10 files changed, 62 insertions, 13 deletions

diff --git a/src/faudit/dbus.c b/src/faudit/dbus.c
index 5f25e7312..f7b5a221d 100644
--- a/src/faudit/dbus.c
+++ b/src/faudit/dbus.c
@@ -42,7 +42,7 @@ void check_session_bus(const char *sockfile) {
                 printf("GOOD: I cannot connect to session bus. If the application misbehaves, please log a bug with the application developer.\n");
         }
         else {
-                printf("MAYBE: I can connect to session bus. If this is undesirable, use \"--private-tmp\" or blacklist the socket file.\n");
+                printf("MAYBE: I can connect to session bus. It could be a good idea to create a new network namespace using \"--net=none\" or \"--net=eth0\".\n");
         }       
 
         close(sock);
diff --git a/src/faudit/files.c b/src/faudit/files.c
index c27973358..e27d3436a 100644
--- a/src/faudit/files.c
+++ b/src/faudit/files.c
@@ -33,7 +33,7 @@ static void check_home_file(const char *name) {
 
         if (access(fname, R_OK) == 0) {
                 printf("UGLY: I can access files in %s directory. ", fname);
-                printf("Use \"firejail --blacklist=~/%s\" to block it.\n", fname);
+                printf("Use \"firejail --blacklist=%s\" to block it.\n", fname);
         }
         else
                 printf("GOOD: I cannot access files in %s directory.\n", fname);
diff --git a/src/faudit/main.c b/src/faudit/main.c
index df549ac3e..86d3fe4a9 100644
--- a/src/faudit/main.c
+++ b/src/faudit/main.c
@@ -41,7 +41,7 @@ int main(int argc, char **argv) {
                 fprintf(stderr, "Error: cannot extract the path of the audit program\n");
                 return 1;
         }
-        printf("INFO: Starting %s.\n", prog);
+        printf("INFO: starting %s.\n", prog);
         
         
         // check pid namespace
diff --git a/src/faudit/network.c b/src/faudit/network.c
index bb3116c3b..39821cd25 100644
--- a/src/faudit/network.c
+++ b/src/faudit/network.c
@@ -40,7 +40,7 @@ void check_ssh(void) {
         if (connect(sock , (struct sockaddr *)&server , sizeof(server)) < 0)
                 printf("GOOD: SSH server not available on localhost.\n");
         else {
-                printf("MAYBE: An SSH server is accessible on localhost. ");
+                printf("MAYBE: an SSH server is accessible on localhost. ");
                 printf("It could be a good idea to create a new network namespace using \"--net=none\" or \"--net=eth0\".\n");
         }
         
diff --git a/src/faudit/syscall.c b/src/faudit/syscall.c
index 84d73a03f..7088ad340 100644
--- a/src/faudit/syscall.c
+++ b/src/faudit/syscall.c
@@ -79,11 +79,8 @@ void syscall_run(const char *name) {
         if (child < 0)
                 errExit("fork");
         if (child == 0) {
-                char *cmd;
-                if (asprintf(&cmd, "%s syscall %s", prog, name) == -1)
-                        errExit("asprintf");
                 execl(prog, prog, "syscall", name, NULL);
-                exit(0);
+                exit(1);
         }
                 
         // wait for the child to finish
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 0b6e2e181..39013de56 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -260,6 +260,7 @@ extern int arg_ipc;		// enable ipc namespace
 extern int arg_writable_etc;    // writable etc
 extern int arg_writable_var;    // writable var
 extern int arg_appimage;        // appimage
+extern int arg_audit;           // audit
 
 extern int parent_to_child_fds[2];
 extern int child_to_parent_fds[2];
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 7b956bf64..34cc38cd5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -100,6 +100,7 @@ int arg_ipc = 0;					// enable ipc namespace
 int arg_writable_etc = 0;                       // writable etc
 int arg_writable_var = 0;                       // writable var
 int arg_appimage = 0;                           // appimage
+int arg_audit = 0;                              // audit
 
 int parent_to_child_fds[2];
 int child_to_parent_fds[2];
@@ -1830,6 +1831,8 @@ int main(int argc, char **argv) {
                 //*************************************
                 // command
                 //*************************************
+                else if (strcmp(argv[i], "--audit") == 0)
+                        arg_audit = 1;
                 else if (strcmp(argv[i], "--appimage") == 0)
                         arg_appimage = 1;
                 else if (strcmp(argv[i], "--csh") == 0) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 0e3d722b7..8cf2486b3 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -275,9 +275,18 @@ static int monitor_application(pid_t app_pid) {
 
 static void start_application(void) {
         //****************************************
+        // audit
+        //****************************************
+        if (arg_audit) {
+                char *audit_prog;
+                if (asprintf(&audit_prog, "%s/firejail/faudit", LIBDIR) == -1)
+                        errExit("asprintf");
+                execl(audit_prog, audit_prog, NULL);
+        }
+        //****************************************
         // start the program without using a shell
         //****************************************
-        if (arg_shell_none) {
+        else if (arg_shell_none) {
                 if (arg_debug) {
                         int i;
                         for (i = cfg.original_program_index; i < cfg.original_argc; i++) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 82b1affcc..e31867351 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -35,6 +35,8 @@ void usage(void) {
         printf("Options:\n\n");
         printf("    -- - signal the end of options and disables further option processing.\n\n");
         printf("    --appimage - sandbox an AppImage application\n\n");
+        printf("    --audit - audit the sandbox, see Audit section for more details\n\n");
+        printf("    --audit=test-program - audit the sandbox, see Audit section for more details\n\n");
 #ifdef HAVE_NETWORK     
         printf("    --bandwidth=name|pid - set  bandwidth  limits  for  the sandbox identified\n");
         printf("\tby name or PID, see Traffic Shaping section fo more details.\n\n");
@@ -298,7 +300,19 @@ void usage(void) {
         printf("\n");
 #endif
 
-
+        printf("Audit\n\n");
+        printf("Audit feature allows the user to point out gaps in security profiles. The\n");
+        printf("implementation replaces the program to be sandboxed with a test program. By\n");
+        printf("default, we use faudit program distributed with Firejail. A custom test program\n");
+        printf("can also be supplied by the user. Examples:\n\n");
+        printf("Running the default audit program:\n");
+        printf("    $ firejail --audit transmission-gtk\n\n");
+        printf("Running a custom audit program:\n");
+        printf("    $ firejail --audit=~/sandbox-test transmission-gtk\n\n");
+        printf("In the examples above, the sandbox configures transmission-gtk profile and\n");
+        printf("starts the test program. The real program, transmission-gtk, will not be\n");
+        printf("started.\n\n\n");
+        
         printf("Monitoring\n\n");
 
         printf("Option --list prints a list of all sandboxes. The format for each entry is as\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index bb8c64dc9..a523e51cb 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -88,6 +88,12 @@ $ firejail --appimage --private krita-3.0-x86_64.appimage
 .br
 $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
 .TP
+\fB\-\-audit
+Audit the sandbox, see \fBAUDIT\fR section for more details.
+.TP
+\fB\-\-audit=test-program
+Audit the sandbox, see \fBAUDIT\fR section for more details.
+.TP
 \fB\-\-bandwidth=name|pid
 Set bandwidth limits for the sandbox identified by name or PID, see \fBTRAFFIC SHAPING\fR section for more details.
 .TP
@@ -1691,15 +1697,15 @@ The shaper works at sandbox level, and can be used only for sandboxes configured
 
 Set rate-limits:
 
-        firejail --bandwidth=name|pid set network download upload
+        $ firejail --bandwidth=name|pid set network download upload
 
 Clear rate-limits:
 
-        firejail --bandwidth=name|pid clear network
+        $ firejail --bandwidth=name|pid clear network
 
 Status:
 
-        firejail --bandwidth=name|pid status
+        $ firejail --bandwidth=name|pid status
 
 where:
 .br
@@ -1723,6 +1729,25 @@ Example:
 .br
         $ firejail \-\-bandwidth=mybrowser clear eth0
 
+.SH AUDIT
+Audit feature allows the user to point out gaps in security profiles. The
+implementation replaces the program to be sandboxed with a test program. By
+default, we use faudit program distributed with Firejail. A custom test program
+can also be supplied by the user. Examples:
+
+Running the default audit program:
+.br
+        $ firejail --audit transmission-gtk
+
+Running a custom audit program:
+.br
+        $ firejail --audit=~/sandbox-test transmission-gtk\n\n");
+
+In the examples above, the sandbox configures transmission-gtk profile and
+starts the test program. The real program, transmission-gtk, will not be
+started.
+
+
 .SH MONITORING
 Option \-\-list prints a list of all sandboxes. The format
 for each process entry is as follows: