b..97ecc8be0 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -31,6 +31,9 @@ echo "TESTING: debug options (test/filters/debug.exp)"
 echo "TESTING: seccomp run files (test/filters/seccomp-run-files.exp)"
 ./seccomp-run-files.exp
 
+echo "TESTING: seccomp postexec (test/filters/seccomp-postexec.exp)"
+./seccomp-postexec.exp
+
 echo "TESTING: noroot (test/filters/noroot.exp)"
 ./noroot.exp
 
diff --git a/test/filters/seccomp-postexec.exp b/test/filters/seccomp-postexec.exp
new file mode 100755
index 000000000..4302aec5e
--- /dev/null
+++ b/test/filters/seccomp-postexec.exp
@@ -0,0 +1,33 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2018 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --debug --seccomp=execve\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "configuring postexec seccomp filter in"
+}
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "data.architecture"
+}
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "monitoring pid"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Sandbox monitor: waitpid"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "Parent is shutting down"
+}
+sleep 1
+
+puts "all done\n"
diff --git a/test/fnetfilter/default.exp b/test/fnetfilter/default.exp
index 4c24b370f..8406160e3 100755
--- a/test/fnetfilter/default.exp
+++ b/test/fnetfilter/default.exp
@@ -31,7 +31,7 @@ after 100
 send -- "fnetfilter test1.net,33\r"
 expect {
         timeout {puts "TESTING ERROR 4\n";exit}
-        "invalid destination file in netfilter command"
+        "cannot open test1.net,33"
 }
 after 100
 send -- "rm outfile\r"
diff --git a/test/fnetfilter/template.exp b/test/fnetfilter/template.exp
index b63a2d4c9..5b84166d8 100755
--- a/test/fnetfilter/template.exp
+++ b/test/fnetfilter/template.exp
@@ -66,7 +66,7 @@ after 100
 send -- "fnetfilter test2.net,icmp-type,destination-unreachable,time-exceeded,echo-request\r"
 expect {
         timeout {puts "TESTING ERROR 12\n";exit}
-        "invalid destination file in netfilter command"
+        "cannot open test2.net,"
 }
 after 100