1 files changed, 60 insertions, 0 deletions

diff --git a/test/utils/audit.exp b/test/utils/audit.exp
index 684886af7..6352dc62d 100755
--- a/test/utils/audit.exp
+++ b/test/utils/audit.exp
@@ -96,4 +96,64 @@ expect {
 }
 after 100
 
+# test seccomp
+send -- "firejail --seccomp.drop=mkdir --audit\r"
+expect {
+        timeout {puts "TESTING ERROR 17\n";exit}
+        "Firejail Audit"
+}
+expect {
+        timeout {puts "TESTING ERROR 18\n";exit}
+        "GOOD: seccomp BPF enabled"
+}
+expect {
+        timeout {puts "TESTING ERROR 19\n";exit}
+        "UGLY: mount syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 20\n";exit}
+        "UGLY: umount2 syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        "UGLY: ptrace syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 22\n";exit}
+        "UGLY: swapon syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 23\n";exit}
+        "UGLY: swapoff syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 24\n";exit}
+        "UGLY: init_module syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 25\n";exit}
+        "UGLY: delete_module syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 26\n";exit}
+        "UGLY: chroot syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 27\n";exit}
+        "UGLY: pivot_root syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 28\n";exit}
+        "UGLY: iopl syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 29\n";exit}
+        "UGLY: ioperm syscall permitted"
+}
+expect {
+        timeout {puts "TESTING ERROR 30\n";exit}
+        "GOOD: all capabilities are disabled"
+}
+after 100
+
 puts "\nall done\n"