faudit network

6 files changed, 19 insertions, 4 deletions

diff --git a/src/faudit/caps.c b/src/faudit/caps.c
index f98d45ec8..db1d3266f 100644
--- a/src/faudit/caps.c
+++ b/src/faudit/caps.c
@@ -66,6 +66,7 @@ void caps_test(void) {
         
         if (caps_val) {
                 printf("BAD: the capability map is %llx, it should be all zero\n", (unsigned long long) caps_val);
+                printf("Use \"firejail --caps.drop=all\" to fix it.\n");
                 
                 if (check_capability(caps_val, CAP_SYS_ADMIN))
                         printf("UGLY: CAP_SYS_ADMIN is enabled\n");
diff --git a/src/faudit/faudit.h b/src/faudit/faudit.h
index fdb4556c3..f8d9b709d 100644
--- a/src/faudit/faudit.h
+++ b/src/faudit/faudit.h
@@ -48,4 +48,10 @@ void seccomp_test(void);
 void syscall_helper(int argc, char **argv);
 void syscall_run(const char *name);
 
+// files.c
+void files_test(void);
+
+// network.c
+void network_test(void);
+
 #endif
\ No newline at end of file
diff --git a/src/faudit/files.c b/src/faudit/files.c
index 0463af66d..9a230d7e5 100644
--- a/src/faudit/files.c
+++ b/src/faudit/files.c
@@ -31,8 +31,10 @@ static void check_home_file(const char *name) {
         if (asprintf(&fname, "%s/%s", homedir, name) ==  -1)
                 errExit("asprintf");
 
-        if (access(fname, R_OK) == 0)
+        if (access(fname, R_OK) == 0) {
                 printf("UGLY: I can access files in %s directory\n", fname);
+                printf("Use \"firejail --blacklist=~/%s\" to block it.\n", fname);
+        }
         else
                 printf("GOOD: I cannot access files in %s directory\n", fname);
         
diff --git a/src/faudit/main.c b/src/faudit/main.c
index 2ed3aa2e1..6758f5671 100644
--- a/src/faudit/main.c
+++ b/src/faudit/main.c
@@ -33,7 +33,7 @@ int main(int argc, char **argv) {
                 return 1;
         }
 
-        printf("\n---------------- Firejail Audit: the Good, the Bad and the Ugly ----------------\n");
+        printf("\n---------------- Firejail Audit: the GOOD, the BAD and the UGLY ----------------\n");
 
         // extract program name
         prog = realpath(argv[0], NULL);
@@ -53,9 +53,12 @@ int main(int argc, char **argv) {
         // check seccomp
         seccomp_test();
         
-        // check some well-known problematic files
+        // check some well-known problematic files and directories
         files_test();
         
+        // network
+        network_test();
+        
         free(prog);
         printf("--------------------------------------------------------------------------------\n");
         return 0;
diff --git a/src/faudit/pid.c b/src/faudit/pid.c
index 53b59a838..57947418e 100644
--- a/src/faudit/pid.c
+++ b/src/faudit/pid.c
@@ -70,6 +70,7 @@ void pid_test(void) {
                                 fclose(fp);
                                 free(fname);
                                 printf("BAD: Process PID %d, not running in a PID namespace\n", getpid());
+                                printf("Are you sure you're running in a sandbox?\n");
                                 return;
                         }
                         j++;
diff --git a/src/faudit/seccomp.c b/src/faudit/seccomp.c
index d88d6a958..9cc1a20f6 100644
--- a/src/faudit/seccomp.c
+++ b/src/faudit/seccomp.c
@@ -50,8 +50,10 @@ void seccomp_test(void) {
                 return;
         }
         
-        if (seccomp_status == 0)
+        if (seccomp_status == 0) {
                 printf("BAD: seccomp disabled\n");
+                printf("Use \"firejail --seccomp\" to fix it.\n");
+        }
         else if (seccomp_status == 1)
                 printf("GOOD: seccomp strict mode - only  read, write, _exit, and sigreturn are allowd\n");
         else if (seccomp_status == 2) {