root@aaa:~# strace useradd 1234
execve("/usr/sbin/useradd", ["useradd", "1234"], 0x7fff9385fac8 /* 12 vars */) = 0
brk(NULL)                               = 0x55c192283000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=51382, ...}) = 0
mmap(NULL, 51382, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a48000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`-\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=124848, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdc31a46000
mmap(NULL, 2261160, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc31605000
mprotect(0x7fdc31622000, 2097152, PROT_NONE) = 0
mmap(0x7fdc31822000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1d000) = 0x7fdc31822000
mmap(0x7fdc31824000, 37032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc31824000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20b\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=154832, ...}) = 0
mmap(NULL, 2259152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc313dd000
mprotect(0x7fdc31402000, 2093056, PROT_NONE) = 0
mmap(0x7fdc31601000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7fdc31601000
mmap(0x7fdc31603000, 6352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc31603000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libsemanage.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\322\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=256480, ...}) = 0
mmap(NULL, 2352656, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc3119e000
mprotect(0x7fdc311da000, 2097152, PROT_NONE) = 0
mmap(0x7fdc313da000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3c000) = 0x7fdc313da000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\34\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30dad000
mprotect(0x7fdc30f94000, 2097152, PROT_NONE) = 0
mmap(0x7fdc31194000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7fdc31194000
mmap(0x7fdc3119a000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc3119a000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcap-ng.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\23\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=18712, ...}) = 0
mmap(NULL, 2113848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30ba8000
mprotect(0x7fdc30bac000, 2093056, PROT_NONE) = 0
mmap(0x7fdc30dab000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fdc30dab000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \25\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=464824, ...}) = 0
mmap(NULL, 2560264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30936000
mprotect(0x7fdc309a6000, 2097152, PROT_NONE) = 0
mmap(0x7fdc30ba6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x70000) = 0x7fdc30ba6000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\16\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14560, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdc31a44000
mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30732000
mprotect(0x7fdc30735000, 2093056, PROT_NONE) = 0
mmap(0x7fdc30934000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fdc30934000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libsepol.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pg\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=701072, ...}) = 0
mmap(NULL, 2803600, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30485000
mprotect(0x7fdc3052e000, 2097152, PROT_NONE) = 0
mmap(0x7fdc3072e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa9000) = 0x7fdc3072e000
mmap(0x7fdc30730000, 6032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc30730000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libbz2.so.1.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \23\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=66728, ...}) = 0
mmap(NULL, 2161864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30275000
mprotect(0x7fdc30284000, 2093056, PROT_NONE) = 0
mmap(0x7fdc30483000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe000) = 0x7fdc30483000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000b\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=144976, ...}) = 0
mmap(NULL, 2221184, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdc30056000
mprotect(0x7fdc30070000, 2093056, PROT_NONE) = 0
mmap(0x7fdc3026f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7fdc3026f000
mmap(0x7fdc30271000, 13440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc30271000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdc31a42000
arch_prctl(ARCH_SET_FS, 0x7fdc31a43140) = 0
mprotect(0x7fdc31194000, 16384, PROT_READ) = 0
mprotect(0x7fdc3026f000, 4096, PROT_READ) = 0
mprotect(0x7fdc30483000, 4096, PROT_READ) = 0
mprotect(0x7fdc3072e000, 4096, PROT_READ) = 0
mprotect(0x7fdc30934000, 4096, PROT_READ) = 0
mprotect(0x7fdc30ba6000, 4096, PROT_READ) = 0
mprotect(0x7fdc30dab000, 4096, PROT_READ) = 0
mprotect(0x7fdc31822000, 4096, PROT_READ) = 0
mprotect(0x7fdc31601000, 4096, PROT_READ) = 0
mprotect(0x7fdc313da000, 4096, PROT_READ) = 0
mprotect(0x55c191da1000, 4096, PROT_READ) = 0
mprotect(0x7fdc31a55000, 4096, PROT_READ) = 0
munmap(0x7fdc31a48000, 51382)           = 0
set_tid_address(0x7fdc31a43410)         = 677
set_robust_list(0x7fdc31a43420, 24)     = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7fdc3005bcb0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fdc30068890}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7fdc3005bd50, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fdc30068890}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
statfs("/sys/fs/selinux", 0x7ffcb411a5c0) = -1 ENOENT (No such file or directory)
statfs("/selinux", 0x7ffcb411a5c0)      = -1 ENOENT (No such file or directory)
brk(NULL)                               = 0x55c192283000
brk(0x55c1922a4000)                     = 0x55c1922a4000
openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 481
read(3, "", 1024)                       = 0
close(3)                                = 0
access("/etc/selinux/config", F_OK)     = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3004224, ...}) = 0
mmap(NULL, 3004224, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc2fd78000
close(3)                                = 0
openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2995, ...}) = 0
read(3, "# Locale name alias data base.\n#"..., 512) = 512
read(3, "See the\n# GNU General Public Lic"..., 512) = 512
read(3, "nd for the time being for\n# back"..., 512) = 512
read(3, "hese lines were removed\n# becaus"..., 512) = 512
read(3, "8859-1\ngalego\t\tgl_ES.ISO-8859-1\n"..., 512) = 512
read(3, "O.ISO-8859-1 nb_NO.ISO-8859-1\nno"..., 512) = 435
read(3, "", 512)                        = 0
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_IDENTIFICATION", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=252, ...}) = 0
mmap(NULL, 252, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a54000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=26376, ...}) = 0
mmap(NULL, 26376, PROT_READ, MAP_SHARED, 3, 0) = 0x7fdc31a4d000
close(3)                                = 0
futex(0x7fdc31199a08, FUTEX_WAKE_PRIVATE, 2147483647) = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MEASUREMENT", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=23, ...}) = 0
mmap(NULL, 23, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a4c000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_TELEPHONE", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=47, ...}) = 0
mmap(NULL, 47, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a4b000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_ADDRESS", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=131, ...}) = 0
mmap(NULL, 131, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a4a000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_NAME", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=62, ...}) = 0
mmap(NULL, 62, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a49000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_PAPER", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=34, ...}) = 0
mmap(NULL, 34, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a48000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MESSAGES", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=3, ...}) = 0
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MESSAGES/SYS_LC_MESSAGES", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=48, ...}) = 0
mmap(NULL, 48, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a41000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MONETARY", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=270, ...}) = 0
mmap(NULL, 270, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc31a40000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_COLLATE", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=1516558, ...}) = 0
mmap(NULL, 1516558, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc318cd000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_TIME", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3360, ...}) = 0
mmap(NULL, 3360, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc318cc000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_NUMERIC", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=50, ...}) = 0
mmap(NULL, 50, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc318cb000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_CTYPE", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=199772, ...}) = 0
mmap(NULL, 199772, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdc3189a000
close(3)                                = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY) = 4
read(4, "65536\n", 31)                  = 6
close(4)                                = 0
mmap(NULL, 528384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdc2fcf7000
openat(AT_FDCWD, "/etc/login.defs", O_RDONLY) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=10550, ...}) = 0
read(4, "#\n# /etc/login.defs - Configurat"..., 512) = 512
read(4, "xes reside, _or_ name of file, r"..., 512) = 512
read(4, "is is no more used for setting u"..., 512) = 512
read(4, "gin failure info.\n# This option "..., 512) = 512
read(4, "ewgrp and sg.\n#\nSYSLOG_SU_ENAB\t\t"..., 512) = 512
read(4, "lay when running \"su -\".  For\n# "..., 512) = 512
read(4, "ists in the user's home director"..., 512) = 512
read(4, "permission.\n#\n# If you have a \"w"..., 512) = 512
read(4, " issuing \n# the \"mesg y\" command"..., 512) = 512
read(4, "or even 077, could be considered"..., 512) = 512
read(4, "7\nKILLCHAR\t025\nUMASK\t\t022\n\n#\n# P"..., 512) = 512
read(4, "ection in groupadd\n#\nGID_MIN\t\t\t "..., 512) = 512
read(4, "ular users using chfn - use\n# an"..., 512) = 512
read(4, "nt).\n#\n#USERDEL_CMD\t/usr/sbin/us"..., 512) = 512
read(4, "rameter\n# will be launched, alth"..., 512) = 512
read(4, "03:tty04\n\n#\n# List of groups to "..., 512) = 512
read(4, "algorithm compatible with the on"..., 512) = 512
read(4, "rd\n# If set to SHA512, SHA512-ba"..., 512) = 512
read(4, "hat it more CPU resources will b"..., 512) = 512
read(4, "te file in /etc/pam.d/ to\t#\n# en"..., 512) = 512
read(4, "                              #\n"..., 512) = 310
read(4, "", 512)                        = 0
close(4)                                = 0
access("/etc/shadow", F_OK)             = 0
access("/etc/gshadow", F_OK)            = 0
openat(AT_FDCWD, "/etc/default/useradd", O_RDONLY) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=1118, ...}) = 0
read(4, "# Default values for useradd(8)\n"..., 512) = 512
read(4, "me name as the user being added "..., 512) = 512
read(4, "hether the mail spool should be "..., 512) = 94
read(4, "", 512)                        = 0
close(4)                                = 0
access("/etc/subuid", F_OK)             = 0
access("/etc/subgid", F_OK)             = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(4)                                = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(4)                                = 0
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=513, ...}) = 0
read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 512) = 512
read(4, "\n", 512)                      = 1
read(4, "", 512)                        = 0
close(4)                                = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=51382, ...}) = 0
mmap(NULL, 51382, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7fdc3188d000
close(4)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\22\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=39744, ...}) = 0
mmap(NULL, 2136256, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fdc2faed000
mprotect(0x7fdc2faf5000, 2097152, PROT_NONE) = 0
mmap(0x7fdc2fcf5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x8000) = 0x7fdc2fcf5000
close(4)                                = 0
mprotect(0x7fdc2fcf5000, 4096, PROT_READ) = 0
munmap(0x7fdc3188d000, 51382)           = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=51382, ...}) = 0
mmap(NULL, 51382, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7fdc3188d000
close(4)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p \0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=47576, ...}) = 0
mmap(NULL, 2143624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fdc2f8e1000
mprotect(0x7fdc2f8ec000, 2093056, PROT_NONE) = 0
mmap(0x7fdc2faeb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xa000) = 0x7fdc2faeb000
close(4)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220@\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=97176, ...}) = 0
mmap(NULL, 2202200, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fdc2f6c7000
mprotect(0x7fdc2f6de000, 2093056, PROT_NONE) = 0
mmap(0x7fdc2f8dd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x16000) = 0x7fdc2f8dd000
mmap(0x7fdc2f8df000, 6744, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc2f8df000
close(4)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P#\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=47568, ...}) = 0
mmap(NULL, 2168632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fdc2f4b5000
mprotect(0x7fdc2f4c0000, 2093056, PROT_NONE) = 0
mmap(0x7fdc2f6bf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xa000) = 0x7fdc2f6bf000
mmap(0x7fdc2f6c1000, 22328, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdc2f6c1000
close(4)                                = 0
mprotect(0x7fdc2f6bf000, 4096, PROT_READ) = 0
mprotect(0x7fdc2f8dd000, 4096, PROT_READ) = 0
mprotect(0x7fdc2faeb000, 4096, PROT_READ) = 0
munmap(0x7fdc3188d000, 51382)           = 0
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
mmap(NULL, 1606, PROT_READ, MAP_SHARED, 4, 0) = 0x7fdc31899000
lseek(4, 1606, SEEK_SET)                = 1606
fstat(4, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
munmap(0x7fdc31899000, 1606)            = 0
close(4)                                = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=51382, ...}) = 0
mmap(NULL, 51382, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7fdc3188d000
close(4)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libnss_systemd.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`X\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=258040, ...}) = 0
mmap(NULL, 2355192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fdc2f276000
mprotect(0x7fdc2f2b2000, 2093056, PROT_NONE) = 0
mmap(0x7fdc2f4b1000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x3b000) = 0x7fdc2f4b1000
close(4)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/librt.so.1", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\"\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=31680, ...}) = 0
mmap(NULL, 2128864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7fdc2f06e000
mprotect(0x7fdc2f075000, 2093056, PROT_NONE) = 0
mmap(0x7fdc2f274000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7fdc2f274000
close(4)                                = 0
mprotect(0x7fdc2f274000, 4096, PROT_READ) = 0
mprotect(0x7fdc2f4b1000, 12288, PROT_READ) = 0
munmap(0x7fdc3188d000, 51382)           = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(4)                                = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(4)                                = 0
openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=660, ...}) = 0
mmap(NULL, 660, PROT_READ, MAP_SHARED, 4, 0) = 0x7fdc31899000
lseek(4, 660, SEEK_SET)                 = 660
fstat(4, {st_mode=S_IFREG|0644, st_size=660, ...}) = 0
munmap(0x7fdc31899000, 660)             = 0
close(4)                                = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
openat(AT_FDCWD, "/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 4
rt_sigaction(SIGALRM, {sa_handler=0x7fdc30ed4c50, sa_mask=~[], sa_flags=SA_RESTORER, sa_restorer=0x7fdc30debf20}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15)                               = 0
fcntl(4, F_SETLKW, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
alarm(0)                                = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7fdc30debf20}, NULL, 8) = 0
getpid()                                = 677
openat(AT_FDCWD, "/etc/passwd.677", O_WRONLY|O_CREAT|O_EXCL, 0600) = 5
getpid()                                = 677
write(5, "677\0", 4)                    = 4
close(5)                                = 0
link("/etc/passwd.677", "/etc/passwd.lock") = 0
stat("/etc/passwd.677", {st_mode=S_IFREG|0600, st_size=4, ...}) = 0
unlink("/etc/passwd.677")               = 0
openat(AT_FDCWD, "/etc/passwd", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 5
fcntl(5, F_GETFL)                       = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
read(5, "root:x:0:0:root:/root:/bin/bash\n"..., 8192) = 1606
read(5, "", 8192)                       = 0
getpid()                                = 677
openat(AT_FDCWD, "/etc/group.677", O_WRONLY|O_CREAT|O_EXCL, 0600) = 7
getpid()                                = 677
write(7, "677\0", 4)                    = 4
close(7)                                = 0
link("/etc/group.677", "/etc/group.lock") = 0
stat("/etc/group.677", {st_mode=S_IFREG|0600, st_size=4, ...}) = 0
unlink("/etc/group.677")                = 0
openat(AT_FDCWD, "/etc/group", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 7
fcntl(7, F_GETFL)                       = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fcntl(7, F_SETFD, FD_CLOEXEC)           = 0
fstat(7, {st_mode=S_IFREG|0644, st_size=660, ...}) = 0
read(7, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 512) = 512
read(7, "resolve:x:103:\ninput:x:104:\ncron"..., 512) = 148
read(7, "", 512)                        = 0
getpid()                                = 677
openat(AT_FDCWD, "/etc/gshadow.677", O_WRONLY|O_CREAT|O_EXCL, 0600) = 8
getpid()                                = 677
write(8, "677\0", 4)                    = 4
close(8)                                = 0
link("/etc/gshadow.677", "/etc/gshadow.lock") = 0
stat("/etc/gshadow.677", {st_mode=S_IFREG|0600, st_size=4, ...}) = 0
unlink("/etc/gshadow.677")              = 0
openat(AT_FDCWD, "/etc/gshadow", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 8
fcntl(8, F_GETFL)                       = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fcntl(8, F_SETFD, FD_CLOEXEC)           = 0
fstat(8, {st_mode=S_IFREG|0640, st_size=549, ...}) = 0
read(8, "root:*::\ndaemon:*::\nbin:*::\nsys:"..., 512) = 512
read(8, "\nrstudio-server:!::\nzeta:!::\naaa"..., 512) = 37
read(8, "", 512)                        = 0
getpid()                                = 677
openat(AT_FDCWD, "/etc/subuid.677", O_WRONLY|O_CREAT|O_EXCL, 0600) = 9
getpid()                                = 677
write(9, "677\0", 4)                    = 4
close(9)                                = 0
link("/etc/subuid.677", "/etc/subuid.lock") = 0
stat("/etc/subuid.677", {st_mode=S_IFREG|0600, st_size=4, ...}) = 0
unlink("/etc/subuid.677")               = 0
openat(AT_FDCWD, "/etc/subuid", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 9
fcntl(9, F_GETFL)                       = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fcntl(9, F_SETFD, FD_CLOEXEC)           = 0
fstat(9, {st_mode=S_IFREG|0644, st_size=55, ...}) = 0
read(9, "ubuntu:100000:65536\nzeta:165536:"..., 512) = 55
read(9, "", 512)                        = 0
getpid()                                = 677
openat(AT_FDCWD, "/etc/subgid.677", O_WRONLY|O_CREAT|O_EXCL, 0600) = 10
getpid()                                = 677
write(10, "677\0", 4)                   = 4
close(10)                               = 0
link("/etc/subgid.677", "/etc/subgid.lock") = 0
stat("/etc/subgid.677", {st_mode=S_IFREG|0600, st_size=4, ...}) = 0
unlink("/etc/subgid.677")               = 0
openat(AT_FDCWD, "/etc/subgid", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 10
fcntl(10, F_GETFL)                      = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fcntl(10, F_SETFD, FD_CLOEXEC)          = 0
fstat(10, {st_mode=S_IFREG|0644, st_size=55, ...}) = 0
read(10, "ubuntu:100000:65536\nzeta:165536:"..., 512) = 55
read(10, "", 512)                       = 0
brk(0x55c1922c7000)                     = 0x55c1922c7000
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 11
lseek(11, 0, SEEK_CUR)                  = 0
fstat(11, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
mmap(NULL, 1606, PROT_READ, MAP_SHARED, 11, 0) = 0x7fdc31899000
lseek(11, 1606, SEEK_SET)               = 1606
fstat(11, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
munmap(0x7fdc31899000, 1606)            = 0
close(11)                               = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
access("/etc/systemd/dont-synthesize-nobody", F_OK) = -1 ENOENT (No such file or directory)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
getpid()                                = 677
openat(AT_FDCWD, "/etc/shadow.677", O_WRONLY|O_CREAT|O_EXCL, 0600) = 11
getpid()                                = 677
write(11, "677\0", 4)                   = 4
close(11)                               = 0
link("/etc/shadow.677", "/etc/shadow.lock") = 0
stat("/etc/shadow.677", {st_mode=S_IFREG|0600, st_size=4, ...}) = 0
unlink("/etc/shadow.677")               = 0
openat(AT_FDCWD, "/etc/shadow", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 11
fcntl(11, F_GETFL)                      = 0x28802 (flags O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fcntl(11, F_SETFD, FD_CLOEXEC)          = 0
fstat(11, {st_mode=S_IFREG|0640, st_size=840, ...}) = 0
read(11, "root:*:18027:0:99999:7:::\ndaemon"..., 512) = 512
read(11, "systemd-resolve:*:18027:0:99999:"..., 512) = 328
read(11, "", 512)                       = 0
openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 12
lseek(12, 0, SEEK_CUR)                  = 0
fstat(12, {st_mode=S_IFREG|0644, st_size=660, ...}) = 0
mmap(NULL, 660, PROT_READ, MAP_SHARED, 12, 0) = 0x7fdc31899000
lseek(12, 660, SEEK_SET)                = 660
fstat(12, {st_mode=S_IFREG|0644, st_size=660, ...}) = 0
munmap(0x7fdc31899000, 660)             = 0
close(12)                               = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 12
fstat(12, {st_mode=S_IFREG|0644, st_size=127, ...}) = 0
fstat(12, {st_mode=S_IFREG|0644, st_size=127, ...}) = 0
read(12, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0"..., 512) = 127
lseek(12, -71, SEEK_CUR)                = 56
read(12, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0"..., 512) = 71
close(12)                               = 0
getpid()                                = 677
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 12
connect(12, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0
sendto(12, "<86>Mar 21 14:01:59 useradd[677]"..., 64, MSG_NOSIGNAL, NULL, 0) = 64
readlink("/proc/self/exe", "/usr/sbin/useradd", 4096) = 17
ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117f70)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 3 entries */, 32768)    = 72
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/1", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117f70)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 3 entries */, 32768)    = 72
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(2, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/2", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117f70)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 3 entries */, 32768)    = 72
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
sendto(3, {{len=112, type=0x45c /* NLMSG_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x67\x72\x6f\x75\x70\x20\x61\x63\x63\x74\x3d\x22\x31\x32\x33\x34\x22\x20\x65\x78\x65\x3d"...}, 112, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 112
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, {{len=132, type=NLMSG_ERROR, flags=0, seq=1, pid=677}, {error=-ECONNREFUSED, msg={{len=112, type=0x45c /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x67\x72\x6f\x75\x70\x20\x61\x63\x63\x74\x3d\x22\x31\x32\x33\x34\x22\x20\x65\x78\x65\x3d"...}}}, 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 132
recvfrom(3, {{len=132, type=NLMSG_ERROR, flags=0, seq=1, pid=677}, {error=-ECONNREFUSED, msg={{len=112, type=0x45c /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=1, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x67\x72\x6f\x75\x70\x20\x61\x63\x63\x74\x3d\x22\x31\x32\x33\x34\x22\x20\x65\x78\x65\x3d"...}}}, 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 132
getpid()                                = 677
sendto(12, "<86>Mar 21 14:01:59 useradd[677]"..., 105, MSG_NOSIGNAL, NULL, 0) = 105
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 13
lseek(13, 0, SEEK_CUR)                  = 0
fstat(13, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
mmap(NULL, 1606, PROT_READ, MAP_SHARED, 13, 0) = 0x7fdc31899000
lseek(13, 1606, SEEK_SET)               = 1606
fstat(13, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
munmap(0x7fdc31899000, 1606)            = 0
close(13)                               = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
access("/var/log/faillog", F_OK)        = 0
openat(AT_FDCWD, "/var/log/faillog", O_RDWR) = 13
lseek(13, 32288, SEEK_SET)              = 32288
write(13, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 32) = 32
fsync(13)                               = 0
close(13)                               = 0
access("/var/log/lastlog", F_OK)        = 0
openat(AT_FDCWD, "/var/log/lastlog", O_RDWR) = 13
lseek(13, 294628, SEEK_SET)             = 294628
write(13, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 292) = 292
fsync(13)                               = 0
close(13)                               = 0
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 13
lseek(13, 0, SEEK_CUR)                  = 0
fstat(13, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
mmap(NULL, 1606, PROT_READ, MAP_SHARED, 13, 0) = 0x7fdc31899000
lseek(13, 1606, SEEK_SET)               = 1606
fstat(13, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
munmap(0x7fdc31899000, 1606)            = 0
close(13)                               = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 13
lseek(13, 0, SEEK_CUR)                  = 0
fstat(13, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
mmap(NULL, 1606, PROT_READ, MAP_SHARED, 13, 0) = 0x7fdc31899000
lseek(13, 1606, SEEK_SET)               = 1606
fstat(13, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
munmap(0x7fdc31899000, 1606)            = 0
close(13)                               = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117d70)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 3 entries */, 32768)    = 72
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/1", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117d70)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 3 entries */, 32768)    = 72
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(2, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/2", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117d70)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 3 entries */, 32768)    = 72
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
fstat(13, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(13, /* 24 entries */, 32768)   = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(13, /* 0 entries */, 32768)    = 0
close(13)                               = 0
sendto(3, {{len=104, type=0x45a /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=2, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x75\x73\x65\x72\x20\x69\x64\x3d\x31\x30\x30\x39\x20\x65\x78\x65\x3d\x22\x2f\x75\x73\x72"...}, 104, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 104
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, {{len=124, type=NLMSG_ERROR, flags=0, seq=2, pid=677}, {error=-ECONNREFUSED, msg={{len=104, type=0x45a /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=2, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x75\x73\x65\x72\x20\x69\x64\x3d\x31\x30\x30\x39\x20\x65\x78\x65\x3d\x22\x2f\x75\x73\x72"...}}}, 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 124
recvfrom(3, {{len=124, type=NLMSG_ERROR, flags=0, seq=2, pid=677}, {error=-ECONNREFUSED, msg={{len=104, type=0x45a /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=2, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x75\x73\x65\x72\x20\x69\x64\x3d\x31\x30\x30\x39\x20\x65\x78\x65\x3d\x22\x2f\x75\x73\x72"...}}}, 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 124
fstat(5, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
umask(0777)                             = 022
openat(AT_FDCWD, "/etc/passwd-", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 13
umask(022)                              = 0777
fchown(13, 0, 0)                        = 0
fchmod(13, 0644)                        = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "root:x:0:0:root:/root:/bin/bash\n"..., 8192) = 1606
fstat(13, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
read(5, "", 8192)                       = 0
write(13, "root:x:0:0:root:/root:/bin/bash\n"..., 1606) = 1606
fsync(13)                               = 0
close(13)                               = 0
utime("/etc/passwd-", {actime=1584799295 /* 2020-03-21T14:01:35+0000 */, modtime=1584799282 /* 2020-03-21T14:01:22+0000 */}) = 0
close(5)                                = 0
umask(0777)                             = 022
openat(AT_FDCWD, "/etc/passwd+", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5
umask(022)                              = 0777
fchown(5, 0, 0)                         = 0
fchmod(5, 0644)                         = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
write(5, "root:x:0:0:root:/root:/bin/bash\n"..., 1643) = 1643
fsync(5)                                = 0
close(5)                                = 0
lstat("/etc/passwd", {st_mode=S_IFREG|0644, st_size=1606, ...}) = 0
rename("/etc/passwd+", "/etc/passwd")   = 0
fstat(11, {st_mode=S_IFREG|0640, st_size=840, ...}) = 0
fstat(11, {st_mode=S_IFREG|0640, st_size=840, ...}) = 0
umask(0777)                             = 022
openat(AT_FDCWD, "/etc/shadow-", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5
umask(022)                              = 0777
fchown(5, 0, 42)                        = 0
fchmod(5, 0640)                         = 0
lseek(11, 0, SEEK_SET)                  = 0
read(11, "root:*:18027:0:99999:7:::\ndaemon"..., 512) = 512
fstat(5, {st_mode=S_IFREG|0640, st_size=0, ...}) = 0
read(11, "systemd-resolve:*:18027:0:99999:"..., 512) = 328
read(11, "", 512)                       = 0
write(5, "root:*:18027:0:99999:7:::\ndaemon"..., 840) = 840
fsync(5)                                = 0
close(5)                                = 0
utime("/etc/shadow-", {actime=1584790501 /* 2020-03-21T11:35:01+0000 */, modtime=1584790264 /* 2020-03-21T11:31:04+0000 */}) = 0
close(11)                               = 0
umask(0777)                             = 022
openat(AT_FDCWD, "/etc/shadow+", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5
umask(022)                              = 0777
fchown(5, 0, 42)                        = -1 EPERM (Operation not permitted)
close(5)                                = 0
unlink("/etc/shadow+")                  = 0
openat(AT_FDCWD, "/usr/share/locale/C.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/C.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/C/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale-langpack/C.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale-langpack/C.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale-langpack/C/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "useradd: failure while writing c"..., 54useradd: failure while writing changes to /etc/shadow
) = 54
getpid()                                = 677
sendto(12, "<83>Mar 21 14:01:59 useradd[677]"..., 78, MSG_NOSIGNAL, NULL, 0) = 78
unlink("/etc/shadow.lock")              = 0
unlink("/etc/passwd.lock")              = 0
close(7)                                = 0
unlink("/etc/group.lock")               = 0
close(8)                                = 0
unlink("/etc/gshadow.lock")             = 0
close(9)                                = 0
unlink("/etc/subuid.lock")              = 0
close(10)                               = 0
unlink("/etc/subgid.lock")              = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdc31a43410) = 678
wait4(678, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], 0, NULL) = 678
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=678, si_uid=0, si_status=127, si_utime=0, si_stime=0} ---
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fdc31a43410) = 679
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=679, si_uid=0, si_status=127, si_utime=0, si_stime=0} ---
wait4(679, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], 0, NULL) = 679
close(4)                                = 0
ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117f50)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(4, /* 3 entries */, 32768)     = 72
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(4, /* 24 entries */, 32768)    = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(4, /* 24 entries */, 32768)    = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/1", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117f50)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(4, /* 3 entries */, 32768)     = 72
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(4, /* 24 entries */, 32768)    = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(4, /* 24 entries */, 32768)    = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat(2, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
readlink("/proc/self/fd/2", "/dev/pts/5", 31) = 10
stat("/dev/pts/5", 0x7ffcb4117f50)      = -1 ENOENT (No such file or directory)
stat("/dev/pts/", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
openat(AT_FDCWD, "/dev/pts/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(4, /* 3 entries */, 32768)     = 72
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(4, /* 24 entries */, 32768)    = 648
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
openat(AT_FDCWD, "/dev/", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
getdents(4, /* 24 entries */, 32768)    = 648
stat("/dev/.", {st_mode=S_IFDIR|0755, st_size=480, ...}) = 0
stat("/dev/..", {st_mode=S_IFDIR|0755, st_size=62, ...}) = 0
stat("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0
stat("/dev/initctl", {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
stat("/dev/core", {st_mode=S_IFREG|0400, st_size=140737477885952, ...}) = 0
stat("/dev/shm", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/ptmx", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 2), ...}) = 0
stat("/dev/fd", {st_mode=S_IFDIR|0500, st_size=0, ...}) = 0
stat("/dev/console", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
stat("/dev/.lxd-mounts", {st_mode=S_IFDIR|0711, st_size=40, ...}) = 0
stat("/dev/lxd", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/mqueue", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=40, ...}) = 0
stat("/dev/net", {st_mode=S_IFDIR|0755, st_size=60, ...}) = 0
stat("/dev/fuse", {st_mode=S_IFCHR|0666, st_rdev=makedev(10, 229), ...}) = 0
stat("/dev/zero", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 5), ...}) = 0
stat("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
stat("/dev/tty", {st_mode=S_IFCHR|0666, st_rdev=makedev(5, 0), ...}) = 0
stat("/dev/random", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 8), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
stat("/dev/full", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 7), ...}) = 0
stat("/dev/pts", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
getdents(4, /* 0 entries */, 32768)     = 0
close(4)                                = 0
sendto(3, {{len=108, type=0x45a /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=3, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x75\x73\x65\x72\x20\x61\x63\x63\x74\x3d\x22\x31\x32\x33\x34\x22\x20\x65\x78\x65\x3d\x22"...}, 108, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 108
poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3, {{len=128, type=NLMSG_ERROR, flags=0, seq=3, pid=677}, {error=-ECONNREFUSED, msg={{len=108, type=0x45a /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=3, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x75\x73\x65\x72\x20\x61\x63\x63\x74\x3d\x22\x31\x32\x33\x34\x22\x20\x65\x78\x65\x3d\x22"...}}}, 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 128
recvfrom(3, {{len=128, type=NLMSG_ERROR, flags=0, seq=3, pid=677}, {error=-ECONNREFUSED, msg={{len=108, type=0x45a /* AUDIT_??? */, flags=NLM_F_REQUEST|NLM_F_ACK, seq=3, pid=0}, "\x6f\x70\x3d\x61\x64\x64\x69\x6e\x67\x20\x75\x73\x65\x72\x20\x61\x63\x63\x74\x3d\x22\x31\x32\x33\x34\x22\x20\x65\x78\x65\x3d\x22"...}}}, 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 128
getpid()                                = 677
sendto(12, "<86>Mar 21 14:01:59 useradd[677]"..., 73, MSG_NOSIGNAL, NULL, 0) = 73
exit_group(1)                           = ?
+++ exited with 1 +++