7015 read(0, "chong\n", 4095) = 6 7015 ioctl(0, SNDCTL_TMR_STOP or TCSETSW, {B38400 opost isig icanon echo ...}) = 0 7015 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 7015 ioctl(0, SNDCTL_TMR_CONTINUE or TCSETSF, {B38400 opost isig icanon echo ...}) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 close(5) = 0 7015 openat(AT_FDCWD, "/var/run/nologin", O_RDONLY) = -1 ENOENT (No such file or directory) 7015 openat(AT_FDCWD, "/etc/nologin", O_RDONLY) = -1 ENOENT (No such file or directory) 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/shells", {st_mode=S_IFREG|0644, st_size=102, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/shells", O_RDONLY) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=102, ...}, AT_EMPTY_PATH) = 0 7015 read(5, "# Pathnames of valid login shell"..., 4096) = 102 7015 read(5, "", 4096) = 0 7015 close(5) = 0 7015 openat(AT_FDCWD, "/var/run/nologin", O_RDONLY) = -1 ENOENT (No such file or directory) 7015 openat(AT_FDCWD, "/etc/nologin", O_RDONLY) = -1 ENOENT (No such file or directory) 7015 openat(AT_FDCWD, "/etc/security/faillock.conf", O_RDONLY) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=2234, ...}, AT_EMPTY_PATH) = 0 7015 read(5, "# Configuration for locking the "..., 4096) = 2234 7015 read(5, "", 4096) = 0 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 close(5) = 0 7015 openat(AT_FDCWD, "/var/run/faillock/chong", O_RDWR) = 5 7015 flock(5, LOCK_EX) = 0 7015 newfstatat(5, "", {st_mode=S_IFREG|0660, st_size=0, ...}, AT_EMPTY_PATH) = 0 7015 read(5, "", 4096) = 0 7015 close(5) = 0 7015 getuid() = 0 7015 openat(AT_FDCWD, "/etc/login.defs", O_RDONLY) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=5645, ...}, AT_EMPTY_PATH) = 0 7015 read(5, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096 7015 read(5, "gin\n#\nLOGIN_TIMEOUT\t\t60\n\n#\n# Whi"..., 4096) = 1549 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0600, st_size=802, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:$6$oOX0TOnRvyaLYS1Z$g0DPKMS"..., 4096) = 802 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 read(5, "", 4096) = 0 7015 close(5) = 0 7015 rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0 7015 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 7015 ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 7015 ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 7015 rt_sigprocmask(SIG_BLOCK, [TSTP], [], 8) = 0 7015 ioctl(0, SNDCTL_TMR_CONTINUE or TCSETSF, {B38400 opost isig icanon -echo ...}) = 0 7015 write(2, "Password: ", 10) = 10 7015 read(0, "1\n", 4095) = 2 7015 ioctl(0, SNDCTL_TMR_STOP or TCSETSW, {B38400 opost isig icanon echo ...}) = 0 7015 write(2, "\n", 1) = 1 7015 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 7015 ioctl(0, SNDCTL_TMR_CONTINUE or TCSETSF, {B38400 opost isig icanon echo ...}) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/shadow", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0600, st_size=802, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:$6$oOX0TOnRvyaLYS1Z$g0DPKMS"..., 4096) = 802 7015 close(5) = 0 7015 openat(AT_FDCWD, "/etc/security/faillock.conf", O_RDONLY) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=2234, ...}, AT_EMPTY_PATH) = 0 7015 read(5, "# Configuration for locking the "..., 4096) = 2234 7015 read(5, "", 4096) = 0 7015 close(5) = 0 7015 newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0 7015 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 5 7015 newfstatat(5, "", {st_mode=S_IFREG|0644, st_size=1335, ...}, AT_EMPTY_PATH) = 0 7015 lseek(5, 0, SEEK_SET) = 0 7015 read(5, "root:x:0:0::/root:/bin/bash\nbin:"..., 4096) = 1335 7015 close(5) = 0 7015 openat(AT_FDCWD, "/var/run/faillock/chong", O_RDWR) = 5 7015 flock(5, LOCK_EX) = 0 7015 newfstatat(5, "", {st_mode=S_IFREG|0660, st_size=0, ...}, AT_EMPTY_PATH) = 0 7015 read(5, "", 4096) = 0 7015 ftruncate(5, 0) = 0 7015 close(5) = 0 7015 socket(AF_NETLINK, SOCK_RAW, NETLINK_AUDIT) = 5 7015 fcntl(5, F_SETFD, FD_CLOEXEC) = 0 7015 sendto(5, [{nlmsg_len=136, nlmsg_type=0x44c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2, nlmsg_pid=0}, "\x6f\x70\x3d\x50\x41\x4d\x3a\x61\x75\x74\x68\x65\x6e\x74\x69\x63\x61\x74\x69\x6f\x6e\x20\x67\x72\x61\x6e\x74\x6f\x72\x73\x3d\x3f"...], 136, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 136 7015 poll([{fd=5, events=POLLIN}], 1, 500) = 1 ([{fd=5, revents=POLLIN}]) 7015 recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=2, nlmsg_pid=7015}, {error=0, msg={nlmsg_len=136, nlmsg_type=AUDIT_FIRST_USER_MSG, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2, nlmsg_pid=0}}], 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36 7015 recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=2, nlmsg_pid=7015}, {error=0, msg={nlmsg_len=136, nlmsg_type=AUDIT_FIRST_USER_MSG, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=2, nlmsg_pid=0}}], 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [12]) = 36 7015 close(5) = 0 7015 pselect6(0, NULL, NULL, NULL, {tv_sec=2, tv_nsec=46609000}, NULL) = 0 (Timeout) 7015 sendto(4, "<85>Jan 2 22:45:57 login: FAILE"..., 85, MSG_NOSIGNAL, NULL, 0) = 85 7015 openat(AT_FDCWD, "/var/log/btmp", O_WRONLY) = 5 7015 alarm(0) = 11 7015 rt_sigaction(SIGALRM, {sa_handler=0x7f2649f6e7a0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f2649e74da0}, {sa_handler=0x557c28913630, sa_mask=[ALRM], sa_flags=SA_RESTORER, sa_restorer=0x7f2649e74da0}, 8) = 0 7015 alarm(10) = 0 7015 fcntl(5, F_SETLKW, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 7015 alarm(0) = 10 7015 rt_sigaction(SIGALRM, {sa_handler=0x557c28913630, sa_mask=[ALRM], sa_flags=SA_RESTORER, sa_restorer=0x7f2649e74da0}, NULL, 8) = 0 7015 alarm(11) = 0 7015 lseek(5, 0, SEEK_END) = 32256 7015 write(5, "\6\0\0\0g\33\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384 7015 fcntl(5, F_SETLKW, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 7015 close(5) = 0 7015 write(2, "Login incorrect\n\n", 17) = 17 7015 ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 7015 ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0 7015 rt_sigprocmask(SIG_BLOCK, [TSTP], [], 8) = 0 7015 ioctl(0, SNDCTL_TMR_CONTINUE or TCSETSF, {B38400 opost isig icanon echo ...}) = 0 7015 write(2, "Arch login: ", 12) = 12 7015 read(0,