What does undocumented "proto" command line argument do in auditdistd on FreeBSD?
2
votes
2
answers
138
views
As you might know there is an
auditdistd(8)
daemon available on FreeBSD. It has some documented command line arguments like -c
, -d
, etc. (see more here (link) ).
I was trying to learn how it works when I stumbled upon a code handling an undocumented command line argument, proto
:
- Apparently, proto_exec
is called when you execute /usr/sbin/auditdistd proto foo bar baz
and foo bar baz
are passed to the function as its arguments.
> /*
> * We are executed from proto to create sandbox.
> */
> if (argc > 1 && strcmp(argv, "proto") == 0) {
> argc -= 2;
> argv += 2;
> if (proto_exec(argc, argv) == -1)
> err(EX_USAGE, "Unable to execute proto");
> }
> _(See /contrib/openbsm/bin/auditdistd/auditdistd.c:main()
(link) for more details.)_
- Here's the proto_exec
function:
> int
> proto_exec(int argc, char *argv[])
> {
> struct proto *proto;
> int error;
>
> if (argc == 0) {
> errno = EINVAL;
> return (-1);
> }
> TAILQ_FOREACH(proto, &protos, prt_next) {
> if (strcmp(proto->prt_name, argv) == 0)
> break;
> }
> if (proto == NULL) {
> errno = EINVAL;
> return (-1);
> }
> if (proto->prt_exec == NULL) {
> errno = EOPNOTSUPP;
> return (-1);
> }
> error = proto->prt_exec(argc, argv);
> if (error != 0) {
> errno = error;
> return (-1);
> }
> /* NOTREACHED */
> return (0);
> }
> _(See /contrib/openbsm/bin/auditdistd/proto.c:proto_exec()
(link) for more details.)_
Honestly, I cannot figure out what is happening here.
- The protos
variable is initialized like this:
> static TAILQ_HEAD(, proto) protos = TAILQ_HEAD_INITIALIZER(protos);
> _(See /contrib/openbsm/bin/auditdistd/proto.c
(link) for more details.)_
- When /usr/sbin/auditdistd proto foo
is called it just says:
> auditdistd: Unable to execute proto: Invalid argument
Does anyone know what is this option and how to use it?
Asked by Mateusz Piotrowski
(4983 rep)
Sep 13, 2016, 06:42 PM
Last activity: Jun 12, 2017, 07:39 AM
Last activity: Jun 12, 2017, 07:39 AM