[linux-l] ftp dirt nicht
Boris Kirkorowicz
boris-ml07 at kirk.de
Do Jul 4 07:33:30 CEST 2019
Hallo,
Am 04.07.19 um 01:21 schrieb Hauke Laging:
> Da fehlt ein -f
>
> Deshalb erfasst der Trace nur den Hauptprozess, der aber gar nichts spannendes
> macht.
ach ja, natürlich. Also:
> sfo2201:~ # strace -fp 1752 -o vsftpd_2019-07-04.log
> strace: Process 1752 attached
> strace: Process 25374 attached
> strace: Process 25375 attached
> strace: Process 25378 attached
...währenddessen auf dem Client:
> boris at linux-t560b:~> ftp sfo2201
> Connected to sfo2201.
> 220 ftp-Zugang sfo2201
> 331 Please specify the password.
> 230 Login successful.
> Remote system type is UNIX.
> Using binary mode to transfer files.
> ftp> dir
> 229 Entering Extended Passive Mode (|||30073|)
> 150 Here comes the directory listing.
> 421 Service not available, remote server has closed connection.
> ftp>
...dann wieder auf dem Server:
> ^Cstrace: Process 1752 detached
>
> sfo2201:~ # cat vsftpd_2019-07-04.log
> 1752 accept(3, {sa_family=AF_INET6, sin6_port=htons(60868), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::ffff:192.168.221.119", &sin6_addr), sin6_scope_id=0}, [28]) = 4
> 1752 clone(child_stack=NULL, flags=CLONE_NEWIPC|SIGCHLD) = 25374
> 1752 close(4) = 0
> 25374 prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
> 1752 accept(3, <unfinished ...>
> 25374 <... prctl resumed>) = 0
> 25374 close(3) = 0
> 25374 dup2(4, 0) = 0
> 25374 dup2(4, 1) = 1
> 25374 dup2(4, 2) = 2
> 25374 close(4) = 0
> 25374 fstat(0, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0
> 25374 getpeername(0, {sa_family=AF_INET6, sin6_port=htons(60868), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::ffff:192.168.221.119", &sin6_addr), sin6_scope_id=0}, [28]) = 0
> 25374 getsockname(0, {sa_family=AF_INET6, sin6_port=htons(21), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::ffff:192.168.221.3", &sin6_addr), sin6_scope_id=0}, [28]) = 0
> 25374 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
> 25374 connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = 0
> 25374 sendto(3, "\2\0\0\0\v\0\0\0\7\0\0\0passwd\0", 19, MSG_NOSIGNAL, NULL, 0) = 19
> 25374 poll([{fd=3, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=3, revents=POLLIN|POLLHUP}])
> 25374 recvmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="passwd\0", iov_len=7}, {iov_base="\310O\3\0\0\0\0\0", iov_len=8}], msg_iovlen=2, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, cmsg_data=[4]}], msg_controllen=20, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 15
> 25374 mmap(NULL, 217032, PROT_READ, MAP_SHARED, 4, 0) = 0x7f2b3bd78000
> 25374 close(4) = 0
> 25374 close(3) = 0
> 25374 setsid() = 25374
> 25374 getpid() = 25374
> 25374 getpgrp() = 25374
> 25374 umask(077) = 022
> 25374 openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 3
> 25374 fstat(3, {st_mode=S_IFREG|0644, st_size=2326, ...}) = 0
> 25374 fstat(3, {st_mode=S_IFREG|0644, st_size=2326, ...}) = 0
> 25374 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\t\0\0\0\0"..., 4096) = 2326
> 25374 lseek(3, -1467, SEEK_CUR) = 859
> 25374 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\t\0\0\0\0"..., 4096) = 1467
> 25374 close(3) = 0
> 25374 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2326, ...}) = 0
> 25374 stat("/usr/share/zoneinfo/UTC-02:00", 0x7ffda822d270) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/share/zoneinfo/UTC-02:00", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 rt_sigaction(SIGPIPE, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
> 25374 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
> 25374 setsockopt(0, SOL_TCP, TCP_NODELAY, [1], 4) = 0
> 25374 setsockopt(0, SOL_SOCKET, SO_OOBINLINE, [1], 4) = 0
> 25374 rt_sigaction(SIGTERM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14d0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 prctl(PR_SET_PDEATHSIG, SIGTERM) = 0
> 25374 socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0
> 25374 rt_sigaction(SIGCHLD, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14d0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 clone(child_stack=NULL, flags=CLONE_NEWNET|SIGCHLD) = 25375
> 25374 close(4) = 0
> 25375 prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
> 25374 read(3, <unfinished ...>
> 25375 <... prctl resumed>) = 0
> 25375 close(3) = 0
> 25375 lstat("/usr/share/empty", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
> 25375 getuid() = 0
> 25375 setgroups(0, NULL) = 0
> 25375 chdir("/usr/share/empty") = 0
> 25375 chroot(".") = 0
> 25375 prlimit64(0, RLIMIT_NOFILE, {rlim_cur=0, rlim_max=0}, NULL) = 0
> 25375 setgid(65534) = 0
> 25375 setuid(465) = 0
> 25375 prlimit64(0, RLIMIT_NPROC, {rlim_cur=0, rlim_max=0}, NULL) = 0
> 25375 access("/", W_OK) = -1 EACCES (Permission denied)
> 25375 prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) = 0
> 25375 prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=96, filter=0x7ffda822d020}) = 0
> 25375 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25375 alarm(900) = 0
> 25375 getpid() = 25375
> 25375 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied)
> 25375 getpid() = 25375
> 25375 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied)
> 25375 write(0, "220 ftp-Zugang sfo2201\r\n", 24) = 24
> 25375 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25375 alarm(900) = 900
> 25375 mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2b3c356000
> 25375 mprotect(0x7f2b3c358000, 4096, PROT_NONE) = 0
> 25375 mprotect(0x7f2b3c356000, 4096, PROT_NONE) = 0
> 25375 recvfrom(0, "USER boris\r\n", 4096, MSG_PEEK, NULL, NULL) = 12
> 25375 read(0, "USER boris\r\n", 12) = 12
> 25375 getpid() = 25375
> 25375 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied)
> 25375 getpid() = 25375
> 25375 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied)
> 25375 write(0, "331 Please specify the password."..., 34) = 34
> 25375 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25375 alarm(900) = 900
> 25375 recvfrom(0, "PASS geheim\r\n", 4096, MSG_PEEK, NULL, NULL) = 13
> 25375 read(0, "PASS geheim\r\n", 13) = 13
> 25375 getpid() = 25375
> 25375 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied)
> 25375 write(4, "\1", 1) = 1
> 25375 write(4, "\5\0\0\0", 4) = 4
> 25374 <... read resumed>"\1", 1) = 1
> 25375 write(4, "boris", 5) = 5
> 25374 read(3, <unfinished ...>
> 25375 write(4, "\6\0\0\0", 4) = 4
> 25374 <... read resumed>"\5\0\0\0", 4) = 4
> 25375 write(4, "geheim", 6) = 6
> 25374 read(3, <unfinished ...>
> 25375 write(4, "\0\0\0\0", 4) = 4
> 25374 <... read resumed>"boris", 5) = 5
> 25375 write(4, "\0\0\0\0", 4) = 4
> 25374 read(3, <unfinished ...>
> 25375 read(4, <unfinished ...>
> 25374 <... read resumed>"\6\0\0\0", 4) = 4
> 25374 read(3, "geheim", 6) = 6
> 25374 read(3, "\0\0\0\0", 4) = 4
> 25374 read(3, "\0\0\0\0", 4) = 4
> 25374 stat("/etc/pam.d", {st_mode=S_IFDIR|0755, st_size=1096, ...}) = 0
> 25374 openat(AT_FDCWD, "/etc/pam.d/vsftpd", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=569, ...}) = 0
> 25374 read(4, "#%PAM-1.0\n\n# Uncomment this to a"..., 4096) = 569
> 25374 futex(0x7f2b3bdd5048, FUTEX_WAKE_PRIVATE, 2147483647) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_listfile.so", O_RDONLY|O_CLOEXEC) = 5
> 25374 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\21\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(5, {st_mode=S_IFREG|0755, st_size=14464, ...}) = 0
> 25374 mmap(NULL, 16560, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f2b3c354000
> 25374 mmap(0x7f2b3c355000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0x7f2b3c355000
> 25374 mmap(0x7f2b3c356000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3c356000
> 25374 mmap(0x7f2b3c357000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3c357000
> 25374 close(5) = 0
> 25374 mprotect(0x7f2b3c357000, 4096, PROT_READ) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_shells.so", O_RDONLY|O_CLOEXEC) = 5
> 25374 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\20\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(5, {st_mode=S_IFREG|0755, st_size=14400, ...}) = 0
> 25374 mmap(NULL, 16496, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f2b3c34f000
> 25374 mmap(0x7f2b3c350000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0x7f2b3c350000
> 25374 mmap(0x7f2b3c351000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3c351000
> 25374 mmap(0x7f2b3c352000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3c352000
> 25374 close(5) = 0
> 25374 mprotect(0x7f2b3c352000, 4096, PROT_READ) = 0
> 25374 openat(AT_FDCWD, "/etc/pam.d/common-auth", O_RDONLY) = 5
> 25374 fstat(5, {st_mode=S_IFREG|0644, st_size=536, ...}) = 0
> 25374 read(5, "#%PAM-1.0\n#\n# This file is autog"..., 4096) = 536
> 25374 openat(AT_FDCWD, "/lib64/security/pam_env.so", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\21\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=18616, ...}) = 0
> 25374 mmap(NULL, 20712, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3c349000
> 25374 mmap(0x7f2b3c34a000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f2b3c34a000
> 25374 mmap(0x7f2b3c34c000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3c34c000
> 25374 mmap(0x7f2b3c34d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3c34d000
> 25374 close(6) = 0
> 25374 mprotect(0x7f2b3c34d000, 4096, PROT_READ) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_unix.so", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0207\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=60328, ...}) = 0
> 25374 mmap(NULL, 111616, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bd5c000
> 25374 mprotect(0x7f2b3bd5f000, 45056, PROT_NONE) = 0
> 25374 mmap(0x7f2b3bd5f000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3bd5f000
> 25374 mmap(0x7f2b3bd67000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xb000) = 0x7f2b3bd67000
> 25374 mmap(0x7f2b3bd6a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xd000) = 0x7f2b3bd6a000
> 25374 mmap(0x7f2b3bd6c000, 46080, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bd6c000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 6
> 25374 fstat(6, {st_mode=S_IFREG|0644, st_size=107325, ...}) = 0
> 25374 mmap(NULL, 107325, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f2b3bd41000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@ \0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=202736, ...}) = 0
> 25374 mmap(NULL, 238280, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bd06000
> 25374 mmap(0x7f2b3bd08000, 86016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3bd08000
> 25374 mmap(0x7f2b3bd1d000, 106496, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f2b3bd1d000
> 25374 mmap(0x7f2b3bd37000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x30000) = 0x7f2b3bd37000
> 25374 mmap(0x7f2b3bd39000, 29384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bd39000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300{\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=167640, ...}) = 0
> 25374 mmap(NULL, 178864, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bcda000
> 25374 mprotect(0x7f2b3bce1000, 135168, PROT_NONE) = 0
> 25374 mmap(0x7f2b3bce1000, 102400, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f2b3bce1000
> 25374 mmap(0x7f2b3bcfa000, 28672, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x20000) = 0x7f2b3bcfa000
> 25374 mmap(0x7f2b3bd02000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x27000) = 0x7f2b3bd02000
> 25374 mmap(0x7f2b3bd04000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bd04000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libnsl.so.2", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0pY\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=116896, ...}) = 0
> 25374 mmap(NULL, 113608, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bcbe000
> 25374 mprotect(0x7f2b3bcc3000, 77824, PROT_NONE) = 0
> 25374 mmap(0x7f2b3bcc3000, 57344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f2b3bcc3000
> 25374 mmap(0x7f2b3bcd1000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x13000) = 0x7f2b3bcd1000
> 25374 mmap(0x7f2b3bcd6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f2b3bcd6000
> 25374 mmap(0x7f2b3bcd8000, 7112, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bcd8000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/libtirpc.so.3", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\242\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=240736, ...}) = 0
> 25374 mmap(NULL, 210888, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bc8a000
> 25374 mmap(0x7f2b3bc93000, 118784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f2b3bc93000
> 25374 mmap(0x7f2b3bcb0000, 45056, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x26000) = 0x7f2b3bcb0000
> 25374 mmap(0x7f2b3bcbb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x30000) = 0x7f2b3bcbb000
> 25374 mmap(0x7f2b3bcbd000, 1992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bcbd000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340!\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=616760, ...}) = 0
> 25374 mmap(NULL, 618984, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bbf2000
> 25374 mmap(0x7f2b3bbf4000, 471040, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3bbf4000
> 25374 mmap(0x7f2b3bc67000, 135168, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x75000) = 0x7f2b3bc67000
> 25374 mmap(0x7f2b3bc88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x95000) = 0x7f2b3bc88000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\323\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=313904, ...}) = 0
> 25374 mmap(NULL, 316416, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bba4000
> 25374 mmap(0x7f2b3bbb0000, 204800, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xc000) = 0x7f2b3bbb0000
> 25374 mmap(0x7f2b3bbe2000, 49152, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3e000) = 0x7f2b3bbe2000
> 25374 mmap(0x7f2b3bbee000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x49000) = 0x7f2b3bbee000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\211\2\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=921560, ...}) = 0
> 25374 mmap(NULL, 924288, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bac2000
> 25374 mprotect(0x7f2b3bae8000, 700416, PROT_NONE) = 0
> 25374 mmap(0x7f2b3bae8000, 397312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x26000) = 0x7f2b3bae8000
> 25374 mmap(0x7f2b3bb49000, 299008, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x87000) = 0x7f2b3bb49000
> 25374 mmap(0x7f2b3bb93000, 69632, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xd0000) = 0x7f2b3bb93000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 at h\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=113872, ...}) = 0
> 25374 mmap(NULL, 119856, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3baa4000
> 25374 mmap(0x7f2b3baaa000, 61440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x6000) = 0x7f2b3baaa000
> 25374 mmap(0x7f2b3bab9000, 20480, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x15000) = 0x7f2b3bab9000
> 25374 mmap(0x7f2b3babe000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x19000) = 0x7f2b3babe000
> 25374 mmap(0x7f2b3bac1000, 1072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bac1000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\"\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=18824, ...}) = 0
> 25374 mmap(NULL, 21000, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3c343000
> 25374 mmap(0x7f2b3c345000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3c345000
> 25374 mmap(0x7f2b3c346000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3c346000
> 25374 mmap(0x7f2b3c347000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3c347000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260G\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=60688, ...}) = 0
> 25374 mmap(NULL, 63080, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3ba94000
> 25374 mmap(0x7f2b3ba98000, 28672, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f2b3ba98000
> 25374 mmap(0x7f2b3ba9f000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xb000) = 0x7f2b3ba9f000
> 25374 mmap(0x7f2b3baa2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0xd000) = 0x7f2b3baa2000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\"\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=18736, ...}) = 0
> 25374 mmap(NULL, 20752, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3ba8e000
> 25374 mmap(0x7f2b3ba90000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3ba90000
> 25374 mmap(0x7f2b3ba91000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3ba91000
> 25374 mmap(0x7f2b3ba92000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3ba92000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240C\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=100792, ...}) = 0
> 25374 mmap(NULL, 100512, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3ba75000
> 25374 mprotect(0x7f2b3ba79000, 69632, PROT_NONE) = 0
> 25374 mmap(0x7f2b3ba79000, 53248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f2b3ba79000
> 25374 mmap(0x7f2b3ba86000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x11000) = 0x7f2b3ba86000
> 25374 mmap(0x7f2b3ba8a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x14000) = 0x7f2b3ba8a000
> 25374 mmap(0x7f2b3ba8c000, 6304, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3ba8c000
> 25374 close(6) = 0
> 25374 mprotect(0x7f2b3ba8a000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3ba92000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bc88000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bd02000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3baa2000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3c347000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3babe000, 8192, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bb93000, 57344, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bbee000, 8192, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bcbb000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bcd6000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bd37000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bd6a000, 4096, PROT_READ) = 0
> 25374 statfs("/sys/fs/selinux", 0x7ffda822c060) = -1 ENOENT (No such file or directory)
> 25374 statfs("/selinux", {f_type=BTRFS_SUPER_MAGIC, f_bsize=4096, f_blocks=17436416, f_bfree=14970520, f_bavail=14121660, f_files=0, f_ffree=0, f_fsid={val=[4137558196, 2692339296]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_RELATIME}) = 0
> 25374 openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 6
> 25374 fstat(6, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
> 25374 read(6, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 372
> 25374 read(6, "", 1024) = 0
> 25374 close(6) = 0
> 25374 access("/etc/selinux/config", F_OK) = -1 ENOENT (No such file or directory)
> 25374 munmap(0x7f2b3bd41000, 107325) = 0
> 25374 read(5, "", 4096) = 0
> 25374 close(5) = 0
> 25374 openat(AT_FDCWD, "/etc/pam.d/common-account", O_RDONLY) = 5
> 25374 fstat(5, {st_mode=S_IFREG|0644, st_size=451, ...}) = 0
> 25374 read(5, "#%PAM-1.0\n#\n# This file is autog"..., 4096) = 451
> 25374 read(5, "", 4096) = 0
> 25374 close(5) = 0
> 25374 openat(AT_FDCWD, "/etc/pam.d/common-password", O_RDONLY) = 5
> 25374 fstat(5, {st_mode=S_IFREG|0644, st_size=429, ...}) = 0
> 25374 read(5, "#%PAM-1.0\n#\n# This file is autog"..., 4096) = 429
> 25374 openat(AT_FDCWD, "/lib64/security/pam_cracklib.so", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\21\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=18632, ...}) = 0
> 25374 mmap(NULL, 20728, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bd56000
> 25374 mmap(0x7f2b3bd57000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f2b3bd57000
> 25374 mmap(0x7f2b3bd59000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3bd59000
> 25374 mmap(0x7f2b3bd5a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3bd5a000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 6
> 25374 fstat(6, {st_mode=S_IFREG|0644, st_size=107325, ...}) = 0
> 25374 mmap(NULL, 107325, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f2b3ba5a000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/libcrack.so.2", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20C\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=43440, ...}) = 0
> 25374 mmap(NULL, 62016, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bd46000
> 25374 mprotect(0x7f2b3bd4a000, 24576, PROT_NONE) = 0
> 25374 mmap(0x7f2b3bd4a000, 12288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f2b3bd4a000
> 25374 mmap(0x7f2b3bd4d000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f2b3bd4d000
> 25374 mmap(0x7f2b3bd50000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x9000) = 0x7f2b3bd50000
> 25374 mmap(0x7f2b3bd52000, 12864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3bd52000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0203\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=100400, ...}) = 0
> 25374 mmap(NULL, 102416, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3ba40000
> 25374 mmap(0x7f2b3ba43000, 57344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3ba43000
> 25374 mmap(0x7f2b3ba51000, 28672, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x11000) = 0x7f2b3ba51000
> 25374 mmap(0x7f2b3ba58000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x17000) = 0x7f2b3ba58000
> 25374 close(6) = 0
> 25374 mprotect(0x7f2b3ba58000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bd50000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3bd5a000, 4096, PROT_READ) = 0
> 25374 munmap(0x7f2b3ba5a000, 107325) = 0
> 25374 read(5, "", 4096) = 0
> 25374 close(5) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_loginuid.so", O_RDONLY|O_CLOEXEC) = 5
> 25374 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\21\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(5, {st_mode=S_IFREG|0755, st_size=14488, ...}) = 0
> 25374 mmap(NULL, 16584, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f2b3c33e000
> 25374 mmap(0x7f2b3c33f000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0x7f2b3c33f000
> 25374 mmap(0x7f2b3c340000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3c340000
> 25374 mmap(0x7f2b3c341000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3c341000
> 25374 close(5) = 0
> 25374 mprotect(0x7f2b3c341000, 4096, PROT_READ) = 0
> 25374 openat(AT_FDCWD, "/etc/pam.d/common-session", O_RDONLY) = 5
> 25374 fstat(5, {st_mode=S_IFREG|0644, st_size=547, ...}) = 0
> 25374 read(5, "#%PAM-1.0\n#\n# This file is autog"..., 4096) = 547
> 25374 openat(AT_FDCWD, "/lib64/security/pam_systemd.so", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0pz\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=364736, ...}) = 0
> 25374 mmap(NULL, 368792, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3b9e5000
> 25374 mprotect(0x7f2b3b9ec000, 323584, PROT_NONE) = 0
> 25374 mmap(0x7f2b3b9ec000, 233472, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f2b3b9ec000
> 25374 mmap(0x7f2b3ba25000, 86016, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x40000) = 0x7f2b3ba25000
> 25374 mmap(0x7f2b3ba3b000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x55000) = 0x7f2b3ba3b000
> 25374 mmap(0x7f2b3ba3f000, 152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f2b3ba3f000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 6
> 25374 fstat(6, {st_mode=S_IFREG|0644, st_size=107325, ...}) = 0
> 25374 mmap(NULL, 107325, PROT_READ, MAP_PRIVATE, 6, 0) = 0x7f2b3ba5a000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/libpam_misc.so.0", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260!\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=18720, ...}) = 0
> 25374 mmap(NULL, 20768, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3b9df000
> 25374 mmap(0x7f2b3b9e1000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3b9e1000
> 25374 mmap(0x7f2b3b9e2000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3b9e2000
> 25374 mmap(0x7f2b3b9e3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3b9e3000
> 25374 close(6) = 0
> 25374 openat(AT_FDCWD, "/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\2403\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=49936, ...}) = 0
> 25374 mmap(NULL, 43520, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3b9d4000
> 25374 mmap(0x7f2b3b9d7000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x3000) = 0x7f2b3b9d7000
> 25374 mmap(0x7f2b3b9db000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x7000) = 0x7f2b3b9db000
> 25374 mmap(0x7f2b3b9dd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x8000) = 0x7f2b3b9dd000
> 25374 close(6) = 0
> 25374 mprotect(0x7f2b3b9dd000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3b9e3000, 4096, PROT_READ) = 0
> 25374 mprotect(0x7f2b3ba3b000, 12288, PROT_READ) = 0
> 25374 munmap(0x7f2b3ba5a000, 107325) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_limits.so", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\"\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=26984, ...}) = 0
> 25374 mmap(NULL, 29008, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3ba6d000
> 25374 mmap(0x7f2b3ba6f000, 12288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3ba6f000
> 25374 mmap(0x7f2b3ba72000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f2b3ba72000
> 25374 mmap(0x7f2b3ba73000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x5000) = 0x7f2b3ba73000
> 25374 close(6) = 0
> 25374 mprotect(0x7f2b3ba73000, 4096, PROT_READ) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_umask.so", O_RDONLY|O_CLOEXEC) = 6
> 25374 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\21\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(6, {st_mode=S_IFREG|0755, st_size=14520, ...}) = 0
> 25374 mmap(NULL, 16624, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2b3bd41000
> 25374 mmap(0x7f2b3bd42000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x1000) = 0x7f2b3bd42000
> 25374 mmap(0x7f2b3bd43000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3bd43000
> 25374 mmap(0x7f2b3bd44000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x2000) = 0x7f2b3bd44000
> 25374 close(6) = 0
> 25374 mprotect(0x7f2b3bd44000, 4096, PROT_READ) = 0
> 25374 read(5, "", 4096) = 0
> 25374 close(5) = 0
> 25374 read(4, "", 4096) = 0
> 25374 close(4) = 0
> 25374 openat(AT_FDCWD, "/etc/pam.d/other", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=251, ...}) = 0
> 25374 read(4, "#%PAM-1.0\nauth\t required\tpam_war"..., 4096) = 251
> 25374 openat(AT_FDCWD, "/lib64/security/pam_warn.so", O_RDONLY|O_CLOEXEC) = 5
> 25374 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\20\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(5, {st_mode=S_IFREG|0755, st_size=14344, ...}) = 0
> 25374 mmap(NULL, 16448, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f2b3ba68000
> 25374 mmap(0x7f2b3ba69000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0x7f2b3ba69000
> 25374 mmap(0x7f2b3ba6a000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3ba6a000
> 25374 mmap(0x7f2b3ba6b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3ba6b000
> 25374 close(5) = 0
> 25374 mprotect(0x7f2b3ba6b000, 4096, PROT_READ) = 0
> 25374 openat(AT_FDCWD, "/lib64/security/pam_deny.so", O_RDONLY|O_CLOEXEC) = 5
> 25374 read(5, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\20\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(5, {st_mode=S_IFREG|0755, st_size=14024, ...}) = 0
> 25374 mmap(NULL, 16424, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x7f2b3ba63000
> 25374 mmap(0x7f2b3ba64000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0x7f2b3ba64000
> 25374 mmap(0x7f2b3ba65000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3ba65000
> 25374 mmap(0x7f2b3ba66000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2000) = 0x7f2b3ba66000
> 25374 close(5) = 0
> 25374 mprotect(0x7f2b3ba66000, 4096, PROT_READ) = 0
> 25374 read(4, "", 4096) = 0
> 25374 close(4) = 0
> 25374 lstat("/etc/ftpusers", {st_mode=S_IFREG|0644, st_size=565, ...}) = 0
> 25374 openat(AT_FDCWD, "/etc/ftpusers", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=565, ...}) = 0
> 25374 read(4, "#\n# ftpusers\tThis file describes"..., 4096) = 565
> 25374 read(4, "", 4096) = 0
> 25374 close(4) = 0
> 25374 stat("/etc/shells", {st_mode=S_IFREG|0644, st_size=310, ...}) = 0
> 25374 openat(AT_FDCWD, "/etc/shells", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=310, ...}) = 0
> 25374 read(4, "/bin/ash\n/bin/bash\n/bin/csh\n/bin"..., 4096) = 310
> 25374 close(4) = 0
> 25374 getuid() = 0
> 25374 openat(AT_FDCWD, "/etc/login.defs", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=9084, ...}) = 0
> 25374 read(4, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
> 25374 read(4, "_MIN to UID_MAX inclusive is the"..., 4096) = 4096
> 25374 close(4) = 0
> 25374 geteuid() = 0
> 25374 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=1175, ...}) = 0
> 25374 read(4, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1175
> 25374 read(4, "", 4096) = 0
> 25374 close(4) = 0
> 25374 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=107325, ...}) = 0
> 25374 mmap(NULL, 107325, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f2b3b9b9000
> 25374 close(4) = 0
> 25374 openat(AT_FDCWD, "/lib64/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = 4
> 25374 read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \"\0\0\0\0\0\0"..., 832) = 832
> 25374 fstat(4, {st_mode=S_IFREG|0755, st_size=45936, ...}) = 0
> 25374 mmap(NULL, 42912, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f2b3b9ae000
> 25374 mprotect(0x7f2b3b9b0000, 28672, PROT_NONE) = 0
> 25374 mmap(0x7f2b3b9b0000, 20480, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x2000) = 0x7f2b3b9b0000
> 25374 mmap(0x7f2b3b9b5000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7000) = 0x7f2b3b9b5000
> 25374 mmap(0x7f2b3b9b7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x8000) = 0x7f2b3b9b7000
> 25374 close(4) = 0
> 25374 mprotect(0x7f2b3b9b7000, 4096, PROT_READ) = 0
> 25374 munmap(0x7f2b3b9b9000, 107325) = 0
> 25374 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=107325, ...}) = 0
> 25374 mmap(NULL, 107325, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f2b3b9b9000
> 25374 close(4) = 0
> 25374 openat(AT_FDCWD, "/lib64/tls/x86_64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/tls/x86_64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/tls/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/tls/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/tls/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/tls/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/tls/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/tls", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/x86_64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/x86_64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/lib64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/lib64", {st_mode=S_IFDIR|0755, st_size=2930, ...}) = 0
> 25374 openat(AT_FDCWD, "/usr/lib64/tls/x86_64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/tls/x86_64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/tls/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/tls/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/tls/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/tls/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/tls/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/tls", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/x86_64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/x86_64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/x86_64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64/x86_64", 0x7ffda822c4f0) = -1 ENOENT (No such file or directory)
> 25374 openat(AT_FDCWD, "/usr/lib64/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
> 25374 stat("/usr/lib64", {st_mode=S_IFDIR|0755, st_size=94952, ...}) = 0
> 25374 munmap(0x7f2b3b9b9000, 107325) = 0
> 25374 openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = 4
> 25374 lseek(4, 0, SEEK_CUR) = 0
> 25374 fstat(4, {st_mode=S_IFREG|0640, st_size=1464, ...}) = 0
> 25374 mmap(NULL, 1464, PROT_READ, MAP_SHARED, 4, 0) = 0x7f2b3ba62000
> 25374 lseek(4, 1464, SEEK_SET) = 1464
> 25374 munmap(0x7f2b3ba62000, 1464) = 0
> 25374 close(4) = 0
> 25374 socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 4
> 25374 fcntl(4, F_SETFD, FD_CLOEXEC) = 0
> 25374 socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 5
> 25374 bind(5, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
> 25374 getsockname(5, {sa_family=AF_NETLINK, nl_pid=25374, nl_groups=00000000}, [12]) = 0
> 25374 sendto(5, {{len=20, type=RTM_GETADDR, flags=NLM_F_REQUEST|NLM_F_DUMP, seq=1562217406, pid=0}, {ifa_family=AF_UNSPEC, ...}}, 20, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 20
> 25374 recvmsg(5, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=76, type=RTM_NEWADDR, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, {ifa_family=AF_INET, ifa_prefixlen=8, ifa_flags=IFA_F_PERMANENT, ifa_scope=RT_SCOPE_HOST, ifa_index=if_nametoindex("lo")}, [{{nla_len=8, nla_type=IFA_ADDRESS}, inet_addr("127.0.0.1")}, {{nla_len=8, nla_type=IFA_LOCAL}, inet_addr("127.0.0.1")}, {{nla_len=7, nla_type=IFA_LABEL}, "lo"}, {{nla_len=8, nla_type=IFA_FLAGS}, IFA_F_PERMANENT}, {{nla_len=20, nla_type=IFA_CACHEINFO}, {ifa_prefered=4294967295, ifa_valid=4294967295, cstamp=185, tstamp=185}}]}, {{len=88, type=RTM_NEWADDR, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, {ifa_family=AF_INET, ifa_prefixlen=24, ifa_flags=IFA_F_PERMANENT, ifa_scope=RT_SCOPE_UNIVERSE, ifa_index=if_nametoindex("enp0s25")}, [{{nla_len=8, nla_type=IFA_ADDRESS}, inet_addr("192.168.2.3")}, {{nla_len=8, nla_type=IFA_LOCAL}, inet_addr("192.168.2.3")}, {{nla_len=8, nla_type=IFA_BROADCAST}, inet_addr("192.168.2.255")}, {{nla_len=12, nla_type=IFA_LABEL}, "enp0s25"}, {{nla_len=8, nla_type=IFA_FLAGS}, IFA_F_PERMANENT}, {{nla_len=20, nla_type=IFA_CACHEINFO}, {ifa_prefered=4294967295, ifa_valid=4294967295, cstamp=2767, tstamp=2767}}]}, {{len=88, type=RTM_NEWADDR, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, {ifa_family=AF_INET, ifa_prefixlen=24, ifa_flags=IFA_F_PERMANENT, ifa_scope=RT_SCOPE_UNIVERSE, ifa_index=if_nametoindex("enp7s0")}, [{{nla_len=8, nla_type=IFA_ADDRESS}, inet_addr("192.168.221.3")}, {{nla_len=8, nla_type=IFA_LOCAL}, inet_addr("192.168.221.3")}, {{nla_len=8, nla_type=IFA_BROADCAST}, inet_addr("192.168.221.255")}, {{nla_len=11, nla_type=IFA_LABEL}, "enp7s0"}, {{nla_len=8, nla_type=IFA_FLAGS}, IFA_F_PERMANENT}, {{nla_len=20, nla_type=IFA_CACHEINFO}, {ifa_prefered=4294967295, ifa_valid=4294967295, cstamp=2720, tstamp=2720}}]}], iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 252
> 25374 recvmsg(5, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=72, type=RTM_NEWADDR, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, {ifa_family=AF_INET6, ifa_prefixlen=128, ifa_flags=IFA_F_PERMANENT, ifa_scope=RT_SCOPE_HOST, ifa_index=if_nametoindex("lo")}, [{{nla_len=20, nla_type=IFA_ADDRESS}, inet_pton(AF_INET6, "::1")}, {{nla_len=20, nla_type=IFA_CACHEINFO}, {ifa_prefered=4294967295, ifa_valid=4294967295, cstamp=185, tstamp=185}}, {{nla_len=8, nla_type=IFA_FLAGS}, IFA_F_PERMANENT}]}, {{len=72, type=RTM_NEWADDR, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, {ifa_family=AF_INET6, ifa_prefixlen=64, ifa_flags=IFA_F_PERMANENT, ifa_scope=RT_SCOPE_LINK, ifa_index=if_nametoindex("enp0s25")}, [{{nla_len=20, nla_type=IFA_ADDRESS}, inet_pton(AF_INET6, "fe80::21e:67ff:fe1b:bbcf")}, {{nla_len=20, nla_type=IFA_CACHEINFO}, {ifa_prefered=4294967295, ifa_valid=4294967295, cstamp=2654, tstamp=2654}}, {{nla_len=8, nla_type=IFA_FLAGS}, IFA_F_PERMANENT}]}, {{len=72, type=RTM_NEWADDR, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, {ifa_family=AF_INET6, ifa_prefixlen=64, ifa_flags=IFA_F_PERMANENT, ifa_scope=RT_SCOPE_LINK, ifa_index=if_nametoindex("enp7s0")}, [{{nla_len=20, nla_type=IFA_ADDRESS}, inet_pton(AF_INET6, "fe80::21e:67ff:fe1b:bbce")}, {{nla_len=20, nla_type=IFA_CACHEINFO}, {ifa_prefered=4294967295, ifa_valid=4294967295, cstamp=2606, tstamp=2606}}, {{nla_len=8, nla_type=IFA_FLAGS}, IFA_F_PERMANENT}]}], iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 216
> 25374 recvmsg(5, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=20, type=NLMSG_DONE, flags=NLM_F_MULTI, seq=1562217406, pid=25374}, 0}, iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20
> 25374 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 6
> 25374 connect(6, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = 0
> 25374 sendto(6, "\2\0\0\0\r\0\0\0\6\0\0\0hosts\0", 18, MSG_NOSIGNAL, NULL, 0) = 18
> 25374 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=6, revents=POLLIN|POLLHUP}])
> 25374 recvmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="hosts\0", iov_len=6}, {iov_base="\310O\3\0\0\0\0\0", iov_len=8}], msg_iovlen=2, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, cmsg_data=[7]}], msg_controllen=20, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 14
> 25374 mmap(NULL, 217032, PROT_READ, MAP_SHARED, 7, 0) = 0x7f2b3b979000
> 25374 close(7) = 0
> 25374 close(6) = 0
> 25374 close(5) = 0
> 25374 readlink("/proc/self/exe", "/usr/sbin/vsftpd", 4096) = 16
> 25374 sendto(4, {{len=204, type=0x44c /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}, "\x6f\x70\x3d\x50\x41\x4d\x3a\x61\x75\x74\x68\x65\x6e\x74\x69\x63\x61\x74\x69\x6f\x6e\x20\x67\x72\x61\x6e\x74\x6f\x72\x73\x3d\x70"...}, 204, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 204
> 25374 poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}])
> 25374 recvfrom(4, {{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=1, pid=25374}, {error=0, msg={len=204, type=AUDIT_FIRST_USER_MSG, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}}}, 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36
> 25374 recvfrom(4, {{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=1, pid=25374}, {error=0, msg={len=204, type=AUDIT_FIRST_USER_MSG, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}}}, 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36
> 25374 close(4) = 0
> 25374 getuid() = 0
> 25374 openat(AT_FDCWD, "/etc/login.defs", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=9084, ...}) = 0
> 25374 read(4, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
> 25374 read(4, "_MIN to UID_MAX inclusive is the"..., 4096) = 4096
> 25374 close(4) = 0
> 25374 geteuid() = 0
> 25374 openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = 4
> 25374 lseek(4, 0, SEEK_CUR) = 0
> 25374 fstat(4, {st_mode=S_IFREG|0640, st_size=1464, ...}) = 0
> 25374 mmap(NULL, 1464, PROT_READ, MAP_SHARED, 4, 0) = 0x7f2b3ba62000
> 25374 lseek(4, 1464, SEEK_SET) = 1464
> 25374 munmap(0x7f2b3ba62000, 1464) = 0
> 25374 close(4) = 0
> 25374 socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 4
> 25374 fcntl(4, F_SETFD, FD_CLOEXEC) = 0
> 25374 sendto(4, {{len=176, type=0x44d /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=2, pid=0}, "\x6f\x70\x3d\x50\x41\x4d\x3a\x61\x63\x63\x6f\x75\x6e\x74\x69\x6e\x67\x20\x67\x72\x61\x6e\x74\x6f\x72\x73\x3d\x70\x61\x6d\x5f\x75"...}, 176, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 176
> 25374 poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}])
> 25374 recvfrom(4, {{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=2, pid=25374}, {error=0, msg={len=176, type=0x44d /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=2, pid=0}}}, 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36
> 25374 recvfrom(4, {{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=2, pid=25374}, {error=0, msg={len=176, type=0x44d /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=2, pid=0}}}, 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36
> 25374 close(4) = 0
> 25374 openat(AT_FDCWD, "/etc/security/pam_env.conf", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=2972, ...}) = 0
> 25374 read(4, "#\n# This is the configuration fi"..., 4096) = 2972
> 25374 read(4, "", 4096) = 0
> 25374 close(4) = 0
> 25374 openat(AT_FDCWD, "/etc/environment", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=97, ...}) = 0
> 25374 read(4, "#\n# This file is parsed by pam_e"..., 4096) = 97
> 25374 read(4, "", 4096) = 0
> 25374 close(4) = 0
> 25374 stat("/home/boris/.pam_environment", 0x7ffda822ccb0) = -1 ENOENT (No such file or directory)
> 25374 getuid() = 0
> 25374 openat(AT_FDCWD, "/etc/login.defs", O_RDONLY) = 4
> 25374 fstat(4, {st_mode=S_IFREG|0644, st_size=9084, ...}) = 0
> 25374 read(4, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
> 25374 read(4, "_MIN to UID_MAX inclusive is the"..., 4096) = 4096
> 25374 close(4) = 0
> 25374 socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 4
> 25374 fcntl(4, F_SETFD, FD_CLOEXEC) = 0
> 25374 sendto(4, {{len=196, type=0x44f /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=3, pid=0}, "\x6f\x70\x3d\x50\x41\x4d\x3a\x73\x65\x74\x63\x72\x65\x64\x20\x67\x72\x61\x6e\x74\x6f\x72\x73\x3d\x70\x61\x6d\x5f\x6c\x69\x73\x74"...}, 196, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 196
> 25374 poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}])
> 25374 recvfrom(4, {{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=3, pid=25374}, {error=0, msg={len=196, type=0x44f /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=3, pid=0}}}, 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36
> 25374 recvfrom(4, {{len=36, type=NLMSG_ERROR, flags=NLM_F_CAPPED, seq=3, pid=25374}, {error=0, msg={len=196, type=0x44f /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=3, pid=0}}}, 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36
> 25374 close(4) = 0
> 25374 munmap(0x7f2b3c354000, 16560) = 0
> 25374 munmap(0x7f2b3c34f000, 16496) = 0
> 25374 munmap(0x7f2b3c349000, 20712) = 0
> 25374 munmap(0x7f2b3bd5c000, 111616) = 0
> 25374 munmap(0x7f2b3bd06000, 238280) = 0
> 25374 munmap(0x7f2b3bcbe000, 113608) = 0
> 25374 munmap(0x7f2b3bc8a000, 210888) = 0
> 25374 munmap(0x7f2b3bba4000, 316416) = 0
> 25374 munmap(0x7f2b3bac2000, 924288) = 0
> 25374 munmap(0x7f2b3baa4000, 119856) = 0
> 25374 munmap(0x7f2b3c343000, 21000) = 0
> 25374 munmap(0x7f2b3ba94000, 63080) = 0
> 25374 munmap(0x7f2b3bcda000, 178864) = 0
> 25374 munmap(0x7f2b3bbf2000, 618984) = 0
> 25374 munmap(0x7f2b3ba8e000, 20752) = 0
> 25374 munmap(0x7f2b3ba75000, 100512) = 0
> 25374 munmap(0x7f2b3bd56000, 20728) = 0
> 25374 munmap(0x7f2b3bd46000, 62016) = 0
> 25374 munmap(0x7f2b3ba40000, 102416) = 0
> 25374 munmap(0x7f2b3c33e000, 16584) = 0
> 25374 munmap(0x7f2b3b9e5000, 368792) = 0
> 25374 munmap(0x7f2b3b9df000, 20768) = 0
> 25374 munmap(0x7f2b3ba6d000, 29008) = 0
> 25374 munmap(0x7f2b3bd41000, 16624) = 0
> 25374 munmap(0x7f2b3ba68000, 16448) = 0
> 25374 munmap(0x7f2b3ba63000, 16424) = 0
> 25374 getpid() = 25374
> 25374 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
> 25374 connect(4, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0
> 25374 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25374"..., 84, MSG_NOSIGNAL, NULL, 0) = 84
> 25374 rt_sigaction(SIGCHLD, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 write(3, "\1", 1) = 1
> 25375 <... read resumed>"\1", 1) = 1
> 25374 wait4(-1, <unfinished ...>
> 25375 exit_group(0) = ?
> 25375 +++ exited with 0 +++
> 25374 <... wait4 resumed>[{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 25375
> 25374 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=25375, si_uid=465, si_status=0, si_utime=0, si_stime=0} ---
> 25374 rt_sigreturn({mask=[]}) = 25375
> 25374 close(3) = 0
> 25374 socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 5]) = 0
> 25374 rt_sigaction(SIGCHLD, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14d0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25374 clone( <unfinished ...>
> 25378 prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
> 25374 <... clone resumed>child_stack=NULL, flags=CLONE_NEWNET|SIGCHLD) = 25378
> 25378 close(3) = 0
> 25374 close(5) = 0
> 25378 getuid() = 0
> 25374 getuid( <unfinished ...>
> 25378 openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY <unfinished ...>
> 25374 <... getuid resumed>) = 0
> 25378 <... openat resumed>) = 3
> 25378 read(3, <unfinished ...>
> 25374 setgroups(0, NULL <unfinished ...>
> 25378 <... read resumed>"65536\n", 31) = 6
> 25374 <... setgroups resumed>) = 0
> 25378 close(3 <unfinished ...>
> 25374 chdir("/usr/share/empty" <unfinished ...>
> 25378 <... close resumed>) = 0
> 25374 <... chdir resumed>) = 0
> 25374 chroot("." <unfinished ...>
> 25378 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0 <unfinished ...>
> 25374 <... chroot resumed>) = 0
> 25378 <... socket resumed>) = 3
> 25378 connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110 <unfinished ...>
> 25374 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, <unfinished ...>
> 25378 <... connect resumed>) = 0
> 25374 <... capget resumed>NULL) = 0
> 25378 sendto(3, "\2\0\0\0\f\0\0\0\6\0\0\0group\0", 18, MSG_NOSIGNAL, NULL, 0 <unfinished ...>
> 25374 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, <unfinished ...>
> 25378 <... sendto resumed>) = 18
> 25374 <... capget resumed>{effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, inheritable=0}) = 0
> 25378 poll([{fd=3, events=POLLIN|POLLERR|POLLHUP}], 1, 5000 <unfinished ...>
> 25374 prctl(PR_SET_KEEPCAPS, 0 <unfinished ...>
> 25378 <... poll resumed>) = 1 ([{fd=3, revents=POLLIN|POLLHUP}])
> 25374 <... prctl resumed>) = 0
> 25378 recvmsg(3, <unfinished ...>
> 25374 prctl(PR_SET_KEEPCAPS, 1 <unfinished ...>
> 25378 <... recvmsg resumed>{msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="group\0", iov_len=6}, {iov_base="\310O\3\0\0\0\0\0", iov_len=8}], msg_iovlen=2, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, cmsg_data=[6]}], msg_controllen=20, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 14
> 25374 <... prctl resumed>) = 0
> 25378 mmap(NULL, 217032, PROT_READ, MAP_SHARED, 6, 0 <unfinished ...>
> 25374 setgid(65534 <unfinished ...>
> 25378 <... mmap resumed>) = 0x7f2b3bd43000
> 25374 <... setgid resumed>) = 0
> 25378 close(6 <unfinished ...>
> 25374 setuid(465 <unfinished ...>
> 25378 <... close resumed>) = 0
> 25374 <... setuid resumed>) = 0
> 25378 close(3 <unfinished ...>
> 25374 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, <unfinished ...>
> 25378 <... close resumed>) = 0
> 25374 <... capget resumed>NULL) = 0
> 25378 setgroups(3, [1002, 1001, 100] <unfinished ...>
> 25374 capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_NET_BIND_SERVICE, permitted=1<<CAP_NET_BIND_SERVICE, inheritable=0} <unfinished ...>
> 25378 <... setgroups resumed>) = 0
> 25374 <... capset resumed>) = 0
> 25378 geteuid( <unfinished ...>
> 25374 access("/", W_OK <unfinished ...>
> 25378 <... geteuid resumed>) = 0
> 25374 <... access resumed>) = -1 EACCES (Permission denied)
> 25378 getegid( <unfinished ...>
> 25374 prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0 <unfinished ...>
> 25378 <... getegid resumed>) = 0
> 25374 <... prctl resumed>) = 0
> 25378 setregid(-1, 100 <unfinished ...>
> 25374 prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=128, filter=0x7ffda822ce30} <unfinished ...>
> 25378 <... setregid resumed>) = 0
> 25378 setreuid(-1, 1000) = 0
> 25378 chdir("/home/boris" <unfinished ...>
> 25374 <... prctl resumed>) = 0
> 25378 <... chdir resumed>) = 0
> 25374 read(3, <unfinished ...>
> 25378 chdir("/srv/ftp") = 0
> 25378 setreuid(-1, 0) = 0
> 25378 setregid(-1, 0) = 0
> 25378 setgid(100) = 0
> 25378 setuid(1000) = 0
> 25378 prlimit64(0, RLIMIT_NPROC, {rlim_cur=0, rlim_max=0}, NULL) = 0
> 25378 prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) = 0
> 25378 prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=192, filter=0x7ffda822cc70}) = 0
> 25378 mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2b3c356000
> 25378 mprotect(0x7f2b3c358000, 4096, PROT_NONE) = 0
> 25378 mprotect(0x7f2b3c356000, 4096, PROT_NONE) = 0
> 25378 getcwd("/srv/ftp", 4096) = 9
> 25378 umask(022) = 077
> 25378 getcwd("/srv/ftp", 4096) = 9
> 25378 openat(AT_FDCWD, ".message", O_RDONLY|O_NONBLOCK) = -1 ENOENT (No such file or directory)
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 113, MSG_NOSIGNAL, NULL, 0) = 113
> 25378 write(0, "230 Login successful.\r\n", 23) = 23
> 25378 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25378 alarm(900) = 0
> 25378 mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2b3c353000
> 25378 mprotect(0x7f2b3c355000, 4096, PROT_NONE) = 0
> 25378 mprotect(0x7f2b3c353000, 4096, PROT_NONE) = 0
> 25378 recvfrom(0, "SYST\r\n", 4096, MSG_PEEK, NULL, NULL) = 6
> 25378 read(0, "SYST\r\n", 6) = 6
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 95, MSG_NOSIGNAL, NULL, 0) = 95
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 109, MSG_NOSIGNAL, NULL, 0) = 109
> 25378 write(0, "215 UNIX Type: L8\r\n", 19) = 19
> 25378 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25378 alarm(900) = 900
> 25378 recvfrom(0, "FEAT\r\n", 4096, MSG_PEEK, NULL, NULL) = 6
> 25378 read(0, "FEAT\r\n", 6) = 6
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 95, MSG_NOSIGNAL, NULL, 0) = 95
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 105, MSG_NOSIGNAL, NULL, 0) = 105
> 25378 write(0, "211-Features:\r\n", 15) = 15
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " EPRT\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " EPSV\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " MDTM\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " PASV\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 106, MSG_NOSIGNAL, NULL, 0) = 106
> 25378 write(0, " REST STREAM\r\n", 14) = 14
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " SIZE\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " TVFS\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, " UTF8\r\n", 7) = 7
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
> 25378 write(0, "211 End\r\n", 9) = 9
> 25378 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25378 alarm(900) = 900
> 25378 recvfrom(0, "PWD\r\n", 4096, MSG_PEEK, NULL, NULL) = 5
> 25378 read(0, "PWD\r\n", 5) = 5
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 94, MSG_NOSIGNAL, NULL, 0) = 94
> 25378 getcwd("/srv/ftp", 4096) = 9
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:46 vsftpd[25378"..., 131, MSG_NOSIGNAL, NULL, 0) = 131
> 25378 write(0, "257 \"/srv/ftp\" is the current di"..., 41) = 41
> 25378 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25378 alarm(900) = 900
> 25378 recvfrom(0, "EPSV\r\n", 4096, MSG_PEEK, NULL, NULL) = 6
> 25378 read(0, "EPSV\r\n", 6) = 6
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:49 vsftpd[25378"..., 95, MSG_NOSIGNAL, NULL, 0) = 95
> 25378 write(5, "\n", 1) = 1
> 25378 read(5, <unfinished ...>
> 25374 <... read resumed>"\n", 1) = 1
> 25374 write(3, "\1", 1) = 1
> 25378 <... read resumed>"\1", 1) = 1
> 25374 read(3, <unfinished ...>
> 25378 write(5, "\f", 1) = 1
> 25374 <... read resumed>"\f", 1) = 1
> 25378 read(5, <unfinished ...>
> 25374 socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP) = 5
> 25374 setsockopt(5, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
> 25374 bind(5, {sa_family=AF_INET6, sin6_port=htons(30073), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::ffff:192.168.221.3", &sin6_addr), sin6_scope_id=0}, 28) = 0
> 25374 listen(5, 1) = 0
> 25374 write(3, "yu\0\0", 4) = 4
> 25378 <... read resumed>"yu\0\0", 4) = 4
> 25374 read(3, <unfinished ...>
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:49 vsftpd[25378"..., 138, MSG_NOSIGNAL, NULL, 0) = 138
> 25378 write(0, "229 Entering Extended Passive Mo"..., 48) = 48
> 25378 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25378 alarm(900) = 897
> 25378 recvfrom(0, "LIST\r\n", 4096, MSG_PEEK, NULL, NULL) = 6
> 25378 read(0, "LIST\r\n", 6) = 6
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:49 vsftpd[25378"..., 95, MSG_NOSIGNAL, NULL, 0) = 95
> 25378 write(5, "\v", 1) = 1
> 25374 <... read resumed>"\v", 1) = 1
> 25378 read(5, <unfinished ...>
> 25374 write(3, "\1\0\0\0", 4 <unfinished ...>
> 25378 <... read resumed>"\1\0\0\0", 4) = 4
> 25374 <... write resumed>) = 4
> 25378 openat(AT_FDCWD, ".", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
> 25374 read(3, <unfinished ...>
> 25378 fstat(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
> 25378 write(5, "\v", 1) = 1
> 25378 read(5, <unfinished ...>
> 25374 <... read resumed>"\v", 1) = 1
> 25374 write(3, "\1\0\0\0", 4 <unfinished ...>
> 25378 <... read resumed>"\1\0\0\0", 4) = 4
> 25374 <... write resumed>) = 4
> 25378 write(5, "\v", 1) = 1
> 25378 read(5, <unfinished ...>
> 25374 read(3, "\v", 1) = 1
> 25374 write(3, "\1\0\0\0", 4) = 4
> 25378 <... read resumed>"\1\0\0\0", 4) = 4
> 25374 read(3, <unfinished ...>
> 25378 write(5, "\r", 1) = 1
> 25374 <... read resumed>"\r", 1) = 1
> 25378 read(5, <unfinished ...>
> 25374 select(6, [5], NULL, NULL, {tv_sec=60, tv_usec=0}) = 1 (in [5], left {tv_sec=59, tv_usec=999997})
> 25374 accept(5, {sa_family=AF_INET6, sin6_port=htons(58584), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::ffff:192.168.221.119", &sin6_addr), sin6_scope_id=0}, [28]) = 6
> 25374 write(3, "\1", 1) = 1
> 25378 <... read resumed>"\1", 1) = 1
> 25374 sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\0", iov_len=1}], msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, cmsg_data=[6]}], msg_controllen=20, msg_flags=0}, 0 <unfinished ...>
> 25378 recvmsg(5, <unfinished ...>
> 25374 <... sendmsg resumed>) = 1
> 25378 <... recvmsg resumed>{msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\0", iov_len=1}], msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, cmsg_data=[6]}], msg_controllen=24, msg_flags=0}, 0) = 1
> 25374 close(6 <unfinished ...>
> 25378 setsockopt(6, SOL_SOCKET, SO_KEEPALIVE, [1], 4 <unfinished ...>
> 25374 <... close resumed>) = 0
> 25378 <... setsockopt resumed>) = 0
> 25374 read(3, <unfinished ...>
> 25378 setsockopt(6, SOL_IP, IP_TOS, [8], 4) = 0
> 25378 rt_sigaction(SIGALRM, {sa_handler=0x562c3bdc14e0, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f2b3be3ae50}, NULL, 8) = 0
> 25378 alarm(300) = 900
> 25378 getpid() = 25378
> 25378 sendto(4, "<94>Jul 4 07:16:49 vsftpd[25378"..., 129, MSG_NOSIGNAL, NULL, 0) = 129
> 25378 write(0, "150 Here comes the directory lis"..., 39) = 39
> 25378 getdents64(3 <unfinished ...>) = ?
> 25378 +++ killed by SIGSYS +++
> 25374 <... read resumed>"", 1) = 0
> 25374 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=25378, si_uid=1000, si_status=SIGSYS, si_utime=0, si_stime=0} ---
> 25374 alarm(1) = 0
> 25374 rt_sigreturn({mask=[]}) = 0
> 25374 alarm(0) = 1
> 25374 wait4(-1, [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSYS}], WNOHANG, NULL) = 25378
> 25374 getpid() = ?
> 25374 +++ killed by SIGSYS +++
> 1752 <... accept resumed>0x7ffda822d330, [28]) = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
> 1752 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=25374, si_uid=465, si_status=SIGSYS, si_utime=2, si_stime=1} ---
> 1752 alarm(1) = 0
> 1752 rt_sigreturn({mask=[]}) = -1 EINTR (Interrupted system call)
> 1752 alarm(0) = 1
> 1752 wait4(-1, NULL, WNOHANG, NULL) = 25374
> 1752 wait4(-1, NULL, WNOHANG, NULL) = -1 ECHILD (No child processes)
> 1752 accept(3, <detached ...>
> sfo2201:~ #
Ist etwas länglich, und vieles dabei, was verdächtig klingt, aber
nichts, woraus ich Schlüsse ziehen kann.
Fällt Dir da etwas auf und/oder ein?
--
Mit freundlichem Gruß Best regards
Boris Kirkorowicz
Mehr Informationen über die Mailingliste linux-l