--- a/test.sh
+++ b/test.sh
@@ -61,7 +61,8 @@ usage() {
 }
 
 val_t=
-NUMCOND=true
+#NUMCOND=true
+NUMCOND="test \$N -ne 12 -a \$N -ne 13 -a \$N -ne 21 -a \$N -ne 28 -a \$N -ne 29 -a \$N -ne 31 -a \$N -ne 48 -a \$N -ne 53 -a \$N -ne 104 -a \$N -ne 105 -a \$N -ne 144 -a \$N -ne 162 -a \$N -ne 202 -a \$N -ne 217 -a \$N -ne 226 -a \$N -ne 227 -a \$N -ne 327 -a \$N -ne 329 -a \$N -ne 370 -a \$N -ne 386 -a \$N -ne 388 -a \$N -ne 399 -a \$N -ne 410 -a \$N -ne 466 -a \$N -ne 467 -a \$N -ne 468 -a \$N -ne 473 -a \$N -ne 478 -a \$N -ne 493 -a \$N -ne 496 -a \$N -ne 499 -a \$N -ne 500 -a \$N -ne 503 -a \$N -ne 509 -a \$N -ne 510 -a \$N -ne 511 -a \$N -ne 512 -a \$N -ne 513 -a \$N -ne 515 -a \$N -ne 516 -a \$N -ne 517 -a \$N -ne 518 -a \$N -ne 519 -a \$N -ne 528"
 #NUMCOND="test \$N -gt 70"
 VERBOSE=
 DEBUG=
@@ -257,6 +258,13 @@ PATH=.:$PATH 	# for relsleep
 #SOCAT_EGD="egd=/dev/egd-pool"
 MISCDELAY=1
 
+# Export SHELL for SHELL: cmds
+[ ! -z "$SHELL" ] && export SHELL || export SHELL=/bin/sh
+# Export USER on linux
+if [ "$UNAME" = "Linux" ]; then
+   [ ! -z "$USER" ] && export USER || export USER=$(id -un)
+fi
+
 OPTS="$opt_t $OPTS"
 
 if [ "$EXPERIMENTAL" ]; then
@@ -1341,14 +1349,15 @@ init_openssl_s_server () {
 # platform is supported, features compiled in, addresses and options
 # available; needs root; is allowed to access the internet
 checkconds() {
-    local unames="$(echo "$1")" 	# must be one of... exa: "Linux,FreeBSD"
-    local root="$2" 				# "root" or ""
+    local unames="$(echo "$1")" 			# must be one of... exa: "Linux,FreeBSD"
+    local root="$2" 					# "root" or "hostroot" or ""
     local progs="$(echo "$3" |tr 'A-Z,' 'a-z ')"	# exa: "nslookup"
     local feats="$(echo "$4" |tr 'a-z,' 'A-Z ')" 	# list of req.features (socat -V)
     local addrs="$(echo "$5" |tr 'a-z,' 'A-Z ')" 	# list of req.addresses (socat -h)
     local opts="$(echo "$6" |tr 'A-Z,' 'a-z ')" 	# list of req.options (socat -hhh)
     local runs="$(echo "$7" |tr , ' ')" 		# list of req.protocols, exa: "sctp6"
     local inet="$8" 					# when "internet": needs allowance
+    local caps="$9"					# Linux capabilities to test against
     local i
 
     if [ "$unames" ]; then
@@ -1409,12 +1418,41 @@ checkconds() {
 	fi
     fi
 
+    if [ "$caps" ]; then
+	allcaps="$(getpcaps $$)"
+	if [ $? -ne 0 ]; then
+	    echo "getpcaps program missing but caps requested"
+	    return 255
+	fi
+	for i in $caps; do
+	    if ! echo "$allcaps" | grep -q "$i"; then
+		echo "capability $i not available on host"
+		return 255;
+	    fi
+	done
+    fi
+
     # Only at the end, so we get a better overview of missing features
-    if [ "$root" = "root" ]; then
+    if [ "$root" = "root" -o "$root" = "hostroot" ]; then
 	if [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
 	    echo "Must be root"
 	    return 255
 	fi
+
+	if [ "$UNAME" = "Linux" ]; then
+            if touch /root.test && chattr +i /root.test 2>/dev/null && chattr -i /root.test 2>/dev/null; then
+		echo "The root is real"
+            else
+		# There is root in namespace or container
+		# If hostroot is requested, bail out
+
+		if [ "$root" = "hostroot" ]; then
+		    echo "host root is needed for this test"
+		    return 255
+		fi
+	    fi
+	    rm -f /root.test
+	fi
     fi
 
     return 0
@@ -2465,8 +2503,16 @@ elif ! feat=$(testfeats ip4) || ! runsip
 elif ! feat=$(testfeats rawip) >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}RAWIP not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
     testecho "$N" "$NAME" "$TEST" "" "IP4:127.0.0.1:$IPPROTO" "$opts"
@@ -2485,8 +2531,16 @@ elif ! feat=$(testfeats ip4) || ! runsip
 elif ! feat=$(testfeats rawip) >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}RAWIP not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
     testecho "$N" "$NAME" "$TEST" "" "IP:127.0.0.1:$IPPROTO" "$opts"
@@ -2505,8 +2559,16 @@ elif ! feat=$(testfeats ip6) || ! runsip
 elif ! feat=$(testfeats rawip) || ! runsip6 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}RAWIP not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
     testecho "$N" "$NAME" "$TEST" "" "IP6:[::1]:$IPPROTO" "$opts"
@@ -2525,8 +2587,16 @@ elif ! feat=$(testfeats ip6) || ! runsip
 elif ! feat=$(testfeats rawip) || ! runsip6 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}RAWIP not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
     testecho "$N" "$NAME" "$TEST" "" "IP:[::1]:$IPPROTO" "$opts"
@@ -7093,8 +7163,16 @@ case "$TESTS" in
 *%$N%*|*%functions%*|*%ip%*|*%ip4%*|*%rawip%*|*%rawip4%*|*%dgram%*|*%root%*|*%$NAME%*)
 TEST="$NAME: raw IPv4 datagram"
 if ! eval $NUMCOND; then :;
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -7145,8 +7223,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip6 rawip && runsip6); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -7337,8 +7423,16 @@ case "$TESTS" in
 *%$N%*|*%functions%*|*%ip4%*|*%dgram%*|*%rawip%*|*%rawip4%*|*%recv%*|*%root%*|*%$NAME%*)
 TEST="$NAME: raw IPv4 receive"
 if ! eval $NUMCOND; then :;
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -7388,8 +7482,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip6 rawip && runsip6); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -7766,8 +7868,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 newport udp4 	# provide free port number in $PORT
@@ -7786,8 +7896,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip libwrap) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 ha="$td/hosts.allow"
@@ -7812,8 +7930,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}IP4 not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 IPPROTO1=$IPPROTO; #IPPROTO=$((IPPROTO+1))
@@ -7836,8 +7962,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip libwrap) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 IPPROTO1=$IPPROTO; #IPPROTO=$((IPPROTO+1))
@@ -7863,8 +7997,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip6 rawip && runsip6); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 newport udp6 	# provide free port number in $PORT
@@ -7883,8 +8025,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip6 rawip libwrap && runsip6); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 ha="$td/hosts.allow"
@@ -7908,8 +8058,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip6 rawip) || ! runsip6 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}raw IP6 not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 IPPROTO1=$IPPROTO; #IPPROTO=$((IPPROTO+1))
@@ -7930,8 +8088,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip6 rawip libwrap && runsip6); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 IPPROTO1=$IPPROTO; #IPPROTO=$((IPPROTO+1))
@@ -8630,8 +8796,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}raw IP4 not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 elif [ -z "$BCADDR" ]; then
     $PRINTF "test $F_n $TEST... ${YELLOW}dont know a broadcast address${NORMAL}\n" $N
@@ -8771,8 +8945,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -8951,8 +9133,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 rawip) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -9010,8 +9200,16 @@ if ! eval $NUMCOND; then :;
 elif ! feat=$(testfeats ip4 tun) || ! runsip4 >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}$feat not available${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -9722,8 +9920,16 @@ TEST="$NAME: raw IPv4 receive with bind"
 # idea: start a socat process with ip4-recv:...,bind=... and send it a packet
 # if the packet passes the test succeeded
 if ! eval $NUMCOND; then :;
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tf="$td/test$N.stdout"
@@ -10031,8 +10237,16 @@ TEST="$NAME: $KEYW log ancillary message
 # for the appropriate output.
 if ! eval $NUMCOND; then :;
 #elif [[ "$PF" == "#*" ]]; then :
-elif [ "$ROOT" = root -a $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 elif ! feat=$(testfeats ${KEYW%[46]} IP${KEYW##*[A-Z]}); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$KEYW not configured in $SOCAT${NORMAL}\n" $N
@@ -10285,8 +10499,16 @@ TEST="$NAME: $KEYW ancillary message set
 # the resulting environment to a file and check its contents for the
 # appropriate variable.
 if ! eval $NUMCOND; then :;
-elif [ "$ROOT" = root -a $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 elif [ "$PF" = "IP6" ] && ( ! feat=$(testfeats ip6) || ! runsip6 ) >/dev/null; then
     $PRINTF "test $F_n $TEST... ${YELLOW}IP6 not available${NORMAL}\n" $N
@@ -12420,8 +12642,16 @@ TEST="$NAME: $ADDR applies option user"
 # Check the owner of the FS entry, then terminate the process.
 # Test succeeds when FS entry exists and has expected owner.
 if ! eval $NUMCOND; then :;
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 else
 tlog="$td/test$N.log"
@@ -14826,6 +15056,23 @@ N=$((N+1))
 # Up to version 1.7.4.2 this desired behaviour was found for most combinations,
 # however some fix in 1.7.4.3 degraded the overall result.
 # This group of tests checks all known combinations.
+
+# On Linux root can happily write to "denied" file protected by "chmod 000"
+# Real root should set immutable flag via "chattr +i" but namespace root
+# needs capabilities Docker or Podman usually do not provide
+hostroot=1
+if ! cond=$(checkconds "" \
+		 "hostroot" \
+		 "" \
+		 "" \
+		 "" \
+		 "" \
+		 "" \
+		 "" \
+		 "" ); then
+    hostroot=0
+fi
+
 while read entry method; do
 if [ -z "$entry" ] || [[ "$entry" == \#* ]]; then continue; fi
 NAME=$(toupper $method)_TO_$(toupper $entry)
@@ -14846,7 +15093,19 @@ printf "test $F_n $TEST... " $N
 # create an invalid or non-matching UNIX socket
 case "$entry" in
     missing)     pid0=; rm -f $ts ;;
-    denied)      pid0=; rm -f $ts; touch $ts; chmod 000 $ts ;;
+    denied)      pid0=; rm -f $ts; touch $ts;
+		 if [ "$UNAME" != "Linux" ]; then
+		     chmod 000 $ts
+		 else
+		     if [ "$hostroot" -eq 0 -a "$method" = "gopen" ]; then
+			 $PRINTF "${YELLOW}need host root${NORMAL}\n" $N
+			 cant
+			 N=$(( N + 1 ))
+			 continue
+		     fi
+		     chattr +i $ts 2>/dev/null
+		 fi
+		 ;;
     directory)   pid0=; mkdir -p $ts ;;
     orphaned)    pid0= 	# the remainder of a UNIX socket in FS
 		 SOCAT_MAIN_WAIT= $SOCAT $opts UNIX-LISTEN:$ts,unlink-close=0 /dev/null >${tf}0 2>${te}0 &
@@ -14911,12 +15170,15 @@ rc1=$?
 	fi
 	ok
 fi
+if [ "$UNAME" = "Linux" ]; then
+    chattr -i $ts 2>/dev/null
+fi
 set +vx
 fi # NUMCOND
  ;;
 esac
 N=$((N+1))
-done <<<"
+done <<< "
 missing     connect
 denied      connect
 directory   connect
@@ -14955,7 +15217,6 @@ directory   gopen
 orphaned    gopen
 "
 
-
 # Test TCP with options connect-timeout and retry.
 # Up to 1.7.4.3 this terminated immediately on connection refused
 NAME=TCP_TIMEOUT_RETRY
@@ -16007,11 +16268,17 @@ printf "test $F_n $TEST... " $N
 { echo "$da"; relsleep 20; } |eval "$CMD0" >"${tf}0" 2>"${te}0" &
 pid0=$!
 relsleep 2
-eval "$CMD1" 2>"${te}1"
-relsleep 2
-pkill -f $T_TTY "$SOCAT\>.*\<STDIO PIPE\>" 2>/dev/null
-kill -$pid0 2>/dev/null
-wait
+if echo "$TTY" | grep -q /; then
+    $CMD1 2>"${te}1" || { echo "pkill -t $TTY -USR1 socat"; }
+    relsleep 1
+    #date +'%Y-%m-%dT%H:%M:%S.%N' >>"${te}1"
+    wait
+    pkill -t $TTY socat >>"${te}1"
+else
+    pkill -USR1 socat || { echo "pkill -USR1 socat"; }
+    relsleep 1
+    pkill socat
+fi
 if [ "$(grep STATISTICS "${te}0" |wc -l)" -eq 2 ]; then
     $PRINTF "$OK\n"
     if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
@@ -16099,8 +16366,16 @@ TEST="$NAME: INTERFACE ignores outgoing
 #idea: create a TUN interface and hook with INTERFACE.
 # Send a packet out the interface, should not be seen by INTERFACE
 if ! eval $NUMCOND; then :;
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 elif ! $(type ping >/dev/null 2>&1); then
     $PRINTF "test $F_n $TEST... ${YELLOW}ping not available${NORMAL}\n" $N
@@ -16556,8 +16831,16 @@ if ! eval $NUMCOND; then :;
 elif [ "$UNAME" != Linux ]; then
     $PRINTF "test $F_n $TEST... ${YELLOW}Only on Linux${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}Must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 elif ! $(type ip >/dev/null 2>&1); then
     $PRINTF "test $F_n $TEST... ${YELLOW}ip program not available${NORMAL}\n" $N
@@ -16651,8 +16934,16 @@ if ! eval $NUMCOND; then :;
 elif [ "$UNAME" != Linux ]; then
     $PRINTF "test $F_n $TEST... ${YELLOW}Only on Linux${NORMAL}\n" $N
     cant
-elif [ $(id -u) -ne 0 -a "$withroot" -eq 0 ]; then
-    $PRINTF "test $F_n $TEST... ${YELLOW}Must be root${NORMAL}\n" $N
+elif ! cond=$(checkconds "" \
+			 "root" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "" \
+			 "cap_net_raw" ); then
+    $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
 elif ! $(type ip >/dev/null 2>&1); then
     $PRINTF "test $F_n $TEST... ${YELLOW}ip program not available${NORMAL}\n" $N
@@ -18512,6 +18803,9 @@ elif ! cond=$(checkconds \
 		  "" ); then
     $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
     cant
+elif ! tty | grep -q /dev/; then
+    $PRINTF "test $F_n $TEST... ${YELLOW}not a tty${NORMAL}\n" $N
+    cant
 else
     tf="$td/test$N.stdout"
     te="$td/test$N.stderr"