5 files changed, 58 insertions, 12 deletions

diff --git a/Makefile.in b/Makefile.in
index 9ef542958..db326d2db 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -310,6 +310,9 @@ deb: dist
 snap: all
         cd platform/snap; ./snap.sh
 
+install-snap: snap
+        sudo snap remove faudit; sudo snap install faudit*.snap
+
 github-compile:
         cd test/compile; ./compile.sh
 
diff --git a/src/faudit/dbus.c b/src/faudit/dbus.c
index f7b5a221d..1ead2aa38 100644
--- a/src/faudit/dbus.c
+++ b/src/faudit/dbus.c
@@ -60,10 +60,10 @@ void dbus_test(void) {
                         sockfile += 13;
                         *sockfile = '@';
                         char *ptr = strchr(sockfile, ',');
-                        if (ptr) {
+                        if (ptr)
                                 *ptr = '\0';    
-                                check_session_bus(sockfile);
-                        }
+                        check_session_bus(sockfile);
+                        
                         sockfile -= 13;
                         free(sockfile);
                 }
diff --git a/src/faudit/main.c b/src/faudit/main.c
index 86d3fe4a9..14794719d 100644
--- a/src/faudit/main.c
+++ b/src/faudit/main.c
@@ -46,23 +46,30 @@ int main(int argc, char **argv) {
         
         // check pid namespace
         pid_test();
+        printf("\n");
         
-        // check capabilities
-        caps_test();
-
         // check seccomp
         seccomp_test();
+        printf("\n");
         
+        // check capabilities
+        caps_test();
+        printf("\n");
+
         // check some well-known problematic files and directories
         files_test();
+        printf("\n");
         
         // network
         network_test();
+        printf("\n");
         
         // dbus
         dbus_test();
+        printf("\n");
         
         free(prog);
         printf("--------------------------------------------------------------------------------\n");
+
         return 0;
 }
diff --git a/src/faudit/network.c b/src/faudit/network.c
index 0e0ad1844..cf1eede69 100644
--- a/src/faudit/network.c
+++ b/src/faudit/network.c
@@ -23,7 +23,7 @@
 #include <linux/netlink.h>
 #include <linux/rtnetlink.h>
 
-void check_ssh(void) {
+static void check_ssh(void) {
         // open socket
         int sock = socket(AF_INET, SOCK_STREAM, 0);
         if (sock == -1) {
@@ -47,6 +47,30 @@ void check_ssh(void) {
         close(sock);
 }
 
+static void check_http(void) {
+        // open socket
+        int sock = socket(AF_INET, SOCK_STREAM, 0);
+        if (sock == -1) {
+                printf("GOOD: HTTP server not available on localhost.\n");
+                return;
+        }
+
+        // connect to localhost
+        struct sockaddr_in server;
+        server.sin_addr.s_addr = inet_addr("127.0.0.1");
+        server.sin_family = AF_INET;
+        server.sin_port = htons(80);    
+        
+        if (connect(sock , (struct sockaddr *)&server , sizeof(server)) < 0)
+                printf("GOOD: HTTP server not available on localhost.\n");
+        else {
+                printf("MAYBE: an HTTP server is accessible on localhost. ");
+                printf("It could be a good idea to create a new network namespace using \"--net=none\" or \"--net=eth0\".\n");
+        }
+        
+        close(sock);
+}
+
 void check_netlink(void) {
         int sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, 0);
         if (sock == -1) {
@@ -72,5 +96,6 @@ void check_netlink(void) {
         
 void network_test(void) {
         check_ssh();
+        check_http();
         check_netlink();
 }
diff --git a/src/faudit/pid.c b/src/faudit/pid.c
index 2770daece..a0fb1d921 100644
--- a/src/faudit/pid.c
+++ b/src/faudit/pid.c
@@ -31,6 +31,7 @@ void pid_test(void) {
         int i;
 
         // look at the first 10 processes
+        int not_visible = 1;
         for (i = 1; i <= 10; i++) { 
                 struct stat s;
                 char *fname;
@@ -45,7 +46,7 @@ void pid_test(void) {
                 /* coverity[toctou] */
                 FILE *fp = fopen(fname, "r");
                 if (!fp) {
-                        fprintf(stderr, "Warning: cannot open %s\n", fname);
+//                      fprintf(stderr, "Warning: cannot open %s\n", fname);
                         free(fname);
                         continue;
                 }
@@ -53,11 +54,13 @@ void pid_test(void) {
                 // read file
                 char buf[100];
                 if (fgets(buf, 10, fp) == NULL) {
-                        fprintf(stderr, "Warning: cannot read %s\n", fname);
+//                      fprintf(stderr, "Warning: cannot read %s\n", fname);
                         fclose(fp);
                         free(fname);
                         continue;
                 }
+                not_visible = 0;
+
                 // clean /n
                 char *ptr;
                 if ((ptr = strchr(buf, '\n')) != NULL)
@@ -69,7 +72,7 @@ void pid_test(void) {
                         if (strncmp(buf, kern_proc[j], strlen(kern_proc[j])) == 0) {
                                 fclose(fp);
                                 free(fname);
-                                printf("BAD: Process %d, not running in a PID namespace. ", getpid());
+                                printf("BAD: Process %d is not running in a PID namespace. ", getpid());
                                 printf("Are you sure you're running in a sandbox?\n");
                                 return;
                         }
@@ -80,11 +83,19 @@ void pid_test(void) {
                 free(fname);
         }
 
-
-        printf("GOOD: process %d running in a PID namespace.\n", getpid());
+        pid_t pid = getpid();
+        if (not_visible && pid > 100)
+                printf("BAD: Process %d is not running in a PID namespace.\n", pid);
+        else
+                printf("GOOD: process %d is running in a PID namespace.\n", pid);
         
         // try to guess the type of container/sandbox
         char *str = getenv("container");
         if (str)
                 printf("INFO: container/sandbox %s.\n", str);
+        else {
+                str = getenv("SNAP");
+                if (str)
+                        printf("INFO: this is a snap package\n");
+        }
 }