execve("/usr/sbin/ntpd", ["/usr/sbin/ntpd", "--debug", "--configfile=/etc/ntp.conf", "--panicgate", "--user=ntp:ntp", "--nofork"], 0x7fdb230e38 /* 46 vars */) = 0 brk(NULL) = 0x557d70c000 faccessat(AT_FDCWD, "/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=43816, ...}) = 0 mmap(NULL, 43816, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f8667e000 close(3) = 0 openat(AT_FDCWD, "/usr/lib64/libcrypto.so.1.1", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\0`\7\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=2605832, ...}) = 0 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8667c000 mmap(NULL, 2687344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f863cb000 mprotect(0x7f8661d000, 61440, PROT_NONE) = 0 mmap(0x7f8662c000, 176128, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x251000) = 0x7f8662c000 mmap(0x7f86657000, 16752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f86657000 close(3) = 0 openat(AT_FDCWD, "/usr/lib64/libssl.so.1.1", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\260\346\1\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=572448, ...}) = 0 mmap(NULL, 636624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8632f000 mprotect(0x7f863ae000, 65536, PROT_NONE) = 0 mmap(0x7f863be000, 53248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7f000) = 0x7f863be000 close(3) = 0 openat(AT_FDCWD, "/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\240\270\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=649104, ...}) = 0 mmap(NULL, 712824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86280000 mprotect(0x7f8631e000, 61440, PROT_NONE) = 0 mmap(0x7f8632d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9d000) = 0x7f8632d000 close(3) = 0 openat(AT_FDCWD, "/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0p\36\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=31296, ...}) = 0 mmap(NULL, 95016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86268000 mprotect(0x7f8626f000, 61440, PROT_NONE) = 0 mmap(0x7f8627e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f8627e000 close(3) = 0 openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\20 \0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=27056, ...}) = 0 mmap(NULL, 90856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86251000 mprotect(0x7f86257000, 61440, PROT_NONE) = 0 mmap(0x7f86266000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f86266000 close(3) = 0 openat(AT_FDCWD, "/usr/lib64/libseccomp.so.2", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0PO\2\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=309208, ...}) = 0 mmap(NULL, 373008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f861f5000 mprotect(0x7f86228000, 61440, PROT_NONE) = 0 mmap(0x7f86237000, 106496, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x32000) = 0x7f86237000 close(3) = 0 openat(AT_FDCWD, "/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\300f\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=173840, ...}) = 0 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f861f3000 mmap(NULL, 201736, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f861c1000 mprotect(0x7f861de000, 61440, PROT_NONE) = 0 mmap(0x7f861ed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c000) = 0x7f861ed000 mmap(0x7f861ef000, 13320, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f861ef000 close(3) = 0 openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0P\16\2\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1499520, ...}) = 0 mmap(NULL, 1572400, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86041000 mprotect(0x7f861a8000, 65536, PROT_NONE) = 0 mmap(0x7f861b8000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x167000) = 0x7f861b8000 mmap(0x7f861be000, 11824, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f861be000 close(3) = 0 openat(AT_FDCWD, "/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\220%\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=92320, ...}) = 0 mmap(NULL, 156040, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8601a000 mprotect(0x7f86030000, 61440, PROT_NONE) = 0 mmap(0x7f8603f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x7f8603f000 close(3) = 0 openat(AT_FDCWD, "/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0 \17\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=14280, ...}) = 0 mmap(NULL, 78080, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86006000 mprotect(0x7f86009000, 61440, PROT_NONE) = 0 mmap(0x7f86018000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f86018000 close(3) = 0 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f86004000 mprotect(0x7f861b8000, 16384, PROT_READ) = 0 mprotect(0x7f86018000, 4096, PROT_READ) = 0 mprotect(0x7f8603f000, 4096, PROT_READ) = 0 mprotect(0x7f861ed000, 4096, PROT_READ) = 0 mprotect(0x7f86237000, 102400, PROT_READ) = 0 mprotect(0x7f86266000, 4096, PROT_READ) = 0 mprotect(0x7f8627e000, 4096, PROT_READ) = 0 mprotect(0x7f8632d000, 4096, PROT_READ) = 0 mprotect(0x7f8662c000, 167936, PROT_READ) = 0 mprotect(0x7f863be000, 32768, PROT_READ) = 0 mprotect(0x5557a4e000, 16384, PROT_READ) = 0 mprotect(0x7f8668b000, 4096, PROT_READ) = 0 munmap(0x7f8667e000, 43816) = 0 set_tid_address(0x7f86004a40) = 156220 set_robust_list(0x7f86004a50, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f861c6fe0, sa_mask=[], sa_flags=SA_SIGINFO}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f861c70e0, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 prctl(PR_CAPBSET_READ, CAP_MAC_OVERRIDE) = 1 prctl(PR_CAPBSET_READ, 0x30 /* CAP_??? */) = -1 EINVAL (Invalid argument) prctl(PR_CAPBSET_READ, 0x28 /* CAP_??? */) = -1 EINVAL (Invalid argument) prctl(PR_CAPBSET_READ, CAP_BLOCK_SUSPEND) = 1 prctl(PR_CAPBSET_READ, 0x26 /* CAP_??? */) = -1 EINVAL (Invalid argument) prctl(PR_CAPBSET_READ, CAP_AUDIT_READ) = 1 rt_sigprocmask(SIG_SETMASK, ~[ILL TRAP BUS FPE SEGV RTMIN RT_1], [], 8) = 0 rt_sigaction(SIGILL, {sa_handler=0x7f864455b0, sa_mask=~[ILL TRAP BUS FPE SEGV RTMIN RT_1], sa_flags=0}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP BUS FPE KILL SEGV STOP RTMIN RT_1], 8) = 0 rt_sigaction(SIGILL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 umask(000) = 022 umask(022) = 000 brk(NULL) = 0x557d70c000 brk(0x557d72d000) = 0x557d72d000 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3 connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0 openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=2137, ...}) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=2137, ...}) = 0 read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\7\0\0\0\0"..., 4096) = 2137 lseek(4, -1359, SEEK_CUR) = 778 read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"..., 4096) = 1359 close(4) = 0 getpid() = 156220 sendto(3, "<29>Jan 10 21:16:37 ntpd[156220]"..., 88, MSG_NOSIGNAL, NULL, 0) = 88 getpid() = 156220 fstat(1, {st_mode=S_IFREG|0644, st_size=8897, ...}) = 0 write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 892020-01-10T21:16:37 ntpd[156220]: INIT: ntpd ntpsec-1.1.8 2020-01-10T19:59:05Z: Starting ) = 89 getpid() = 156220 sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 139, MSG_NOSIGNAL, NULL, 0) = 139 getpid() = 156220 write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 1402020-01-10T21:16:37 ntpd[156220]: INIT: Command line: /usr/sbin/ntpd --debug --configfile=/etc/ntp.conf --panicgate --user=ntp:ntp --nofork ) = 140 getuid() = 0 socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4 close(4) = 0 socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 4 getsockname(4, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_scope_id=0}, [28]) = 0 close(4) = 0 rt_sigaction(SIGPIPE, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTART}, NULL, 8) = 0 rt_sigaction(SIGINT, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGQUIT, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGHUP, {sa_handler=0x55579f5ae0, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {sa_handler=0x55579f5b30, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGUSR1, {sa_handler=0x55579f5b80, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGUSR2, {sa_handler=0x55579f5b80, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGPIPE, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 uname({sysname="Linux", nodename="hermod", ...}) = 0 futex(0x7f86659b70, FUTEX_WAKE_PRIVATE, 2147483647) = 0 futex(0x7f86659a20, FUTEX_WAKE_PRIVATE, 2147483647) = 0 futex(0x7f86659a24, FUTEX_WAKE_PRIVATE, 2147483647) = 0 futex(0x7f86659a28, FUTEX_WAKE_PRIVATE, 2147483647) = 0 getpid() = 156220 getrandom("\x98\x54\xa4\x4b\xc4\x65\xc2\xda\x16\x49\x4d\x18\xa5\xe3\x43\x18\x66\x37\x34\x47\xa4\x5d\xcc\x6b\x94\x8e\xa6\x09\x00\xa3\xca\x03", 32, 0) = 32 getpid() = 156220 futex(0x7f86659b4c, FUTEX_WAKE_PRIVATE, 2147483647) = 0 getpid() = 156220 getpid() = 156220 getpid() = 156220 getpid() = 156220 openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=332, ...}) = 0 read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 332 read(4, "", 4096) = 0 close(4) = 0 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=43816, ...}) = 0 mmap(NULL, 43816, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f8667e000 close(4) = 0 openat(AT_FDCWD, "/lib64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = 4 read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\300\30\0\0\0\0\0\0"..., 832) = 832 fstat(4, {st_mode=S_IFREG|0755, st_size=30752, ...}) = 0 mmap(NULL, 95112, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f85fec000 mprotect(0x7f85ff3000, 61440, PROT_NONE) = 0 mmap(0x7f86002000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7f86002000 close(4) = 0 openat(AT_FDCWD, "/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4 read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\360#\0\0\0\0\0\0"..., 832) = 832 fstat(4, {st_mode=S_IFREG|0755, st_size=51360, ...}) = 0 mmap(NULL, 115696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f85fcf000 mprotect(0x7f85fdb000, 61440, PROT_NONE) = 0 mmap(0x7f85fea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xb000) = 0x7f85fea000 close(4) = 0 mprotect(0x7f85fea000, 4096, PROT_READ) = 0 mprotect(0x7f86002000, 4096, PROT_READ) = 0 munmap(0x7f8667e000, 43816) = 0 openat(AT_FDCWD, "/var/db/services.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/services", O_RDONLY|O_CLOEXEC) = 4 lseek(4, 0, SEEK_CUR) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=36587, ...}) = 0 read(4, "# /etc/services\n#\n# Network serv"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 4096 read(4, " private\t77/tcp\t\t\t\t# any private"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 8192 read(4, "e\nemfis-cntl\t141/udp\nimap\t\t143/t"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 12288 read(4, "dialog\t360/tcp\t\t\t\t# scoi2odialog"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 16384 read(4, "\t\tdqs313_intercell\ncryptoadmin\t6"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 20480 read(4, "# Citrix ICA Client\nica\t\t1494/ud"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 24576 read(4, "udp\nnetchat\t\t2451/tcp\nnetchat\t\t2"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 28672 read(4, "VM Service\ncaevms\t\t5251/udp\nxmpp"..., 4096) = 4096 lseek(4, 0, SEEK_CUR) = 32768 read(4, "a\t\t10080/tcp\t\t\t# amanda backup s"..., 4096) = 3819 close(4) = 0 newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=617, ...}, 0) = 0 openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=935, ...}) = 0 read(4, "# /etc/host.conf:\n# $Header: /va"..., 4096) = 935 read(4, "", 4096) = 0 close(4) = 0 futex(0x7f861c0118, FUTEX_WAKE_PRIVATE, 2147483647) = 0 openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=617, ...}) = 0 read(4, "# This file is managed by man:sy"..., 4096) = 617 read(4, "", 4096) = 0 close(4) = 0 uname({sysname="Linux", nodename="hermod", ...}) = 0 openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 4 lseek(4, 0, SEEK_CUR) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=1251, ...}) = 0 read(4, "# /etc/hosts: Local Host Databas"..., 4096) = 1251 lseek(4, 0, SEEK_CUR) = 1251 read(4, "", 4096) = 0 close(4) = 0 openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = 4 fstat(4, {st_mode=S_IFREG|0644, st_size=2584, ...}) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=2584, ...}) = 0 read(4, "# Configuration for getaddrinfo("..., 4096) = 2584 read(4, "", 4096) = 0 close(4) = 0 futex(0x7f861bf178, FUTEX_WAKE_PRIVATE, 2147483647) = 0 socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 4 bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0 getsockname(4, {sa_family=AF_NETLINK, nl_pid=156220, nl_groups=00000000}, [12]) = 0 sendto(4, {{len=20, type=0x16 /* NLMSG_??? */, flags=NLM_F_REQUEST|0x300, seq=1578687397, pid=0}, "\x00\x00\x00\x00"}, 20, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 20 recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=76, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x02\x08\x80\xfe\x01\x00\x00\x00\x08\x00\x01\x00\x7f\x00\x00\x01\x08\x00\x02\x00\x7f\x00\x00\x01\x07\x00\x03\x00\x6c\x6f\x00\x00"...}, {{len=88, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x02\x18\x00\x00\x02\x00\x00\x00\x08\x00\x01\x00\xc0\xa8\x01\xdb\x08\x00\x02\x00\xc0\xa8\x01\xdb\x08\x00\x04\x00\xc0\xa8\x01\xff"...}], iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 164 recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x80\x80\xfe\x01\x00\x00\x00\x14\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x14\x00\x06\x00"...}, {{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x80\x80\x00\x02\x00\x00\x00\x14\x00\x01\x00\xfd\xf5\xb6\x49\x2a\xe7\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x36\x14\x00\x06\x00"...}, {{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x40\x80\x00\x02\x00\x00\x00\x14\x00\x01\x00\xfd\xf5\xb6\x49\x2a\xe7\x00\x00\xde\xa6\x32\xff\xfe\x55\x71\x7d\x14\x00\x06\x00"...}, {{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x40\x80\xfd\x02\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\xde\xa6\x32\xff\xfe\x55\x71\x7d\x14\x00\x06\x00"...}], iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 288 recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=20, type=NLMSG_DONE, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, 0}, iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 close(4) = 0 socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 4 connect(4, {sa_family=AF_INET, sin_port=htons(2947), sin_addr=inet_addr("127.0.0.1")}, 16) = 0 getsockname(4, {sa_family=AF_INET, sin_port=htons(52129), sin_addr=inet_addr("127.0.0.1")}, [28->16]) = 0 close(4) = 0 socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 4 connect(4, {sa_family=AF_INET6, sin6_port=htons(2947), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0 getsockname(4, {sa_family=AF_INET6, sin6_port=htons(39138), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, [28]) = 0 close(4) = 0 getpid() = 156220 sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 68, MSG_NOSIGNAL, NULL, 0) = 68 getpid() = 156220 write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 692020-01-10T21:16:37 ntpd[156220]: INIT: precision = 0.389 usec (-21) ) = 69 getpid() = 156220 getpid() = 156220 prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=RLIM64_INFINITY, rlim_max=RLIM64_INFINITY}, NULL) = 0 mlockall(MCL_CURRENT|MCL_FUTURE) = 0 getpid() = 156220 sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 68, MSG_NOSIGNAL, NULL, 0) = 68 getpid() = 156220 write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 692020-01-10T21:16:37 ntpd[156220]: INIT: successfully locked into RAM ) = 69 prctl(PR_SET_KEEPCAPS, 1) = 0 openat(AT_FDCWD, "/var/db/passwd.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 4 lseek(4, 0, SEEK_CUR) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=2237, ...}) = 0 read(4, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 2237 close(4) = 0 openat(AT_FDCWD, "/var/db/group.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 4 lseek(4, 0, SEEK_CUR) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=985, ...}) = 0 read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 985 close(4) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY) = 4 read(4, "65536\n", 31) = 6 close(4) = 0 openat(AT_FDCWD, "/var/db/group.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 4 lseek(4, 0, SEEK_CUR) = 0 fstat(4, {st_mode=S_IFREG|0644, st_size=985, ...}) = 0 read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 lseek(4, 0, SEEK_CUR) = 985 read(4, "", 4096) = 0 close(4) = 0 setgroups(1, [123]) = 0 setgid(123) = 0 setresgid(-1, 123, -1) = 0 setgroups(1, [123]) = 0 setuid(123) = 0 setresuid(-1, 123, -1) = 0 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = 0 capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<Jan 10 21:16:37 ntpd[156220]"..., 65, MSG_NOSIGNAL, NULL, 0) = 65 getpid() = 156220 write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 662020-01-10T21:16:37 ntpd[156220]: INIT: sandbox: seccomp enabled. ) = 66 openat(AT_FDCWD, "/etc/ntp.conf", O_RDONLY) = 4 getpid() = 156220 sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 81, MSG_NOSIGNAL, NULL, 0) = 81 getpid() = 156220 write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 822020-01-10T21:16:37 ntpd[156220]: CONFIG: readconfig: parsing file: /etc/ntp.conf ) = 82 fstat(4, {st_mode=S_IFREG|0644, st_size=727, ...}) = 0 read(4, "# This is a Gentoo specific conf"..., 4096) = 727 read(4, "", 4096) = 0 newfstatat(AT_FDCWD, "/etc/ntp.d", 0x7feb1ce4a8, 0) = -1 ENETDOWN (Network is down) --- SIGSYS {si_signo=SIGSYS, si_code=SYS_SECCOMP, si_call_addr=0x7f8610e800, si_syscall=__NR_newfstatat, si_arch=AUDIT_ARCH_AARCH64} --- getpid() = 156220 sendto(3, "<27>Jan 10 21:16:37 ntpd[156220]"..., 59, MSG_NOSIGNAL, NULL, 0) = 59 getpid() = 156220 write(2, "2020-01-10T21:16:37 ", 202020-01-10T21:16:37 ) = 20 write(2, "ntpd[156220]: ", 14ntpd[156220]: ) = 14 write(2, "ERR: SIGSYS: got a trap.\n", 25ERR: SIGSYS: got a trap. ) = 25 getpid() = 156220 sendto(3, "<27>Jan 10 21:16:37 ntpd[156220]"..., 80, MSG_NOSIGNAL, NULL, 0) = 80 getpid() = 156220 write(2, "2020-01-10T21:16:37 ", 202020-01-10T21:16:37 ) = 20 write(2, "ntpd[156220]: ", 14ntpd[156220]: ) = 14 write(2, "ERR: SIGSYS/seccomp bad syscall "..., 46ERR: SIGSYS/seccomp bad syscall 79/0xc00000b7 ) = 46 futex(0x7f866598fc, FUTEX_WAKE_PRIVATE, 2147483647) = 0 exit_group(1) = ? +++ exited with 1 +++