rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f27b34a6220}, {0x40f0e0, [INT QUIT], SA_RESTORER|SA_NOCLDSTOP, 0x7f27b34a6220}, 8) = 0 close(6) = 0 rt_sigaction(SIGTTOU, {SIG_IGN, [TTOU], SA_RESTORER|SA_RESTART, 0x7f27b34a6220}, {SIG_DFL, [], 0}, 8) = 0 open("/dev/tty", O_RDWR|O_NOCTTY) = -1 ENXIO (No such device or address) setsid() = 763 open("/dev/tty", O_RDWR|O_NOCTTY) = -1 ENXIO (No such device or address) ioctl(7, TIOCSCTTY) = 0 open("/dev/pts/0", O_RDWR) = 6 close(6) = 0 open("/dev/tty", O_WRONLY) = 6 close(6) = 0 dup2(7, 0) = 0 dup2(7, 2) = 2 dup2(7, 1) = 1 close(7) = 0 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 6 lseek(6, 0, SEEK_CUR) = 0 fstat(6, {st_mode=S_IFREG|0644, st_size=71, ...}) = 0 mmap(NULL, 71, PROT_READ, MAP_SHARED, 6, 0) = 0x7f27b4035000 lseek(6, 71, SEEK_SET) = 71 munmap(0x7f27b4035000, 71) = 0 close(6) = 0 geteuid() = 0 gettimeofday({1277594087, 669747}, NULL) = 0 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 readlink("/proc/self/fd/0", "/dev/pts/0"..., 4127) = 10 access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory) open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 6 fcntl(6, F_GETFD) = 0x1 (flags FD_CLOEXEC) lseek(6, 0, SEEK_SET) = 0 access("/var/run/utmpx", F_OK) = -1 ENOENT (No such file or directory) open("/var/run/utmp", O_RDWR|O_CLOEXEC) = 7 lseek(6, 0, SEEK_CUR) = 0 lseek(7, 0, SEEK_SET) = 0 dup2(7, 6) = 6 close(7) = 0 alarm(0) = 0 rt_sigaction(SIGALRM, {0x7f27b3578f90, [], SA_RESTORER, 0x7f27b34a6220}, {SIG_DFL, [], 0}, 8) = 0 alarm(10) = 0 fcntl(6, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=0}) = 0 read(6, "", 384) = 0 fcntl(6, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 alarm(0) = 10 rt_sigaction(SIGALRM, {SIG_DFL, [], SA_RESTORER, 0x7f27b34a6220}, NULL, 8) = 0 alarm(0) = 0 rt_sigaction(SIGALRM, {0x7f27b3578f90, [], SA_RESTORER, 0x7f27b34a6220}, {SIG_DFL, [], SA_RESTORER, 0x7f27b34a6220}, 8) = 0 alarm(10) = 0 fcntl(6, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0 lseek(6, 0, SEEK_END) = 0 write(6, "\7\0\0\0\373\2\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384 fcntl(6, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 alarm(0) = 10 rt_sigaction(SIGALRM, {SIG_DFL, [], SA_RESTORER, 0x7f27b34a6220}, NULL, 8) = 0 close(6) = 0 access("/var/log/wtmpx", F_OK) = -1 ENOENT (No such file or directory) open("/var/log/wtmp", O_WRONLY) = 6 alarm(0) = 0 rt_sigaction(SIGALRM, {0x7f27b3578f90, [], SA_RESTORER, 0x7f27b34a6220}, {SIG_DFL, [], SA_RESTORER, 0x7f27b34a6220}, 8) = 0 alarm(10) = 0 fcntl(6, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0 lseek(6, 0, SEEK_END) = 0 write(6, "\7\0\0\0\373\2\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384 fcntl(6, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 alarm(0) = 10 rt_sigaction(SIGALRM, {SIG_DFL, [], SA_RESTORER, 0x7f27b34a6220}, NULL, 8) = 0 close(6) = 0 stat("/var/log/lastlog", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 open("/var/log/lastlog", O_RDWR|O_CREAT, 0600) = 6 lseek(6, 0, SEEK_SET) = 0 write(6, "\347\211&Lpts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 292) = 292 close(6) = 0 stat("/root/.hushlogin", 0x7fffd0a54410) = -1 ENOENT (No such file or directory) open("/etc/motd", O_RDONLY) = -1 ENOENT (No such file or directory) gettimeofday({1277594087, 678178}, NULL) = 0 getuid() = 0 setgid(0) = 0 open("/proc/sys/kernel/ngroups_max", O_RDONLY) = 6 read(6, "65536\n", 31) = 6 close(6) = 0 open("/etc/group", O_RDONLY|O_CLOEXEC) = 6 lseek(6, 0, SEEK_CUR) = 0 fstat(6, {st_mode=S_IFREG|0644, st_size=24, ...}) = 0 mmap(NULL, 24, PROT_READ, MAP_SHARED, 6, 0) = 0x7f27b4035000 lseek(6, 24, SEEK_SET) = 24 fstat(6, {st_mode=S_IFREG|0644, st_size=24, ...}) = 0 munmap(0x7f27b4035000, 24) = 0 close(6) = 0 setgroups(1, [0]) = 0 setuid(0) = 0 chdir("/root") = 0 rt_sigaction(SIGPIPE, {SIG_DFL, [PIPE], SA_RESTORER|SA_RESTART, 0x7f27b34a6220}, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f27b34a6220}, 8) = 0 close(3) = 0 close(4) = 0 execve("/bin/sh", ["-sh"], [/* 6 vars */]) = 0 brk(0) = 0x1e89000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272ef000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=1565, ...}) = 0 mmap(NULL, 1565, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ff2272ee000 close(3) = 0 open("/lib/libutil.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \16\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=10144, ...}) = 0 mmap(NULL, 2105368, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff226ed0000 mprotect(0x7ff226ed2000, 2093056, PROT_NONE) = 0 mmap(0x7ff2270d1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7ff2270d1000 close(3) = 0 open("/lib/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@ \0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=88368, ...}) = 0 mmap(NULL, 2183664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff226cba000 mprotect(0x7ff226ccf000, 2093056, PROT_NONE) = 0 mmap(0x7ff226ece000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x7ff226ece000 close(3) = 0 open("/lib/libcrypt.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\n\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=38816, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272ed000 mmap(NULL, 2322784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff226a82000 mprotect(0x7ff226a8a000, 2097152, PROT_NONE) = 0 mmap(0x7ff226c8a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7ff226c8a000 mmap(0x7ff226c8c000, 184672, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff226c8c000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\354\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1399848, ...}) = 0 mmap(NULL, 3508136, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ff226729000 mprotect(0x7ff226879000, 2093056, PROT_NONE) = 0 mmap(0x7ff226a78000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14f000) = 0x7ff226a78000 mmap(0x7ff226a7d000, 18344, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ff226a7d000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272ec000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272eb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272ea000 arch_prctl(ARCH_SET_FS, 0x7ff2272eb700) = 0 mprotect(0x7ff226a78000, 16384, PROT_READ) = 0 mprotect(0x7ff226c8a000, 4096, PROT_READ) = 0 mprotect(0x7ff226ece000, 4096, PROT_READ) = 0 mprotect(0x7ff2270d1000, 4096, PROT_READ) = 0 mprotect(0x624000, 4096, PROT_READ) = 0 mprotect(0x7ff2272f0000, 4096, PROT_READ) = 0 munmap(0x7ff2272ee000, 1565) = 0 setrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=0}) = 0 brk(0) = 0x1e89000 brk(0x1eaa000) = 0x1eaa000 rt_sigaction(SIGINT, {0x40fec0, [INT], SA_RESTORER|SA_RESTART, 0x7ff22675b220}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGTERM, {0x40fec0, [TERM], SA_RESTORER|SA_RESTART, 0x7ff22675b220}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7ff22675b220}, {SIG_DFL, [], 0}, 8) = 0 rt_sigaction(SIGCHLD, {0x40fff0, ~[HUP INT QUIT ILL TRAP ABRT FPE PIPE CHLD CONT TTIN XFSZ WINCH IO SYS RTMIN RT_1 RT_3 RT_4 RT_16 RT_17 RT_18 RT_19 RT_20 RT_21 RT_22 RT_23 RT_24 RT_25 RT_26 RT_27 RT_28 RT_29 RT_30 RT_31], SA_RESTORER|SA_NOCLDSTOP, 0x7ff22675b220}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x40ffc0, [SEGV], SA_RESTORER|SA_RESTART, 0x7ff22675b220}, {SIG_DFL, [], 0}, 8) = 0 open("/etc/dropbear/dropbear_rsa_host_key", O_RDONLY) = 3 read(3, "\0\0\0\7ssh-rsa\0\0\0\1#\0\0\1\1\0\330\274\371\222\246\246\206\224\322\255\232"..., 1700) = 803 read(3, "", 897) = 0 close(3) = 0 open("/etc/dropbear/dropbear_dss_host_key", O_RDONLY) = 3 read(3, "\0\0\0\7ssh-dss\0\0\0\201\0\220/\333`8\270d\213\265\266\0\357=\r\263w"..., 1700) = 459 read(3, "", 1241) = 0 close(3) = 0 open("/dev/urandom", O_RDONLY) = 3 select(4, [3], NULL, NULL, {2, 0}) = 1 (in [3], left {1, 999995}) read(3, "?L\224B\21:~3\365\244\316\300|k\17\256B\0034\211\301\1\367\301Ka\334\356_\7s!", 32) = 32 close(3) = 0 socket(PF_NETLINK, SOCK_RAW, 0) = 3 bind(3, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 getsockname(3, {sa_family=AF_NETLINK, pid=763, groups=00000000}, [12]) = 0 gettimeofday({1277594087, 699982}, NULL) = 0 sendto(3, "\24\0\0\0\26\0\1\3\347\211&L\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"0\0\0\0\24\0\2\0\347\211&L\373\2\0\0\2\10\200\376\1\0\0\0\10\0\1\0\177\0\0\1"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 108 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"@\0\0\0\24\0\2\0\347\211&L\373\2\0\0\n\200\200\376\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 128 recvmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\24\0\0\0\3\0\2\0\347\211&L\373\2\0\0\0\0\0\0\1\0\0\0\24\0\1\0\0\0\0\0"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 close(3) = 0 open("/etc/gai.conf", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=2917, ...}) = 0 fstat(3, {st_mode=S_IFREG|0644, st_size=2917, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272ee000 read(3, "# Configuration for getaddrinfo("..., 4096) = 2917 read(3, "", 4096) = 0 close(3) = 0 munmap(0x7ff2272ee000, 4096) = 0 socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP) = 3 connect(3, {sa_family=AF_INET6, sin6_port=htons(22), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 getsockname(3, {sa_family=AF_INET6, sin6_port=htons(43058), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 connect(3, {sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, 16) = 0 connect(3, {sa_family=AF_INET, sin_port=htons(22), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 getsockname(3, {sa_family=AF_INET6, sin6_port=htons(34135), inet_pton(AF_INET6, "::ffff:127.0.0.1", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 0 close(3) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=5}, 8) = 0 setsockopt(3, SOL_TCP, TCP_NODELAY, [1], 4) = 0 setsockopt(3, SOL_IP, IP_TOS, [16], 4) = 0 setsockopt(3, SOL_SOCKET, SO_PRIORITY, [6], 4) = 0 bind(3, {sa_family=AF_INET, sin_port=htons(22), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EADDRINUSE (Address already in use) close(3) = 0 socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=5}, 8) = 0 setsockopt(3, SOL_TCP, TCP_NODELAY, [1], 4) = 0 setsockopt(3, SOL_IP, IP_TOS, [16], 4) = 0 setsockopt(3, SOL_SOCKET, SO_PRIORITY, [6], 4) = 0 bind(3, {sa_family=AF_INET6, sin6_port=htons(22), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EADDRINUSE (Address already in use) close(3) = 0 gettimeofday({1277594087, 709941}, NULL) = 0 open("/etc/localtime", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0 fstat(3, {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff2272ee000 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"..., 4096) = 2309 lseek(3, -1467, SEEK_CUR) = 842 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\t\0\0\0\0"..., 4096) = 1467 close(3) = 0 munmap(0x7ff2272ee000, 4096) = 0 getpid() = 763 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3 connect(3, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 ENOENT (No such file or directory) close(3) = 0 gettimeofday({1277594087, 714428}, NULL) = 0 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3 connect(3, {sa_family=AF_FILE, path="/dev/log"}, 110) = -1 ENOENT (No such file or directory) close(3) = 0 exit_group(1) = ?