| files >> /lib/ |
| files >> //lib/libaudit.so.1.0.0 |
ELF 4 ( 4 ( i i dm d} d} o $ $ PtdW W W Qtd Rtddm d} d} GNU G P+M\F }bhC = f68`A "$ ) Ii D @ D TBA* aD@ @ = > ? @ B C D E F H J K M N O P R T W X Y ] ` b d f g h k l o p q r s t u w x | } ~ vG*v t4B!}.㩮q&0ޢ p GU=h{,Ac(>/ ak ɿMtԇC nv2Lz
ˡv%6ϱs5zB CV\n%5#9ޭ
Ia U|6ed; 2L?!bCE-T|j/{4nqLlJQa@BSedi^3WqX v[~N%? } X + ? W j / q o b ] q J ^ L 8 U E d H = & " $ ; # 4! 2 pK R @J / 6 p2 2 0? h 6 c x 0| 1 F ] ! 0A c `P 9 _ = ~ 0U ! S j P B W N 4 ; i = > r Q < F % 0! ~ T 9
b ! C [ ! i 0&
8
F J ) m - `Q < ? 3 K e / 6 7 7 h ' p ] 3 ] u X (! 0S j R j 8 e u d ? 08 ! / P\ B d P D! p; # O 9 ~ p> % ,! pa ! @ P 9 t 4 " G z P j ! m O 9 F " 05 __gmon_start__ _init _fini __cxa_finalize _Jv_RegisterClasses audit_request_status audit_add_watch_dir audit_rule_syscall_data audit_rule_syscallbyname_data audit_detect_machine audit_update_watch_perms audit_number_to_errmsg stderr __fprintf_chk uname audit_rule_free_data free audit_rule_interfield_comp_data strstr strchr audit_determine_machine strcasecmp audit_rule_fieldpair_data __ctype_b_loc strcmp strtoul strtol getgrnam _audit_syscalladded _audit_permadded realloc strncpy __errno_location _audit_elf _audit_archadded __ctype_tolower_loc getpwnam memset audit_setloginuid __snprintf_chk write audit_getloginuid read audit_trim_subtrees audit_delete_rule_data audit_add_rule_data audit_request_signal_info audit_request_rules_list_data audit_make_equivalent strlen malloc memcpy audit_add_dir audit_add_watch audit_is_enabled poll getuid audit_set_backlog_limit audit_set_rate_limit audit_set_failure audit_set_enabled audit_set_pid get_auditfail_action __fxstat fdopen fgets fclose audit_msg set_aumessage_mode __vfprintf_chk fputc __vsyslog_chk audit_get_reply audit_send recvfrom audit_close audit_open socket fcntl sendto __memcpy_chk audit_name_to_field audit_name_to_syscall audit_name_to_msg_type audit_msg_type_to_name audit_name_to_machine audit_machine_to_elf audit_elf_to_machine audit_operator_to_symbol audit_name_to_errno audit_name_to_ftype audit_syscall_to_name audit_flag_to_name audit_action_to_name audit_machine_to_name audit_errno_to_name audit_ftype_to_name audit_field_to_name __strncpy_chk audit_name_to_action audit_name_to_flag audit_value_needs_encoding audit_encode_value audit_encode_nv_string __asprintf_chk getaddrinfo inet_ntop freeaddrinfo gai_strerror ttyname_r __lxstat audit_log_user_command __strdup getcwd __strcpy_chk readlink audit_log_user_avc_message __strncat_chk __syslog_chk audit_log_user_message audit_log_acct_message strnlen audit_log_semanage_message audit_log_user_comm_message audit_send_user_message libc.so.6 __stack_chk_fail _edata __bss_start _end libaudit.so.1 GLIBC_2.1.3 GLIBC_2.4 GLIBC_2.3 GLIBC_2.8 GLIBC_2.1 GLIBC_2.3.4 GLIBC_2.0 s i ii
ii
ii
ii
ti ! ii
- } } } } } } } } } } ~ ~ ~ $~ 0~ <~ H~ T~ `~ l~ x~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ X z > k 9
$ ( ,
0 4 8 < @ D H L P T X \ W ` d h l p t x | ! " # $ % & ' ( ) * + , - . / 0 t 1 Ā 2 Ȁ 3 ̀ 4 Ѐ 5 Ԁ 6 7 ܀ 8 9 : ; n < US [f t y f X[ h h h h h h( $ h0 ( h8 p, h@ `0 hH P4 hP @8 hX 0< h` @ hh D hp H hx L h P h T h X h \ h ` h d h h h pl h `p h Pt h @x h 0| h h h h h h h h h h( h0 h8 p h@ ` hH P hP @ hX 0 h` hh hp hx h h h h h h h h p h ` h P h @ h 0 h UVS b d$, u\t ${|x)0 9s t& 0 x0 9rƃ, d$[^]
US0 Kb d$싓tt $Ѝd$[]Ë $ÐU1WV1d$U} EJu4t& @9v ju @9 wE t Ed$^_]Ã>EwDŽ j DŽ @ BE 뿐& UVM uɍQ I>) D 1^]Ív ' U1WVS 'a d$ԍM} @R tM9
u@tGt|u.D2D$ D$ O D$ $dt& d$,[^_]Í& |$ D$L D$D$ $ d$,[^_]ËD2|$D$ ǐ& US0K` $\e E1n$¸ur$= Ue3 u
$ []_ ' US_ d$E$rd$[]Ít& ' Ud$ȋEuu ]Ü_ }8u]u}]Í& >wፃS 4$D$t' @ H 0> t9 u1멐t& D$= 4$t @I4$MU24 ƋM\ $4 UɸB}6GDŽ o t\ Y ! t=DŽ G1t@#DŽ DŽ ˃t#nDŽ DŽ DŽ 떃 tpmNDŽ x t& DŽ BH DŽ Zf#DŽ
a k ~& m`DŽ l tf1[ f tb f.t& DŽ DŽ
t[nDŽ 4DŽ tnDŽ DŽ mtpnSv @<DŽ fDŽ V"n
v Ƀ{f)I tmDŽ DŽ tmDŽ DŽ tmkDŽ DŽ t& UVSZ d$uV t$$7t[Z t$$!t 4$U8 1҅y d$[^]fxu t40ҍt& 빍t& tuFt묍 u$0 u누tt& qv t& uuуw̐t& 벍& ' Ud$uu}} ]éY u]u}]Í& z>wፃS <$D$U U5 @ @E 0EEt? tM9 t<$U[. NjUu BMfE܉ C dm
t& i 1}щU؍qM U9DHM ~ -] g D$EU؉$ UQ JDŽ I1Ov ^ <$D$UUt @ @E `Ea <$D$UUtK @ @E PEuuD$ D$ 4$U؋}܋J Td <$D$U/U @ @E HE
f U%u UDH fH ED$ D$ $UxU؋M܉ JU} UDHtDD$ D$ <$D$= <$UUtA @E @E2uU؉4$UUtF}܋@J D$> <$U4Ut< @E EE$ D$~ D$ ]D$< <$UU @E E}D$ D$ 4$}j}v ]} @F} 091}щU؍qEM U9DHMq~-uuNDH kD$& <$UUH @E E
f u@8 u9 1}у ~1}у ߋBU؉Mԉ Eȉ $D$ljU؋MM L$MUT$ $O} z Uu UDH D$ D$ 4$2lm t& i gt hf+}!}u1}щU؍q9M U9DHM ~u-unuNDHt`D$ D$ 4$UvFj3 kt& }`kt i EU؉$. U؋M܉ J 9uD$ D$ 4$> } @ U u UDH U }Ɖ<$D$ D$ "> tC7G$b $ D$| $:" UxJ 4EU؉$$! Un븁} 0}t
}EU؉$, U؋M܉ J vM}t& 7 t Wnk}:} @'1}у 11M;}sKUM U 9rt)at Ńwt#xu}܉ uNDHJu4$M܉U x}1ыED$ L$$FEU؉$. UɸMr $. U؉ J.}wum t$D$$
v UWVSO d$}L|$D$$ t<1vt*D$<$Vu⋄D d$ 1[^_]fE |$D$ $ D$g d$ [^_]É' UWVSNiN d$} u : tD us
ҸxZT$<$<2 x_uE d$ [^_]t& G: uG:BuG:Bu1D @?u0d$ [^_]É$m DPuD$ D$ <$kِUWVS^yM d$e E1 EEUԉD$U $D$D$ D$ D$ D$ $sE ~t1f <)ƅ~_Et$D$Eĉ$yۋU:t؍ $ D$ Eĉ$J Ue3 u6d$\[^_]ËUĉ$%1ܐt$ D$: L & ' UWVS 9L d$e E1k ED$ $lx8UԉUED$ D$<$YyUă:tۉ<$sv Ue3 uAd$L[^_]Ít& EċUD5 $D$
D$ Uċt'K & Ud$D$ D$ D$ ]E :K u}$ x]u}]Ðt& ؉$~G8o|$T$D@$ ]u}]Ðt& Ud$؋U]òJ u}E UP D$ET$ D$ $ x]u}]ftC؉$8o |$T$D@$ ]u}]Í$ D$ 돍$ D$ oUd$؋U]I u}E UP D$ET$ D$ $ x]u}]fǍ ?t؉$?o t D$$HD$ ]u}]Í $ D$ w& Ud$D$ D$ D$ ]EúH u$% x]u]Ív ؉$D$$ tD$L ]u]Ud$D$ D$ D$ ]E :H u}$ u]u}]Ít& y؉$zC8o|$T$D@$ ]u}]ÐUd$D$ D$ D$ ]EÚG u}$ x]u}]Ðt& ؉$8o|$T$D@$ ]u}]Ðt& UWVSG d$ԋE $PNjE$CE܍L $MƋML$D$ $FEE U܉D$E>V|$$}U܋ET$<$D$MEL$ t$D$ $ x4$d$,[^_]Ít& ؉$E8oUT$D@T$$ 믍 UWVS F d$ԋE$@NjE t J
}k $L$UMƋE UM0 L$D$ 4$ F 4$D$ UF dž @ U |$T$$adž j dž @dž 1d$,[^_]Ít& }i $ D$ ̐$ D$ 뮉$[ $ D$u 뉍& ' Ud$$k E D$ED$OÍ ' Ud$$i E D$ED$ Í ' UWVSD $ue E1 U$' EfDž 1D$d D$ 4$y
8tڋUD$ D$ D$$
~JvK t;(utu1t'1Ue3 u $l# [^_]Ðt& E@۸B t& U1 d$]}B UȉuE E E܋ED$ T$D$ $+ x]u}]Í ؉$8o|$T$D@$< ]u}]Í ' U1 d$]}+B UȉuE E E؋ED$ T$D$ $k
x]u}]Í ؉$F8oD|$T$D@$| ]u}]Í ' U1 d$]}PkA UȉuE E EЋED$ T$D$ $ x]u}]Í ؉$O8ol|$T$D@$ ]u}]Í ' U1 d$]}ë@ UȉuE E E̋ED$ T$D$ $ x]u}]Í ؉$8o|$T$D@$ ]u}]Í ' U WVS? $ue E1E Dž D$ T$D$ 4$ E tcfDž D$d D$ <$xy
8tڍD$ D$ D$4$ Ue3 uC$|# [^_]Ð؉$~G8ot$T$D@$ > ' UWVSù> $E*e U1ǃD D$ $ L$D$$ # t$D$$ ( $ % = D$HD$$ 4$}?v s $0D$ D$$ =D$l D Me3
$< [^_]Í4$D$ d T Dž v L$D$ $a D$
$t d < u
v v< t~u{v t < Wu ׅt>#uэ< t Gt
Hu ȅ :q W:Qt c v @ t5 P
t
zu u Jt& R
tɍzu! Q& t u t̉NjL$ D$T$$ 6 tx1tDf tct$$uۋ
1 4$L$RK$3& 11fD$L$ $ D$1T & $zD 1T$D$$ ɋ(T$)kL$D $jD$ D$$ SD$ 4$n-D$T$ lL$D$$ e $D$} 9 O9 UE E H ]Í& ' Ud$]u9 EU tCtL MtVL$ T$D$ $$
D$]u]Ít& H t胻 MuL$ T$D$ $Z]u]Ë $ÐUWVS9T8 d$MɋU @ EE EU } uEЉUԐMЋEԋUL$|$t$ D$ # D$$yK.tǃ ։t$$FD$$ D$7؍d$L[^_]Ðt& } U܅@ u }ԃN~dž(# V V v[9rWf fL f f f fhu Uԃ(# Tf= # u1 $ D$& $ D$ 4 d$L[^_]ÍD $ D$[ftwEfWM Uԃ(# t $ D$
}flffT} Uԃ(# @ US5 d$Ex$nd$[]Í& Ud$D$ D$ $ ]upË5 }ix3D$ D$ $ ]u}]Ív 8]tJtEat@<$ED$$
D$U:]u}]Í& UD$$ U:NjU4$d$%D$$ @
D$kU/UWVS^y4 $d}EUe
M1ɅU r
# L |D$ # D$ IL $BE |fҋL fDž Dž fDž Dž Dž t& D$D$ D$ D$T$<$y
8t; 1҅y {t& k ЋUe3 / $F [^_]f; T$D$ # T$$P ǐfDž v D$ D$ 4$py
8tڋD$ D$ T$ $u
t1댍t& t t"L 1 |D$ D$ D$<$:|t|ىjUn1 U Ew
t& =Z 1]Ít& =Z ~틔(|Lqt]=` хx͋L7 *t]=9 = ~IMt]Ðt& =d ~k^n]Ít& =; ]v RH<;]Ðȍ!]Í& UN0 E~
1]Í x))t]Í& U0 E~
1]Í xl)T)t]Í& UZ/ E~
1]Í xt]Í& / U1Ut& 9lt@u0]Ív p]Í& U1S.I/ Ml 9Lt@u[]fl[]Í& ' U 1҉WVuS.
v H9|%
< ;;,t|ۍP9}1[^_]Ðt& L[^_]Í U. Ex#= ~l t]Ív 1]Ít& UWVS.I. d$EЉŰUЉ$e E1oǍ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ; 1 <E~9|F MƋE ULD$Eԉ$? UċMt$}N9}1}e3= u e[^_]Ðt& LỦ , & U 1҉WVuS -
v H9|%
< ;;
t|ۍP9}1[^_]Ðt&
[^_]Í U( 1҉WVuSï,
v H9|%
< ;;,t|ۍP9}1[^_]Ðt& [^_]Í U 1҉WVuS$?,
v H9|%
< ;;l t|ۍP9}1[^_]Ðt& ![^_]Í UWVS+ d$EЉŰUЉ$e E1Ǎ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ) 1 E~9|F MƋE UD$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& lỦ * & Ud$UE¸EE
UWVSnÉ* d$EЉŰUЉ$e E1Ǎ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ3 1 ME~9|F MƋE ULD$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& ,Ủ 8) & UWVSNi) d$EЉŰUЉ$e E1Ǎ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ\ 1 ^E~9|F MƋE U D$Eԉ$_ UċMt$}N9}1}e3= u e[^_]Ðt& Ủ ( & UWVS.I( d$EЉŰUЉ$e E1oǍ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ 1 LqE~9|F MƋE U D$Eԉ$? UċMt$}N9}1}e3= u e[^_]Ðt& Ủ & & UWVS)' d$EЉŰUЉ$e E1OǍ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ< 1 E~9|F MƋE U D$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& Ủ % & UWVS & d$EЉŰUЉ$e E1/Ǎ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ 1
E~9|F MƋE U0 D$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& L Ủ $ & Ud$UE¸EE
UWVSù$ d$EЉŰUЉ$e E1߿Ǎ@ 1)čD$E1t2}U
xpU}FI9Mw}UԹ 1 l E~9|F MƋE UD$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& Ủ h# & UV d$E8-t#U1tEƍd$^]Í @Ӎ& ' UWVS.I# d$EЉŰUЉ$e E1oǍ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ 1 E~9|F MƋE U D$Eԉ$? UċMt$}N9}1}e3= u e[^_]Ðt& LỦ ! & Ud$UE¸EE
UWVS! d$EЉŰUЉ$e E1 Ǎ@ 1)čD$E1t2}U
xpU}FI9Mw}UԹ 1 E~9|F MƋE Ul$D$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& &Ủ & Ud$e U1҉]E諾 U؉u}E u uD$] 4$w ) }E E ND$ T$t$<$ٹ脹 D$
D$ <$覺Ue3 ub]u}]Ðt& Mԋ DPuǐt& E뽍v ED$
D$ $:c v UWVS~Ù d$EЉŰUЉ$e E1迺Ǎ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ 1 T)E~9|F MƋE Ux)D$Eԉ$菻 UċMt$}N9}1}e3= u e[^_]Ðt& )Ủ H & Ud$UE¸EE
UWVS.I d$EЉŰUЉ$e E1oǍ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ 1 )E~9|F MƋE U)D$Eԉ$? UċMt$}N9}1}e3= u e[^_]Ðt& )Ủ & Ud$UE¸EE
UWVS d$EЉŰUЉ$e E1 Ǎ@ 1)čD$E1t2}U
x pU}FI9Mw}UԹ] 1 *E~9|F MƋE ULD$Eԉ$ UċMt$}N9}1}e3= u e[^_]Ðt& ̘Ủ & US d$U Ew
⍴& d$[]Ít& UHtEd$[]fUP捶 Up֍ Uƍ U붍 U릐UVMu t4t0 ~."t)1u ~"tt
@9w1^]Ð ^]UWVEu S踸 }tJtN1҅t; P LPR9w x [^_]Ív t& ' Ud$uu ]}1L }tVtr|$4$fujfEt$D$ D$ 6D$E$ȴ E]u}]Ät 4$$lj4$|$t4똍D?$|th|$t$$E蕶UԋET$D$ D$ .D$E$:UyE $E]u}]Ít& ]u}1]ÐUd$]u" ҉}E ?@ t: u]u}]Ív U1 EE E D$ T$D$ 4$ɳuMUBt:RMT$L$D$ . $E$]u}]ÐRĉ$D$ t$t$ D$"= ' UWV1S ' $tEED$ D$4$ 1Ʌ u}1ɀ? ҍvuu E E$ [^_]Ã~ߐED$E$ D$nuE% = t E$ D$DD$N떃}v >uuǃEz >ub
U卤$(e E1U] ҉u}u}y"Ue3 ]u}]Ðt& EV]D
l< ? Dv> t4$htttD$ p $跲 pv!%t DVD p+pt$$C pt$T$h $ٲDžd t $t<tT
X tD @ u1tt$$諱 tpD$ T$ $1t$dE UEcwd=E%s E cmd=@%s @ term@inal@=%s @ res=f@%s@ l4L$ DhpL$T$|$ D$zD$
# D$ D$
# <$
ȭ ƋE |$ D$ED$ $R `VOpD$ D$h$蓯Džd 5t& cmd=@"%s"f@ @ t& UEcwd=E"%s"fE E
0 .t ƀ t& tpt$L$$ o)E2fDž? f t& ' U卤$D$ ]u }|$e E1e$ Ƅ D$<$uV9|$D$D$ D$ D$ $Ue3 u.]u}]Ív t$|$$R t& "?" D$$ 뒍 UWVS $TMEue U1҅ɉ} E t> DE t 8 4 Mȉr,! 7 ? N 4L$$|$(DE D$ ,! D$t$ D$D$
# D$D$ D$
# 4$謭g NjU ET$t$ D$ $ t"~7ЋUe3 $# [^_]É- uÉ뿐t& ,! _t& MD$ . $D$- D$KEĉNjf4t& U $D$ t$D$ D$$ 菫1 v UWVS辭 $TEMe E1ɋuU} E V]Eȅt > DE t : $ U| |, % ? < 4L$(D, D$T$ |$$t$ D$D$
# D$D$ D$
# <$W ƋUE |$ D$ D$$
~ Ue3 $# [^_]Ít& >uډ֍ , |'|t& E|D$ . D$- T$$
|fEĉ|Nj|f4
UWVS辫
$EU(e E1} $Mu U$}(} V0E,]D00t > DE t : Y U,,h 9" L$9,A D$$ D$ D$ D$ t ? D} 4T$ U D|$(T$D0D$,,D$$(D$t$ D$DD$
# D$ D$
# <$蛥 ƋUE |$ D$ D$$% >uUe3 $ $ [^_]Ít& $)$ D$ƅN ND$ H D$G 4$蟨4D$ $詧ƄN D$$$跧( 4T$ 4DT$ D0D$,,D$$(|$(t$ D$T$ED$ . D$- T$,$轧,A ,A Љ o t& L$ m$L$D$4$dh t& Eĉ
Nj b & UWVS
$EUE 4U$E(0,U,E0($U4e E1} Mu8U<}@C V ED]D t > DE t : + U 9 ? t: ? } > fr ,L ,: = 0 0: 4 4: : $x $: i (C (: 4 T$DD$<,0T$0D$,4 T$(D$$$(T$ D$ E D$|$@t$8L$4T$DD$D$
# D$ D$
# <$ ڠ ƋE |$ D$ED$ $d Ue3 $\$ [^_]ÍEĉNjt& , , , v 4(& 4$& 4 Q& 44 & 40& 4,& 4t& 4`t& & ED$ . D$- T$$fNT$ƅN D$ H D$G $賢 D$ $轡ƄN D$ $ˡɍ _ t? u4t> u4,t ,8 u 4,0t 08 u 404t 48 u 44 t 8 u 4 $t $8 u 4$(t (8 u 4( D$DT$<,0D$0T$,4 D$(T$$$(D$ T$ D$|$@t$8L$4T$GT$ $T$ln & UWVS螡ù $DEMUxe E1ɋuU } VE$]Dt > DE t : U||,a ? D $1D$t$t D$$9tD$D$ D$ D$ t4T$xDT$|$(DD$,|D$$t$ ,a D$ D$
# D$ D$D$
# <$菞J ƋE |$ D$ED$ $ uUe3 $C [^_]Ít& T$T$$t膞tv ,a =XED$ . D$- T$|$3! Dž"?" v E UWVSޞ d$E } u-t& usMcE
tO4$t$D$ E|$$
t5ut}t d$,[^_]Í& ƍd$,[^_]1ݐUS ; UVS ptp& vЋu[^]US [ Y[ %s %s
!= b64 b32 >= <= &= unset Unknown user: %s Unknown group: %s Cannot realloc memory!
Option %s not found - line %d all %u /proc/self/loginuid Error writing loginuid Rule exists Rule is not empty
Invalid type used
/etc/libaudit.conf Error opening %s (%s) Error fstat'ing %s (%s) Error - %s is world writable rm Error - fdopen failed (%s) -F missing operation for -F unknown field: must be before -S machine type not found elf mapping not found -F unknown message type - Failed upgrading rule String value too long only takes = or != operators -F unknown errno - -F unknown file type - -F value should be number for -C unknown field: Too many fields in rule failure_action ignore log terminate %ڤssssaudit_failure_parser called with: %s Error opening /proc/self/loginuid Error sending trim subtrees command (%s) Use of entry filter is deprecated Error sending delete rule request (No rule matches) Error sending delete rule data request (%s) Error sending add rule data request (%s) Error sending signal_info request (%s) Error sending rule list data request (%s) Error sending status request (%s) Error sending make_equivalent command (%s) Error sending backlog limit request (%s) Error sending rate limit request (%s) Error sending failure mode request (%s) Error sending enable request (%s) Error setting audit daemon pid (%s) Config file %s doesn't exist, skipping Config file %s opened for parsing Error - %s isn't owned by root Error - %s is not a regular file Unknown keyword "%s" in line %d of %s Wrong number of arguments for line %d in %s Missing equal sign for line %d in %s requested bit level not supported by machine can only be used with exit filter list msgtype field can only be used with exclude filter list Only msgtype field can be used with exclude filter Permission can only contain 'rwxa' can only be used with exit and entry filter list Key field needs a watch or syscall given prior to it -F missing value after operation for -F missing field name before operator for -C missing field name before operator for -C missing value after operation for -C unknown right hand value for comparison with: Error receiving audit netlink packet (%s) Bad address size reading audit netlink socket Spoofed packet received on audit netlink socket Netlink event from kernel is too big Netlink message from kernel was not OK Error - audit support not in kernel Error opening audit netlink socket (%s) Error setting audit netlink socket CLOEXEC flag (%s) \ 44\t block character dir fifo file link socket @ ` # # ` @ E2BIG EACCES EADDRINUSE EADDRNOTAVAIL EADV EAFNOSUPPORT EAGAIN EALREADY EBADE EBADF EBADFD EBADMSG EBADR EBADRQC EBADSLT EBFONT EBUSY ECANCELED ECHILD ECHRNG ECOMM ECONNABORTED ECONNREFUSED ECONNRESET EDEADLK EDEADLOCK EDESTADDRREQ EDOM EDOTDOT EDQUOT EEXIST EFAULT EFBIG EHOSTDOWN EHOSTUNREACH EIDRM EILSEQ EINPROGRESS EINTR EINVAL EIO EISCONN EISDIR EISNAM EKEYEXPIRED EKEYREJECTED EKEYREVOKED EL2HLT EL2NSYNC EL3HLT EL3RST ELIBACC ELIBBAD ELIBEXEC ELIBMAX ELIBSCN ELNRNG ELOOP EMEDIUMTYPE EMFILE EMLINK EMSGSIZE EMULTIHOP ENAMETOOLONG ENAVAIL ENETDOWN ENETRESET ENETUNREACH ENFILE ENOANO ENOBUFS ENOCSI ENODATA ENODEV ENOENT ENOEXEC ENOKEY ENOLCK ENOLINK ENOMEDIUM ENOMEM ENOMSG ENONET ENOPKG ENOPROTOOPT ENOSPC ENOSR ENOSTR ENOSYS ENOTBLK ENOTCONN ENOTDIR ENOTEMPTY ENOTNAM ENOTRECOVERABLE ENOTSOCK ENOTTY ENOTUNIQ ENXIO EOPNOTSUPP EOVERFLOW EOWNERDEAD EPERM EPFNOSUPPORT EPIPE EPROTO EPROTONOSUPPORT EPROTOTYPE ERANGE EREMCHG EREMOTE EREMOTEIO ERESTART EROFS ESHUTDOWN ESOCKTNOSUPPORT ESPIPE ESRCH ESRMNT ESTALE ESTRPIPE ETIME ETIMEDOUT ETOOMANYREFS ETXTBSY EUCLEAN EUNATCH EUSERS EWOULDBLOCK EXDEV EXFULL Y m @ M 3 t N 8 J f Y F A #
l
' / W H c P H i q y ^ & r [ D * T - 7 y 9 _ +
" 5 + O Q ? 4 ' ` | g s N
& + 8 ? H N T [ c i q y
' - 4 @ F M Q Y ` g s
" + 5 A H O W ^ f m t |
# * 3 9 D N Y _ l r y ' / 7 > J P
b c D a r 4 M J 5 8 9 ; }
, F g o h # # Y ! I z p q + T s j x 3 - . / O P S R Q 0 ( | Z H $ w d f e 7 i 2 = ~ % C { * @ A \ ? < & k ' v X L _ K ` G ] [ " N B y U l ^ E t V > n m u 1 W 6 != & &= < <= = > >= 0 @ H P `
@ > 2 i386 i486 i586 i686 ia64 ppc ppc64 s390 s390x x86_64 . ( #
# ( . ADD_GROUP ADD_USER ANOM_ABEND ANOM_ACCESS_FS ANOM_ADD_ACCT ANOM_AMTU_FAIL ANOM_CRYPTO_FAIL ANOM_DEL_ACCT ANOM_EXEC ANOM_LINK ANOM_LOGIN_ACCT ANOM_LOGIN_FAILURES ANOM_LOGIN_LOCATION ANOM_LOGIN_SESSIONS ANOM_LOGIN_TIME ANOM_MAX_DAC ANOM_MAX_MAC ANOM_MK_EXEC ANOM_MOD_ACCT ANOM_PROMISCUOUS ANOM_RBAC_FAIL ANOM_RBAC_INTEGRITY_FAIL ANOM_ROOT_TRANS AVC AVC_PATH BPRM_FCAPS CAPSET CHGRP_ID CHUSER_ID CONFIG_CHANGE CRED_ACQ CRED_DISP CRED_REFR CRYPTO_FAILURE_USER CRYPTO_KEY_USER CRYPTO_LOGIN CRYPTO_LOGOUT CRYPTO_PARAM_CHANGE_USER CRYPTO_REPLAY_USER CRYPTO_SESSION CRYPTO_TEST_USER CWD DAC_CHECK DAEMON_ABORT DAEMON_ACCEPT DAEMON_CLOSE DAEMON_CONFIG DAEMON_END DAEMON_RESUME DAEMON_ROTATE DAEMON_START DEL_GROUP DEL_USER DEV_ALLOC DEV_DEALLOC EOE EXECVE FD_PAIR FEATURE_CHANGE FS_RELABEL GRP_AUTH INTEGRITY_DATA INTEGRITY_HASH INTEGRITY_METADATA INTEGRITY_PCR INTEGRITY_RULE INTEGRITY_STATUS IPC IPC_SET_PERM KERNEL KERNEL_OTHER LABEL_LEVEL_CHANGE LABEL_OVERRIDE LIST_RULES LOGIN MAC_CIPSOV4_ADD MAC_CIPSOV4_DEL MAC_CONFIG_CHANGE MAC_IPSEC_ADDSA MAC_IPSEC_ADDSPD MAC_IPSEC_DELSA MAC_IPSEC_DELSPD MAC_IPSEC_EVENT MAC_MAP_ADD MAC_MAP_DEL MAC_POLICY_LOAD MAC_STATUS MAC_UNLBL_ALLOW MAC_UNLBL_STCADD MAC_UNLBL_STCDEL MMAP MQ_GETSETATTR MQ_NOTIFY MQ_OPEN MQ_SENDRECV NETFILTER_CFG NETFILTER_PKT OBJ_PID PATH PROCTITLE RESP_ACCT_LOCK RESP_ACCT_LOCK_TIMED RESP_ACCT_REMOTE RESP_ACCT_UNLOCK_TIMED RESP_ALERT RESP_ANOMALY RESP_EXEC RESP_HALT RESP_KILL_PROC RESP_SEBOOL RESP_SINGLE RESP_TERM_ACCESS RESP_TERM_LOCK ROLE_ASSIGN ROLE_MODIFY ROLE_REMOVE SECCOMP SELINUX_ERR SERVICE_START SERVICE_STOP SOCKADDR SOCKETCALL SYSCALL SYSTEM_BOOT SYSTEM_RUNLEVEL SYSTEM_SHUTDOWN TEST TRUSTED_APP TTY TTY_GET TTY_SET USER USER_ACCT USER_AUTH USER_AVC USER_CHAUTHTOK USER_CMD USER_END USER_ERR USER_LABELED_EXPORT USER_LOGIN USER_LOGOUT USER_MAC_CONFIG_CHANGE USER_MAC_POLICY_LOAD USER_MGMT USER_ROLE_CHANGE USER_SELINUX_ERR USER_START USER_TTY USER_UNLABELED_EXPORT USYS_CONFIG VIRT_CONTROL VIRT_MACHINE_ID VIRT_RESOURCE L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k ! " # $ % & ' ( ) * + , - . / 0 x y z { | } ~
4 5 6 7 8 9 : ; < = > ? @ A B C D E ` a b c d e f g < h
C v t y W s
H d T M u Z h @ u 5 , ? y d o W [ i y Q ] 0 A s 4 d % G U } ; . J i - [ G q f > ) O ~ F | ' .
- ; J [ i s } . G W [ d o v . ? C M Z h u
% 4 G U d u y 0 A Q ] i y ) > O f q ~ , 5 @ H T d t y ' < F W h s | \ Z ? B ; > C @ 7 4 8 6 5 9 : A D < = E x z ) * _ e O P V e d b c a f g ` ^ ] [ ( % 0 f
$ } { | ~ + # " ! - , & / . y j k g i h ` a ' M L S T c R U X Y N b Q d W always never possible
entry exclude exit task user _llseek _newselect _sysctl access acct add_key adjtimex afs_syscall alarm bdflush break brk capget capset chdir chmod chown chown32 chroot clock_adjtime clock_getres clock_gettime clock_nanosleep clock_settime clone close creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_pwait epoll_wait eventfd eventfd2 execve exit exit_group faccessat fadvise64 fadvise64_64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchown32 fchownat fcntl fcntl64 fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsetxattr fstat fstat64 fstatat64 fstatfs fstatfs64 fsync ftime ftruncate ftruncate64 futex futimesat get_kernel_syms get_mempolicy get_robust_list get_thread_area getcpu getcwd getdents getdents64 getegid getegid32 geteuid geteuid32 getgid getgid32 getgroups getgroups32 getitimer getpgid getpgrp getpid getpmsg getppid getpriority getresgid getresgid32 getresuid getresuid32 getrlimit getrusage getsid gettid gettimeofday getuid getuid32 getxattr gtty idle init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel io_destroy io_getevents io_setup io_submit ioctl ioperm iopl ioprio_get ioprio_set ipc kcmp keyctl kill lchown lchown32 lgetxattr link linkat listxattr llistxattr lock lookup_dcookie lremovexattr lseek lsetxattr lstat lstat64 madvise madvise1 mbind migrate_pages mincore mkdir mkdirat mknod mknodat mlock mlockall mmap mmap2 modify_ldt mount move_pages mprotect mpx mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedsend mq_unlink mremap msync munlock munlockall munmap name_to_handle_at nanosleep nfsservctl nice oldfstat oldlstat oldolduname oldstat olduname open open_by_handle_at openat pause perf_event_open personality pipe pipe2 pivot_root poll ppoll prctl pread64 preadv prlimit64 process_vm_readv process_vm_writev prof profil pselect6 ptrace putpmsg pwrite64 pwritev query_module quotactl read readahead readdir readlink readlinkat readv reboot recvmmsg remap_file_pages removexattr rename renameat request_key restart_syscall rmdir rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_tgsigqueueinfo sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getattr sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield select sendfile sendfile64 sendmmsg set_mempolicy set_robust_list set_thread_area set_tid_address setdomainname setfsgid setfsgid32 setfsuid setfsuid32 setgid setgid32 setgroups setgroups32 sethostname setitimer setns setpgid setpriority setregid setregid32 setresgid setresgid32 setresuid setresuid32 setreuid setreuid32 setrlimit setsid settimeofday setuid setuid32 setxattr sgetmask sigaction sigaltstack signal signalfd signalfd4 sigpending sigprocmask sigreturn sigsuspend socketcall splice ssetmask stat stat64 statfs statfs64 stime stty swapoff swapon symlink symlinkat sync sync_file_range syncfs sys_kexec_load sysfs sysinfo syslog tee tgkill time timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd timerfd_gettime timerfd_settime times tkill truncate truncate64 ugetrlimit ulimit umask umount umount2 uname unlink unlinkat unshare uselib ustat utime utimensat utimes vfork vhangup vm86 vm86old vmsplice vserver wait4 waitid waitpid write writev b ) $
[ j w p R e
o I D b u ] u i Z 4 X %
" 4
t t ]
J
H
-
5
Z k / f { | <
9 _ ] 8 $
K S . E
z o # / v U J 8 # *
$ , ; N H r
i R \
I * d 9 V X v \ c
a l P z o X 4 K ,
Q
?
|
f
|
a <
$ ; . ` j r Z e { P | g ) ? $ f e
M ~
' $ ? S o } S r @ C 3
2 J J : R 1 a t 6 u .
" _sysctl accept accept4 access acct add_key adjtimex afs_syscall alarm arch_prctl bind brk capget capset chdir chmod chown chroot clock_adjtime clock_getres clock_gettime clock_nanosleep clock_settime clone close connect creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_ctl_old epoll_pwait epoll_wait epoll_wait_old eventfd eventfd2 execve exit exit_group faccessat fadvise64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchownat fcntl fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsetxattr fstat fstatfs fsync ftruncate futex futimesat get_kernel_syms get_mempolicy get_robust_list get_thread_area getcpu getcwd getdents getdents64 getegid geteuid getgid getgroups getitimer getpeername getpgid getpgrp getpid getpmsg getppid getpriority getresgid getresuid getrlimit getrusage getsid getsockname getsockopt gettid gettimeofday getuid getxattr init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel io_destroy io_getevents io_setup io_submit ioctl ioperm iopl ioprio_get ioprio_set kcmp kexec_load keyctl kill lchown lgetxattr link linkat listen listxattr llistxattr lookup_dcookie lremovexattr lseek lsetxattr lstat madvise mbind migrate_pages mincore mkdir mkdirat mknod mknodat mlock mlockall mmap modify_ldt mount move_pages mprotect mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedsend mq_unlink mremap msgctl msgget msgrcv msgsnd msync munlock munlockall munmap name_to_handle_at nanosleep newfstatat nfsservctl open open_by_handle_at openat pause perf_event_open personality pipe pipe2 pivot_root poll ppoll prctl pread preadv prlimit64 process_vm_readv process_vm_writev pselect6 ptrace putpmsg pwrite pwritev query_module quotactl read readahead readlink readlinkat readv reboot recvfrom recvmmsg recvmsg remap_file_pages removexattr rename renameat request_key restart_syscall rmdir rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_tgsigqueueinfo sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getattr sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield security select semctl semget semop semtimedop sendfile sendmmsg sendmsg sendto set_mempolicy set_robust_list set_thread_area set_tid_address setdomainname setfsgid setfsuid setgid setgroups sethostname setitimer setns setpgid setpriority setregid setresgid setresuid setreuid setrlimit setsid setsockopt settimeofday setuid setxattr shmat shmctl shmdt shmget shutdown sigaltstack signalfd signalfd4 socket socketpair splice stat statfs swapoff swapon symlink symlinkat sync sync_file_range syncfs sysfs sysinfo syslog tee tgkill time timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd timerfd_gettime timerfd_settime times tkill truncate tuxcall umask umount2 uname unlink unlinkat unshare uselib ustat utime utimensat utimes vfork vhangup vmsplice vserver wait4 waitid write writev r
B ] ! B V ~ # n G *
% @ Y
' 1
Q i `
u & v } b z $
P [ V h L x x
n t g l N X
O
w & ~ D : n e b Z a :
; w
H
. C R e & R h F + z
1 r
~
W 0 ) p 4 d
8 n @ + U
` { # 7 1 V / G h
K '
c { k Y K P # \ [ @ 5
f S }
b ' k
7 ? F
' e ? / O
m L t + {
K 5 _sysctl accept accept4 access acct add_key adjtimex afs_syscall bdflush bind brk capget capset chdir chmod chown chroot clock_adjtime clock_getres clock_gettime clock_nanosleep clock_settime clone clone2 close connect creat delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_pwait epoll_wait eventfd eventfd2 execve exit exit_group faccessat fadvise64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchownat fcntl fdatasync fgetxattr finit_module flistxattr flock fremovexattr fsetxattr fstat fstatfs fstatfs64 fsync ftruncate futex futimesat get_mempolicy get_robust_list getcpu getcwd getdents getdents64 getegid geteuid getgid getgroups getitimer getpeername getpgid getpid getpmsg getppid getpriority getresgid getresuid getrlimit getrusage getsid getsockname getsockopt gettid gettimeofday getuid getunwind getxattr init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel io_destroy io_getevents io_setup io_submit ioctl ioprio_get ioprio_set kexec_load keyctl kill lchown lgetxattr link linkat listen listxattr llistxattr lookup_dcookie lremovexattr lseek lsetxattr lstat madvise mbind migrate_pages mincore mkdir mkdirat mknod mknodat mlock mlockall mmap mmap2 mount mprotect mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedsend mq_unlink mremap msgctl msgget msgrcv msgsnd msync munlock munlockall munmap name_to_handle_at nanosleep newfstatat nfsservctl ni_syscall open open_by_handle_at openat pciconfig_read pciconfig_write perfmonctl personality pipe pipe2 pivot_root poll ppoll prctl pread64 preadv prlimit64 process_vm_readv process_vm_writev pselect ptrace putpmsg pwrite64 pwritev quotactl read readahead readlink readlinkat readv reboot recv recvfrom recvmmsg recvmsg remap_file_pages removexattr rename renameat request_key restart_syscall rmdir rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_tgsigqueueinfo sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getattr sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield select semctl semget semop semtimedop send sendfile sendmmsg sendmsg sendto set_mempolicy set_robust_list set_tid_address set_zone_reclaim setdomainname setfsgid setfsuid setgid setgroups sethostname setitimer setns setpgid setpriority setregid setresgid setresuid setreuid setrlimit setsid setsockopt settimeofday setuid setxattr shmat shmctl shmdt shmget shutdown sigaltstack signalfd signalfd4 socket socketpair splice stat statfs statfs64 swapoff swapon symlink symlinkat sync sync_file_range syncfs sysfs sysinfo syslog tee tgkill timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd timerfd_create timerfd_gettime timerfd_settime times tkill truncate tux umask umount uname unlink unlinkat unshare uselib ustat utimensat utimes vhangup vmsplice vserver wait4 waitid write writev P ! > I _ m e k e 1 D j X
( + M ' + q ] h { q . T 8 7 | F
V ?
7
. \ '
0 9 G @ 2
D ' t z
8 + ^ @ t
4 t & y g + N T \ N ] p 1 > L [ k x m Q X q
H -
%
{ "
u } K k U 4 > X 8 . j
U I -
.
H ! # | j > E & N
` b N
V ]
| t f ! c
8
@ . ~ 5 n x m
N ? P @ _llseek _newselect _sysctl accept accept4 access acct add_key adjtimex afs_syscall alarm bdflush bind break brk capget capset chdir chmod chown chroot clock_adjtime clock_getres clock_gettime clock_nanosleep clock_settime clone close connect creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_pwait epoll_wait eventfd eventfd2 execve exit exit_group faccessat fadvise64 fadvise64_64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchownat fcntl fcntl64 fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsetxattr fstat fstat64 fstatat fstatfs fstatfs64 fsync ftime ftruncate ftruncate64 futex futimesat get_kernel_syms get_robust_list getcpu getcwd getdents getdents64 getegid geteuid getgid getgroups getitimer getpeername getpgid getpgrp getpid getpmsg getppid getpriority getresgid getresuid getrlimit getrusage getsid getsockname getsockopt gettid gettimeofday getuid getxattr gtty idle init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel io_destroy io_getevents io_setup io_submit ioctl ioperm iopl ioprio_get ioprio_set ipc kcmp kexec_load keyctl kill lchown lgetxattr link linkat listen listxattr llistxattr lock lookup_dcookie lremovexattr lseek lsetxattr lstat lstat64 madvise mincore mkdir mkdirat mknod mknodat mlock mlockall mmap mmap2 modify_ldt mount move_pages mprotect mpx mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedsend mq_unlink mremap msync multiplexer munlock munlockall munmap name_to_handle_at nanosleep nfsservctl nice oldfstat oldlstat oldolduname oldstat olduname open open_by_handle_at openat pause pciconfig_iobase pciconfig_read pciconfig_write perf_counter_open personality pipe pipe2 pivot_root poll ppoll prctl pread preadv prlimit64 process_vm_readv process_vm_writev prof profil pselect6 ptrace putpmsg pwrite pwritev query_module quotactl read readahead readdir readlink readlinkat readv reboot recv recvfrom recvmmsg recvmsg remap_file_pages removexattr rename renameat request_key rmdir rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_tgsigqueueinfo rtas sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getattr sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield select send sendfile sendfile64 sendmmsg sendmsg sendto set_robust_list set_tid_address setdomainname setfsgid setfsuid setgid setgroups sethostname setitimer setns setpgid setpriority setregid setresgid setresuid setreuid setrlimit setsid setsockopt settimeofday setuid setxattr sgetmask shutdown sigaction sigaltstack signal signalfd signalfd4 sigpending sigprocmask sigreturn sigsuspend socket socketcall socketpair splice spu_create spu_run ssetmask stat stat64 statfs statfs64 stime stty subpage_prot swapcontext swapoff swapon symlink symlinkat sync sync_file_range2 syncfs sysfs sysinfo syslog tee tgkill time timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd timerfd_gettime timerfd_settime times tkill truncate truncate64 tuxcall ugetrlimit ulimit umask umount umount2 uname unlink unlinkat unshare uselib ustat utime utimensat utimes vfork vhangup vm86 vmsplice wait4 waitid waitpid write writev v 4 i M | o ~ ' f < 3 Z g W
1 5 S k 7 * ~ v ' l
1 n I t Z 0 a B + 8
y
g
%
.
j t J
O d ' ] x D 3 J % ! f O
P D V U q x
v O > k
` # Y G . ~ 5 ; ! 0 C {
` S
V 9 T ) F D p w
[ : < O n I < V q - ^
F # 9 G d 6 ) ? { " = S I ( n v x z 6 f [
,
d - ^ l ` G
^ { <
f / K d
a
V p
?
x " R o u _sysctl access acct add_key adjtimex afs_syscall alarm bdflush brk capget capset chdir chmod chown chroot clock_adjtime clock_getres clock_gettime clock_nanosleep clock_settime clone close creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_pwait epoll_wait eventfd eventfd2 execve exit exit_group faccessat fadvise64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchownat fcntl fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsetxattr fstat fstatfs fstatfs64 fsync ftruncate futex futimesat get_kernel_syms get_robust_list getcpu getcwd getdents getegid geteuid getgid getgroups getitimer getpgid getpgrp getpid getpmsg getppid getpriority getresgid getresuid getrlimit getrusage getsid gettid gettimeofday getuid getxattr idle init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel io_destroy io_getevents io_setup io_submit ioctl ioprio_get ioprio_set ipc kcmp kexec_load keyctl kill lchown lgetxattr link linkat listxattr llistxattr lremovexattr lseek lsetxattr lstat madvise mincore mkdir mkdirat mknod mknodat mlock mlockall mmap mount mprotect mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedsend mq_unlink mremap msync munlock munlockall munmap name_to_handle_at nanosleep newfstatat nfsservctl nice open open_by_handle_at openat pause perf_event_open personality pipe pipe2 pivot_root poll ppoll prctl pread preadv prlimit64 process_vm_readv process_vm_writev pselect6 ptrace putpmsg pwrite pwritev query_module quotactl read readahead readdir readlink readlinkat readv reboot remap_file_pages removexattr rename renameat request_key rmdir rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_tgsigqueueinfo s390_runtime_instr sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getattr sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield select sendfile set_robust_list set_tid_address setdomainname setfsgid setfsuid setgid setgroups sethostname setitimer setns setpgid setpriority setregid setresgid setresuid setreuid setrlimit setsid settimeofday setuid setxattr sigaction sigaltstack signal signalfd signalfd4 sigpending sigprocmask sigreturn sigsuspend socketcall splice stat statfs statfs64 swapoff swapon symlink symlinkat sync sync_file_range syncfs sysfs sysinfo syslog tee tgkill timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd timerfd_create timerfd_gettime timerfd_settime times tkill truncate umask umount umount2 uname unlink unlinkat unshare uselib ustat utime utimensat utimes vfork vhangup vmsplice wait4 waitid write writev A
/ U
: Q Y W % { @
1 M z
* k b K ~ o %
? G
_ :
c t
C Y $ m
R > v 1
$ g : # O 5 5
&
J O
+ > 7 c % l 8
g m \ k % ~
e C J
} u s 9 | ] 2 ) z C ; +
V +
. < u F [ x A E r
I 7 d F Q _ 4 \
i a - Q e
N . p
^
e
)
1 V t S o } 4 j Y N _llseek _newselect _sysctl access acct add_key adjtimex afs_syscall alarm bdflush brk capget capset chdir chmod chown chown32 chroot clock_adjtime clock_getres clock_gettime clock_nanosleep clock_settime clone close creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_pwait epoll_wait eventfd eventfd2 execve exit exit_group faccessat fadvise64 fadvise64_64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchown32 fchownat fcntl fcntl64 fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsetxattr fstat fstat64 fstatat fstatfs fstatfs64 fsync ftruncate ftruncate64 futex futimesat get_kernel_syms get_robust_list getcpu getcwd getdents getdents64 getegid getegid32 geteuid geteuid32 getgid getgid32 getgroups getgroups32 getitimer getpgid getpgrp getpid getpmsg getppid getpriority getresgid getresgid32 getresuid getresuid32 getrlimit getrusage getsid gettid gettimeofday getuid getuid32 getxattr idle init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel io_destroy io_getevents io_setup io_submit ioctl ioperm ioprio_get ioprio_set ipc kcmp kexec_load keyctl kill lchown lchown32 lgetxattr link linkat listxattr llistxattr lremovexattr lseek lsetxattr lstat lstat64 madvise mincore mkdir mkdirat mknod mknodat mlock mlockall mmap mmap2 mount mprotect mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedsend mq_unlink mremap msync munlock munlockall munmap name_to_handle_at nanosleep nfsservctl nice open open_by_handle_at openat pause perf_event_open personality pipe pipe2 pivot_root poll ppoll prctl pread preadv prlimit64 process_vm_readv process_vm_writev pselect6 ptrace putpmsg pwrite pwritev query_module quotactl read readahead readdir readlink readlinkat readv reboot remap_file_pages removexattr rename renameat request_key rmdir rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_tgsigqueueinfo s390_runtime_instr sched_get_priority_max sched_get_priority_min sched_getaffinity sched_getattr sched_getparam sched_getscheduler sched_rr_get_interval sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield sendfile sendfile64 set_robust_list set_tid_address setdomainname setfsgid setfsgid32 setfsuid setfsuid32 setgid setgid32 setgroups setgroups32 sethostname setitimer setns setpgid setpriority setregid setregid32 setresgid setresgid32 setresuid setresuid32 setreuid setreuid32 setrlimit setsid settimeofday setuid setuid32 setxattr sigaction sigaltstack signal signalfd signalfd4 sigpending sigprocmask sigreturn sigsuspend socketcall splice stat stat64 statfs statfs64 stime swapoff swapon symlink symlinkat sync sync_file_range syncfs sysfs sysinfo syslog tee tgkill time timer_create timer_delete timer_getoverrun timer_gettime timer_settime timerfd timerfd_create timerfd_gettime timerfd_settime times tkill truncate truncate64 ugetrlimit umask umount umount2 uname unlink unlinkat unshare uselib ustat utime utimensat utimes vfork vhangup vmsplice wait4 waitid write writev \ # U d
j 9 C t
D
; , Z R
" T K ~ H 1 _ ;
/
8 f m P S d
U Z F
; X
? z
w g 1
/ I %
) J
8 ) / q ( ; r B s \ M { A \ N k S p V ] @ z = o w ]
E h # | } f v 7 5 ( ` Q
A ) 4 J a # 9 v
k
] j r ` R ' / l a ! M &
l G Q
-
# D + J :
L 1 Y `
E j { { c " ' / 8 D J R X \ c j p v | ) 3 ? J R [ b g r | # ) . ; E K S ] e o u { % , 5 ? K U ] e l t | $ 1 ? P Z e r { $ . 4 < D M S a i o w } $ / 6 H R ] b k t " 4 9 @ I P X a i v * 9 I V d t , ; N Z a j u ~
$
.
4
<
H
Q
\
f
r
|
# - 8 C J S X _ f o u z $ 2 : J Z ` f o z
$
*
! 3 | - = W
x ) ? J I ? C H 3 D R S ^ 2 _ * 7 ^ l , d
v # ] + 8 > 2 1 / P i A @ ` L M N p $ # L % 6 e n " ! u ] % / 5 k & ' ( ) Z { = } 8 [ U " T ; m V ' P * K 5 M T [ \ , b 4 N Y U 1 X Q & . ( O ` _ R Y 7 y . Q J h Z 9 a G F K B O D C 0 A G I ~ w H f 9 E j c s W S 0 $ : X t g ;
B F E + \ : < 4 z
- 6 V > @ o q < r # + 4 @ F Q V Z a h n t z ' 1 ? K V e m v } & + 8 B H P V ` f p & . : D N X b i u # ) 0 5 @ K P [ b g n x }
! & 1 7 B K Y c k { % + ; G L R ] b h n t { ' / @ L S \ h x ~ # 5 C R e {
' 7 G W e n w ~
$
*
1
:
F
O
Y
`
k
r
w
~
' / ? O U [ d l r z + % 1 } ~ P Z \ 1 8 * U ! $ # " ; <
, - Q [ ] H K 9 I 9 J M 5 O N l k h s $ 4 y o ' n x v a b | 3 7 ` f & 8 > ^ V 2 S
G D F E / # 0 " * % ' . 6 7 e ( Y - + / R T
) ; : B @ A ( 3 . , { z j t & 4 m r w u q p 6 i C 0 ! ) 5 X
2 c g d L _ ? W : = # + 4 @ H M Q X _ e k q x ! - 8 @ I P U ` j t ~ ( . 8 > H V f m t } % 0 7 D K U ^ j | ! & - 4 > I X e k u { ! + 2 9 @ G N T \ g n
& . 5 ? P b j q y + 1 > L [ k x . @ N ] p | ' . 8 D N T \ h q {
"
'
.
7
?
F
N
X
]
m
t
z
' + 1 8 > E N V ] c m t | ~ 6 ( k u r $
, 0 h n ! . $ # "
+ , K L * 7 y P J x ' & 5 _ 7 M 3 1 = > : Q ? m & ) d
X U W V . / t " % B | ' - 4 5 } ( q D z H * e ) 9 8 A T R S 3 i w v % 6 ; ^ 2 8 N 0 4 2 / < 9 @ Z \ [ Y ! O G F C
1 s g ] # I ` + j E - c f { " * 1 6 > G S Y a f l p w ~ " / = G S ^ f o v { # . 4 9 F P V ^ f n x ~
# + 3 : B J V ` j t ~ ) 6 ? I O V [ f q u z ' - 5 ; D I O Z ` k t x ' 0 < D M R d k q % , 5 < D K S ` i n x ) 9 F T d v { ! 0 C O V [ d o x
%
.
8
?
J
W
^
g
p
y
! ( 1 7 < I U ] d l v { ' - 3 < G O Z a g n v | J X ! 3
| G - = [ x H ) ? < ; / 3 : * 5 C D ^ ) _ ! 7 a l # d v # ] " + . 2 1 / P i L A @ ` L M K T N p > 6 e n u b % & I 5 k ' Z { - } 8
[ Y " T ; m Z ? * = @ E _ ` , b A Y U ( X P Q W V & % ( B d c R N ] U O , y . Q J h ^ 9 a G F K B S O D R C 0 1 9 I ~ w H F f M E j c 6 s W S ' $ 4 \ t g
2 8 7 + \ : < 4 z
$ V > 0 o q r % 1 7 ? C J Q W ] c j x ) 1 : A F Q [ e o } $ . 4 > N ^ e l u } & + 7 I V d u
% + 5 ; C K Q Y _ g m v {
* / 4 F M S c o t z
$ - 8 > E V b i r ~ % < N \ k ~ ) 2 9 C O Y _ g s | # . 5 : A J R Y a k p
%
+
1
:
@
G
O
U
\
e
m
t
z
! 3 | - = Q x ) ? F G 8 > C , : L M ^ + # 7 X l d
v ] $ 1 7 i A @ ` M N p D 6 u W % ( k ' ! " Z } [ O % " P K * E . H N T U - I Y U * X & ' ( J V Z Y 0 y J h S 9 a K B O C 0 < B I ~ w H f 2 j c s W S ) $ 3 R t g 4 = ? A @ + \ < 4 z
& / V > ; 9 o 5 r " ' / 8 D J R V ] d j p v ~ # - 9 D L U \ a l v # ( 5 ? E M U ] g m w ) 1 9 @ H P \ f r | ) 4 A J T Z a l w {
! ) / 8 = C I R ` j r
, 1 7 B G M S Y ` j { & / ; A N \ k { ( ; Q c q # / ; E K S _ h s }
%
1
;
F
Q
X
]
d
k
t
z
# + : J Z ` f o z ! 3 | - = Q x ) ? F G 8 > C , : L M ^ + _ # 7 X l % d
v ] $ 1 7 2 1 / P i A @ ` L M N p D 6 e u W % ( k ' ! " Z } [ O " P K * E . H N T U - I Y U * X & ' ( J V Z Y 0 y . Q J h S 9 a G F K B O C 0 < B I ~ w H f 2 j c s W S ) $ 3 R t g 4
= ? A @ + \ < 4 z
& / V > ; 9 o 5 r a0 a1 a2 a3 arch auid devmajor devminor dir egid euid exit field_compare filetype fsgid fsuid gid inode key loginuid msgtype obj_gid obj_lev_high obj_lev_low obj_role obj_type obj_uid obj_user path perm pers pid ppid sgid subj_clr subj_role subj_sen subj_type subj_user success suid uid
d e f g h i j k l m n o 1 X ^ , R u b 6 ( I } ; h ( , 1 6 ; I R X ^ b h l u } d e k g o l f n m i j
h UNKNOWN[ 0123456789ABCDEF %s=%s ? %s="%s" /dev/ FATAL: bad tty %s failed success /proc/self/exe resolve_addr: cannot resolve hostname %s (%s) get_exename: cannot determine executable %s exe=%s sauid=%d hostname=%s addr=%s terminal=%s Can't send to audit system: %s %s op=%s acct="%s" exe=%s hostname=%s addr=%s terminal=%s res=%s op=%s acct=%s exe=%s hostname=%s addr=%s terminal=%s res=%s op=%s id=%u exe=%s hostname=%s addr=%s terminal=%s res=%s op=%s acct="%s" old-seuser=%s old-role=%s old-range=%s new-seuser=%s new-role=%s new-range=%s exe=%s hostname=%s addr=%s terminal=%s res=%s op=%s acct=%s old-seuser=%s old-role=%s old-range=%s new-seuser=%s new-role=%s new-range=%s exe=%s hostname=%s addr=%s terminal=%s res=%s op=%s id=%u old-seuser=%s old-role=%s old-range=%s new-seuser=%s new-role=%s new-range=%s exe=%s hostname=%s addr=%s terminal=%s res=%s %s comm=%s exe=%s hostname=%s addr=%s terminal=%s res=%s ; R 0 D `l p X 4 pt ` $ ` 0 @0 l @ P `( L
00
pX
@
< l ` P p
00
P`
@( `X @ ( ` X
`
0 l 0 `, `\ $ @' (, zR | ( t AD
DV
AA A H 6 AG
GeA < l AD
C}
AAA H v
AAA A $ c AB
AX
A A % AB
A_A , AB
MCRR
AH ( ( AB
BV
AA C , T
AB
JFCa
AH 8 AB
Cl
AAA C kAAA < p AB
C]
AAA J w
AAA A , 2 AB
C
AAA A , 0 0 AB
C
AAA E 8 ` AB
bTX
AF A
A < D AB
J]B
AC F
AA < AB
J]B
AC P
AG 0 AB
bQU
AD n
A8 P AB
bTY
AE E
A 8 T AB
bTX
AF A
A ,
AB
C
AAA E , AB
C
AAA E ( # AB
_ H # AB
_ , h AB
C
AAA F 8 AI
J|X
AG A
A 8 AI
J|X
AG A
A 8 AI
J|X
AG A
A 8 L AI
J|X
AG A
A , 3 AG
JA
AAA B , (c AB
CY
AAA A h" LB
S 0 x AB
Je
AE v
A < < P z AG
C
AAA F
AAA A 0) AB
AcA 8 </ AB
aNy
AD O
AH , 0 AB
C
AAA C L AM
m
E _
A _
A b
F c
E n
B X $ p 9 AM
K
G X $ 9 AM
K
G X $ 9 AM
K
G X $ (9 LD
\
D H , @B AD
An
A C HA 8 @ `j AI
EA
AAA F NAAA $ | < AM
f
D C , AB
C
AAA F 8 j AI
EA
AAA F NAAA 8 j AI
EA
AAA F NAAA 8 L j AI
EA
AAA F NAAA , 8 AB
C
AAA F (! AB
] , 8 AB
C
AAA F ,
( AB
C
AAA F , 8
AB
C
AAA F , h
AB
C
AAA F ,
AB
C
AAA F
! AB
] ,
AB
C
AAA F $ B AB
Fg
A G , @ AB
C
AAA F p ! AB
] , AB
C
AAA F , = AB
VW
AF , AB
C
AAA F ! AB
] , @ AB
C
AAA F p ! AB
] , AB
C
AAA F , AB
Av
A E T
A C , P AB
G{
A B FA ,
u AB
HA]
AAA D D P
/ AB
JFk
AA
AE M
A 8
AB
J^P
AD }
AB ,
AB
DAd
AAA A , | AB
XV`
AF , 4 < AB
UZ
AD , d ,- AB
C>
AAA A , , AB
CZ
AAA E , AB
C
AAA E , X AB
C
AAA A , $ AB
C
AAA E < T L AB
C
AAA H I
AAA A AB
A Ł ׁ ܆ 4 4 l J g z ć 0 X ؈ ڂ 0
o8
7 P oH o o< o" F V f v & 6 F V f v & 6 F V f v & 6 F V f v libaudit.so.1.0.0.debug n4 .shstrtab .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .text .fini .rodata .eh_frame_hdr .eh_frame .ctors .dtors .jcr .data.rel.ro .dynamic .got .got.plt .data .bss .gnu_debuglink $ o 8 8 | ( P 0 7 8 o < <
E o H H T P ]
f 0 a 0 0 l b r x @ @ p W W LZ LZ d} dm l} lm t} tm } m o o o q ! $ <
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`