ELF > 5% @ @ 8 @ @ @ @ 8 8 8 < < P T T T D D Ptd Qtd Rtd h h /lib64/ld-linux-x86-64.so.2 GNU GNU 9d\ۤG,bG b A @ b d g BE| qX b , & 9 B Y 0 ` l q c . n t u " G T ) $ M ? 2 ` i K X 7 Z $ } Q " F [ 1 D I 8 0 f libauparse.so.0 audit_detect_machine _ITM_deregisterTMCloneTable audit_msg_type_to_name audit_flag_to_name audit_elf_to_machine audit_syscall_to_name __gmon_start__ _Jv_RegisterClasses _ITM_registerTMCloneTable audit_machine_to_name audit_errno_to_name _fini auparse_do_interpretation _init auparse_interp_adjust_type libaudit.so.1 _audit_elf audit_send audit_open audit_set_loginuid_immutable audit_set_enabled audit_number_to_errmsg _audit_exeadded audit_rule_syscallbyname_data audit_msg audit_machine_to_elf audit_can_control audit_is_enabled audit_set_rate_limit audit_set_backlog_limit audit_strsplit _audit_syscalladded audit_add_watch_dir audit_make_equivalent audit_rule_fieldpair_data audit_close audit_add_rule_data audit_request_rules_list_data audit_log_user_message _audit_permadded audit_field_to_name audit_update_watch_perms audit_fstype_to_name audit_request_status _audit_filterfsadded audit_action_to_name audit_reset_lost audit_set_failure _audit_archadded audit_request_features audit_rule_interfield_comp_data audit_trim_subtrees audit_get_reply audit_operator_to_symbol set_aumessage_mode audit_delete_rule_data libcap-ng.so.0 libc.so.6 __xpg_basename __printf_chk exit optind __strdup __fdelt_chk strncpy puts __stack_chk_fail putchar fgets_unlocked select strlen strstr __errno_location memcmp memcpy fclose strtoul malloc __ctype_b_loc optarg stderr __snprintf_chk getopt_long __strncat_chk __fxstat fwrite geteuid strchr __strtok_r fdopen __ctype_tolower_loc __cxa_finalize __xstat opterr __strcat_chk strcmp strerror __asprintf_chk __libc_start_main free _edata __bss_start _end key GLIBC_2.3 GLIBC_2.14 GLIBC_2.8 GLIBC_2.15 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.3.4 ii M W ii b l ii w ui ti & % j @ 1j ( + 0 1 ; ȏ E Џ H ؏ L S Z \ a ( 0 8 @ H P X ` h p x ȍ Ѝ ؍ ! " # $ % & ' ) * , ( - 0 . 8 / @ 2 H 3 P 4 X 5 ` 6 h 7 p 8 x 9 : < = > ? @ A B C Ȏ D Ў F ؎ G I J K M N O P Q R ( T 0 U 8 V @ W H X P Y X [ ` ] h ^ p _ x ` HH}q Ht; H 5n %n @ %n h %n h %zn h %rn h %jn h %bn h %Zn h %Rn h p%Jn h `%Bn h P%:n h @%2n h 0%*n h %"n h %n h %n h % n h %n h %m h %m h %m h %m h %m h %m h p%m h `%m h P%m h @%m h 0%m h %m h %m h %m h %m h %m h! %zm h" %rm h# %jm h$ %bm h% %Zm h& %Rm h' p%Jm h( `%Bm h) P%:m h* @%2m h+ 0%*m h, %"m h- %m h. %m h/ % m h0 %m h1 %l h2 %l h3 %l h4 %l h5 %l h6 %l h7 p%l h8 `%l h9 P%l h: @%l h; 0%l h< %l h= %l h> %l h? %l h@ %l hA %zl hB %rl hC %jl hD %bl hE %Zl hF %Rl hG p%Jl hH `%Bl hI P%:l hJ @%2l hK 0%*l hL %"l hM %l hN %l hO % l hP %l hQ %2l f%Zl fATI1U1SNw ! ID$8- xR x 1 lj l V I|$' H=il ^ hl I\$H5E Ht!;-u{C<htm<luo{ uiu_ u}1L` t-=kk tqXlj`k t H=k ({ tuH5T 1 []A\H=k =j uH=E 1I^HHPTL5A H @ H=7RH k H=k UH)HHw]Hi Ht] @ Hj H=j UH)HHHH?HHu]H j Ht]H @ =j u'H=j UHt H=d h]j @ f. H=d t&Hi HtUH=zd H]W Kf. AU ATUSH# H\$dH%( H$# 1HHHc=i L$ E1HE oi у?)Ѻ HH T- f D H$ HD$ D 8u i 11IHލxnxڋ=i 1ɺ L~9$ uH$# t5h L- t A t @ AA'bH$# dH3%( uH# []A\A] @ HH=> I HtoH=> HtLH=> HtiH=> HtFH=> HƸ 8tF @ A 1f D A 1f D A 1f D A 1f D A Ch 0 @ HH g H= h h g xg jg Hf g g Hg Hf Hf Hf HHg 1HHf x 1H @ f yH5@ 1 N Hwt-M8o tHH5+= 1 1H5@ 11 @ f. Su9He sf f [ _ e = t HWe 8tH=Sf H5U 1 e e H5(f =e 11r ۋe ۅMf=je ;1&f Be = t Hd 8tH=e H5jT 1 d d H5ye =d >11Q H; H5|? 18 cf D ;tDH=; uHH5 ? 1 H5(; 1 [f D H5d ktW'H몉HVH5d kuߋ c c =c dž i 0O c c =c dž i 'H=> =c ATUSHH dH%( H$ 1H= ^ ;/tAH5;: 1H$ dH3 %( HĠ []A\f D HHHH}HIrI % H59 HHtH5:E 1N* HaH H5IE 1%H Hv-HH:/t HtH </Ht HHi uD$1% = @ @Ǎ|?iH5b Hf. H5D 1} ? HH"0 D H5D 1=b3 HH=8 HtJH=8 Hָ @@8t H=y8 Hְ8tf *a 1 a 0 AUI, ATUHSHHHtL`, LHt H[]A\A] LHBt=,A} t#LuA} t=` t1LLHt, D f. Hw1҅~` Hf D AUAATUSH( L%_ dH%( H$ 1A,$ > 1 HHHHB` H|$ @ Hp _t#EA,$uBH5B 1 D A,$H$ dH3%( u^H( []A\A] H51B D 1 A$ U A$ @E A$ 5 @ f. USHtL'tH[] k1ۃ8H[] K8ouHu^ H=5 HfAUATUHSH, HHH HHI M<,u @ IAE <,t I] D <,HS HuMt}LHt I @ H,ttXHKf,HAtgHuHt8IHHLwtu H54 1L 1LD$ D$ H[]A\A] H HKHHH[]A\A]ÐAWAVAUIATE1USH F HX ] dH%( H$H 1H\\ Lt$4t$$D$4 H\ H] HD$@HD$ @ H \ H:E ML%t(ww HcHH=a7 A^f D H[ ( f D 9~$At H5E 1A D H\ 8 t|\ ur[ HD$8 ӃH \ H|$8HH 1 8 Ht$8H=/\ Q H|$8f D AD# H$H dH3 %( p HX []A\A]A^A_f. Hq4 H5p4 1 A0HZ A = [ E Af/ H`Z 8 =Z A @ HYZ L8MtIH DP H5{> L 1A!f HY HY , HHHX x L`G , LH1 =Z LHgr D 5Y H{Y L M LGA 1H81AHʋ r w x HA9wH=Y "]HX A f HX Ht*< ~ Hf g Hu=X E1E11$ }s @ =X A@@ Y A.f D HW DEM HW DE: H X D E' HW 8 H5? 1A X A =W h H5Y? 1A_rf. HYW H8H 0 11=W ! =sW Nf HV H8H 0 11n=(W 1 H5)> 1AfHV L8Mt,IH DP H5: L 1A>Qf L=9V H5- M'LHtHU F V V H5; 1A HU H8H V HU U oAESf D HU E1 U A% U m e D V E Et- ljD$ T$ H5T HT H=U H0o rHT E \=T LHT |$$H04 @ RU L%cT I<$;U H59 1A$7 U U Af L=S H5* M'LgHtHS $ T T lH5T LT d S =S E HcL$4HS AHH4 O H5 < 1A*f=zS pi @ 9 =;S A/=%S AHS R L=R H=eS I7=u HNS P jHCR R = Y L=(R MH=* Lι IMLLL$L S LL$AI!сကtH5R DIPLD IL+Q 1I> II c H=* Lι LϾ LL$rHLL$tH5* Lʿ 12MHhR 8 & !R H=RR Hcҹ L"H;R H!%t DHJHD HH+P )ЉQ =Q L=P MMH5}) 1At P H58 1AAT @ H58 1A 2f. =nP H P H8HJ OP 3f D 12H53 H1 A D 1f2 @ YH53 H1 Anf auL A H5( 1A':fH5!( 1Af. I7A` hIE8- xi x O @5 @ HN Hc ID 8-- xk# x HcmO Iu H=O @mwH5!2 1A/Bf. H55 1AH55 1AH52 1A(N Y L=M MN E 11 LHD$ HL$ =M C @ +Y11 LHD$HL$ M =}M @ =VM "L=L MMCD$HL H5k$ H1L$AH5y% 1AH5L 3 & A #H5 % 1A:M D H53 1 H5% 1HD$8 8oH5" 1f. H= & H|$Lκ H|$- Ƅ$@ x L@HD$( - LLD$HH z H@ HL$(LD$ys yyuysuyy usH=% H H=H$ H H=5$ H H="$ Ht{H5$ 1& H=# LvH=# L_H=# LHH59$ 1X MH=1K LAHK P jpH,J H=2K H56 LL$J LL$P3H5. 1AH5&/ 1AHhI Hc ID 8-Q H58. 1 O HcI H5! A1(;H I Hc ID Ht58-u0xku*x u$HcI Iu H='J @H5- 1 AH581 1AI$H5 1A|H51 1A^qH5H LXtLH5- 1 xix H @IH5 1AIH5 1AH5m 1AH5. 1 }`G 1ۉEHDG 9}QL=WG H5 T$(MLLL$Ht*HcT$(LL$ID 8-uxtux u H5- 1AHt$8AMH5- 1 H5, 1 {H5 1{1qH5 ¿ 1ZH5- 1 B%H5), 1 %H5|+ 1 H5Z 1 H5Z H5 1 H5 1 y 1Hul D HHt0\t3@t u7H1Huf D f D @t1f D D f. SHHtbHKHf t+QHHt)uA Hf. A\Hf D A H[s [ @ f. AW1AVAUATUSH dH%( H$ 1H|$ HT$ ƿ e |$< D$8 % = HT$H5- 1A H$ dH3%( D H []A\A]A^A_8taHT$H5 H 1A s8A HT$H5n H 1DgHT$H5, 1E1 GHT$H5, H5P YHI H$ A AEL H߉D$ H HHt HE H!ကt$ DHEHD HH)@ uHK D Hq@ t@u A\HHdHI 8#tH 1H xIHcHHV L`HD$L`HAGD$ f D ;l$}#LIM|$1HIuHT$HcH JA L|$t$ LLR r b8o HL$T$ H5)+ 1 =B tY= B -B LE1HT$H5 8?H5 HLA`H5 1L@H|$AmL%H HG G f HHG HHu f D HHBHuHW @ f. HGHtH@HG f. AUIATIUSH HMHt[LHHtLLH HHM H; LeHE t4HCHhHkCH[]A\A]f H H+ϐf. ATIUSH Hu # HH;HkHHuID$ AD$ []I$ A\f. AWAVAUAATUSH$ dH%( H$# 1TA" H\$@ 1HHIcEeHl$DE1 AL ?)Ѻ HH T@HD$ HHD$H$ H$ @ HD$ HD$ @ S8u11IHDxH4$1ɺ Du~!H$ D9x A AA'~H|$|HD$(Hu D H|$H HH D2y؉H5) H¿ 1oH$# dH3 %( H$ []A\A]A^A_Ð$ ZtD= 1H$# H$# H|$ H H$# ؉<H5( H¿ 1B @ H|$N1-# AWAVAUATUSH(H = dH%( HD$19 HD$E1E1IH HD$Gu m D t3AHIE9gvPD D t`E vAAit tptAHE9gw 1Ht$dH34%( H([]A\A]A^A_ H|$O7 H( 1 x2HT$H5< HH$H$HHu9T @ HD$ 1 f D f. H=)< < f. H_' t HN' rHg' HN' HD @ HX' t HH' rH7' HF' HD @ AWAVAUATUSHH dH%( H$ 1H: ~x= = = HSH5) 1; 1 H$ dH34%( E H []A\A]A^A_Ãt҃uH0# 8-H0# H5( Hڿ 1 : 1Hs: H0# t H0# H=: H aW: =H : H0# . PH % t H % rH % H% HDʋ@Hg% t HS% rHi% HP% HDH5( 1(H0# H5r( DHD@HP @ $19 1yH0# @@ H% H % H5' HDʋP A9 H=B9 H>9 H H$ Ht$Ht$`Ht$ Ht$XHt$@ @ H(DEE A@H 1H = t iJ HH9t%juH H9u} PG > 1f HH= ! | t}HH5& HH1 Ed H AE1 AHD;e uD D H6 DA xD8zA H7 DE< H6 DDE H5Z# H¿ 1AHD;ekDt$HOAŋE P 1 D HH= ? | t11E1A @ DDDHc҅D tbH6 8 E DDH HH^" f H5" 1DAA vt$L\$,DED$( YDDIH54" HL 1/D$( D$L D$HD$, E L HD$8 HD$0 E11M Ai Ak< ApB A U Aj Af! AoD A8 A A E7 |$,wH45 _ |$H5I# HEL 1 D I;] E E AA tA xDDl$iHI} A AF AE|$N% IDD$ DD$H5 HM1L AGI;]S ^H=g4 2HQH=R4 1&f D DL$(J% AEu#H5/ 1hAI D H5 1E A?(H A?|$I+H5 HML 1rf. DD$(J% AEuH5 1[ |$E7A H5f! HE 1 E/Ƅ$ A. A A A t$(HT$D H54 11 @ Ag A E7|$H5 HEL 1_ J% AH5 f AH|$@N% H_ 1 ] H|$XAL-F HT$ LIHt^Hl$Lt$ l$(&H5< 1M1LL`Ht#HuH5 1! Hl$H|$X艿| @ H5 1` |$E7H5 HEL 1+A?!AH57 HcHH|$H5 о&H|$H5 赾H|$H5) 蚾HD$r f8E7DHD$0YA?;HA?* D H5V H¿ 1pDHD$8 } HD$X 1+ H u21 H5, 1 HL$HL$Ha HkH5 D 1ec諾A D$LELt$L L$ HD$x D$dD$HLD$`HD$0HD$hHD$8HD$p1fLL L$ >Ht$ |$IѾH5U HML 1L AA? 1)fE7EiHHD$[|$sLD$H5 HL 1EDHH5 HD 1 D$, D$L 'H=H 1|$H5y H¿ 1ӿF|$սH5F H¿ 1诿"|$豽H5 H¿ 1苿|$荽H5 H¿ 1g|$iH5 H¿ 1C|$EH5{ H¿ 1 |$!H5G H¿ 1n|$H5 H¿ 1J|$ټH5 H¿ 1賾&|$赼H5 H¿ 1菾|$葼H5z H¿ 1k|$mH5F H¿ 1G|$IH5 H¿ 1#|$%H5 H¿ 1r|$H5 H¿ 1۽N|$ݻH5} H¿ 1跽*|$蹻H5F H¿ 1蓽|$蕻H5 H¿ 1o|$qH5 H¿ 1K|$MH5 H¿ 1'|$)H5m H¿ 1v|$H57 H¿ 1R|$H5 H¿ 1軼.|$轺H5 H¿ 1藼 |$虺H5 H¿ 1s1mHPH5O 1N!H5 16D$,? D$L CD$HP蟹f. D AWAAVIAUIATL%p$ UH-p$ SL)1HHHt LLDAHH9uH[]A\A]A^A_Ðf. HH task exit user filesystem exclude The audit system is disabled Rule exists Error - no list specified The path must start with '/' .. never possible always The audit system is disabled Syscall name unknown: %s Only -i option is allowed Error converting rate Error converting backlog Append rule - bad keyword %s Add rule - bad keyword %s Delete rule - bad keyword %s Error detecting machine type Error looking up elf type %d Elf type unknown: 0x%x arch= key= Only the -k option is allowed watch option needs a path key option needs a value key option exceeds size limit ids- file exec mkexe low med hi ids key is bad key %s has illegal character Permission %c isn't supported 2.8.5 auditctl version %s lost: %u Out of memory adding key ids key type is bad inf ids key severity is bad Error opening %s (%s) Error fstat'ing %s (%s) Error - %s is world writable rm Error - fdopen failed (%s) auditctl --help loginuid-immutable reset-lost Cannot open netlink audit socket The audit system is in immutable mode, no rule changes allowed Error sending add rule data request (%s) Error sending delete rule data request (%s) usage: auditctl [options] -a <l,a> Append rule to end of <l>ist with <a>ction -A <l,a> Add rule at beginning of <l>ist with <a>ction -b <backlog> Set max number of outstanding audit buffers allowed Default=64 -c Continue through errors in rules -C f=f Compare collected fields if available: Field name, operator(=,!=), field name -d <l,a> Delete rule from <l>ist with <a>ction l=task,exit,user,exclude a=never,always -D Delete all rules and watches -e [0..2] Set enabled flag -f [0..2] Set failure flag 0=silent 1=printk 2=panic -F f=v Build rule: field name, operator(=,!=,<,>,<=, >=,&,&=) value -h Help -i Ignore errors when reading rules from file -k <key> Set filter key on audit rule -l List rules -m text Send a user-space message -p [r|w|x|a] Set permissions filter on watch r=read, w=write, x=execute, a=attribute -q <mount,subtree> make subtree part of mount point's dir watches -r <rate> Set limit in messages/sec (0=none) -R <file> read rules from file -s Report status -S syscall Build rule: syscall name or number -t Trim directory watches -v Version -w <path> Insert watch at <path> -W <path> Remove watch at <path> --loginuid-immutable Make loginuids unchangeable once set --reset-lost Reset the lost record counter The path passed for the watch is too big The base name of the path is too big Warning - relative path notation is not supported Warning - wildcard notation is not supported WARNING - 32/64 bit syscall mismatch in line %d, you should specify an arch WARNING - 32/64 bit syscall mismatch, you should specify an arch Too many options for status command Enable must be 0, 1, or 2 was %s Failure must be 0, 1, or 2 was %s Rate must be a numeric value was %s Backlog must be a numeric value was %s Wrong number of options for list request Only -k or -i options are allowed Syscall auditing requested for task list Multiple rule insert/delete operations are not allowed Append rule - possible is deprecated Error: syscall auditing requested for task list Multiple rule insert/delete operations are not allowed Delete rule - possible is deprecated Error: syscall auditing being added to task list Error: syscall auditing being added to user list Error: syscall auditing being added to filesystem list Error: syscall auditing cannot be put on exclude list List must be given before field The -m option must be only the only option and takes 1 parameter Illegal character in audit event Error - nested rule files not supported Wrong number of options for Delete all request watch option can't be given with a syscall key option needs a watch or syscall given prior to it permission option needs a watch given prior to it permission option needs a filter Syscall auditing requested for make equivalent backlog_wait_time is not supported on your kernel hicslDvtC:e:f:r:b:a:A:d:S:F:m:R:w:W:k:p:q: parameter passed without an option given Error parsing equivalent parts file %s doesn't exist, skipping Error - %s isn't owned by root Error - %s is not a regular file There was an error in line %d of %s You must be root to run this program. @80P`P0`0к( Error receiving rules list (%s) Error deleting rule (%s) disable enabled enabled+immutable unknown silent printk panic , unlocked No rules -F arch%s0x%X -F arch%sb64 -F arch%sb32 -F arch%s%s -S -F %s%s%d -F %s%s%s -F %s%s%.*s -w %.*s -F path=%.*s -F dir=%.*s -F exe=%.*s -k %s -F key=%s a -p %s -F perm=%s -F %s%s%u -C uid%sobj_uid -C gid%sobj_gid -C euid%sobj_uid -C egid%sobj_gid -C auid%sobj_uid -C suid%sobj_uid -C sgid%sobj_gid -C fsuid%sobj_uid -C fsgid%sobj_gid -C uid%sauid -C uid%seuid -C uid%sfsuid -C uid%ssuid -C auid%sfsuid -C auid%ssuid -C auid%seuid -C euid%ssuid -C euid%sfsuid -C suid%sfsuid -C gid%segid -C gid%sfsgid -C gid%ssgid -C egid%sfsgid -C egid%ssgid -C sgid%sfsgid -F %s%s0x%X -F %s%s-%s f%d%s%d NLMSG_ERROR %d (%s) enabled %s failure %s enabled %u failure %u loginuid_immutable %u %s Unknown: type=%d, len=%d -a %s,%s -S all pid %u rate_limit %u backlog_limit %u lost %u backlog %u jF"nJ&rN*v; ! @` %0 @ P P pH ` Я 0 h @ @ P @` 0 H ` x p zR x * zR x $ 0 FJ w ?;*3$" < D < BGA A(GH (A ABBA h D E HR D_ A $ Cu H G 4 BAA J_ AABG < ث} < T @ BJA D(D0l (A ABBI * De < ج" BEA A(G (A ABBD 4 ȭ AAF k CAI Q FAH L $ O BBA D(O@ (A ABBD W (G ABBE L t ) BBB E(D0C8N 8A0A(B BBBK xr Ag H AL BDB B(A0A8G2 8A0A(B BBBA , L BFE ` ABA | X ` X" p < x BED A(L0X (A ABBJ , S BDA @AJ L L h BBB E(A0A8GH 8A0A(B BBBB L (a BBB B(A0A8D` 8A0A(B BBBD H P, h, L 4 BBB B(A0A8J 8A0A(B BBBA D 0e BEE E(H0H8M@l8A0A(B BBB X & % ? q 0 f o ، o o o o 2 o f v & 6 F V f v & 6 F V f v ! ! &! 6! F! V! f! v! ! ! ! ! ! ! ! ! " " &" 6" F" V" f" v" " " " " " " " " # # &# 6# F# V# f# v# j 1j auditctl.debug 9K7zXZ ִF ! t/G] ?Eh=ڊ2Nз0@sY]6:oVst?J9:>!ssbM + =:`vZuN?I.\ko wYqqUǞt!1[>V 퐫1go4>%-]I< (Ho:-(8laWBN Ηh? r\lY*;G[OO.~(lU!O7I| WxLE ص{q˙D )8D*uwaŗHo7qB2d aZdyk«r 317IaDpzI9*e*ޗ#;yG//\SF o h)ӂ.@*e%!]x7"yv{ +AnZ)4=iu,gЖ+ӾeA<: r1|I; DC?.}k3ЧϓΜE*߳$~ڣr.Ĝ~& ?4٦cE*R4W5+ h-Ԑ ۔ܻR8MmF>cϐ4{C`n P[Vt9U~&]k1<j;≼;jSy͆ϳq=2%#YoqB圯&ʷ_TaڏKId].5U1k8iC.W"|tv ;<VTdy!d28(FtRn1C1&멿BMR;mCN ՋRL/^1ƍZLX~<ޢ q!lGQY8DER& -^>֙ǗMj _oJ cb <XWZ|?<AT P@.]uU`qNif2 ¹o~e\(^/ҘXN , d14pߠ-y%p!\=;랂Q/pXW&RM' BX)d8?W`6N1"DvYi۪Q c 3<Ri]CG| wckBJFO: !yF(gɑc]nKZs_n=3ɂǑ@ 2Ɩ H@ 5r % & V=g YZ .shstrtab .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .jcr .data.rel.ro .dynamic .data .bss .gnu_debuglink .gnu_debugdata 8 8 T T ! t t $ 4 o < > F N o 2 2 [ o j t B ~ 0 0 y P P 0 # # # # B f f f f ( ( ، ، ( h