6 files changed, 156 insertions, 9 deletions

diff --git a/README b/README
index bf5fcf041..a4f8497e8 100644
--- a/README
+++ b/README
@@ -245,6 +245,8 @@ Ivan Kozik (https://github.com/ivan)
         - speed up sandbox exit
 Jaykishan Mutkawoa (https://github.com/jmutkawoa)
         - cpio profile
+James Elford (https://github.com/jelford)
+        - pass password manager support
 Jericho (https://github.com/attritionorg)
         - spelling
 Jesse Smith (https://github.com/slicer69)
@@ -293,6 +295,9 @@ mahdi1234 (https://github.com/mahdi1234)
 Martin Carpenter (https://github.com/mcarpenter)
         - security audit and bug fixes
         - Centos 6.x support
+Martin Dosch (spam-debian@mdosch.de)
+        - support for gnome-shell integration addon in Firefox
+          (Bug-Debian: https://bugs.debian.org/872720)
 Matt Parnell (https://github.com/ilikenwf)
         - whitelisting for core firefox related functionality
 Mattias Wadman (https://github.com/wader)
diff --git a/README.md b/README.md
index 8372841a5..dd616f8a4 100644
--- a/README.md
+++ b/README.md
@@ -168,6 +168,12 @@ Check the status of the latest build here: https://travis-ci.org/netblue30/firej
                  48 pts/0    00:00:00 ps
               $
 
+       --seccomp.block_secondary
+              Enable seccomp filter and filter system call  architectures  so
+              that  only  the native architecture is allowed. For example, on
+              amd64, i386 and x32 system calls are blocked as well as  chang‐
+              ing the execution domain with personality(2) system call.
+
 `````
 
 ## /etc/firejail/firejail.config
diff --git a/RELNOTES b/RELNOTES
index 56e9cce35..7b0f13737 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -3,18 +3,22 @@ firejail (0.9.49) baseline; urgency=low
   * modif: --output split in two commands, --output and --output-stderr
   * feature: per-profile disable-mnt (--disable-mnt)
   * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
-  * feature: --memory-deny-write-execute seccomp feature
   * feature: private /lib directory (--private-lib)
   * feature: disable CDROM/DVD drive (--nodvd)
   * feature: disable DVB devices (--notv)
   * enhancement: print all seccomp filters under --debug
   * enhancement: /proc/sys mounting
-  * enhancement: default seccomp list update
   * enhancement: rework IP address assingment for --net options
   * enhancement: support for newer Xpra versions (2.1+) -
      set "xpra-attach yes" in /etc/firejail/firejail.config
   * enhancement: all profiles use a standard layout style
   * enhancement: create /usr/local for firecfg if the directory doesn't exist
+  * seccomp feature: --memory-deny-write-execute
+  * seccomp feature: seccomp post-exec
+  * seccomp feature: block secondary architecture (--seccomp.block_secondary)
+  * seccomp feature: seccomp syscall groups
+  * seccomp enhancement: print all seccomp filters under --debug
+  * seccomp enhancement: default seccomp list update
   * new profiles: curl, mplayer2, SMPlayer, Calibre, ebook-viewer, KWrite,
   * new profiles: Geary, Liferea, peek, silentarmy, IntelliJ IDEA,
   * new profiles: Android Studio, electron, riot-web, Extreme Tux Racer,
diff --git a/test/filters/block-secondary.profile b/test/filters/block-secondary.profile
new file mode 100644
index 000000000..e32056c3d
--- /dev/null
+++ b/test/filters/block-secondary.profile
@@ -0,0 +1 @@
+seccomp.block-secondary
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 611580612..3ebb61419 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -54,8 +54,12 @@ fi
 echo "TESTING: seccomp bad empty (test/filters/seccomp-bad-empty.exp)"
 ./seccomp-bad-empty.exp
 
-echo "TESTING: seccomp debug  (test/filters/seccomp-debug.exp)"
-./seccomp-debug.exp
+if [ "$(uname -m)" = "x86_64" ]; then
+        echo "TESTING: seccomp debug  (test/filters/seccomp-debug.exp)"
+        ./seccomp-debug.exp
+else
+        echo "TESTING SKIP: protocol, running only on x86_64"
+fi
 
 echo "TESTING: seccomp errno (test/filters/seccomp-errno.exp)"
 ./seccomp-errno.exp
diff --git a/test/filters/seccomp-debug.exp b/test/filters/seccomp-debug.exp
index a95f3bd23..7f03e45e8 100755
--- a/test/filters/seccomp-debug.exp
+++ b/test/filters/seccomp-debug.exp
@@ -7,25 +7,152 @@ set timeout 10
 spawn $env(SHELL)
 match_max 100000
 
-send --  "firejail --seccomp --debug\r"
+send --  "firejail --debug sleep 1; echo done\r"
 expect {
         timeout {puts "TESTING ERROR 0\n";exit}
         "SECCOMP Filter"
 }
 expect {
-        timeout {puts "TESTING ERROR 2\n";exit}
+        timeout {puts "TESTING ERROR 1\n";exit}
         "BLACKLIST"
 }
 expect {
-        timeout {puts "TESTING ERROR 3\n";exit}
+        timeout {puts "TESTING ERROR 2\n";exit}
         "open_by_handle_at"
 }
 expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Child process initialized"
+}
+expect {
         timeout {puts "TESTING ERROR 4\n";exit}
+        "done"
+}
+after 100
+
+
+# amd64 architecture
+send --  "firejail --debug sleep 1; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
         "Child process initialized"
 }
-sleep 2
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "Installing /run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "done"
+}
+after 100
 
-send -- "exit\r"
+# amd64 architecture - ignore seccomp
+send --  "firejail --debug --ignore=seccomp sleep 1; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "Installing /run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 11\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 12\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 13\n";exit}
+        "Installing /run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 14\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 15\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 16\n";exit}
+        "done"
+}
 after 100
+
+# amd64 architecture - ignore protocol
+send --  "firejail --debug --ignore=protocol sleep 1; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 17\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 18\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 19\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 20\n";exit}
+        "Installing /run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 22\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 23\n";exit}
+        "done"
+}
+after 100
+
+# memory-deny-write-execute
+send --  "firejail --debug --memory-deny-write-execute sleep 1; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 24\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 25\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 26\n";exit}
+        "done"
+}
+
+
+# amd64 architecture - seccomp.block-secondary
+send --  "firejail --debug --seccomp.block-secondary sleep 1; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 27\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 28\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 29\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 30\n";exit}
+        "Installing /run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 31\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 32\n";exit}
+        "Installing /run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 33\n";exit}
+        "done"
+}
+after 100
+
+# amd64 architecture - seccomp.block-secondary, profile
+send --  "firejail --debug --profile=block-secondary.profile sleep 1; echo done\r"
+expect {
+        timeout {puts "TESTING ERROR 33\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 34\n";exit}
+        "Child process initialized"
+}
+expect {
+        timeout {puts "TESTING ERROR 35\n";exit}
+        "Installing /run/firejail/mnt/seccomp.i386 seccomp filter" {puts "TESTING ERROR 35\n";exit}
+        "Installing /run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 37\n";exit}
+        "done"
+}
+after 100
+
 puts "all done\n"