Mogens Kjaer wrote:
Here are the opens immediately before the mremaps start. I believe the one you're after is for /etc/gshadowIf you search backwards from here, there should be an open call returning 5, something like:
open(bla...) = 5
Thank you for taking an interest in this issue.
open("/etc/.pwd.lock", O_WRONLY|O_CREAT, 0600) = 3
fcntl64(3, F_GETFD) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
rt_sigaction(SIGALRM, {0x8fb440, ~[], SA_RESTORER, 0x856a48}, {SIG_DFL}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15) = 0
fcntl64(3, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
alarm(0) = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {SIG_DFL}, NULL, 8) = 0
getpid() = 4210
open("/etc/group.4210", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 4
write(4, "4210\0", 5) = 5
close(4) = 0
link("/etc/group.4210", "/etc/group.lock") = -1 EEXIST (File exists)
open("/etc/group.lock", O_RDWR|O_LARGEFILE) = 4
read(4, "4208\0", 31) = 5
close(4) = 0
kill(4208, SIG_0) = -1 ESRCH (No such process)
unlink("/etc/group.lock") = 0
link("/etc/group.4210", "/etc/group.lock") = 0
stat64("/etc/group.4210", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/group.4210") = 0
open("/etc/group", O_RDWR|O_LARGEFILE) = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=2643, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7
df2000
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 2643
read(4, "", 4096) = 0
open("/etc/gshadow.4210", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 5
write(5, "4210\0", 5) = 5
close(5) = 0
link("/etc/gshadow.4210", "/etc/gshadow.lock") = -1 EEXIST (File exists)
open("/etc/gshadow.lock", O_RDWR|O_LARGEFILE) = 5
read(5, "4208\0", 31) = 5
close(5) = 0
kill(4208, SIG_0) = -1 ESRCH (No such process)
unlink("/etc/gshadow.lock") = 0
link("/etc/gshadow.4210", "/etc/gshadow.lock") = 0
stat64("/etc/gshadow.4210", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/gshadow.4210") = 0
open("/etc/gshadow", O_RDWR|O_LARGEFILE) = 5
fstat64(5, {st_mode=S_IFREG|0400, st_size=95441786, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7
df1000
read(5, "root:::root,helen,ronl\nbin:::roo"..., 4096) = 4096
read(5, "e,,are,re,are,,hare,!,re,e,are,,"..., 4096) = 4096
read(5, ",!,re,are,share,,re,are,are,are,"..., 4096) = 4096
brk(0x86bb000) = 0x86bb000
brk(0x86dc000) = 0x86dc000
read(5, ",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"..., 4096) = 4096
brk(0x86fd000) = 0x86fd000
read(5, ",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"..., 4096) = 4096
brk(0x8727000) = 0x8727000
brk(0x8748000) = 0x8748000
brk(0x8769000) = 0x8769000
-- Bill Gradwohl bill@xxxxxxx http://www.ycc.com spamSTOMPER Protected email
