testing

gcov.sh

@@ -13,16 +13,17 @@ gcov_init() {
 }
 
 generate() {
- lcov -q --capture -d src/firejail -d src/firemon -d src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg --output-file gcov-file
+ lcov -q --capture -d src/firejail -d src/firemon -d src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg --output-file gcov-file-new
+ lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file
  rm -fr gcov-dir
  genhtml -q gcov-file --output-directory gcov-dir
+ sudo rm `find . -name *.gcda`
+ cp gcov-file gcov-file-old
+ gcov_init
 }
 
-gcov_init
-generate
-echo "press any key to continue, or Ctrl-C to exit"
-read text
 
+gcov_init
 
 # running tests
 make test-root

src/firejail/seccomp.c

@@ -195,10 +195,8 @@ int seccomp_filter_keep(void) {
  printf("Build drop seccomp filter\n");
 
  // build the seccomp filter as a regular user
- int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
+ sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
  PATH_FSECCOMP, "keep", RUN_SECCOMP_CFG, cfg.seccomp_list_keep);
- if (rv)
- exit(rv);
  if (arg_debug)
  printf("seccomp filter configured\n");
 
@@ -246,10 +244,7 @@ void seccomp_print_filter(pid_t pid) {
  }
 
  // read and print the filter - run this as root, the user doesn't have access
- int rv = sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3,
- PATH_FSECCOMP, "print", fname);
- if (rv)
- exit(rv);
+ sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", fname);
  free(fname);
 
  exit(0);

test/environment/dns.exp

@@ -71,6 +71,6 @@ after 100
 send -- "rm index.html\r"
 after 100
 send -- "exit\r"
-after 100
+sleep 1
 
 puts "\nall done\n"

test/utils/shutdown.exp

@@ -32,4 +32,18 @@ expect {
 }
 sleep 1
 
+send -- "firejail --shutdown=sutdowntesting\r"
+expect {
+ timeout {puts "TESTING ERROR 5\n";exit}
+ "cannot find sandbox sutdowntesting"
+}
+after 100
+
+send -- "firejail --shutdown=10\r"
+expect {
+ timeout {puts "TESTING ERROR 5\n";exit}
+ "this is not a firejail sandbox"
+}
+after 100
+
 puts "\nall done\n"

todo

@@ -297,3 +297,5 @@ install mount namespace
 read-only /etc
 read-only /var
 read-only /bin
+
+31. --private and --allusers are coliding