5 files changed, 66 insertions, 40 deletions

diff --git a/test/capabilities/capabilities.sh b/test/capabilities/capabilities.sh
index 50279cd4f..2d345025a 100755
--- a/test/capabilities/capabilities.sh
+++ b/test/capabilities/capabilities.sh
@@ -21,3 +21,6 @@ echo "TESTING: capabilities print (test/filters/caps-print.exp)"
 echo "TESTING: capabilities join (test/filters/caps-join.exp)"
 ./caps-join.exp
 
+echo "TESTING: firemon caps (test/utils/firemon-caps.exp)"
+./firemon-caps.exp
+
diff --git a/test/capabilities/caps-join.exp b/test/capabilities/caps-join.exp
index 1830143fb..ecb43d943 100755
--- a/test/capabilities/caps-join.exp
+++ b/test/capabilities/caps-join.exp
@@ -35,7 +35,7 @@ sleep 1
 
 set spawn_id $id1
 send -- "exit\r"
-after 100
+sleep 1
 
 #
 # no caps
@@ -67,7 +67,7 @@ sleep 1
 
 set spawn_id $id1
 send -- "exit\r"
-after 100
+after 500
 
 #
 # no caps
@@ -91,6 +91,6 @@ sleep 1
 
 set spawn_id $id1
 send -- "exit\r"
-after 100
+after 500
 
 puts "all done\n"
diff --git a/test/capabilities/caps-print.exp b/test/capabilities/caps-print.exp
index b403f9ffe..66a7e093b 100755
--- a/test/capabilities/caps-print.exp
+++ b/test/capabilities/caps-print.exp
@@ -68,7 +68,7 @@ expect {
         timeout {puts "TESTING ERROR 13\n";exit}
         "syslog              - disabled"
 }
-after 100
+after 500
 
 send -- "firejail --debug-caps\r"
 expect {
@@ -87,7 +87,7 @@ expect {
         timeout {puts "TESTING ERROR 9\n";exit}
         "24     - sys_resource"
 }
-after 100
+after 500
 
 send -- "firejail --caps.keep=\"bla bla bla\"\r"
 expect {
@@ -99,5 +99,5 @@ expect {
         "not found"
 }
 
-after 100
+after 500
 puts "\nall done\n"
diff --git a/test/capabilities/caps.exp b/test/capabilities/caps.exp
index dbd63efda..bd7ab04eb 100755
--- a/test/capabilities/caps.exp
+++ b/test/capabilities/caps.exp
@@ -7,14 +7,11 @@ set timeout 10
 spawn $env(SHELL)
 match_max 100000
 
-send -- "firejail --caps.keep=chown,fowner --noprofile\r"
+send -- "firejail --caps.keep=chown,fowner --noprofile cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
 }
-after 100
-
-send -- "cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
         "CapBnd:        0000000000000009"
@@ -23,17 +20,13 @@ expect {
         timeout {puts "TESTING ERROR 3\n";exit}
         "Seccomp:"
 }
-send -- "exit\r"
-sleep 1
+after 500
 
-send -- "firejail --caps.drop=all --noprofile\r"
+send -- "firejail --caps.drop=all --noprofile cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 4\n";exit}
         -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
 }
-after 100
-
-send -- "cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "CapBnd:        0000000000000000"
@@ -42,17 +35,13 @@ expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         "Seccomp:"
 }
-send -- "exit\r"
-sleep 1
+after 500
 
-send -- "firejail --caps.drop=chown,dac_override,dac_read_search,fowner --noprofile\r"
+send -- "firejail --caps.drop=chown,dac_override,dac_read_search,fowner --noprofile cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 7\n";exit}
         -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
 }
-after 100
-
-send -- "cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 8\n";exit}
         "CapBnd:"
@@ -65,11 +54,9 @@ expect {
         timeout {puts "TESTING ERROR 10\n";exit}
         "Seccomp:"
 }
-send -- "exit\r"
-sleep 1
+after 500
 
-
-send -- "firejail --profile=caps1.profile --debug\r"
+send -- "firejail --profile=caps1.profile --debug ls\r"
 expect {
         timeout {puts "TESTING ERROR 11\n";exit}
         "Drop CAP_SYS_MODULE"
@@ -83,10 +70,7 @@ expect {
         "Drop CAP_" {puts "TESTING ERROR 14\n";exit}
         -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
 }
-after 100
-send -- "exit\r"
-sleep 1
-
+after 500
 
 ## tofix: possible problem with caps.keep in profile files
 ##send -- "firejail --caps.keep=chown,fowner --noprofile\r"
@@ -110,14 +94,11 @@ sleep 1
 #sleep 1
 
 #send -- "firejail --caps.drop=chown,dac_override,dac_read_search,fowner --noprofile\r"
-send -- "firejail --profile=caps3.profile\r"
+send -- "firejail --profile=caps3.profile cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 18\n";exit}
         -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
 }
-after 100
-
-send -- "cat /proc/self/status\r"
 expect {
         timeout {puts "TESTING ERROR 19\n";exit}
         "CapBnd:"
@@ -130,10 +111,5 @@ expect {
         timeout {puts "TESTING ERROR 21\n";exit}
         "Seccomp:"
 }
-send -- "exit\r"
-sleep 1
-
-
-
-after 100
+after 500
 puts "\nall done\n"
diff --git a/test/capabilities/firemon-caps.exp b/test/capabilities/firemon-caps.exp
new file mode 100755
index 000000000..905c8cba9
--- /dev/null
+++ b/test/capabilities/firemon-caps.exp
@@ -0,0 +1,47 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2023 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --name=bingo1 --noprofile --caps\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
+}
+sleep 1
+
+spawn $env(SHELL)
+send --  "firejail --name=bingo2 --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms"
+}
+sleep 1
+
+spawn $env(SHELL)
+send -- "firemon --caps\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "need to be root" {puts "TESTING SKIP: /proc mounted as hidepid\n"; exit}
+        "bingo1"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "31cffff"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "bingo2"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "fffffff"
+}
+
+after 500
+
+puts "all done\n"