Attachment 1450799 Details for Bug 1590649 – rcp strace non root account

rcp strace non root account

rcp-non-root.txt (text/plain), 45.68 KB, created by Ramesh Sahoo on 2018-06-13 06:33:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ramesh Sahoo

Created: 2018-06-13 06:33:57 UTC

Size: 45.68 KB

patch

obsolete

>19537 11:52:40 execve("/bin/rcp", ["rcp", "abc.txt", "10.74.253.12:/tmp/"], ["XDG_SESSION_ID=23380", "HOSTNAME=vm251-125.gsslab.pnq2.redhat.com", "SHELL=/bin/bash", "TERM=xterm-256color", "HISTSIZE=1000", "USER=test", "LS_COLORS=rs=0:di=38;5;27:ln=38;5;51:mh=44;38;5;15:pi=40;38;5;11:so=38;5;13:do=38;5;5:bd=48;5;232;38;5;11:cd=48;5;232;38;5;3:or=48;5;232;38;5;9:mi=05;48;5;232;38;5;15:su=48;5;196;38;5;15:sg=48;5;11;38;5;16:ca=48;5;196;38;5;226:tw=48;5;10;38;5;16:ow=48;5;10;38;5;21:st=48;5;21;38;5;15:ex=38;5;34:*.tar=38;5;9:*.tgz=38;5;9:*.arc=38;5;9:*.arj=38;5;9:*.taz=38;5;9:*.lha=38;5;9:*.lz4=38;5;9:*.lzh=38;5;9:*.lzma=38;5;9:*.tlz=38;5;9:*.txz=38;5;9:*.tzo=38;5;9:*.t7z=38;5;9:*.zip=38;5;9:*.z=38;5;9:*.Z=38;5;9:*.dz=38;5;9:*.gz=38;5;9:*.lrz=38;5;9:*.lz=38;5;9:*.lzo=38;5;9:*.xz=38;5;9:*.bz2=38;5;9:*.bz=38;5;9:*.tbz=38;5;9:*.tbz2=38;5;9:*.tz=38;5;9:*.deb=38;5;9:*.rpm=38;5;9:*.jar=38;5;9:*.war=38;5;9:*.ear=38;5;9:*.sar=38;5;9:*.rar=38;5;9:*.alz=38;5;9:*.ace=38;5;9:*.zoo=38;5;9:*.cpio=38;5;9:*.7z=38;5;9:*.rz=38;5;9:*.cab=38;5;9:*.jpg=38;5;13:*.jpeg=38;5;13:*.gif=38;5;13:*.bmp=38;5;13:*.pbm=38;5;13:*.pgm=38;5;13:*.ppm=38;5;13:*.tga=38;5;13:*.xbm=38;5;13:*.xpm=38;5;13:*.tif=38;5;13:*.tiff=38;5;13:*.png=38;5;13:*.svg=38;5;13:*.svgz=38;5;13:*.mng=38;5;13:*.pcx=38;5;13:*.mov=38;5;13:*.mpg=38;5;13:*.mpeg=38;5;13:*.m2v=38;5;13:*.mkv=38;5;13:*.webm=38;5;13:*.ogm=38;5;13:*.mp4=38;5;13:*.m4v=38;5;13:*.mp4v=38;5;13:*.vob=38;5;13:*.qt=38;5;13:*.nuv=38;5;13:*.wmv=38;5;13:*.asf=38;5;13:*.rm=38;5;13:*.rmvb=38;5;13:*.flc=38;5;13:*.avi=38;5;13:*.fli=38;5;13:*.flv=38;5;13:*.gl=38;5;13:*.dl=38;5;13:*.xcf=38;5;13:*.xwd=38;5;13:*.yuv=38;5;13:*.cgm=38;5;13:*.emf=38;5;13:*.axv=38;5;13:*.anx=38;5;13:*.ogv=38;5;13:*.ogx=38;5;13:*.aac=38;5;45:*.au=38;5;45:*.flac=38;5;45:*.mid=38;5;45:*.midi=38;5;45:*.mka=38;5;45:*.mp3=38;5;45:*.mpc=38;5;45:*.ogg=38;5;45:*.ra=38;5;45:*.wav=38;5;45:*.axa=38;5;45:*.oga=38;5;45:*.spx=38;5;45:*.xspf=38;5;45:", "MAIL=/var/spool/mail/test", "PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/test/.local/bin:/home/test/bin", "PWD=/home/test", "LANG=en_US.UTF-8", "HISTCONTROL=ignoredups", "SHLVL=1", "HOME=/home/test", "LOGNAME=test", "LESSOPEN=||/usr/bin/lesspipe.sh %s", "_=/bin/strace"]) = 0 <0.000539>
>19537 11:52:40 brk(NULL)                = 0x55e20d62e000 <0.000012>
>19537 11:52:40 fcntl(0, F_GETFD)        = 0 <0.000017>
>19537 11:52:40 fcntl(1, F_GETFD)        = 0 <0.000014>
>19537 11:52:40 fcntl(2, F_GETFD)        = 0 <0.000013>
>19537 11:52:40 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory) <0.000021>
>19537 11:52:40 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e7211000 <0.000023>
>19537 11:52:40 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) <0.000016>
>19537 11:52:40 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000026>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=8497766, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=53930, st_atime=2018/06/12-14:10:01.048597387, st_mtime=2018/06/06-14:09:49.852092884, st_ctime=2018/06/06-14:09:49.852092884}) = 0 <0.000018>
>19537 11:52:40 mmap(NULL, 53930, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fb7e7203000 <0.000022>
>19537 11:52:40 close(3)                 = 0 <0.000018>
>19537 11:52:40 open("/lib64/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3 <0.000031>
>19537 11:52:40 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\230\226\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0!\0 \0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\310s\0\0\0\0\0\0\310s\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\200}\0\0\0\0\0\0\200} \0\0\0\0\0\200} \0\0\0\0\0@\3\0\0\0\0\0\0\240\344\2\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240}\0\0\0\0\0\0\240} \0\0\0\0\0\240} \0\0\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\300l\0\0\0\0\0\0\300l\0\0\0\0\0\0\300l\0\0\0\0\0\0\254\0\0\0\0\0\0\0\254\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\200}\0\0\0\0\0\0\200} \0\0\0\0\0\200} \0\0\0\0\0\200\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\7\242\20\315t\5\\\367\241\360U\rV\321\37\240\3\0\205m\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0 \0\0\0\0\0\0\0\17\0\0\0\36\0\0\0\1\0\0\0\6\0\0\0\4I\300,$\204 \f\0\0\0\0\0\0\0\0\0\0\0\0\36\0\0\0\37\0\0\0 \0\0\0\0\0\0\0!\0\0\0\"\0\0\0\0\0\0\0#\0\0\0\0\0\0\0$\0\0\0%\0\0\0\0\0\0\0k\31Qj\233(\375B\233`\205\33\327\16?\17I->\333\235C\r\375\313\373_\22\273\25sB\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0q\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0)\1\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0i\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\0\0\0\26\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\246\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", 832) = 832 <0.000019>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=65687, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=80, st_size=40664, st_atime=2018/06/13-07:10:01.297454232, st_mtime=2018/02/05-21:09:07, st_ctime=2018/05/30-07:09:13.567599555}) = 0 <0.000018>
>19537 11:52:40 mmap(NULL, 2318880, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb7e6dba000 <0.000035>
>19537 11:52:40 mprotect(0x7fb7e6dc2000, 2093056, PROT_NONE) = 0 <0.000026>
>19537 11:52:40 mmap(0x7fb7e6fc1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7fb7e6fc1000 <0.000031>
>19537 11:52:40 mmap(0x7fb7e6fc3000, 184864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb7e6fc3000 <0.000024>
>19537 11:52:40 close(3)                 = 0 <0.000018>
>19537 11:52:40 open("/lib64/libutil.so.1", O_RDONLY|O_CLOEXEC) = 3 <0.000033>
>19537 11:52:40 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\16\0\0\0\0\0\0@\0\0\0\0\0\0\0`0\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0!\0 \0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\33\0\0\0\0\0\0|\33\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240\35\0\0\0\0\0\0\240\35 \0\0\0\0\0\240\35 \0\0\0\0\0X\3\0\0\0\0\0\0`\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\300\35\0\0\0\0\0\0\300\35 \0\0\0\0\0\300\35 \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\220\27\0\0\0\0\0\0\220\27\0\0\0\0\0\0\220\27\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\240\35\0\0\0\0\0\0\240\35 \0\0\0\0\0\240\35 \0\0\0\0\0`\2\0\0\0\0\0\0`\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\213+\237\215\306\376/\21\355\336 X\5\257`\213(B\377Y\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0 \0\0\0\0\0\0\0\n\0\0\0#\0\0\0\1\0\0\0\6\0\0\0\200\200@\300\4 \24D\0\0\0\0\0\0\0\0#\0\0\0$\0\0\0%\0\0\0\0\0\0\0&\0\0\0(\0\0\0)\0\0\0\0\0\0\0\365\361\253\272\217\365\310\207\237<\300|\364\243\343p\277\370\337\17_+\337\v\273\25sB\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\234\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0w\1\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0[\1\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\0\0\0\26\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0o\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\262\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", 832) = 832 <0.000021>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=934173, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=32, st_size=14496, st_atime=2018/06/12-12:28:08.691517720, st_mtime=2018/02/05-21:09:06, st_ctime=2018/05/30-07:09:13.670598729}) = 0 <0.000017>
>19537 11:52:40 mmap(NULL, 2105600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb7e6bb7000 <0.000047>
>19537 11:52:40 mprotect(0x7fb7e6bb9000, 2093056, PROT_NONE) = 0 <0.000028>
>19537 11:52:40 mmap(0x7fb7e6db8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7fb7e6db8000 <0.000027>
>19537 11:52:40 close(3)                 = 0 <0.000019>
>19537 11:52:40 open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 <0.000029>
>19537 11:52:40 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340$\2\0\0\0\0\0@\0\0\0\0\0\0\0\230\302 \0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0L\0K\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\20\341\30\0\0\0\0\0\20\341\30\0\0\0\0\0\20\341\30\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\370%\34\0\0\0\0\0\370%\34\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0 '\34\0\0\0\0\0 '<\0\0\0\0\0 '<\0\0\0\0\0\200Q\0\0\0\0\0\0\300\232\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\200[\34\0\0\0\0\0\200[<\0\0\0\0\0\200[<\0\0\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0p\2\0\0\0\0\0\0p\2\0\0\0\0\0\0p\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0 '\34\0\0\0\0\0 '<\0\0\0\0\0 '<\0\0\0\0\0\20\0\0\0\0\0\0\0\240\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0P\345td\4\0\0\0,\341\30\0\0\0\0\0,\341\30\0\0\0\0\0,\341\30\0\0\0\0\0\264j\0\0\0\0\0\0\264j\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0 '\34\0\0\0\0\0 '<\0\0\0\0\0 '<\0\0\0\0\0\3408\0\0\0\0\0\0\3408\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\205\352\n\345Y\265:\266\r\205H$,\355\320\350?H\26\332\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0 \0\0\0\0\0\0\0\363\3\0\0\7\0\0\0\0\1\0\0\16\0\0\0\0000\20D\240 \2\1\210\3\346\220\305E\214\0\300\0\10\0\5\200\0`\300\200\0\r\212\f\0\4\20\0\210D2\10.@\210T<, \0162H&\204\300\214\4\10\0\2\2\16\241\254\32\4f\300\0\3002\0\300\0P\1 \201\10\204\v  ($\0\4 Z\0\20X\200\312DB(\0\6\200\20\30B\0 @\200\0\tP\0Q\212@\20\0\0\0\0\10\0\0\21\20", 832) = 832 <0.000013>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=65683, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=4208, st_size=2151832, st_atime=2018/06/13-07:10:01.354453780, st_mtime=2018/02/05-21:09:07, st_ctime=2018/05/30-07:09:13.556599643}) = 0 <0.000012>
>19537 11:52:40 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e7202000 <0.000014>
>19537 11:52:40 mmap(NULL, 3981792, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb7e67ea000 <0.000015>
>19537 11:52:40 mprotect(0x7fb7e69ad000, 2093056, PROT_NONE) = 0 <0.000023>
>19537 11:52:40 mmap(0x7fb7e6bac000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c2000) = 0x7fb7e6bac000 <0.000019>
>19537 11:52:40 mmap(0x7fb7e6bb2000, 16864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb7e6bb2000 <0.000015>
>19537 11:52:40 close(3)                 = 0 <0.000012>
>19537 11:52:40 open("/lib64/libfreebl3.so", O_RDONLY|O_CLOEXEC) = 3 <0.000020>
>19537 11:52:40 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\v\0\0\0\0\0\0@\0\0\0\0\0\0\0x%\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\35\0\34\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\24\0\0\0\0\0\0|\24\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\250\35\0\0\0\0\0\0\250\35 \0\0\0\0\0\250\35 \0\0\0\0\0\340\2\0\0\0\0\0\0\10\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\310\35\0\0\0\0\0\0\310\35 \0\0\0\0\0\310\35 \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\350\21\0\0\0\0\0\0\350\21\0\0\0\0\0\0\350\21\0\0\0\0\0\0t\0\0\0\0\0\0\0t\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\250\35\0\0\0\0\0\0\250\35 \0\0\0\0\0\250\35 \0\0\0\0\0X\2\0\0\0\0\0\0X\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\267X\210\37Kj\366\302\214\7\241\245w\23\313\322\24F(\324\0\0\0\0\3\0\0\0\24\0\0\0\1\0\0\0\6\0\0\0\241\210\31\21@\2\313`\24\0\0\0\31\0\0\0\34\0\0\0\30\274\342\374\320\223@\334\260y\0\362\304\214\267\3467\247\300\312<0?\347J\3178\252?u\4X\322\263\222r\346m\204\214GJ)\252\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\206\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0q\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\262\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0i\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\231\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\251\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", 832) = 832 <0.000017>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=40884, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=24, st_size=11448, st_atime=2018/06/13-07:10:01.297454232, st_mtime=2018/03/19-20:01:03, st_ctime=2018/05/30-07:09:06.383657139}) = 0 <0.000014>
>19537 11:52:40 mmap(NULL, 2105520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb7e65e7000 <0.000017>
>19537 11:52:40 mprotect(0x7fb7e65e9000, 2093056, PROT_NONE) = 0 <0.000018>
>19537 11:52:40 mmap(0x7fb7e67e8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7fb7e67e8000 <0.000023>
>19537 11:52:40 close(3)                 = 0 <0.000012>
>19537 11:52:40 open("/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3 <0.000030>
>19537 11:52:40 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\r\0\0\0\0\0\0@\0\0\0\0\0\0\0\30C\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0!\0 \0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\37\0\0\0\0\0\0\4\37\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0X-\0\0\0\0\0\0X- \0\0\0\0\0X- \0\0\0\0\0\20\3\0\0\0\0\0\0\270\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\210-\0\0\0\0\0\0\210- \0\0\0\0\0\210- \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0@\31\0\0\0\0\0\0@\31\0\0\0\0\0\0@\31\0\0\0\0\0\0\274\0\0\0\0\0\0\0\274\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0X-\0\0\0\0\0\0X- \0\0\0\0\0X- \0\0\0\0\0\250\2\0\0\0\0\0\0\250\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\204\36#\212\23}\215\364\216\367\246\34\357\352K\10\221H0\304\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0 \0\0\0\0\0\0\0\33\0\0\0\32\0\0\0\2\0\0\0\7\0\0\0\230\2\21\0\200H\0\4\22\0\0@\203(\10\236\32\0\0\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\35\0\0\0\0\0\0\0\36\0\0\0\0\0\0\0\37\0\0\0\0\0\0\0 \0\0\0\"\0\0\0#\0\0\0%\0\0\0&\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0'\0\0\0\0\0\0\0\0\0\0\0\353\26\251\30a\257\0\371\301S\200\30\273\25sB\257\304M\17\221!\374\370\6\2\4\371\3733\373\17\371\31sB\372\31sB\225\263_\31\177\236\320\30a\242\222\6\5\350\7\371\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0=\1\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\375\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\337\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0 \0\0\0", 832) = 832 <0.000017>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=527264, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=40, st_size=19288, st_atime=2018/06/13-07:10:01.354453780, st_mtime=2018/02/05-21:09:06, st_ctime=2018/05/30-07:09:13.569599539}) = 0 <0.000014>
>19537 11:52:40 mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb7e63e3000 <0.000017>
>19537 11:52:40 mprotect(0x7fb7e63e5000, 2097152, PROT_NONE) = 0 <0.000020>
>19537 11:52:40 mmap(0x7fb7e65e5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fb7e65e5000 <0.000016>
>19537 11:52:40 close(3)                 = 0 <0.000011>
>19537 11:52:40 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e7201000 <0.000013>
>19537 11:52:40 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e71ff000 <0.000012>
>19537 11:52:40 arch_prctl(ARCH_SET_FS, 0x7fb7e71ff740) = 0 <0.000040>
>19537 11:52:40 mprotect(0x7fb7e6bac000, 16384, PROT_READ) = 0 <0.000018>
>19537 11:52:40 mprotect(0x7fb7e65e5000, 4096, PROT_READ) = 0 <0.000019>
>19537 11:52:40 mprotect(0x7fb7e67e8000, 4096, PROT_READ) = 0 <0.000020>
>19537 11:52:40 mprotect(0x7fb7e6db8000, 4096, PROT_READ) = 0 <0.000016>
>19537 11:52:40 mprotect(0x7fb7e6fc1000, 4096, PROT_READ) = 0 <0.000014>
>19537 11:52:40 mprotect(0x55e20b841000, 4096, PROT_READ) = 0 <0.000014>
>19537 11:52:40 mprotect(0x7fb7e7212000, 4096, PROT_READ) = 0 <0.000017>
>19537 11:52:40 munmap(0x7fb7e7203000, 53930) = 0 <0.000025>
>19537 11:52:40 brk(NULL)                = 0x55e20d62e000 <0.000011>
>19537 11:52:40 brk(0x55e20d64f000)      = 0x55e20d64f000 <0.000013>
>19537 11:52:40 brk(NULL)                = 0x55e20d64f000 <0.000011>
>19537 11:52:40 socket(AF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 <0.000046>
>19537 11:52:40 connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) <0.000033>
>19537 11:52:40 close(3)                 = 0 <0.000016>
>19537 11:52:40 socket(AF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 <0.000014>
>19537 11:52:40 connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) <0.000029>
>19537 11:52:40 close(3)                 = 0 <0.000014>
>19537 11:52:40 open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3 <0.000024>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=8480154, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=1975, st_atime=2018/06/12-12:28:08.707517592, st_mtime=2018/05/30-07:10:55.478782659, st_ctime=2018/05/30-07:10:55.478782659}) = 0 <0.000016>
>19537 11:52:40 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e7210000 <0.000019>
>19537 11:52:40 read(3, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previous entry turned\n# up nothing. Note that if the search failed due to some other reason\n# (like no NIS server responding) then the search continues with the\n# next entry.\n#\n# Valid entries include:\n#\n#\tnisplus\t\t\tUse NIS+ (NIS version 3)\n#\tnis\t\t\tUse NIS (NIS version 2), also called YP\n#\tdns\t\t\tUse DNS (Domain Name Service)\n#\tfiles\t\t\tUse the local files\n#\tdb\t\t\tUse the local database (.db) files\n#\tcompat\t\t\tUse NIS on compat mode\n#\thesiod\t\t\tUse Hesiod for user lookups\n#\t[NOTFOUND=return]\tStop searching if not found so far\n#\n\n# To use db, put the \"db\" in front of \"files\" for entries you want to be\n# looked up first in the databases\n#\n# Example:\n#passwd:    db files nisplus nis\n#shadow:    db files nisplus nis\n#group:     db files nisplus nis\n\npasswd:     files sss\nshadow:     files sss\ngroup:      files sss\n#initgroups: files\n\n#hosts:     db files nisplus nis dns\nhosts:       files mdns4_minimal [NOTFOUND=return] dns\n#hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname\n#hosts:      files mdns [NOTFOUND=return] resolve [!UNAVAIL=return] dns\n#hosts:\t    files dns\n#hosts:     files mdns4_minimal [NOTFOUND=return] dns myhostname\n\n# Example - obey only what nisplus tells us...\n#services:   nisplus [NOTFOUND=return] files\n#networks:   nisplus [NOTFOUND=return] files\n#protocols:  nisplus [NOTFOUND=return] files\n#rpc:        nisplus [NOTFOUND=return] files\n#ethers:     nisplus [NOTFOUND=return] files\n#netmasks:   nisplus [NOTFOUND=return] files     \n\nbootparams: nisplus [NOTFOUND=return] files\n\nethers:     files\nnetmasks:   files\nnetworks:   files\nprotocols:  files\nrpc:        files\nservices:   files sss\n\nnetgroup:   files sss\n\npublickey:  nisplus\n\nautomount:  files\naliases:    files nisplus\n\n", 4096) = 1975 <0.000025>
>19537 11:52:40 read(3, "", 4096)        = 0 <0.000012>
>19537 11:52:40 close(3)                 = 0 <0.000014>
>19537 11:52:40 munmap(0x7fb7e7210000, 4096) = 0 <0.000019>
>19537 11:52:40 open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000015>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=8497766, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=112, st_size=53930, st_atime=2018/06/12-14:10:01.048597387, st_mtime=2018/06/06-14:09:49.852092884, st_ctime=2018/06/06-14:09:49.852092884}) = 0 <0.000011>
>19537 11:52:40 mmap(NULL, 53930, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fb7e7203000 <0.000015>
>19537 11:52:40 close(3)                 = 0 <0.000011>
>19537 11:52:40 open("/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3 <0.000020>
>19537 11:52:40 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000!\0\0\0\0\0\0@\0\0\0\0\0\0\0x\350\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0!\0 \0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\262\0\0\0\0\0\0(\262\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\200\275\0\0\0\0\0\0\200\275 \0\0\0\0\0\200\275 \0\0\0\0\0\270\3\0\0\0\0\0\0\330j\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\275\0\0\0\0\0\0\240\275 \0\0\0\0\0\240\275 \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0\310\1\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0X\225\0\0\0\0\0\0X\225\0\0\0\0\0\0X\225\0\0\0\0\0\0\224\2\0\0\0\0\0\0\224\2\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0R\345td\4\0\0\0\200\275\0\0\0\0\0\0\200\275 \0\0\0\0\0\200\275 \0\0\0\0\0\200\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0002\322\256\311\230\7\2\263\210\276\232x\22\203\7\306W\366\2r\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0 \0\0\0\0\0\0\0k\0\0\0.\0\0\0\10\0\0\0\t\0\0\0\22F\344\25\240\245\201\0\t\10\0028\223\6\310\0\0\0z\0]\201\240Jx\2108*\220\200\0$\7!\5\24)\"\226<\0\4\0\33\0\20\2\0\0@\10\201\3100\200\200B@\206\0\302\0\200\300.\0\0\0/\0\0\0\0\0\0\0000\0\0\0001\0\0\0002\0\0\0003\0\0\0004\0\0\0\0\0\0\0005\0\0\0\0\0\0\0006\0\0\0008\0\0\0009\0\0\0\0\0\0\0;\0\0\0\0\0\0\0=\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\0\0\0@\0\0\0\0\0\0\0A\0\0\0C\0\0\0\0\0\0\0D\0\0\0E\0\0\0F\0\0\0G\0\0\0\0\0\0\0I\0\0\0J\0\0\0K\0\0\0\0\0\0\0\0\0\0\0L\0\0\0M\0\0\0N\0\0\0\0\0\0\0O\0\0\0P\0\0\0\0\0\0\0\0\0\0\0Q\0\0\0R\0\0\0\0\0\0\0T\0\0\0U\0\0\0\0\0\0\0V\0\0\0\0\0\0\0", 832) = 832 <0.000012>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=527280, st_mode=S_IFREG|0755, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=128, st_size=61624, st_atime=2018/06/12-12:28:08.707517592, st_mtime=2018/02/05-21:09:06, st_ctime=2018/05/30-07:09:13.642598953}) = 0 <0.000021>
>19537 11:52:40 mmap(NULL, 2173016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb7e61d0000 <0.000017>
>19537 11:52:40 mprotect(0x7fb7e61dc000, 2093056, PROT_NONE) = 0 <0.000018>
>19537 11:52:40 mmap(0x7fb7e63db000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7fb7e63db000 <0.000018>
>19537 11:52:40 mmap(0x7fb7e63dd000, 22616, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb7e63dd000 <0.000015>
>19537 11:52:40 close(3)                 = 0 <0.000011>
>19537 11:52:40 mprotect(0x7fb7e63db000, 4096, PROT_READ) = 0 <0.000018>
>19537 11:52:40 munmap(0x7fb7e7203000, 53930) = 0 <0.000023>
>19537 11:52:40 open("/etc/services", O_RDONLY|O_CLOEXEC) = 3 <0.000025>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=8389601, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=1312, st_size=670293, st_atime=2018/06/12-13:11:50.090686914, st_mtime=2013/06/07-20:01:32, st_ctime=2018/05/30-07:09:03.638679143}) = 0 <0.000012>
>19537 11:52:40 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e7210000 <0.000014>
>19537 11:52:40 read(3, "# /etc/services:\n# $Id: services,v 1.55 2013/04/14 ovasik Exp $\n#\n# Network services, Internet style\n# IANA services version: last updated 2013-04-10\n#\n# Note that it is presently the policy of IANA to assign a single well-known\n# port number for both TCP and UDP; hence, most entries here have two entries\n# even if the protocol doesn't support UDP operations.\n# Updated from RFC 1700, ``Assigned Numbers'' (October 1994).  Not all ports\n# are included, only the more common ones.\n#\n# The latest IANA port assignments can be gotten from\n#       http://www.iana.org/assignments/port-numbers\n# The Well Known Ports are those from 0 through 1023.\n# The Registered Ports are those from 1024 through 49151\n# The Dynamic and/or Private Ports are those from 49152 through 65535\n#\n# Each line describes one service, and is of the form:\n#\n# service-name  port/protocol  [aliases ...]   [# comment]\n\ntcpmux          1/tcp                           # TCP port service multiplexer\ntcpmux          1/udp                           # TCP port service multiplexer\nrje             5/tcp                           # Remote Job Entry\nrje             5/udp                           # Remote Job Entry\necho            7/tcp\necho            7/udp\ndiscard         9/tcp           sink null\ndiscard         9/udp           sink null\nsystat          11/tcp          users\nsystat          11/udp          users\ndaytime         13/tcp\ndaytime         13/udp\nqotd            17/tcp          quote\nqotd            17/udp          quote\nmsp             18/tcp                          # message send protocol (historic)\nmsp             18/udp                          # message send protocol (historic)\nchargen         19/tcp          ttytst source\nchargen         19/udp          ttytst source\nftp-data        20/tcp\nftp-data        20/udp\n# 21 is registered to ftp, but also used by fsp\nftp             21/tcp\nftp             21/udp          fsp fspd\nssh             22/tcp                          # The Secure Shell (SSH) Protocol\nssh             22/udp                          # The Secure Shell (SSH) Protocol\ntelnet          23/tcp\ntelnet          23/udp\n# 24 - private mail system\nlmtp            24/tcp                          # LMTP Mail Delivery\nlmtp            24/udp                          # LMTP Mail Delivery\nsmtp            25/tcp          mail\nsmtp            25/udp          mail\ntime            37/tcp          timserver\ntime            37/udp          timserver\nrlp             39/tcp          resource        # resource location\nrlp             39/udp          resource        # resource location\nnameserver      42/tcp          name            # IEN 116\nnameserver      42/udp          name            # IEN 116\nnicname         43/tcp          whois\nnicname         43/udp          whois\ntacacs          49/tcp                          # Login Host Protocol (TACACS)\ntacacs          49/udp                          # Login Host Protocol (TACACS)\nre-mail-ck      50/tcp                          # Remote Mail Checking Protocol\nre-mail-ck      50/udp                          # Remote Mail Checking Protocol\ndomain          53/tcp                          # name-domain server\ndomain          53/udp\nwhois++         63/tcp          whoispp\nwhois++         63/udp          whoispp\nbootps          67/tcp                          # BOOTP server\nbootps          67/udp\nbootpc          68/tcp          dhcpc           # BOOTP client\nbootpc          68/udp          dhcpc\ntftp            69/tcp\ntftp            69/udp\ngopher          70/tcp                          # Internet Gopher\ngopher          70/udp\nnetrjs-1        71/tcp                          # Remote Job Service\nnetrjs-1        71/udp                          # Remote Job Service\nnetrjs-2        72/tcp                          # Remote Job Service\nnetrjs-2        72/udp                          # Remote Job Service\nnetrjs-3        73/tcp                          # Remote Job Service\nnetrjs-3        73/udp                          # Remote Job Service\nnetrjs-4        74/tcp                          # Remote Job Service\nnetrjs-4       ", 4096) = 4096 <0.000017>
>19537 11:52:40 read(3, " 74/udp                          # Remote Job Service\nfinger          79/tcp\nfinger          79/udp\nhttp            80/tcp          www www-http    # WorldWideWeb HTTP\nhttp            80/udp          www www-http    # HyperText Transfer Protocol\nhttp            80/sctp                         # HyperText Transfer Protocol\nkerberos        88/tcp          kerberos5 krb5  # Kerberos v5\nkerberos        88/udp          kerberos5 krb5  # Kerberos v5\nsupdup          95/tcp\nsupdup          95/udp\nhostname        101/tcp         hostnames       # usually from sri-nic\nhostname        101/udp         hostnames       # usually from sri-nic\niso-tsap        102/tcp         tsap            # part of ISODE.\ncsnet-ns        105/tcp         cso             # also used by CSO name server\ncsnet-ns        105/udp         cso\n# unfortunately the poppassd (Eudora) uses a port which has already\n# been assigned to a different service. We list the poppassd as an\n# alias here. This should work for programs asking for this service.\n# (due to a bug in inetd the 3com-tsmux line is disabled)\n#3com-tsmux     106/tcp         poppassd\n#3com-tsmux     106/udp         poppassd\nrtelnet         107/tcp                         # Remote Telnet\nrtelnet         107/udp\npop2            109/tcp         pop-2 postoffice        # POP version 2\npop2            109/udp         pop-2\npop3            110/tcp         pop-3           # POP version 3\npop3            110/udp         pop-3\nsunrpc          111/tcp         portmapper rpcbind      # RPC 4.0 portmapper TCP\nsunrpc          111/udp         portmapper rpcbind      # RPC 4.0 portmapper UDP\nauth            113/tcp         authentication tap ident\nauth            113/udp         authentication tap ident\nsftp            115/tcp\nsftp            115/udp\nuucp-path       117/tcp\nuucp-path       117/udp\nnntp            119/tcp         readnews untp   # USENET News Transfer Protocol\nnntp            119/udp         readnews untp   # USENET News Transfer Protocol\nntp             123/tcp\nntp             123/udp                         # Network Time Protocol\nnetbios-ns      137/tcp                         # NETBIOS Name Service\nnetbios-ns      137/udp\nnetbios-dgm     138/tcp                         # NETBIOS Datagram Service\nnetbios-dgm     138/udp\nnetbios-ssn     139/tcp                         # NETBIOS session service\nnetbios-ssn     139/udp\nimap            143/tcp         imap2           # Interim Mail Access Proto v2\nimap            143/udp         imap2\nsnmp            161/tcp                         # Simple Net Mgmt Proto\nsnmp            161/udp                         # Simple Net Mgmt Proto\nsnmptrap        162/tcp                         # SNMPTRAP\nsnmptrap        162/udp         snmp-trap       # Traps for SNMP\ncmip-man        163/tcp                         # ISO mgmt over IP (CMOT)\ncmip-man        163/udp\ncmip-agent      164/tcp\ncmip-agent      164/udp\nmailq           174/tcp                         # MAILQ\nmailq           174/udp                         # MAILQ\nxdmcp           177/tcp                         # X Display Mgr. Control Proto\nxdmcp           177/udp\nnextstep        178/tcp         NeXTStep NextStep       # NeXTStep window\nnextstep        178/udp         NeXTStep NextStep       # server\nbgp             179/tcp                         # Border Gateway Proto.\nbgp             179/udp\nbgp             179/sctp\nprospero        191/tcp                         # Cliff Neuman's Prospero\nprospero        191/udp\nirc             194/tcp                         # Internet Relay Chat\nirc             194/udp\nsmux            199/tcp                         # SNMP Unix Multiplexer\nsmux            199/udp\nat-rtmp         201/tcp                         # AppleTalk routing\nat-rtmp         201/udp\nat-nbp          202/tcp                         # AppleTalk name binding\nat-nbp          202/udp\nat-echo         204/tcp                         # AppleTalk echo\nat-echo         204/udp\nat-zis          206/tcp                         # AppleTalk zone information\nat-zis          206/udp\nqmtp            209/tcp                    ", 4096) = 4096 <0.000013>
>19537 11:52:40 read(3, "     # Quick Mail Transfer Protocol\nqmtp            209/udp                         # Quick Mail Transfer Protocol\nz39.50          210/tcp         z3950 z39-50 wais      # NISO Z39.50 database\nz39.50          210/udp         z3950 z39-50 wais\nipx             213/tcp                         # IPX\nipx             213/udp\nimap3           220/tcp                         # Interactive Mail Access\nimap3           220/udp                         # Protocol v3\nlink            245/tcp         ttylink\nlink            245/udp         ttylink\ngist            270/udp                         # Q-mode encapsulation for GIST messages\nfatserv         347/tcp                         # Fatmen Server\nfatserv         347/udp                         # Fatmen Server\nrsvp_tunnel     363/tcp         rsvp-tunnel\nrsvp_tunnel     363/udp         rsvp-tunnel\nodmr            366/tcp                         # odmr required by fetchmail\nodmr            366/udp                         # odmr required by fetchmail\nrpc2portmap     369/tcp\nrpc2portmap     369/udp                         # Coda portmapper\ncodaauth2       370/tcp\ncodaauth2       370/udp                         # Coda authentication server\nulistproc       372/tcp         ulistserv       # UNIX Listserv\nulistproc       372/udp         ulistserv\nldap            389/tcp\nldap            389/udp\nosb-sd          400/tcp                         # Oracle Secure Backup\nosb-sd          400/udp                         # Oracle Secure Backup\nsvrloc          427/tcp                         # Server Location Protocl\nsvrloc          427/udp                         # Server Location Protocl\nmobileip-agent  434/tcp\nmobileip-agent  434/udp\nmobilip-mn      435/tcp\nmobilip-mn      435/udp\nhttps           443/tcp                         # http protocol over TLS/SSL\nhttps           443/udp                         # http protocol over TLS/SSL\nhttps           443/sctp                        # http protocol over TLS/SSL\nsnpp            444/tcp                         # Simple Network Paging Protocol\nsnpp            444/udp                         # Simple Network Paging Protocol\nmicrosoft-ds    445/tcp\nmicrosoft-ds    445/udp\nkpasswd         464/tcp         kpwd            # Kerberos \"passwd\"\nkpasswd         464/udp         kpwd            # Kerberos \"passwd\"\nphoturis        468/tcp\nphoturis        468/udp\nsaft            487/tcp                         # Simple Asynchronous File Transfer\nsaft            487/udp                         # Simple Asynchronous File Transfer\ngss-http        488/tcp\ngss-http        488/udp\npim-rp-disc     496/tcp\npim-rp-disc     496/udp\nisakmp          500/tcp\nisakmp          500/udp\ngdomap          538/tcp                         # GNUstep distributed objects\ngdomap          538/udp                         # GNUstep distributed objects\niiop            535/tcp\niiop            535/udp\ndhcpv6-client   546/tcp\ndhcpv6-client   546/udp\ndhcpv6-server   547/tcp\ndhcpv6-server   547/udp\nrtsp            554/tcp                         # Real Time Stream Control Protocol\nrtsp            554/udp                         # Real Time Stream Control Protocol\nnntps           563/tcp                         # NNTP over SSL\nnntps           563/udp                         # NNTP over SSL\nwhoami          565/tcp\nwhoami          565/udp\nsubmission      587/tcp         msa             # mail message submission\nsubmission      587/udp         msa             # mail message submission\nnpmp-local      610/tcp         dqs313_qmaster  # npmp-local / DQS\nnpmp-local      610/udp         dqs313_qmaster  # npmp-local / DQS\nnpmp-gui        611/tcp         dqs313_execd    # npmp-gui / DQS\nnpmp-gui        611/udp         dqs313_execd    # npmp-gui / DQS\nhmmp-ind        612/tcp         dqs313_intercell # HMMP Indication / DQS\nhmmp-ind        612/udp         dqs313_intercell # HMMP Indication / DQS\nipp             631/tcp                         # Internet Printing Protocol\nipp             631/udp                         # Internet Printing Protocol\nldaps           636/tcp                         # LDAP over SSL\nldaps       ", 4096) = 4096 <0.000013>
>19537 11:52:40 read(3, "    636/udp                         # LDAP over SSL\nacap            674/tcp\nacap            674/udp\nha-cluster      694/tcp                         # Heartbeat HA-cluster\nha-cluster      694/udp                         # Heartbeat HA-cluster\nkerberos-adm    749/tcp                         # Kerberos `kadmin' (v5)\nkerberos-adm    749/udp                         # kerberos administration\nkerberos-iv     750/udp         kerberos4 kerberos-sec kdc loadav\nkerberos-iv     750/tcp         kerberos4 kerberos-sec kdc rfile\nwebster         765/tcp                         # Network dictionary\nwebster         765/udp\nphonebook       767/tcp                         # Network phonebook\nphonebook       767/udp\nrsync           873/tcp                         # rsync\nrsync           873/udp                         # rsync\n#rquotad unreserved in IANA!\nrquotad         875/tcp                         # rquota daemon\n#rquotad unreserved in IANA!\nrquotad         875/udp                         # rquota daemon\ntelnets         992/tcp\ntelnets         992/udp\nimaps           993/tcp                         # IMAP over SSL\nimaps           993/udp                         # IMAP over SSL\npop3s           995/tcp                         # POP-3 over SSL\npop3s           995/udp                         # POP-3 over SSL\n\n#\n# UNIX specific services\n#\nexec            512/tcp\nbiff            512/udp         comsat\nlogin           513/tcp\nwho             513/udp         whod\nshell           514/tcp         cmd             # no passwords used\nsyslog          514/udp\nprinter         515/tcp         spooler         # line printer spooler\nprinter         515/udp         spooler         # line printer spooler\ntalk            517/udp\nntalk           518/udp\nutime           519/tcp         unixtime\nutime           519/udp         unixtime\nefs             520/tcp\nrouter          520/udp         route routed    # RIP\nripng           521/tcp\nripng           521/udp\ntimed           525/tcp         timeserver\ntimed           525/udp         timeserver\ntempo           526/tcp         newdate\ncourier         530/tcp         rpc\nconference      531/tcp         chat\nnetnews         532/tcp\nnetwall         533/udp                         # -for emergency broadcasts\nuucp            540/tcp         uucpd           # uucp daemon\nklogin          543/tcp                         # Kerberized `rlogin' (v5)\nkshell          544/tcp         krcmd           # Kerberized `rsh' (v5)\nafpovertcp      548/tcp                         # AFP over TCP\nafpovertcp      548/udp                         # AFP over TCP\nremotefs        556/tcp         rfs_server rfs  # Brunhoff remote filesystem\n\n#\n# From ``PORT NUMBERS'':\n#\n#>REGISTERED PORT NUMBERS\n#>\n#>The Registered Ports are listed by the IANA and on most systems can be\n#>used by ordinary user processes or programs executed by ordinary\n#>users.\n#>\n#>Ports are used in the TCP [RFC793] to name the ends of logical\n#>connections which carry long term conversations.  For the purpose of\n#>providing services to unknown callers, a service contact port is\n#>defined.  This list specifies the port used by the server process as\n#>its contact port.\n#>\n#>The IANA registers uses of these ports as a convienence to the\n#>community.\n#\nsocks           1080/tcp                        # socks proxy server\nsocks           1080/udp                        # socks proxy server\n\n# Port 1236 is registered as `bvcontrol', but is also used by the\n# Gracilis Packeten remote config server.  The official name is listed as\n# the primary name, with the unregistered name as an alias.\nbvcontrol       1236/tcp        rmtcfg          # Daniel J. Walsh, Gracilis Packeten remote config server\nbvcontrol       1236/udp                        # Daniel J. Walsh\n\nh323hostcallsc  1300/tcp                        # H.323 Secure Call Control\nh323hostcallsc  1300/udp                        # H.323 Secure Call Control\nms-sql-s        1433/tcp                        # Microsoft-SQL-Server\nms-sql-s        1433/udp                        # Microsoft-SQL-Server\nms-sql-m        1434/tcp              ", 4096) = 4096 <0.000014>
>19537 11:52:40 close(3)                 = 0 <0.000014>
>19537 11:52:40 munmap(0x7fb7e7210000, 4096) = 0 <0.000021>
>19537 11:52:40 getuid()                 = 1006 <0.000011>
>19537 11:52:40 socket(AF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 <0.000016>
>19537 11:52:40 connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) <0.000021>
>19537 11:52:40 close(3)                 = 0 <0.000015>
>19537 11:52:40 socket(AF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 <0.000017>
>19537 11:52:40 connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) <0.000019>
>19537 11:52:40 close(3)                 = 0 <0.000014>
>19537 11:52:40 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 <0.000016>
>19537 11:52:40 fstat(3, {st_dev=makedev(253, 0), st_ino=8788466, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=8, st_size=2980, st_atime=2018/06/12-20:56:01.629661236, st_mtime=2018/06/11-20:55:37.872122003, st_ctime=2018/06/11-20:55:37.874121987}) = 0 <0.000012>
>19537 11:52:40 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e7210000 <0.000013>
>19537 11:52:40 read(3, "root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\nmail:x:8:12:mail:/var/spool/mail:/sbin/nologin\noperator:x:11:0:operator:/root:/sbin/nologin\ngames:x:12:100:games:/usr/games:/sbin/nologin\nftp:x:14:50:FTP User:/var/ftp:/sbin/nologin\nnobody:x:99:99:Nobody:/:/sbin/nologin\nsystemd-bus-proxy:x:999:997:systemd Bus Proxy:/:/sbin/nologin\nsystemd-network:x:192:192:systemd Network Management:/:/sbin/nologin\ndbus:x:81:81:System message bus:/:/sbin/nologin\npolkitd:x:998:996:User for polkitd:/:/sbin/nologin\ntss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin\npostfix:x:89:89::/var/spool/postfix:/sbin/nologin\nsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin\nchrony:x:997:995::/var/lib/chrony:/sbin/nologin\nrsahoo:x:1000:1000:Ramesh Sahoo:/home/rsahoo:/bin/bash\ndovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/bin/bash\ndovenull:x:996:994:Dovecot's unauthorized user:/usr/libexec/dovecot:/sbin/nologin\napache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin\nntp:x:38:38::/etc/ntp:/sbin/nologin\nsaslauth:x:995:76:Saslauthd user:/run/saslauthd:/sbin/nologin\nimapproxy:x:1002:1002::/home/imapproxy:/sbin/nologin\ntcpdump:x:72:72::/:/sbin/nologin\nexim:x:93:93::/var/spool/exim:/sbin/nologin\nnginx:x:994:993:Nginx web server:/var/lib/nginx:/sbin/nologin\navahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin\ncolord:x:993:992:User for colord:/var/lib/colord:/sbin/nologin\nsssd:x:992:991:User for sssd:/:/sbin/nologin\nvsftpd:x:1003:1003::/data/ftp:/sbin/nologin\nnamed:x:25:25:Named:/var/named:/sbin/nologin\nadmin:x:1004:1004::/home/admin:/bin/bash\nruser1:x:1005:1005::/home/ruser1:/bin/bash\nnscd:x:28:28:NSCD Daemon:/:/sbin/nologin\nsquid:x:23:23::/var/spool/squid:/sbin/nologin\npcp:x:991:990:Performance Co-Pilot:/var/lib/pcp:/sbin/nologin\nident:x:98:98::/:/sbin/nologin\nunbound:x:990:989:Unbound DNS resolver:/etc/unbound:/sbin/nologin\ntest:x:1006:1007::/home/test:/bin/bash\nmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false\npostgres:x:26:26:PostgreSQL Server:/var/lib/pgsql:/bin/bash\npentaho:x:1007:1008::/home/pentaho:/bin/bash\nrupesh:x:1008:1009::/home/rupesh:/bin/bash\nsetroubleshoot:x:989:986::/var/lib/setroubleshoot:/sbin/nologin\nradiusd:x:95:95:radiusd user:/var/lib/radiusd:/sbin/nologin\nrowell:x:1009:1010::/home/rowell:/bin/bash\nlocaluser:x:1010:1011::/home/localuser:/bin/rbash\nramesh:x:1011:1012::/home/ramesh:/bin/bash\nrpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin\nrpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin\nnfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin\nmailnull:x:47:47::/var/spool/mqueue:/sbin/nologin\nsmmsp:x:51:51::/var/spool/mqueue:/sbin/nologin\nvpn1:x:1012:1014::/home/vpn1:/bin/bash\n", 4096) = 2980 <0.000016>
>19537 11:52:40 close(3)                 = 0 <0.000014>
>19537 11:52:40 munmap(0x7fb7e7210000, 4096) = 0 <0.000017>
>19537 11:52:40 rt_sigaction(SIGPIPE, {0x55e20b63f150, [PIPE], SA_RESTORER|SA_RESTART, 0x7fb7e6820280}, {SIG_DFL, [], 0}, 8) = 0 <0.000013>
>19537 11:52:40 getpid()                 = 19537 <0.000022>
>19537 11:52:40 rt_sigprocmask(SIG_BLOCK, [URG], [], 8) = 0 <0.000012>
>19537 11:52:40 socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 <0.000024>
>19537 11:52:40 bind(3, {sa_family=AF_INET, sin_port=htons(1023), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EACCES (Permission denied) <0.000013>
>19537 11:52:40 close(3)                 = 0 <0.000024>
>19537 11:52:40 write(2, "rcmd: socket: Permission denied\n", 32) = 32 <0.000148>
>19537 11:52:40 rt_sigprocmask(SIG_SETMASK, [], [URG], 8) = 0 <0.000012>
>19537 11:52:40 exit_group(1)            = ?
>19537 11:52:40 +++ exited with 1 +++

Actions: View

Attachments on bug 1590649: 1450799 | 1450800