ntpsecstrace.txt

ntpsecstrace.txt (text/plain), 26.17 KB, created by crabbed halo ablution on 2020-01-10 21:11:13 UTC

execve("/usr/sbin/ntpd", ["/usr/sbin/ntpd", "--debug", "--configfile=/etc/ntp.conf", "--panicgate", "--user=ntp:ntp", "--nofork"], 0x7fdb230e38 /* 46 vars */) = 0
brk(NULL)                               = 0x557d70c000
faccessat(AT_FDCWD, "/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=43816, ...}) = 0
mmap(NULL, 43816, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f8667e000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib64/libcrypto.so.1.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\0`\7\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2605832, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8667c000
mmap(NULL, 2687344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f863cb000
mprotect(0x7f8661d000, 61440, PROT_NONE) = 0
mmap(0x7f8662c000, 176128, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x251000) = 0x7f8662c000
mmap(0x7f86657000, 16752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f86657000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib64/libssl.so.1.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\260\346\1\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=572448, ...}) = 0
mmap(NULL, 636624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8632f000
mprotect(0x7f863ae000, 65536, PROT_NONE) = 0
mmap(0x7f863be000, 53248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7f000) = 0x7f863be000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\240\270\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=649104, ...}) = 0
mmap(NULL, 712824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86280000
mprotect(0x7f8631e000, 61440, PROT_NONE) = 0
mmap(0x7f8632d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9d000) = 0x7f8632d000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0p\36\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=31296, ...}) = 0
mmap(NULL, 95016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86268000
mprotect(0x7f8626f000, 61440, PROT_NONE) = 0
mmap(0x7f8627e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f8627e000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\20 \0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=27056, ...}) = 0
mmap(NULL, 90856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86251000
mprotect(0x7f86257000, 61440, PROT_NONE) = 0
mmap(0x7f86266000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f86266000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib64/libseccomp.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0PO\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=309208, ...}) = 0
mmap(NULL, 373008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f861f5000
mprotect(0x7f86228000, 61440, PROT_NONE) = 0
mmap(0x7f86237000, 106496, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x32000) = 0x7f86237000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\300f\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=173840, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f861f3000
mmap(NULL, 201736, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f861c1000
mprotect(0x7f861de000, 61440, PROT_NONE) = 0
mmap(0x7f861ed000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c000) = 0x7f861ed000
mmap(0x7f861ef000, 13320, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f861ef000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0P\16\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1499520, ...}) = 0
mmap(NULL, 1572400, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86041000
mprotect(0x7f861a8000, 65536, PROT_NONE) = 0
mmap(0x7f861b8000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x167000) = 0x7f861b8000
mmap(0x7f861be000, 11824, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f861be000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\220%\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=92320, ...}) = 0
mmap(NULL, 156040, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f8601a000
mprotect(0x7f86030000, 61440, PROT_NONE) = 0
mmap(0x7f8603f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x7f8603f000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0 \17\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=14280, ...}) = 0
mmap(NULL, 78080, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f86006000
mprotect(0x7f86009000, 61440, PROT_NONE) = 0
mmap(0x7f86018000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f86018000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f86004000
mprotect(0x7f861b8000, 16384, PROT_READ) = 0
mprotect(0x7f86018000, 4096, PROT_READ) = 0
mprotect(0x7f8603f000, 4096, PROT_READ) = 0
mprotect(0x7f861ed000, 4096, PROT_READ) = 0
mprotect(0x7f86237000, 102400, PROT_READ) = 0
mprotect(0x7f86266000, 4096, PROT_READ) = 0
mprotect(0x7f8627e000, 4096, PROT_READ) = 0
mprotect(0x7f8632d000, 4096, PROT_READ) = 0
mprotect(0x7f8662c000, 167936, PROT_READ) = 0
mprotect(0x7f863be000, 32768, PROT_READ) = 0
mprotect(0x5557a4e000, 16384, PROT_READ) = 0
mprotect(0x7f8668b000, 4096, PROT_READ) = 0
munmap(0x7f8667e000, 43816)             = 0
set_tid_address(0x7f86004a40)           = 156220
set_robust_list(0x7f86004a50, 24)       = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7f861c6fe0, sa_mask=[], sa_flags=SA_SIGINFO}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7f861c70e0, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
prctl(PR_CAPBSET_READ, CAP_MAC_OVERRIDE) = 1
prctl(PR_CAPBSET_READ, 0x30 /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x28 /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, CAP_BLOCK_SUSPEND) = 1
prctl(PR_CAPBSET_READ, 0x26 /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, CAP_AUDIT_READ)  = 1
rt_sigprocmask(SIG_SETMASK, ~[ILL TRAP BUS FPE SEGV RTMIN RT_1], [], 8) = 0
rt_sigaction(SIGILL, {sa_handler=0x7f864455b0, sa_mask=~[ILL TRAP BUS FPE SEGV RTMIN RT_1], sa_flags=0}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigprocmask(SIG_BLOCK, NULL, ~[ILL TRAP BUS FPE KILL SEGV STOP RTMIN RT_1], 8) = 0
rt_sigaction(SIGILL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
umask(000)                              = 022
umask(022)                              = 000
brk(NULL)                               = 0x557d70c000
brk(0x557d72d000)                       = 0x557d72d000
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 3
connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=2137, ...}) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=2137, ...}) = 0
read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\7\0\0\0\0"..., 4096) = 2137
lseek(4, -1359, SEEK_CUR)               = 778
read(4, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\10\0\0\0\0"..., 4096) = 1359
close(4)                                = 0
getpid()                                = 156220
sendto(3, "<29>Jan 10 21:16:37 ntpd[156220]"..., 88, MSG_NOSIGNAL, NULL, 0) = 88
getpid()                                = 156220
fstat(1, {st_mode=S_IFREG|0644, st_size=8897, ...}) = 0
write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 892020-01-10T21:16:37 ntpd[156220]: INIT: ntpd ntpsec-1.1.8 2020-01-10T19:59:05Z: Starting
) = 89
getpid()                                = 156220
sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 139, MSG_NOSIGNAL, NULL, 0) = 139
getpid()                                = 156220
write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 1402020-01-10T21:16:37 ntpd[156220]: INIT: Command line: /usr/sbin/ntpd --debug --configfile=/etc/ntp.conf --panicgate --user=ntp:ntp --nofork
) = 140
getuid()                                = 0
socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4
close(4)                                = 0
socket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 4
getsockname(4, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_scope_id=0}, [28]) = 0
close(4)                                = 0
rt_sigaction(SIGPIPE, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTART}, NULL, 8) = 0
rt_sigaction(SIGINT, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGQUIT, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGTERM, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=0x55579f5ae0, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x55579f5a90, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x55579f5b30, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGUSR1, {sa_handler=0x55579f5b80, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGUSR2, {sa_handler=0x55579f5b80, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGPIPE, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
uname({sysname="Linux", nodename="hermod", ...}) = 0
futex(0x7f86659b70, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f86659a20, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f86659a24, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f86659a28, FUTEX_WAKE_PRIVATE, 2147483647) = 0
getpid()                                = 156220
getrandom("\x98\x54\xa4\x4b\xc4\x65\xc2\xda\x16\x49\x4d\x18\xa5\xe3\x43\x18\x66\x37\x34\x47\xa4\x5d\xcc\x6b\x94\x8e\xa6\x09\x00\xa3\xca\x03", 32, 0) = 32
getpid()                                = 156220
futex(0x7f86659b4c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
getpid()                                = 156220
getpid()                                = 156220
getpid()                                = 156220
getpid()                                = 156220
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=332, ...}) = 0
read(4, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 332
read(4, "", 4096)                       = 0
close(4)                                = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=43816, ...}) = 0
mmap(NULL, 43816, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f8667e000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libnss_db.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\300\30\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=30752, ...}) = 0
mmap(NULL, 95112, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f85fec000
mprotect(0x7f85ff3000, 61440, PROT_NONE) = 0
mmap(0x7f86002000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x6000) = 0x7f86002000
close(4)                                = 0
openat(AT_FDCWD, "/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\360#\0\0\0\0\0\0"..., 832) = 832
fstat(4, {st_mode=S_IFREG|0755, st_size=51360, ...}) = 0
mmap(NULL, 115696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f85fcf000
mprotect(0x7f85fdb000, 61440, PROT_NONE) = 0
mmap(0x7f85fea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xb000) = 0x7f85fea000
close(4)                                = 0
mprotect(0x7f85fea000, 4096, PROT_READ) = 0
mprotect(0x7f86002000, 4096, PROT_READ) = 0
munmap(0x7f8667e000, 43816)             = 0
openat(AT_FDCWD, "/var/db/services.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/services", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=36587, ...}) = 0
read(4, "# /etc/services\n#\n# Network serv"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 4096
read(4, " private\t77/tcp\t\t\t\t# any private"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 8192
read(4, "e\nemfis-cntl\t141/udp\nimap\t\t143/t"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 12288
read(4, "dialog\t360/tcp\t\t\t\t# scoi2odialog"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 16384
read(4, "\t\tdqs313_intercell\ncryptoadmin\t6"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 20480
read(4, "# Citrix ICA Client\nica\t\t1494/ud"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 24576
read(4, "udp\nnetchat\t\t2451/tcp\nnetchat\t\t2"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 28672
read(4, "VM Service\ncaevms\t\t5251/udp\nxmpp"..., 4096) = 4096
lseek(4, 0, SEEK_CUR)                   = 32768
read(4, "a\t\t10080/tcp\t\t\t# amanda backup s"..., 4096) = 3819
close(4)                                = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=617, ...}, 0) = 0
openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=935, ...}) = 0
read(4, "# /etc/host.conf:\n# $Header: /va"..., 4096) = 935
read(4, "", 4096)                       = 0
close(4)                                = 0
futex(0x7f861c0118, FUTEX_WAKE_PRIVATE, 2147483647) = 0
openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=617, ...}) = 0
read(4, "# This file is managed by man:sy"..., 4096) = 617
read(4, "", 4096)                       = 0
close(4)                                = 0
uname({sysname="Linux", nodename="hermod", ...}) = 0
openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=1251, ...}) = 0
read(4, "# /etc/hosts: Local Host Databas"..., 4096) = 1251
lseek(4, 0, SEEK_CUR)                   = 1251
read(4, "", 4096)                       = 0
close(4)                                = 0
openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=2584, ...}) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=2584, ...}) = 0
read(4, "# Configuration for getaddrinfo("..., 4096) = 2584
read(4, "", 4096)                       = 0
close(4)                                = 0
futex(0x7f861bf178, FUTEX_WAKE_PRIVATE, 2147483647) = 0
socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 4
bind(4, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 0
getsockname(4, {sa_family=AF_NETLINK, nl_pid=156220, nl_groups=00000000}, [12]) = 0
sendto(4, {{len=20, type=0x16 /* NLMSG_??? */, flags=NLM_F_REQUEST|0x300, seq=1578687397, pid=0}, "\x00\x00\x00\x00"}, 20, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 20
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=76, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x02\x08\x80\xfe\x01\x00\x00\x00\x08\x00\x01\x00\x7f\x00\x00\x01\x08\x00\x02\x00\x7f\x00\x00\x01\x07\x00\x03\x00\x6c\x6f\x00\x00"...}, {{len=88, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x02\x18\x00\x00\x02\x00\x00\x00\x08\x00\x01\x00\xc0\xa8\x01\xdb\x08\x00\x02\x00\xc0\xa8\x01\xdb\x08\x00\x04\x00\xc0\xa8\x01\xff"...}], iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 164
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x80\x80\xfe\x01\x00\x00\x00\x14\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x14\x00\x06\x00"...}, {{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x80\x80\x00\x02\x00\x00\x00\x14\x00\x01\x00\xfd\xf5\xb6\x49\x2a\xe7\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x36\x14\x00\x06\x00"...}, {{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x40\x80\x00\x02\x00\x00\x00\x14\x00\x01\x00\xfd\xf5\xb6\x49\x2a\xe7\x00\x00\xde\xa6\x32\xff\xfe\x55\x71\x7d\x14\x00\x06\x00"...}, {{len=72, type=0x14 /* NLMSG_??? */, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, "\x0a\x40\x80\xfd\x02\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\xde\xa6\x32\xff\xfe\x55\x71\x7d\x14\x00\x06\x00"...}], iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 288
recvmsg(4, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=20, type=NLMSG_DONE, flags=NLM_F_MULTI, seq=1578687397, pid=156220}, 0}, iov_len=4096}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20
close(4)                                = 0
socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET, sin_port=htons(2947), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
getsockname(4, {sa_family=AF_INET, sin_port=htons(52129), sin_addr=inet_addr("127.0.0.1")}, [28->16]) = 0
close(4)                                = 0
socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 4
connect(4, {sa_family=AF_INET6, sin6_port=htons(2947), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, 28) = 0
getsockname(4, {sa_family=AF_INET6, sin6_port=htons(39138), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::1", &sin6_addr), sin6_scope_id=0}, [28]) = 0
close(4)                                = 0
getpid()                                = 156220
sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 68, MSG_NOSIGNAL, NULL, 0) = 68
getpid()                                = 156220
write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 692020-01-10T21:16:37 ntpd[156220]: INIT: precision = 0.389 usec (-21)
) = 69
getpid()                                = 156220
getpid()                                = 156220
prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=RLIM64_INFINITY, rlim_max=RLIM64_INFINITY}, NULL) = 0
mlockall(MCL_CURRENT|MCL_FUTURE)        = 0
getpid()                                = 156220
sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 68, MSG_NOSIGNAL, NULL, 0) = 68
getpid()                                = 156220
write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 692020-01-10T21:16:37 ntpd[156220]: INIT: successfully locked into RAM
) = 69
prctl(PR_SET_KEEPCAPS, 1)               = 0
openat(AT_FDCWD, "/var/db/passwd.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=2237, ...}) = 0
read(4, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 2237
close(4)                                = 0
openat(AT_FDCWD, "/var/db/group.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=985, ...}) = 0
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 985
close(4)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY) = 4
read(4, "65536\n", 31)                  = 6
close(4)                                = 0
openat(AT_FDCWD, "/var/db/group.db", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/group", O_RDONLY|O_CLOEXEC) = 4
lseek(4, 0, SEEK_CUR)                   = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=985, ...}) = 0
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
lseek(4, 0, SEEK_CUR)                   = 985
read(4, "", 4096)                       = 0
close(4)                                = 0
setgroups(1, [123])                     = 0
setgid(123)                             = 0
setresgid(-1, 123, -1)                  = 0
setgroups(1, [123])                     = 0
setuid(123)                             = 0
setresuid(-1, 123, -1)                  = 0
capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = 0
capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_NET_BIND_SERVICE|1<<CAP_SYS_NICE|1<<CAP_SYS_TIME, permitted=1<<CAP_NET_BIND_SERVICE|1<<CAP_SYS_NICE|1<<CAP_SYS_TIME, inheritable=0}) = 0
rt_sigaction(SIGSYS, {sa_handler=0x55579f3150, sa_mask=[], sa_flags=SA_SIGINFO}, NULL, 8) = 0
brk(0x557d74e000)                       = 0x557d74e000
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)  = 0
seccomp(SECCOMP_SET_MODE_STRICT, 1, NULL) = -1 EINVAL (Invalid argument)
seccomp(SECCOMP_SET_MODE_FILTER, 0, {len=85, filter=0x557d72f670}) = 0
getpid()                                = 156220
sendto(3, "<29>Jan 10 21:16:37 ntpd[156220]"..., 65, MSG_NOSIGNAL, NULL, 0) = 65
getpid()                                = 156220
write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 662020-01-10T21:16:37 ntpd[156220]: INIT: sandbox: seccomp enabled.
) = 66
openat(AT_FDCWD, "/etc/ntp.conf", O_RDONLY) = 4
getpid()                                = 156220
sendto(3, "<30>Jan 10 21:16:37 ntpd[156220]"..., 81, MSG_NOSIGNAL, NULL, 0) = 81
getpid()                                = 156220
write(1, "2020-01-10T21:16:37 ntpd[156220]"..., 822020-01-10T21:16:37 ntpd[156220]: CONFIG: readconfig: parsing file: /etc/ntp.conf
) = 82
fstat(4, {st_mode=S_IFREG|0644, st_size=727, ...}) = 0
read(4, "# This is a Gentoo specific conf"..., 4096) = 727
read(4, "", 4096)                       = 0
newfstatat(AT_FDCWD, "/etc/ntp.d", 0x7feb1ce4a8, 0) = -1 ENETDOWN (Network is down)
--- SIGSYS {si_signo=SIGSYS, si_code=SYS_SECCOMP, si_call_addr=0x7f8610e800, si_syscall=__NR_newfstatat, si_arch=AUDIT_ARCH_AARCH64} ---
getpid()                                = 156220
sendto(3, "<27>Jan 10 21:16:37 ntpd[156220]"..., 59, MSG_NOSIGNAL, NULL, 0) = 59
getpid()                                = 156220
write(2, "2020-01-10T21:16:37 ", 202020-01-10T21:16:37 )    = 20
write(2, "ntpd[156220]: ", 14ntpd[156220]: )          = 14
write(2, "ERR: SIGSYS: got a trap.\n", 25ERR: SIGSYS: got a trap.
) = 25
getpid()                                = 156220
sendto(3, "<27>Jan 10 21:16:37 ntpd[156220]"..., 80, MSG_NOSIGNAL, NULL, 0) = 80
getpid()                                = 156220
write(2, "2020-01-10T21:16:37 ", 202020-01-10T21:16:37 )    = 20
write(2, "ntpd[156220]: ", 14ntpd[156220]: )          = 14
write(2, "ERR: SIGSYS/seccomp bad syscall "..., 46ERR: SIGSYS/seccomp bad syscall 79/0xc00000b7
) = 46
futex(0x7f866598fc, FUTEX_WAKE_PRIVATE, 2147483647) = 0
exit_group(1)                           = ?
+++ exited with 1 +++