execve("/usr/sbin/useradd", ["/usr/sbin/useradd", "-u", "603", "test333"], [/* 24 vars */]) = 0 uname({sys="Linux", node="fakehostname.zzz", ...}) = 0 brk(0) = 0x8f10000 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=45064, ...}) = 0 old_mmap(NULL, 45064, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb75f1000 close(3) = 0 open("/lib/libcrypt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\t\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=23388, ...}) = 0 old_mmap(NULL, 181308, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x5f1000 old_mmap(0x5f6000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x4000) = 0x5f6000 old_mmap(0x5f7000, 156732, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x5f7000 close(3) = 0 open("/lib/liblaus.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 \r\0\000"..., 512) = 512 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75f0000 fstat64(3, {st_mode=S_IFREG|0555, st_size=8548, ...}) = 0 old_mmap(NULL, 11812, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xc45000 old_mmap(0xc47000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x1000) = 0xc47000 close(3) = 0 open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200X\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1573120, ...}) = 0 old_mmap(NULL, 1280524, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x445000 old_mmap(0x578000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x132000) = 0x578000 old_mmap(0x57b000, 10764, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x57b000 close(3) = 0 set_thread_area({entry_number:-1 -> 6, base_addr:0xb75f0ae0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb75f1000, 45064) = 0 open("/dev/audit", O_RDWR) = -1 ENOENT (No such file or directory) brk(0) = 0x8f10000 brk(0x8f31000) = 0x8f31000 brk(0) = 0x8f31000 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=32148976, ...}) = 0 mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb73f0000 close(3) = 0 stat64("/etc/ptmp", 0xbfffdb70) = -1 ENOENT (No such file or directory) access("/etc/shadow", F_OK) = 0 access("/etc/gshadow", F_OK) = 0 open("/etc/default/useradd", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0600, st_size=96, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ef000 read(3, "# useradd defaults file\nGROUP=10"..., 4096) = 96 socket(PF_FILE, SOCK_STREAM, 0) = 4 connect(4, {sa_family=AF_FILE, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=1710, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(4, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1710 read(4, "", 4096) = 0 close(4) = 0 munmap(0xb73ee000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=45064, ...}) = 0 old_mmap(NULL, 45064, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb73e3000 close(4) = 0 open("/lib/libnss_files.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20\35\0"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=51952, ...}) = 0 old_mmap(NULL, 46748, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0x8ff000 old_mmap(0x90a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4, 0xa000) = 0x90a000 close(4) = 0 munmap(0xb73e3000, 45064) = 0 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(4, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 close(4) = 0 munmap(0xb73ee000, 4096) = 0 read(3, "", 4096) = 0 open("/etc/login.defs", O_RDONLY|O_LARGEFILE) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=1180, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(4, "# *REQUIRED*\n# Directory where"..., 4096) = 1180 read(4, "", 4096) = 0 close(4) = 0 munmap(0xb73ee000, 4096) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 connect(4, {sa_family=AF_FILE, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(4) = 0 open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=1659, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(4, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1659 read(4, "", 4096) = 0 close(4) = 0 munmap(0xb73ee000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=45064, ...}) = 0 old_mmap(NULL, 45064, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb73e3000 close(4) = 0 open("/lib/tls/i686/mmx/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/tls/i686/mmx", 0xbfffd474) = -1 ENOENT (No such file or directory) open("/lib/tls/i686/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/tls/i686", 0xbfffd474) = -1 ENOENT (No such file or directory) open("/lib/tls/mmx/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/tls/mmx", 0xbfffd474) = -1 ENOENT (No such file or directory) open("/lib/tls/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/tls", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 open("/lib/i686/mmx/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/i686/mmx", 0xbfffd474) = -1 ENOENT (No such file or directory) open("/lib/i686/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/i686", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 open("/lib/mmx/libnss_winbind.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/lib/mmx", 0xbfffd474) = -1 ENOENT (No such file or directory) open("/lib/libnss_winbind.so.2", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0004\21\0"..., 512) = 512 fstat64(4, {st_mode=S_IFREG|0755, st_size=19548, ...}) = 0 old_mmap(NULL, 27484, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xdcf000 old_mmap(0xdd3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4, 0x3000) = 0xdd3000 old_mmap(0xdd4000, 7004, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xdd4000 close(4) = 0 munmap(0xb73e3000, 45064) = 0 getpid() = 10153 getpid() = 10153 getpid() = 10153 lstat64("/tmp/.winbindd", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 lstat64("/tmp/.winbindd/pipe", {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 connect(4, {sa_family=AF_FILE, path="/tmp/.winbindd/pipe"}, 110) = 0 getpid() = 10153 getpid() = 10153 select(5, [4], NULL, NULL, {0, 0}) = 0 (Timeout) write(4, "$\7\0\0\0\0\0\0\251\'\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(5, [4], NULL, NULL, {5, 0}) = 1 (in [4], left {5, 0}) read(4, "\24\5\0\0\2\0\0\0\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 getpid() = 10153 getpid() = 10153 select(5, [4], NULL, NULL, {0, 0}) = 0 (Timeout) write(4, "$\7\0\0%\0\0\0\251\'\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(5, [4], NULL, NULL, {5, 0}) = 1 (in [4], left {5, 0}) read(4, "C\5\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 select(5, [4], NULL, NULL, {5, 0}) = 1 (in [4], left {5, 0}) read(4, "/usr/local/samba/var/locks/winbi"..., 47) = 47 lstat64("/usr/local/samba/var/locks/winbindd_privileged", {st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0 lstat64("/usr/local/samba/var/locks/winbindd_privileged/pipe", {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 5 fcntl64(5, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(5, F_GETFD) = 0 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0 connect(5, {sa_family=AF_FILE, path="/usr/local/samba/var/locks/winbindd_privileged/pipe"}, 110) = 0 close(4) = 0 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\1\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 open("/etc/group", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(4, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 read(4, "", 4096) = 0 close(4) = 0 munmap(0xb73ee000, 4096) = 0 getpid() = 10153 getpid() = 10153 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\3\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 open("/etc/.pwd.lock", O_WRONLY|O_CREAT, 0600) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 rt_sigaction(SIGALRM, {0x527790, ~[], SA_RESTORER, 0x46d0d8}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0 alarm(15) = 0 fcntl64(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0 alarm(0) = 15 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGALRM, {SIG_DFL}, NULL, 8) = 0 getpid() = 10153 open("/etc/passwd.10153", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 6 getpid() = 10153 write(6, "10153\0", 6) = 6 close(6) = 0 link("/etc/passwd.10153", "/etc/passwd.lock") = -1 EEXIST (File exists) open("/etc/passwd.lock", O_RDWR|O_LARGEFILE) = 6 read(6, "10066\0", 31) = 6 close(6) = 0 kill(10066, SIG_0) = -1 ESRCH (No such process) unlink("/etc/passwd.lock") = 0 link("/etc/passwd.10153", "/etc/passwd.lock") = 0 stat64("/etc/passwd.10153", {st_mode=S_IFREG|0600, st_size=6, ...}) = 0 unlink("/etc/passwd.10153") = 0 open("/etc/passwd", O_RDWR|O_LARGEFILE) = 6 fstat64(6, {st_mode=S_IFREG|0644, st_size=1659, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(6, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1659 read(6, "", 4096) = 0 getpid() = 10153 open("/etc/shadow.10153", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 7 getpid() = 10153 write(7, "10153\0", 6) = 6 close(7) = 0 link("/etc/shadow.10153", "/etc/shadow.lock") = -1 EEXIST (File exists) open("/etc/shadow.lock", O_RDWR|O_LARGEFILE) = 7 read(7, "10066\0", 31) = 6 close(7) = 0 kill(10066, SIG_0) = -1 ESRCH (No such process) unlink("/etc/shadow.lock") = 0 link("/etc/shadow.10153", "/etc/shadow.lock") = 0 stat64("/etc/shadow.10153", {st_mode=S_IFREG|0600, st_size=6, ...}) = 0 unlink("/etc/shadow.10153") = 0 open("/etc/shadow", O_RDWR|O_LARGEFILE) = 7 fstat64(7, {st_mode=S_IFREG|0400, st_size=1116, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ed000 read(7, "root:$1$h5.CK6a7$yoEwd7axtwX15.N"..., 4096) = 1116 read(7, "", 4096) = 0 getpid() = 10153 open("/etc/group.10153", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 8 getpid() = 10153 write(8, "10153\0", 6) = 6 close(8) = 0 link("/etc/group.10153", "/etc/group.lock") = -1 EEXIST (File exists) open("/etc/group.lock", O_RDWR|O_LARGEFILE) = 8 read(8, "10066\0", 31) = 6 close(8) = 0 kill(10066, SIG_0) = -1 ESRCH (No such process) unlink("/etc/group.lock") = 0 link("/etc/group.10153", "/etc/group.lock") = 0 stat64("/etc/group.10153", {st_mode=S_IFREG|0600, st_size=6, ...}) = 0 unlink("/etc/group.10153") = 0 open("/etc/group", O_RDWR|O_LARGEFILE) = 8 fstat64(8, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ec000 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 read(8, "", 4096) = 0 getpid() = 10153 open("/etc/gshadow.10153", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 9 getpid() = 10153 write(9, "10153\0", 6) = 6 close(9) = 0 link("/etc/gshadow.10153", "/etc/gshadow.lock") = -1 EEXIST (File exists) open("/etc/gshadow.lock", O_RDWR|O_LARGEFILE) = 9 read(9, "10066\0", 31) = 6 close(9) = 0 kill(10066, SIG_0) = -1 ESRCH (No such process) unlink("/etc/gshadow.lock") = 0 link("/etc/gshadow.10153", "/etc/gshadow.lock") = 0 stat64("/etc/gshadow.10153", {st_mode=S_IFREG|0600, st_size=6, ...}) = 0 unlink("/etc/gshadow.10153") = 0 open("/etc/gshadow", O_RDWR|O_LARGEFILE) = 9 fstat64(9, {st_mode=S_IFREG|0400, st_size=495, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73eb000 read(9, "root:::\nbin:::bin,daemon\ndaemon:"..., 4096) = 495 read(9, "", 4096) = 0 open("/etc/passwd", O_RDONLY) = 10 fcntl64(10, F_GETFD) = 0 fcntl64(10, F_SETFD, FD_CLOEXEC) = 0 fstat64(10, {st_mode=S_IFREG|0644, st_size=1659, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ea000 _llseek(10, 0, [0], SEEK_CUR) = 0 read(10, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1659 read(10, "", 4096) = 0 getpid() = 10153 getpid() = 10153 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\6\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 open("/etc/group", O_RDONLY) = 11 fcntl64(11, F_GETFD) = 0 fcntl64(11, F_SETFD, FD_CLOEXEC) = 0 fstat64(11, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73e9000 _llseek(11, 0, [0], SEEK_CUR) = 0 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 read(11, "", 4096) = 0 getpid() = 10153 getpid() = 10153 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\t\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 _llseek(11, 0, [0], SEEK_SET) = 0 read(11, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 read(11, "", 4096) = 0 close(11) = 0 munmap(0xb73e9000, 4096) = 0 getpid() = 10153 getpid() = 10153 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\4\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 time([1129224737]) = 1129224737 open("/etc/localtime", O_RDONLY) = 11 fstat64(11, {st_mode=S_IFREG|0644, st_size=1279, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73e9000 read(11, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0"..., 4096) = 1279 close(11) = 0 munmap(0xb73e9000, 4096) = 0 getpid() = 10153 socket(PF_FILE, SOCK_DGRAM, 0) = 11 fcntl64(11, F_SETFD, FD_CLOEXEC) = 0 connect(11, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0 send(11, "<86>Oct 13 12:32:17 useradd[1015"..., 69, MSG_NOSIGNAL) = 69 _llseek(10, 0, [0], SEEK_SET) = 0 read(10, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1659 read(10, "", 4096) = 0 getpid() = 10153 getpid() = 10153 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\6\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 time(NULL) = 1129224737 time([1129224737]) = 1129224737 getpid() = 10153 send(11, "<86>Oct 13 12:32:17 useradd[1015"..., 113, MSG_NOSIGNAL) = 113 _llseek(10, 0, [0], SEEK_SET) = 0 read(10, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1659 read(10, "", 4096) = 0 close(10) = 0 munmap(0xb73ea000, 4096) = 0 getpid() = 10153 getpid() = 10153 select(6, [5], NULL, NULL, {0, 0}) = 0 (Timeout) write(5, "$\7\0\0\2\0\0\0\251\'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828 select(6, [5], NULL, NULL, {5, 0}) = 1 (in [5], left {5, 0}) read(5, "\24\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300 open("/var/log/faillog", O_RDWR|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/var/log/lastlog", O_RDWR|O_LARGEFILE) = 10 _llseek(10, 176076, [176076], SEEK_SET) = 0 write(10, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 292) = 292 close(10) = 0 getuid32() = 0 access("/home/test333", F_OK) = 0 access("/etc/skel", F_OK) = 0 access("/home/test333", F_OK) = 0 open("/etc/skel", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 10 fstat64(10, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 fcntl64(10, F_SETFD, FD_CLOEXEC) = 0 getdents64(10, /* 8 entries */, 4096) = 240 lstat64("/etc/skel/.kde", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 mkdir("/home/test333/.kde", 0755) = -1 EEXIST (File exists) chown32("/home/test333/.kde", 603, 603) = 0 access("/etc/skel/.kde", F_OK) = 0 access("/home/test333/.kde", F_OK) = 0 open("/etc/skel/.kde", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 12 fstat64(12, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 fcntl64(12, F_SETFD, FD_CLOEXEC) = 0 getdents64(12, /* 3 entries */, 4096) = 80 lstat64("/etc/skel/.kde/Autostart", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 mkdir("/home/test333/.kde/Autostart", 0755) = -1 EEXIST (File exists) chown32("/home/test333/.kde/Autostart", 603, 603) = 0 access("/etc/skel/.kde/Autostart", F_OK) = 0 access("/home/test333/.kde/Autostart", F_OK) = 0 open("/etc/skel/.kde/Autostart", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 13 fstat64(13, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 fcntl64(13, F_SETFD, FD_CLOEXEC) = 0 getdents64(13, /* 3 entries */, 4096) = 80 lstat64("/etc/skel/.kde/Autostart/.directory", {st_mode=S_IFREG|0644, st_size=381, ...}) = 0 open("/etc/skel/.kde/Autostart/.directory", O_RDONLY|O_LARGEFILE) = 14 open("/home/test333/.kde/Autostart/.directory", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0) = 15 chown32("/home/test333/.kde/Autostart/.directory", 603, 603) = 0 chmod("/home/test333/.kde/Autostart/.directory", 0644) = 0 read(14, "[Desktop Entry]\nType=Directory\nN"..., 1024) = 381 write(15, "[Desktop Entry]\nType=Directory\nN"..., 381) = 381 read(14, "", 1024) = 0 close(14) = 0 close(15) = 0 getdents64(13, /* 0 entries */, 4096) = 0 close(13) = 0 getdents64(12, /* 0 entries */, 4096) = 0 close(12) = 0 lstat64("/etc/skel/.emacs", {st_mode=S_IFREG|0644, st_size=237, ...}) = 0 open("/etc/skel/.emacs", O_RDONLY|O_LARGEFILE) = 12 open("/home/test333/.emacs", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0) = 13 chown32("/home/test333/.emacs", 603, 603) = 0 chmod("/home/test333/.emacs", 0644) = 0 read(12, ";; .emacs\n\n;;; uncomment this li"..., 1024) = 237 write(13, ";; .emacs\n\n;;; uncomment this li"..., 237) = 237 read(12, "", 1024) = 0 close(12) = 0 close(13) = 0 lstat64("/etc/skel/.bash_logout", {st_mode=S_IFREG|0644, st_size=24, ...}) = 0 open("/etc/skel/.bash_logout", O_RDONLY|O_LARGEFILE) = 12 open("/home/test333/.bash_logout", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0) = 13 chown32("/home/test333/.bash_logout", 603, 603) = 0 chmod("/home/test333/.bash_logout", 0644) = 0 read(12, "# ~/.bash_logout\n\nclear\n", 1024) = 24 write(13, "# ~/.bash_logout\n\nclear\n", 24) = 24 read(12, "", 1024) = 0 close(12) = 0 close(13) = 0 lstat64("/etc/skel/.bash_profile", {st_mode=S_IFREG|0644, st_size=191, ...}) = 0 open("/etc/skel/.bash_profile", O_RDONLY|O_LARGEFILE) = 12 open("/home/test333/.bash_profile", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0) = 13 chown32("/home/test333/.bash_profile", 603, 603) = 0 chmod("/home/test333/.bash_profile", 0644) = 0 read(12, "# .bash_profile\n\n# Get the alias"..., 1024) = 191 write(13, "# .bash_profile\n\n# Get the alias"..., 191) = 191 read(12, "", 1024) = 0 close(12) = 0 close(13) = 0 lstat64("/etc/skel/.bashrc", {st_mode=S_IFREG|0644, st_size=124, ...}) = 0 open("/etc/skel/.bashrc", O_RDONLY|O_LARGEFILE) = 12 open("/home/test333/.bashrc", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0) = 13 chown32("/home/test333/.bashrc", 603, 603) = 0 chmod("/home/test333/.bashrc", 0644) = 0 read(12, "# .bashrc\n\n# User specific alias"..., 1024) = 124 write(13, "# .bashrc\n\n# User specific alias"..., 124) = 124 read(12, "", 1024) = 0 close(12) = 0 close(13) = 0 lstat64("/etc/skel/.gtkrc", {st_mode=S_IFREG|0644, st_size=120, ...}) = 0 open("/etc/skel/.gtkrc", O_RDONLY|O_LARGEFILE) = 12 open("/home/test333/.gtkrc", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0) = 13 chown32("/home/test333/.gtkrc", 603, 603) = 0 chmod("/home/test333/.gtkrc", 0644) = 0 read(12, "# -- THEME AUTO-WRITTEN DO NOT E"..., 1024) = 120 write(13, "# -- THEME AUTO-WRITTEN DO NOT E"..., 120) = 120 read(12, "", 1024) = 0 close(12) = 0 close(13) = 0 getdents64(10, /* 0 entries */, 4096) = 0 close(10) = 0 open("/etc/group", O_RDONLY) = 10 fcntl64(10, F_GETFD) = 0 fcntl64(10, F_SETFD, FD_CLOEXEC) = 0 fstat64(10, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ea000 read(10, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 close(10) = 0 munmap(0xb73ea000, 4096) = 0 access("/var/mail/test333", R_OK) = 0 fstat64(6, {st_mode=S_IFREG|0644, st_size=1659, ...}) = 0 fstat64(6, {st_mode=S_IFREG|0644, st_size=1659, ...}) = 0 umask(077) = 022 open("/etc/passwd-", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 10 umask(022) = 077 _llseek(6, 0, [0], SEEK_SET) = 0 read(6, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1659 fstat64(10, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ea000 read(6, "", 4096) = 0 write(10, "root:x:0:0:root:/root:/bin/bash\n"..., 1659) = 1659 close(10) = 0 munmap(0xb73ea000, 4096) = 0 utime("/etc/passwd-", [2005/10/13-12:32:17, 2005/10/13-12:28:19]) = 0 close(6) = 0 munmap(0xb73ee000, 4096) = 0 umask(0777) = 022 open("/etc/passwd+", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 0777 fchown32(6, 0, 0) = 0 fchmod(6, 0644) = 0 fstat64(6, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 write(6, "root:x:0:0:root:/root:/bin/bash\n"..., 1702) = 1702 fsync(6) = 0 close(6) = 0 munmap(0xb73ee000, 4096) = 0 rename("/etc/passwd+", "/etc/passwd") = 0 fstat64(7, {st_mode=S_IFREG|0400, st_size=1116, ...}) = 0 fstat64(7, {st_mode=S_IFREG|0400, st_size=1116, ...}) = 0 umask(077) = 022 open("/etc/shadow-", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 077 _llseek(7, 0, [0], SEEK_SET) = 0 read(7, "root:$1$h5.CK6a7$yoEwd7axtwX15.N"..., 4096) = 1116 fstat64(6, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(7, "", 4096) = 0 write(6, "root:$1$h5.CK6a7$yoEwd7axtwX15.N"..., 1116) = 1116 close(6) = 0 munmap(0xb73ee000, 4096) = 0 utime("/etc/shadow-", [2005/10/13-12:32:17, 2005/10/13-12:28:19]) = 0 close(7) = 0 munmap(0xb73ed000, 4096) = 0 umask(0777) = 022 open("/etc/shadow+", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 0777 fchown32(6, 0, 0) = 0 fchmod(6, 0400) = 0 fstat64(6, {st_mode=S_IFREG|0400, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 write(6, "root:$1$h5.CK6a7$yoEwd7axtwX15.N"..., 1146) = 1146 fsync(6) = 0 close(6) = 0 munmap(0xb73ee000, 4096) = 0 rename("/etc/shadow+", "/etc/shadow") = 0 fstat64(8, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 fstat64(8, {st_mode=S_IFREG|0644, st_size=609, ...}) = 0 umask(077) = 022 open("/etc/group-", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 077 _llseek(8, 0, [0], SEEK_SET) = 0 read(8, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 4096) = 609 fstat64(6, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(8, "", 4096) = 0 write(6, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 609) = 609 close(6) = 0 munmap(0xb73ee000, 4096) = 0 utime("/etc/group-", [2005/10/13-12:32:17, 2005/10/13-12:28:19]) = 0 close(8) = 0 munmap(0xb73ec000, 4096) = 0 umask(0777) = 022 open("/etc/group+", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 0777 fchown32(6, 0, 0) = 0 fchmod(6, 0644) = 0 fstat64(6, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 write(6, "root:x:0:\nbin:x:1:bin,daemon\ndae"..., 624) = 624 fsync(6) = 0 close(6) = 0 munmap(0xb73ee000, 4096) = 0 rename("/etc/group+", "/etc/group") = 0 fstat64(9, {st_mode=S_IFREG|0400, st_size=495, ...}) = 0 fstat64(9, {st_mode=S_IFREG|0400, st_size=495, ...}) = 0 umask(077) = 022 open("/etc/gshadow-", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 077 _llseek(9, 0, [0], SEEK_SET) = 0 read(9, "root:::\nbin:::bin,daemon\ndaemon:"..., 4096) = 495 fstat64(6, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 read(9, "", 4096) = 0 write(6, "root:::\nbin:::bin,daemon\ndaemon:"..., 495) = 495 close(6) = 0 munmap(0xb73ee000, 4096) = 0 utime("/etc/gshadow-", [2005/10/13-12:32:17, 2005/10/13-12:28:19]) = 0 close(9) = 0 munmap(0xb73eb000, 4096) = 0 umask(0777) = 022 open("/etc/gshadow+", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 6 umask(022) = 0777 fchown32(6, 0, 0) = 0 fchmod(6, 0400) = 0 fstat64(6, {st_mode=S_IFREG|0400, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb73ee000 write(6, "root:::\nbin:::bin,daemon\ndaemon:"..., 507) = 507 fsync(6) = 0 close(6) = 0 munmap(0xb73ee000, 4096) = 0 rename("/etc/gshadow+", "/etc/gshadow") = 0 open("/var/run/nscd/nscd.pid", O_RDONLY) = -1 ENOENT (No such file or directory) open("/var/run/nscd.pid", O_RDONLY) = -1 ENOENT (No such file or directory) unlink("/etc/group.lock") = 0 unlink("/etc/gshadow.lock") = 0 unlink("/etc/passwd.lock") = 0 unlink("/etc/shadow.lock") = 0 socket(PF_FILE, SOCK_STREAM, 0) = 6 connect(6, {sa_family=AF_FILE, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(6) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 6 connect(6, {sa_family=AF_FILE, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(6) = 0 close(4) = 0 exit_group(0) = ?