> Please post the output of:
...
++++++++++++++++++++++++++++++
# strace /usr/sbin/groupadd -g 117 ssh
execve("/usr/sbin/groupadd", ["/usr/sbin/groupadd", "-g", "117", "ssh"],
[/* 25 vars */]) = 0
brk(0) = 0x7f17b5210000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4320000
access("/etc/ld.so.preload", R_OK) = 0
open("/etc/ld.so.preload", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
close(3) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=44647, ...}) = 0
mmap(NULL, 44647, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f17b4315000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20*\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=113024, ...}) = 0
mmap(NULL, 2249344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b3ccd000
mprotect(0x7f17b3ce7000, 2093056, PROT_NONE) = 0
mmap(0x7f17b3ee6000, 12288, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7f17b3ee6000
mmap(0x7f17b3ee9000, 37504, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3ee9000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20c\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=142728, ...}) = 0
mmap(NULL, 2246896, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b3aa8000
mprotect(0x7f17b3ac9000, 2097152, PROT_NONE) = 0
mmap(0x7f17b3cc9000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x21000) = 0x7f17b3cc9000
mmap(0x7f17b3ccb000, 6384, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3ccb000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\34\2\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1738176, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4314000
mmap(NULL, 3844640, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b36fd000
mprotect(0x7f17b389f000, 2093056, PROT_NONE) = 0
mmap(0x7f17b3a9e000, 24576, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a1000) = 0x7f17b3a9e000
mmap(0x7f17b3aa4000, 14880, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3aa4000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\27\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=448440, ...}) = 0
mmap(NULL, 2543976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b348f000
mprotect(0x7f17b34fb000, 2097152, PROT_NONE) = 0
mmap(0x7f17b36fb000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6c000) = 0x7f17b36fb000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14664, ...}) = 0
mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b328b000
mprotect(0x7f17b328e000, 2093056, PROT_NONE) = 0
mmap(0x7f17b348d000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f17b348d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20o\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=137440, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4313000
mmap(NULL, 2213008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b306e000
mprotect(0x7f17b3086000, 2093056, PROT_NONE) = 0
mmap(0x7f17b3285000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7f17b3285000
mmap(0x7f17b3287000, 13456, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3287000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4312000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4310000
arch_prctl(ARCH_SET_FS, 0x7f17b4310800) = 0
mprotect(0x7f17b3a9e000, 16384, PROT_READ) = 0
mprotect(0x7f17b3285000, 4096, PROT_READ) = 0
mprotect(0x7f17b348d000, 4096, PROT_READ) = 0
mprotect(0x7f17b36fb000, 4096, PROT_READ) = 0
mprotect(0x7f17b3cc9000, 4096, PROT_READ) = 0
mprotect(0x7f17b3ee6000, 8192, PROT_READ) = 0
mprotect(0x7f17b4322000, 4096, PROT_READ) = 0
mprotect(0x7f17b4113000, 4096, PROT_READ) = 0
munmap(0x7f17b4315000, 44647) = 0
set_tid_address(0x7f17b4310ad0) = 4240
set_robust_list(0x7f17b4310ae0, 24) = 0
rt_sigaction(SIGRTMIN, {0x7f17b30749f0, [], SA_RESTORER|SA_SIGINFO,
0x7f17b307d8d0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {0x7f17b3074a80, [],
SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f17b307d8d0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
statfs("/sys/fs/selinux", 0x7ffd3872a820) = -1 ENOENT (No such file or
directory)
statfs("/selinux", 0x7ffd3872a820) = -1 ENOENT (No such file or
directory)
brk(0) = 0x7f17b5210000
brk(0x7f17b5231000) = 0x7f17b5231000
open("/proc/filesystems", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 362
read(3, "", 1024) = 0
close(3) = 0
munmap(0x7f17b431f000, 4096) = 0
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=1607712, ...}) = 0
mmap(NULL, 1607712, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f17b4187000
close(3) = 0
socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl(3, F_SETFD, FD_CLOEXEC) = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) =
-1 ENOENT (No such file or directory)
close(4) = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) =
-1 ENOENT (No such file or directory)
close(4) = 0
open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=497, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 497
read(4, "", 4096) = 0
close(4) = 0
munmap(0x7f17b431f000, 4096) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=44647, ...}) = 0
mmap(NULL, 44647, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f17b4315000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\23\0\0\0\0\0\0"...,
832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=31632, ...}) = 0
mmap(NULL, 2126976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2e66000
mprotect(0x7f17b2e6d000, 2093056, PROT_NONE) = 0
mmap(0x7f17b306c000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7f17b306c000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`A\0\0\0\0\0\0"..., 832)
= 832
fstat(4, {st_mode=S_IFREG|0644, st_size=89104, ...}) = 0
mmap(NULL, 2194072, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2c4e000
mprotect(0x7f17b2c63000, 2093056, PROT_NONE) = 0
mmap(0x7f17b2e62000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x14000) = 0x7f17b2e62000
mmap(0x7f17b2e64000, 6808, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b2e64000
close(4) = 0
mprotect(0x7f17b2e62000, 4096, PROT_READ) = 0
mprotect(0x7f17b306c000, 4096, PROT_READ) = 0
munmap(0x7f17b4315000, 44647) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=44647, ...}) = 0
mmap(NULL, 44647, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f17b4315000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240!\0\0\0\0\0\0"...,
832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=43592, ...}) = 0
mmap(NULL, 2139560, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2a43000
mprotect(0x7f17b2a4d000, 2093056, PROT_NONE) = 0
mmap(0x7f17b2c4c000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x9000) = 0x7f17b2c4c000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\"\0\0\0\0\0\0"...,
832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=47712, ...}) = 0
mmap(NULL, 2144392, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2837000
mprotect(0x7f17b2842000, 2093056, PROT_NONE) = 0
mmap(0x7f17b2a41000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xa000) = 0x7f17b2a41000
close(4) = 0
mprotect(0x7f17b2a41000, 4096, PROT_READ) = 0
mprotect(0x7f17b2c4c000, 4096, PROT_READ) = 0
munmap(0x7f17b4315000, 44647) = 0
open("/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
mmap(NULL, 813, PROT_READ, MAP_SHARED, 4, 0) = 0x7f17b431f000
lseek(4, 813, SEEK_SET) = 813
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
munmap(0x7f17b431f000, 813) = 0
close(4) = 0
open("/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
mmap(NULL, 813, PROT_READ, MAP_SHARED, 4, 0) = 0x7f17b431f000
lseek(4, 813, SEEK_SET) = 813
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
munmap(0x7f17b431f000, 813) = 0
close(4) = 0
access("/etc/gshadow", F_OK) = 0
open("/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 4
rt_sigaction(SIGALRM, {0x7f17b37eada0, ~[], SA_RESTORER,
0x7f17b37320e0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
alarm(0) = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {SIG_DFL, [], SA_RESTORER, 0x7f17b37320e0}, NULL,
8) = 0
open("/etc/group.4240", O_WRONLY|O_CREAT|O_EXCL, 0600) = 5
write(5, "4240\0", 5) = 5
close(5) = 0
link("/etc/group.4240", "/etc/group.lock") = 0
stat("/etc/group.4240", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/group.4240") = 0
open("/etc/gshadow.4240", O_WRONLY|O_CREAT|O_EXCL, 0600) = 5
write(5, "4240\0", 5) = 5
close(5) = 0
link("/etc/gshadow.4240", "/etc/gshadow.lock") = 0
stat("/etc/gshadow.4240", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/gshadow.4240") = 0
open("/etc/group", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 5
fcntl(5, F_GETFL) = 0x28802 (flags
O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fstat(5, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
lseek(5, 0, SEEK_CUR) = 0
fcntl(5, F_SETFD, FD_CLOEXEC) = 0
read(5, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 813
read(5, "", 4096) = 0
open("/etc/login.defs", O_RDONLY) = 6
fstat(6, {st_mode=S_IFREG|0644, st_size=10478, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431e000
read(6, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
read(6, " issuing \n# the \"mesg y\" command"..., 4096) = 4096
read(6, "It supports passwords of unlimit"..., 4096) = 2286
read(6, "", 4096) = 0
close(6) = 0
munmap(0x7f17b431e000, 4096) = 0
open("/etc/gshadow", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 6
fcntl(6, F_GETFL) = 0x28802 (flags
O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fstat(6, {st_mode=S_IFREG|0640, st_size=689, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431e000
lseek(6, 0, SEEK_CUR) = 0
fcntl(6, F_SETFD, FD_CLOEXEC) = 0
read(6, "root:*::\ndaemon:*::\nbin:*::\nsys:"..., 4096) = 689
read(6, "", 4096) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
umask(077) = 022
open("/etc/group-", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 7
umask(022) = 077
lseek(5, 0, SEEK_SET) = 0
read(5, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 813
fstat(7, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431d000
read(5, "", 4096) = 0
write(7, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 813) = 813
fsync(7) = 0
close(7) = 0
munmap(0x7f17b431d000, 4096) = 0
utime("/etc/group-", [2016/04/25-20:45:25, 2016/04/25-20:45:25]) = 0
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
umask(0777) = 022
open("/etc/group+", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5
umask(022) = 0777
fchown(5, 0, 0) = 0
fchmod(5, 0644) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
write(5, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 824) = 824
fsync(5) = 0
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
lstat("/etc/group", {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
rename("/etc/group+", "/etc/group") = -1 EBUSY (Device or resource busy)
open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=2492, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(5, "# Locale name alias data base.\n#"..., 4096) = 2492
read(5, "", 4096) = 0
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
open("/usr/share/locale/en_US/LC_MESSAGES/shadow.mo", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT
(No such file or directory)
write(2, "groupadd: failure while writing "..., 54groupadd: failure
while writing changes to /etc/group
) = 54
open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(5,
"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"...,
4096) = 2309
lseek(5, -1467, SEEK_CUR) = 842
read(5,
"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\t\0\0\0\0"..., 4096)
= 1467
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
connect(5, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = 0
sendto(5, "<83>Apr 25 22:22:37 groupadd[424"..., 75, MSG_NOSIGNAL, NULL,
0) = 75
readlink("/proc/self/exe", "/usr/sbin/groupadd", 4096) = 18
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
{B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/0", 31) = 10
stat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0),
...}) = 0
sendto(3, "\200\0\0\0\\\4\5\0\1\0\0\0\0\0\0\0op=adding group "..., 128,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 128
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\1\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\1\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
groups=00000000}, [12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\1\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\1\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
sendto(5, "<83>Apr 25 22:22:37 groupadd[424"..., 73, MSG_NOSIGNAL, NULL,
0) = 73
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
{B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/0", 31) = 10
stat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0),
...}) = 0
sendto(3, "\200\0\0\0\\\4\5\0\2\0\0\0\0\0\0\0op=adding group "..., 128,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 128
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\2\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\2\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
groups=00000000}, [12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\2\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\2\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
sendto(5, "<83>Apr 25 22:22:37 groupadd[424"..., 59, MSG_NOSIGNAL, NULL,
0) = 59
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
{B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/0", 31) = 10
stat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0),
...}) = 0
sendto(3, "d\0\0\0\\\4\5\0\3\0\0\0\0\0\0\0op= acct=\"ssh\" e"..., 100,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 100
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\3\0\0\0\220\20\0\0\0\0\0\0d\0\0\0\\\4\5\0\3\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
groups=00000000}, [12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\3\0\0\0\220\20\0\0\0\0\0\0d\0\0\0\\\4\5\0\3\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
close(6) = 0
munmap(0x7f17b431e000, 4096) = 0
unlink("/etc/gshadow.lock") = 0
unlink("/etc/group.lock") = 0
close(4) = 0
exit_group(10) = ?
+++ exited with 10 +++
root@michael-wst:~# strace /usr/sbin/groupadd -g 117 ssh 2>&1> strace
execve("/usr/sbin/groupadd", ["/usr/sbin/groupadd", "-g", "117", "ssh"],
[/* 25 vars */]) = 0
brk(0) = 0x7f17b5210000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4320000
access("/etc/ld.so.preload", R_OK) = 0
open("/etc/ld.so.preload", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
close(3) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=44647, ...}) = 0
mmap(NULL, 44647, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f17b4315000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20*\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=113024, ...}) = 0
mmap(NULL, 2249344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b3ccd000
mprotect(0x7f17b3ce7000, 2093056, PROT_NONE) = 0
mmap(0x7f17b3ee6000, 12288, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7f17b3ee6000
mmap(0x7f17b3ee9000, 37504, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3ee9000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20c\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=142728, ...}) = 0
mmap(NULL, 2246896, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b3aa8000
mprotect(0x7f17b3ac9000, 2097152, PROT_NONE) = 0
mmap(0x7f17b3cc9000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x21000) = 0x7f17b3cc9000
mmap(0x7f17b3ccb000, 6384, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3ccb000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\34\2\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1738176, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4314000
mmap(NULL, 3844640, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b36fd000
mprotect(0x7f17b389f000, 2093056, PROT_NONE) = 0
mmap(0x7f17b3a9e000, 24576, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a1000) = 0x7f17b3a9e000
mmap(0x7f17b3aa4000, 14880, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3aa4000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\27\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=448440, ...}) = 0
mmap(NULL, 2543976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b348f000
mprotect(0x7f17b34fb000, 2097152, PROT_NONE) = 0
mmap(0x7f17b36fb000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6c000) = 0x7f17b36fb000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14664, ...}) = 0
mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b328b000
mprotect(0x7f17b328e000, 2093056, PROT_NONE) = 0
mmap(0x7f17b348d000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f17b348d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20o\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=137440, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4313000
mmap(NULL, 2213008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3,
0) = 0x7f17b306e000
mprotect(0x7f17b3086000, 2093056, PROT_NONE) = 0
mmap(0x7f17b3285000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7f17b3285000
mmap(0x7f17b3287000, 13456, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b3287000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4312000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b4310000
arch_prctl(ARCH_SET_FS, 0x7f17b4310800) = 0
mprotect(0x7f17b3a9e000, 16384, PROT_READ) = 0
mprotect(0x7f17b3285000, 4096, PROT_READ) = 0
mprotect(0x7f17b348d000, 4096, PROT_READ) = 0
mprotect(0x7f17b36fb000, 4096, PROT_READ) = 0
mprotect(0x7f17b3cc9000, 4096, PROT_READ) = 0
mprotect(0x7f17b3ee6000, 8192, PROT_READ) = 0
mprotect(0x7f17b4322000, 4096, PROT_READ) = 0
mprotect(0x7f17b4113000, 4096, PROT_READ) = 0
munmap(0x7f17b4315000, 44647) = 0
set_tid_address(0x7f17b4310ad0) = 4240
set_robust_list(0x7f17b4310ae0, 24) = 0
rt_sigaction(SIGRTMIN, {0x7f17b30749f0, [], SA_RESTORER|SA_SIGINFO,
0x7f17b307d8d0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {0x7f17b3074a80, [],
SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f17b307d8d0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
statfs("/sys/fs/selinux", 0x7ffd3872a820) = -1 ENOENT (No such file or
directory)
statfs("/selinux", 0x7ffd3872a820) = -1 ENOENT (No such file or
directory)
brk(0) = 0x7f17b5210000
brk(0x7f17b5231000) = 0x7f17b5231000
open("/proc/filesystems", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 362
read(3, "", 1024) = 0
close(3) = 0
munmap(0x7f17b431f000, 4096) = 0
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=1607712, ...}) = 0
mmap(NULL, 1607712, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f17b4187000
close(3) = 0
socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 3
fcntl(3, F_SETFD, FD_CLOEXEC) = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) =
-1 ENOENT (No such file or directory)
close(4) = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) =
-1 ENOENT (No such file or directory)
close(4) = 0
open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=497, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 497
read(4, "", 4096) = 0
close(4) = 0
munmap(0x7f17b431f000, 4096) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=44647, ...}) = 0
mmap(NULL, 44647, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f17b4315000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\23\0\0\0\0\0\0"...,
832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=31632, ...}) = 0
mmap(NULL, 2126976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2e66000
mprotect(0x7f17b2e6d000, 2093056, PROT_NONE) = 0
mmap(0x7f17b306c000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7f17b306c000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`A\0\0\0\0\0\0"..., 832)
= 832
fstat(4, {st_mode=S_IFREG|0644, st_size=89104, ...}) = 0
mmap(NULL, 2194072, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2c4e000
mprotect(0x7f17b2c63000, 2093056, PROT_NONE) = 0
mmap(0x7f17b2e62000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x14000) = 0x7f17b2e62000
mmap(0x7f17b2e64000, 6808, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f17b2e64000
close(4) = 0
mprotect(0x7f17b2e62000, 4096, PROT_READ) = 0
mprotect(0x7f17b306c000, 4096, PROT_READ) = 0
munmap(0x7f17b4315000, 44647) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=44647, ...}) = 0
mmap(NULL, 44647, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f17b4315000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240!\0\0\0\0\0\0"...,
832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=43592, ...}) = 0
mmap(NULL, 2139560, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2a43000
mprotect(0x7f17b2a4d000, 2093056, PROT_NONE) = 0
mmap(0x7f17b2c4c000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x9000) = 0x7f17b2c4c000
close(4) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or
directory)
open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4,
"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\"\0\0\0\0\0\0"...,
832) = 832
fstat(4, {st_mode=S_IFREG|0644, st_size=47712, ...}) = 0
mmap(NULL, 2144392, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
0) = 0x7f17b2837000
mprotect(0x7f17b2842000, 2093056, PROT_NONE) = 0
mmap(0x7f17b2a41000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xa000) = 0x7f17b2a41000
close(4) = 0
mprotect(0x7f17b2a41000, 4096, PROT_READ) = 0
mprotect(0x7f17b2c4c000, 4096, PROT_READ) = 0
munmap(0x7f17b4315000, 44647) = 0
open("/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
mmap(NULL, 813, PROT_READ, MAP_SHARED, 4, 0) = 0x7f17b431f000
lseek(4, 813, SEEK_SET) = 813
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
munmap(0x7f17b431f000, 813) = 0
close(4) = 0
open("/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
mmap(NULL, 813, PROT_READ, MAP_SHARED, 4, 0) = 0x7f17b431f000
lseek(4, 813, SEEK_SET) = 813
fstat(4, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
munmap(0x7f17b431f000, 813) = 0
close(4) = 0
access("/etc/gshadow", F_OK) = 0
open("/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 4
rt_sigaction(SIGALRM, {0x7f17b37eada0, ~[], SA_RESTORER,
0x7f17b37320e0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
alarm(0) = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {SIG_DFL, [], SA_RESTORER, 0x7f17b37320e0}, NULL,
8) = 0
open("/etc/group.4240", O_WRONLY|O_CREAT|O_EXCL, 0600) = 5
write(5, "4240\0", 5) = 5
close(5) = 0
link("/etc/group.4240", "/etc/group.lock") = 0
stat("/etc/group.4240", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/group.4240") = 0
open("/etc/gshadow.4240", O_WRONLY|O_CREAT|O_EXCL, 0600) = 5
write(5, "4240\0", 5) = 5
close(5) = 0
link("/etc/gshadow.4240", "/etc/gshadow.lock") = 0
stat("/etc/gshadow.4240", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/gshadow.4240") = 0
open("/etc/group", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 5
fcntl(5, F_GETFL) = 0x28802 (flags
O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fstat(5, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
lseek(5, 0, SEEK_CUR) = 0
fcntl(5, F_SETFD, FD_CLOEXEC) = 0
read(5, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 813
read(5, "", 4096) = 0
open("/etc/login.defs", O_RDONLY) = 6
fstat(6, {st_mode=S_IFREG|0644, st_size=10478, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431e000
read(6, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
read(6, " issuing \n# the \"mesg y\" command"..., 4096) = 4096
read(6, "It supports passwords of unlimit"..., 4096) = 2286
read(6, "", 4096) = 0
close(6) = 0
munmap(0x7f17b431e000, 4096) = 0
open("/etc/gshadow", O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 6
fcntl(6, F_GETFL) = 0x28802 (flags
O_RDWR|O_NONBLOCK|O_LARGEFILE|O_NOFOLLOW)
fstat(6, {st_mode=S_IFREG|0640, st_size=689, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431e000
lseek(6, 0, SEEK_CUR) = 0
fcntl(6, F_SETFD, FD_CLOEXEC) = 0
read(6, "root:*::\ndaemon:*::\nbin:*::\nsys:"..., 4096) = 689
read(6, "", 4096) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
umask(077) = 022
open("/etc/group-", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 7
umask(022) = 077
lseek(5, 0, SEEK_SET) = 0
read(5, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 4096) = 813
fstat(7, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431d000
read(5, "", 4096) = 0
write(7, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 813) = 813
fsync(7) = 0
close(7) = 0
munmap(0x7f17b431d000, 4096) = 0
utime("/etc/group-", [2016/04/25-20:45:25, 2016/04/25-20:45:25]) = 0
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
umask(0777) = 022
open("/etc/group+", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5
umask(022) = 0777
fchown(5, 0, 0) = 0
fchmod(5, 0644) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
write(5, "root:x:0:\ndaemon:x:1:\nbin:x:2:\ns"..., 824) = 824
fsync(5) = 0
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
lstat("/etc/group", {st_mode=S_IFREG|0644, st_size=813, ...}) = 0
rename("/etc/group+", "/etc/group") = -1 EBUSY (Device or resource busy)
open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=2492, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(5, "# Locale name alias data base.\n#"..., 4096) = 2492
read(5, "", 4096) = 0
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
open("/usr/share/locale/en_US/LC_MESSAGES/shadow.mo", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT
(No such file or directory)
write(2, "groupadd: failure while writing "..., 54groupadd: failure
while writing changes to /etc/group
) = 54
open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0
fstat(5, {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7f17b431f000
read(5,
"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"...,
4096) = 2309
lseek(5, -1467, SEEK_CUR) = 842
read(5,
"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\t\0\0\0\t\0\0\0\0"..., 4096)
= 1467
close(5) = 0
munmap(0x7f17b431f000, 4096) = 0
socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
connect(5, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = 0
sendto(5, "<83>Apr 25 22:22:37 groupadd[424"..., 75, MSG_NOSIGNAL, NULL,
0) = 75
readlink("/proc/self/exe", "/usr/sbin/groupadd", 4096) = 18
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
{B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/0", 31) = 10
stat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0),
...}) = 0
sendto(3, "\200\0\0\0\\\4\5\0\1\0\0\0\0\0\0\0op=adding group "..., 128,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 128
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\1\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\1\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
groups=00000000}, [12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\1\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\1\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
sendto(5, "<83>Apr 25 22:22:37 groupadd[424"..., 73, MSG_NOSIGNAL, NULL,
0) = 73
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
{B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/0", 31) = 10
stat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0),
...}) = 0
sendto(3, "\200\0\0\0\\\4\5\0\2\0\0\0\0\0\0\0op=adding group "..., 128,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 128
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\2\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\2\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
groups=00000000}, [12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\2\0\0\0\220\20\0\0\0\0\0\0\200\0\0\0\\\4\5\0\2\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
sendto(5, "<83>Apr 25 22:22:37 groupadd[424"..., 59, MSG_NOSIGNAL, NULL,
0) = 59
ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS,
{B38400 opost isig icanon echo ...}) = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
readlink("/proc/self/fd/0", "/dev/pts/0", 31) = 10
stat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
lstat("/dev/pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0),
...}) = 0
sendto(3, "d\0\0\0\\\4\5\0\3\0\0\0\0\0\0\0op= acct=\"ssh\" e"..., 100,
0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 100
poll([{fd=3, events=POLLIN}], 1, 500) = 1 ([{fd=3, revents=POLLIN}])
recvfrom(3,
"$\0\0\0\2\0\0\0\3\0\0\0\220\20\0\0\0\0\0\0d\0\0\0\\\4\5\0\3\0\0\0"...,
8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0,
groups=00000000}, [12]) = 36
recvfrom(3,
"$\0\0\0\2\0\0\0\3\0\0\0\220\20\0\0\0\0\0\0d\0\0\0\\\4\5\0\3\0\0\0"...,
8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000},
[12]) = 36
close(6) = 0
munmap(0x7f17b431e000, 4096) = 0
unlink("/etc/gshadow.lock") = 0
unlink("/etc/group.lock") = 0
close(4) = 0
exit_group(10) = ?
+++ exited with 10 +++
++++++++++++++++++++++++++++++
# mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs
(rw,relatime,size=10240k,nr_inodes=1006705,mode=755)
devpts on /dev/pts type devpts
(rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,relatime,size=1614284k,mode=755)
/dev/sda3 on / type btrfs (rw,noatime,ssd,space_cache)
securityfs on /sys/kernel/security type securityfs
(rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup
(rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/cpuset type cgroup
(rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup
(rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/devices type cgroup
(rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup
(rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup
(rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/blkio type cgroup
(rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/perf_event type cgroup
(rw,nosuid,nodev,noexec,relatime,perf_event)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs
(rw,relatime,fd=23,pgrp=1,timeout=300,minproto=5,maxproto=5,direct)
mqueue on /dev/mqueue type mqueue (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,relatime)
/dev/sdb1 on /home type btrfs (rw,noatime,ssd,space_cache)
/dev/sda2 on /boot type ext4 (rw,relatime,data=ordered)
/dev/sda1 on /boot/efi type vfat
(rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=utf8,shortname=mixed,errors=remount-ro)
rpc_pipefs on /run/rpc_pipefs type rpc_pipefs (rw,relatime)
tmpfs on /run/user/108 type tmpfs
(rw,nosuid,nodev,relatime,size=807144k,mode=700,uid=108,gid=114)
tmpfs on /run/user/1000 type tmpfs
(rw,nosuid,nodev,relatime,size=807144k,mode=700,uid=1000,gid=1000)
++++++++++++++++++++++++++++++
# dmesg | tail
[ 422.827267] FS-Cache: Netfs 'cifs' registered for caching
[ 422.827284] Key type cifs.spnego registered
[ 422.827291] Key type cifs.idmap registered
[ 422.917997] loop: module loaded
[ 422.937419] EXT4-fs (loop0): recovery complete
[ 422.937423] EXT4-fs (loop0): mounted filesystem with ordered data
mode. Opts: (null)
[ 4488.049729] systemd-fstab-generator[4605]: Checking was requested for
"/media/[snipped for privacy]", but it is not a device.
[ 4502.160575] systemd-fstab-generator[4670]: Checking was requested for
"/media/[snipped for privacy]", but it is not a device.
[ 4502.215109] systemd-fstab-generator[4684]: Checking was requested for
"/media/[snipped for privacy]", but it is not a device.
[ 4502.272462] systemd-fstab-generator[4697]: Checking was requested for
"/media/[snipped for privacy]", but it is not a device.
++++++++++++++++++++++++++++++
# lsattr /etc/group
---------------- /etc/group
++++++++++++++++++++++++++++++
// Michael
