11738 execve("/bin/su", ["su", "-"], [/* 30 vars */]) = 0 11738 brk(0) = 0x8f15000 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7731000 11738 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) 11738 open("/etc/ld.so.cache", O_RDONLY) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=17106, ...}) = 0 11738 mmap2(NULL, 17106, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb772c000 11738 close(3) = 0 11738 open("/lib/libpam_misc.so.0", O_RDONLY) = 3 11738 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\v\0\0004\0\0\0"..., 512) = 512 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=9712, ...}) = 0 11738 mmap2(NULL, 12436, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xba7000 11738 fadvise64(3, 0, 12436, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0xba9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0xba9000 11738 close(3) = 0 11738 open("/lib/libpam.so.0", O_RDONLY) = 3 11738 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0000\33\0\0004\0\0\0"..., 512) = 512 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=50832, ...}) = 0 11738 mmap2(NULL, 53540, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x4f8000 11738 fadvise64(3, 0, 53540, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x504000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb) = 0x504000 11738 close(3) = 0 11738 open("/lib/libaudit.so.1", O_RDONLY) = 3 11738 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260\33\0\0004\0\0\0"..., 512) = 512 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=91700, ...}) = 0 11738 mmap2(NULL, 94488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x110000 11738 fadvise64(3, 0, 94488, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x126000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15) = 0x126000 11738 close(3) = 0 11738 open("/lib/libc.so.6", O_RDONLY) = 3 11738 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360m\1\0004\0\0\0"..., 512) = 512 11738 fstat64(3, {st_mode=S_IFREG|0755, st_size=1446164, ...}) = 0 11738 mmap2(NULL, 1457256, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x708000 11738 fadvise64(3, 0, 1457256, POSIX_FADV_WILLNEED) = 0 11738 mprotect(0x865000, 4096, PROT_NONE) = 0 11738 mmap2(0x866000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15d) = 0x866000 11738 mmap2(0x869000, 11368, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x869000 11738 close(3) = 0 11738 open("/lib/libdl.so.2", O_RDONLY) = 3 11738 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\n\0\0004\0\0\0"..., 512) = 512 11738 fstat64(3, {st_mode=S_IFREG|0755, st_size=13896, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb772b000 11738 mmap2(NULL, 16500, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2bf000 11738 fadvise64(3, 0, 16500, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x2c2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2) = 0x2c2000 11738 close(3) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb772a000 11738 set_thread_area({entry_number:-1 -> 6, base_addr:0xb772a6c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 11738 mprotect(0x2c2000, 4096, PROT_READ) = 0 11738 mprotect(0x866000, 8192, PROT_READ) = 0 11738 mprotect(0x126000, 4096, PROT_READ) = 0 11738 mprotect(0x504000, 4096, PROT_READ) = 0 11738 mprotect(0xba9000, 4096, PROT_READ) = 0 11738 mprotect(0x804d000, 4096, PROT_READ) = 0 11738 mprotect(0xe72000, 4096, PROT_READ) = 0 11738 munmap(0xb772c000, 17106) = 0 11738 fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 fstat64(2, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 11738 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 11738 rt_sigaction(SIGINT, {SIG_IGN, [], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0 11738 rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0 11738 rt_sigaction(SIGTSTP, {SIG_IGN, [], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0 11738 rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0 11738 brk(0) = 0x8f15000 11738 brk(0x8f36000) = 0x8f36000 11738 socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 11738 connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) 11738 close(3) = 0 11738 socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 11738 connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) 11738 close(3) = 0 11738 open("/etc/nsswitch.conf", O_RDONLY) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=1808, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "#\n# Please refer to nsswitch.con"..., 4096) = 1808 11738 read(3, "", 4096) = 0 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 open("/etc/ld.so.cache", O_RDONLY) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=17106, ...}) = 0 11738 mmap2(NULL, 17106, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb772c000 11738 close(3) = 0 11738 open("/lib/libnss_files.so.2", O_RDONLY) = 3 11738 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\240\32\0\0004\0\0\0"..., 512) = 512 11738 fstat64(3, {st_mode=S_IFREG|0755, st_size=46740, ...}) = 0 11738 mmap2(NULL, 49872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x883000 11738 fadvise64(3, 0, 49872, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x88e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa) = 0x88e000 11738 close(3) = 0 11738 mprotect(0x88e000, 4096, PROT_READ) = 0 11738 munmap(0xb772c000, 17106) = 0 11738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 11738 fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC) 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=1756, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "root:x:0:0:System Administrator:"..., 4096) = 1756 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 stat64("/etc/pam.d", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 11738 open("/etc/pam.d/su", O_RDONLY|O_LARGEFILE) = 3 11738 fstat64(3, {st_mode=S_IFREG|0600, st_size=578, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "#%PAM-1.0\nauth\t\tsufficient\tpam_r"..., 4096) = 578 11738 open("/lib/security/pam_rootok.so", O_RDONLY) = 4 11738 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\4\0\0004\0\0\0"..., 512) = 512 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=5360, ...}) = 0 11738 mmap2(NULL, 8224, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x9c6000 11738 fadvise64(4, 0, 8224, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x9c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0) = 0x9c7000 11738 close(4) = 0 11738 open("/etc/ld.so.cache", O_RDONLY) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=17106, ...}) = 0 11738 mmap2(NULL, 17106, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7725000 11738 close(4) = 0 11738 open("/lib/libselinux.so.1", O_RDONLY) = 4 11738 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360C\0\0004\0\0\0"..., 512) = 512 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=108472, ...}) = 0 11738 mmap2(NULL, 113668, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb31000 11738 fadvise64(4, 0, 113668, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0xb4b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x19) = 0xb4b000 11738 close(4) = 0 11738 mprotect(0xb4b000, 4096, PROT_READ) = 0 11738 mprotect(0x9c7000, 4096, PROT_READ) = 0 11738 statfs64("/selinux", 84, {f_type="EXT2_SUPER_MAGIC", f_bsize=4096, f_blocks=2621440, f_bfree=1870903, f_bavail=1870903, f_files=200000, f_ffree=188094, f_fsid={-968390795, 180631185}, f_namelen=255, f_frsize=4096}) = 0 11738 open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb772f000 11738 read(4, "\text3\nnodev\tdevtmpfs\nnodev\tnfs\nn"..., 1024) = 104 11738 read(4, "", 1024) = 0 11738 close(4) = 0 11738 munmap(0xb772f000, 4096) = 0 11738 munmap(0xb7725000, 17106) = 0 11738 open("/etc/pam.d/system-auth", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=362, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb772f000 11738 read(4, "#%PAM-1.0\nauth\t\trequired\tpam_tcb"..., 4096) = 362 11738 open("/lib/security/pam_tcb.so", O_RDONLY) = 5 11738 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\26\0\0004\0\0\0"..., 512) = 512 11738 fstat64(5, {st_mode=S_IFREG|0644, st_size=30380, ...}) = 0 11738 mmap2(NULL, 33168, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x899000 11738 fadvise64(5, 0, 33168, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x8a0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x6) = 0x8a0000 11738 close(5) = 0 11738 open("/etc/ld.so.cache", O_RDONLY) = 5 11738 fstat64(5, {st_mode=S_IFREG|0644, st_size=17106, ...}) = 0 11738 mmap2(NULL, 17106, PROT_READ, MAP_PRIVATE, 5, 0) = 0xb7725000 11738 close(5) = 0 11738 open("/lib/libnsl.so.1", O_RDONLY) = 5 11738 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\3001\0\0004\0\0\0"..., 512) = 512 11738 fstat64(5, {st_mode=S_IFREG|0755, st_size=92024, ...}) = 0 11738 mmap2(NULL, 104392, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x49d000 11738 fadvise64(5, 0, 104392, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x4b3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x15) = 0x4b3000 11738 mmap2(0x4b5000, 6088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4b5000 11738 close(5) = 0 11738 open("/lib/libcrypt.so.1", O_RDONLY) = 5 11738 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P_\0\0004\0\0\0"..., 512) = 512 11738 fstat64(5, {st_mode=S_IFREG|0755, st_size=59084, ...}) = 0 11738 mmap2(NULL, 221692, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0xfc6000 11738 fadvise64(5, 0, 221692, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0xfd4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xd) = 0xfd4000 11738 mmap2(0xfd6000, 156156, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xfd6000 11738 close(5) = 0 11738 open("/lib/libtcb.so.0", O_RDONLY) = 5 11738 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320\7\0\0004\0\0\0"..., 512) = 512 11738 fstat64(5, {st_mode=S_IFREG|0644, st_size=9596, ...}) = 0 11738 mmap2(NULL, 12448, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0xc2e000 11738 fadvise64(5, 0, 12448, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0xc2f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1) = 0xc2f000 11738 mmap2(0xc31000, 160, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xc31000 11738 close(5) = 0 11738 mprotect(0xc2f000, 4096, PROT_READ) = 0 11738 mprotect(0xfd4000, 4096, PROT_READ) = 0 11738 mprotect(0x4b3000, 4096, PROT_READ) = 0 11738 mprotect(0x8a0000, 4096, PROT_READ) = 0 11738 munmap(0xb7725000, 17106) = 0 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb772f000, 4096) = 0 11738 open("/etc/pam.d/system-auth", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=362, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb772f000 11738 read(4, "#%PAM-1.0\nauth\t\trequired\tpam_tcb"..., 4096) = 362 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb772f000, 4096) = 0 11738 open("/lib/security/pam_deny.so", O_RDONLY) = 4 11738 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\3\0\0004\0\0\0"..., 512) = 512 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=5296, ...}) = 0 11738 mmap2(NULL, 8208, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x509000 11738 fadvise64(4, 0, 8208, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x50a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0) = 0x50a000 11738 close(4) = 0 11738 mprotect(0x50a000, 4096, PROT_READ) = 0 11738 open("/etc/pam.d/system-auth", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=362, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb772f000 11738 read(4, "#%PAM-1.0\nauth\t\trequired\tpam_tcb"..., 4096) = 362 11738 open("/lib/security/pam_mktemp.so", O_RDONLY) = 5 11738 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0\n\0\0004\0\0\0"..., 512) = 512 11738 fstat64(5, {st_mode=S_IFREG|0644, st_size=9564, ...}) = 0 11738 mmap2(NULL, 12428, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x128000 11738 fadvise64(5, 0, 12428, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x12a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1) = 0x12a000 11738 close(5) = 0 11738 mprotect(0x12a000, 4096, PROT_READ) = 0 11738 open("/lib/security/pam_limits.so", O_RDONLY) = 5 11738 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\v\0\0004\0\0\0"..., 512) = 512 11738 fstat64(5, {st_mode=S_IFREG|0644, st_size=13716, ...}) = 0 11738 mmap2(NULL, 16528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x2c9000 11738 fadvise64(5, 0, 16528, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x2cc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2) = 0x2cc000 11738 close(5) = 0 11738 mprotect(0x2cc000, 4096, PROT_READ) = 0 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb772f000, 4096) = 0 11738 open("/lib/security/pam_xauth.so", O_RDONLY) = 4 11738 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 \21\0\0004\0\0\0"..., 512) = 512 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=17932, ...}) = 0 11738 mmap2(NULL, 20744, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x581000 11738 fadvise64(4, 0, 20744, POSIX_FADV_WILLNEED) = 0 11738 mmap2(0x585000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x3) = 0x585000 11738 close(4) = 0 11738 mprotect(0x585000, 4096, PROT_READ) = 0 11738 read(3, "", 4096) = 0 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 open("/etc/pam.d/other", O_RDONLY|O_LARGEFILE) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=127, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "#%PAM-1.0\nauth\t\trequired\tpam_den"..., 4096) = 127 11738 read(3, "", 4096) = 0 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 11738 fstat64(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 readlink("/proc/self/fd/0", "/dev/pts/1", 4095) = 10 11738 stat64("/dev/pts/1", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 11738 fstat64(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 readlink("/proc/self/fd/0", "/dev/pts/1"..., 511) = 10 11738 stat64("/dev/pts/1", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory) 11738 open("/var/run/utmp", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory) 11738 access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory) 11738 open("/var/run/utmp", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory) 11738 time(NULL) = 1312541124 11738 getuid32() = 0 11738 open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 3 11738 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "\text3\nnodev\tdevtmpfs\nnodev\tnfs\nn"..., 1024) = 104 11738 read(3, "", 1024) = 0 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 socket(PF_NETLINK, SOCK_RAW, 9) = 3 11738 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 11738 socket(PF_NETLINK, SOCK_RAW, 0) = 4 11738 bind(4, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 11738 getsockname(4, {sa_family=AF_NETLINK, pid=11738, groups=00000000}, [12]) = 0 11738 time(NULL) = 1312541124 11738 sendto(4, "\24\0\0\0\26\0\1\3\304\311;N\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 11738 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"0\0\0\0\24\0\2\0\304\311;N\332-\0\0\2\10\200\376\1\0\0\0\10\0\1\0\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 104 11738 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"@\0\0\0\24\0\2\0\304\311;N\332-\0\0\n\200\200\376\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 64 11738 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\24\0\0\0\3\0\2\0\304\311;N\332-\0\0\0\0\0\0\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 11738 close(4) = 0 11738 open("/dev/urandom", O_RDONLY) = 4 11738 read(4, "\303\n\272\230\1\222\6\260", 8) = 8 11738 close(4) = 0 11738 getpid() = 11738 11738 open("/dev/urandom", O_RDONLY) = 4 11738 read(4, "\26\317\255\\7-\25B", 8) = 8 11738 close(4) = 0 11738 open("/etc/resolv.conf", O_RDONLY) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=71, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "search mozilla-russia.org\nnamese"..., 4096) = 71 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4 11738 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) 11738 close(4) = 0 11738 socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4 11738 connect(4, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) 11738 close(4) = 0 11738 open("/etc/host.conf", O_RDONLY) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=26, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "order hosts,bind\nmulti on\n", 4096) = 26 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=133, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "127.0.0.1 localhost.localdomain "..., 4096) = 133 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 readlink("/proc/self/exe", "/bin/su", 4095) = 7 11738 sendto(3, "\204\0\0\0L\4\5\0\1\0\0\0\0\0\0\0op=PAM:authentic"..., 132, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 132 11738 poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}]) 11738 recvfrom(3, "\230\0\0\0\2\0\0\0\1\0\0\0\332-\0\0\221\377\377\377\204\0\0\0L\4\5\0\1\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 152 11738 recvfrom(3, "\230\0\0\0\2\0\0\0\1\0\0\0\332-\0\0\221\377\377\377\204\0\0\0L\4\5\0\1\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 152 11738 close(3) = 0 11738 getuid32() = 0 11738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=1756, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "root:x:0:0:System Administrator:"..., 4096) = 1756 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTART}, {SIG_DFL, [], 0}, 8) = 0 11738 pipe([3, 4]) = 0 11738 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb772a728) = 11739 11738 close(4) = 0 11738 read(3, 11739 close(3) = 0 11739 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 11739 fstat64(3, {st_mode=S_IFREG|0644, st_size=1756, ...}) = 0 11739 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11739 read(3, "root:x:0:0:System Administrator:"..., 4096) = 1756 11739 close(3) = 0 11739 munmap(0xb7730000, 4096) = 0 11739 open("/etc/ld.so.cache", O_RDONLY) = 3 11739 fstat64(3, {st_mode=S_IFREG|0644, st_size=17106, ...}) = 0 11739 mmap2(NULL, 17106, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb772c000 11739 close(3) = 0 11739 open("/lib/libnss_tcb.so.2", O_RDONLY) = 3 11739 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\7\0\0004\0\0\0"..., 512) = 512 11739 fstat64(3, {st_mode=S_IFREG|0644, st_size=5472, ...}) = 0 11739 mmap2(NULL, 8284, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x6b8000 11739 fadvise64(3, 0, 8284, POSIX_FADV_WILLNEED) = 0 11739 mmap2(0x6b9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0x6b9000 11739 close(3) = 0 11739 mprotect(0x6b9000, 4096, PROT_READ) = 0 11739 munmap(0xb772c000, 17106) = 0 11739 geteuid32() = 0 11739 stat64("/etc/tcb", {st_mode=S_IFDIR|0710, st_size=4096, ...}) = 0 11739 stat64("/etc/tcb/root", {st_mode=S_IFDIR|S_ISGID|0710, st_size=4096, ...}) = 0 11739 getgroups32(1024, []) = 0 11739 setgroups32(0, []) = 0 11739 setfsgid32(26) = 0 11739 setfsgid32(26) = 26 11739 setfsuid32(0) = 0 11739 setfsuid32(0) = 0 11739 open("/etc/tcb/root/shadow", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 3 11739 fstat64(3, {st_mode=S_IFREG|0640, st_size=18, ...}) = 0 11739 setfsuid32(0) = 0 11739 setfsuid32(0) = 0 11739 setfsgid32(0) = 26 11739 setfsgid32(0) = 0 11739 setgroups32(0, []) = 0 11739 fcntl64(3, F_GETFL) = 0x20800 (flags O_RDONLY|O_NONBLOCK|O_NOFOLLOW) 11739 fstat64(3, {st_mode=S_IFREG|0640, st_size=18, ...}) = 0 11739 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11739 _llseek(3, 0, [0], SEEK_CUR) = 0 11739 read(3, "root::13342::::::\n", 4096) = 18 11739 _llseek(3, 18, [18], SEEK_SET) = 0 11739 close(3) = 0 11739 munmap(0xb7730000, 4096) = 0 11739 time(NULL) = 1312541124 11739 write(4, "\377\0\0\0", 4) = 4 11738 <... read resumed> "\377\0\0\0", 4) = 4 11739 exit_group(0) = ? 11738 waitpid(11739, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 11739 11738 --- {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11739, si_status=0, si_utime=0, si_stime=0} (Child exited) --- 11738 close(3) = 0 11738 rt_sigaction(SIGCHLD, {SIG_DFL, [], 0}, NULL, 8) = 0 11738 socket(PF_NETLINK, SOCK_RAW, 9) = 3 11738 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 11738 socket(PF_NETLINK, SOCK_RAW, 0) = 4 11738 bind(4, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 11738 getsockname(4, {sa_family=AF_NETLINK, pid=11738, groups=00000000}, [12]) = 0 11738 time(NULL) = 1312541125 11738 sendto(4, "\24\0\0\0\26\0\1\3\305\311;N\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 11738 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"0\0\0\0\24\0\2\0\305\311;N\332-\0\0\2\10\200\376\1\0\0\0\10\0\1\0\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 104 11738 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"@\0\0\0\24\0\2\0\305\311;N\332-\0\0\n\200\200\376\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 64 11738 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\24\0\0\0\3\0\2\0\305\311;N\332-\0\0\0\0\0\0\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 11738 close(4) = 0 11738 stat64("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=71, ...}) = 0 11738 open("/etc/resolv.conf", O_RDONLY) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=71, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "search mozilla-russia.org\nnamese"..., 4096) = 71 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=133, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "127.0.0.1 localhost.localdomain "..., 4096) = 133 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 readlink("/proc/self/exe", "/bin/su", 4095) = 7 11738 sendto(3, "\200\0\0\0M\4\5\0\2\0\0\0\0\0\0\0op=PAM:accountin"..., 128, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 128 11738 poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}]) 11738 recvfrom(3, "\224\0\0\0\2\0\0\0\2\0\0\0\332-\0\0\221\377\377\377\200\0\0\0M\4\5\0\2\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 148 11738 recvfrom(3, "\224\0\0\0\2\0\0\0\2\0\0\0\332-\0\0\221\377\377\377\200\0\0\0M\4\5\0\2\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 148 11738 close(3) = 0 11738 getuid32() = 0 11738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=1756, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "root:x:0:0:System Administrator:"..., 4096) = 1756 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 getuid32() = 0 11738 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 11738 fstat64(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 readlink("/proc/self/fd/0", "/dev/pts/1", 511) = 10 11738 stat64("/dev/pts/1", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0 11738 access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory) 11738 open("/var/run/utmp", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory) 11738 access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory) 11738 open("/var/run/utmp", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory) 11738 time(NULL) = 1312541125 11738 open("/etc/localtime", O_RDONLY) = 3 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0 11738 fstat64(3, {st_mode=S_IFREG|0644, st_size=2194, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0\0\0\0"..., 4096) = 2194 11738 _llseek(3, -27, [2167], SEEK_CUR) = 0 11738 read(3, "\nMSK-3MSD,M3.5.0,M10.5.0/3\n", 4096) = 27 11738 _llseek(3, 2193, [2193], SEEK_SET) = 0 11738 close(3) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3 11738 connect(3, {sa_family=AF_FILE, path="/dev/log"}, 110) = 0 11738 send(3, "<86>Aug 5 14:45:25 su[11738]: p"..., 86, MSG_NOSIGNAL) = 86 11738 geteuid32() = 0 11738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=1756, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "root:x:0:0:System Administrator:"..., 4096) = 1756 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "\text3\nnodev\tdevtmpfs\nnodev\tnfs\nn"..., 1024) = 104 11738 read(4, "", 1024) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 stat64("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 11738 mkdir("/tmp/.private", 0755) = -1 EEXIST (File exists) 11738 lstat64("/tmp/.private", {st_mode=S_IFDIR|0711, st_size=4096, ...}) = 0 11738 chmod("/tmp/.private", 0755) = -1 EPERM (Operation not permitted) 11738 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=1756, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "root:x:0:0:System Administrator:"..., 4096) = 1756 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 getrlimit(RLIMIT_CPU, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_FSIZE, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_DATA, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_RSS, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_NPROC, {rlim_cur=1024, rlim_max=1024}) = 0 11738 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0 11738 getrlimit(RLIMIT_MEMLOCK, {rlim_cur=64*1024, rlim_max=64*1024}) = 0 11738 getrlimit(RLIMIT_AS, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_LOCKS, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0 11738 getrlimit(RLIMIT_SIGPENDING, {rlim_cur=16146, rlim_max=16146}) = 0 11738 getrlimit(RLIMIT_MSGQUEUE, {rlim_cur=800*1024, rlim_max=800*1024}) = 0 11738 getrlimit(RLIMIT_NICE, {rlim_cur=0, rlim_max=0}) = 0 11738 getrlimit(RLIMIT_RTPRIO, {rlim_cur=0, rlim_max=0}) = 0 11738 getpriority(PRIO_PROCESS, 0) = 20 11738 open("/etc/security/limits.conf", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=1825, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "# /etc/security/limits.conf\n#\n#E"..., 4096) = 1825 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 open("/etc/security/limits.d", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 4 11738 fcntl64(4, F_GETFD) = 0x1 (flags FD_CLOEXEC) 11738 getdents64(4, /* 3 entries */, 32768) = 88 11738 getdents64(4, /* 0 entries */, 32768) = 0 11738 close(4) = 0 11738 open("/etc/security/limits.d/50-defaults.conf", O_RDONLY|O_LARGEFILE) = 4 11738 fstat64(4, {st_mode=S_IFREG|0644, st_size=114, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(4, "# recommended defaults for most "..., 4096) = 114 11738 read(4, "", 4096) = 0 11738 close(4) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0 11738 setrlimit(RLIMIT_NPROC, {rlim_cur=1024, rlim_max=1024}) = 0 11738 setpriority(PRIO_PROCESS, 0, 0) = 0 11738 access("/usr/X11R6/bin/xauth", X_OK) = -1 ENOENT (No such file or directory) 11738 access("/usr/bin/xauth", X_OK) = -1 ENOENT (No such file or directory) 11738 access("/usr/bin/X11/xauth", X_OK) = -1 ENOENT (No such file or directory) 11738 socket(PF_NETLINK, SOCK_RAW, 9) = 4 11738 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 11738 socket(PF_NETLINK, SOCK_RAW, 0) = 5 11738 bind(5, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 11738 getsockname(5, {sa_family=AF_NETLINK, pid=11738, groups=00000000}, [12]) = 0 11738 time(NULL) = 1312541125 11738 sendto(5, "\24\0\0\0\26\0\1\3\305\311;N\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 11738 recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"0\0\0\0\24\0\2\0\305\311;N\332-\0\0\2\10\200\376\1\0\0\0\10\0\1\0\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 104 11738 recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"@\0\0\0\24\0\2\0\305\311;N\332-\0\0\n\200\200\376\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 64 11738 recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\24\0\0\0\3\0\2\0\305\311;N\332-\0\0\0\0\0\0\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 11738 close(5) = 0 11738 stat64("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=71, ...}) = 0 11738 open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 5 11738 fstat64(5, {st_mode=S_IFREG|0644, st_size=133, ...}) = 0 11738 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7730000 11738 read(5, "127.0.0.1 localhost.localdomain "..., 4096) = 133 11738 read(5, "", 4096) = 0 11738 close(5) = 0 11738 munmap(0xb7730000, 4096) = 0 11738 readlink("/proc/self/exe", "/bin/su", 4095) = 7 11738 sendto(4, "\200\0\0\0Q\4\5\0\3\0\0\0\0\0\0\0op=PAM:session_o"..., 128, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 128 11738 poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}]) 11738 recvfrom(4, "\224\0\0\0\2\0\0\0\3\0\0\0\332-\0\0\221\377\377\377\200\0\0\0Q\4\5\0\3\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 148 11738 recvfrom(4, "\224\0\0\0\2\0\0\0\3\0\0\0\332-\0\0\221\377\377\377\200\0\0\0Q\4\5\0\3\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 148 11738 close(4) = 0 11738 write(2, "su: Cannot make/remove an entry "..., 58) = 58 11738 munmap(0x9c6000, 8224) = 0 11738 munmap(0x899000, 33168) = 0 11738 munmap(0x49d000, 104392) = 0 11738 munmap(0xfc6000, 221692) = 0 11738 munmap(0xc2e000, 12448) = 0 11738 munmap(0x509000, 8208) = 0 11738 munmap(0x128000, 12428) = 0 11738 munmap(0x2c9000, 16528) = 0 11738 munmap(0x581000, 20744) = 0 11738 munmap(0xb31000, 113668) = 0 11738 ioctl(0, SNDCTL_TMR_CONTINUE or SNDRV_TIMER_IOCTL_GPARAMS or TCSETSF, {B38400 opost isig icanon echo ...}) = 0 11738 exit_group(1) = ?