grsec-unoff (RAP) related Call Traces, 171123-1530 oops
(No. 0) 171114-1000-manu 171117-1426-oops 171118-0933-rsys 171118-1030-none 171122-1348-rsys 171123-1254 171123-1530 171124-0102-none 180101-1917-rsync
(the title in some pages is misleading, but that's how in my --still-- vague understanding I started this section, can't now change that, sorry)
I got the manual ("manu" in the name of file, and link) and the rsyslog ("rsys" in those) trace for this one.
_vmi videobuf2_v4l2 cx88xx drm tveeprom v4l2_common snd_hda_codec_realtek snd_hda_codec_generic irqbypass videobuf2_core videodev media evdev pcspkr snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep i2c_algo_bit k10temp serio_raw snd_pcm fb_sys_fops syscopyarea sysfillrect sysimglt snd_timer sp5100_tco sg wmi snd nuvoton_cir rc_core soundcore shpchp button acpi_cpufreq ext4 crc16 jbd2 fscrypto mbcache xts gf128mul algif_skcipher af_alg dm_crypt dm_mod sr_mod cdrom sd_mod ata_generic uas usb_storage ohci_pci psmouse r8169 mii firewire_ohci firewire_core crc_itu_t sky2 ahci libahci pata_atiixp xhci_pci ehci_pci ohci_pci xhci_hcd ehci_hcd libata usbcore scsi_mod i2c_piix4fjes [ 19.489557] CPU: 0 PID: 917 Comm: systemd-udevd Not tainted 4.9.64-unofficial+grsec171123-09 #1 [ 19.489610] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./979 Extreme4, BIOS P2.60 11/11/2013 [ 19.489671] task: ffff88031e738340 tsk.stack: ffffc90003670000 [ 19.489707] RIP: 0010:[] [ ] _raw_spin_lock+0x55/0x70 [ 19.489762] RSP: 0018:ffffc90003673b98 EFLAGS: 00000087 [ 19.489822] RAX: ffffffff811f60da RBX: ffff88032fff9010 RCX: 0000000000000020 [ 19.489865] RDX: 0000000000000001 RSI: 000000000000001f RDI: ffff88032fff9010 [ 19.489908] RBP: 000000000000001f R08: 0000000000016d48 R09: 0000000000000202 [ 19.489951] R10: 0000000000000000 R11: 0000000000000364 R12: ffff88032fff8000 [ 19.489993] R13: 0000000000000206 R14: ffffea000c6b9400 R15: ffff88032fff8b80 [ 19.490036] FS: 000003a61feba8c0(0000) GS:ffff88032fc00000(0000) knlGS:0000000000000000 [ 19.490085] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 19.490120] CR2: 0000004845db1ed0 CR3: 0000000001ca3000 CR4: 00000000000006f0 [ 19.492062] Stack: [ 19.493996] ffff88032fff8b80 ffffffff811f60da 00000000000004b6 ffff88032fff8b80 [ 19.494076] grsec: exec of /bin/loadkeys (loadkeys /etc/console-setup/cached_UTF-8_del.kmap.gz ) by /bin/loadkeys[cached_setup_ke:929] uid/euid:0/0 gid/egid:0/0, parent /etc/console-setup/cached_setup_keyboard.sh[cached_setup_ke:911] uid/euid:0/0 gid/egid:0/0 [ 19.500053] 0000000100000001 ffff88032fc16d58 ffff88032fc16d68 0000001f00000001 [ 19.502153] ffff88032fc16d48 ffffea000c6b9420 ffff88032fc16d68 b35977662375a8cb [ 19.504259] Call Trace: [ 19.506328] [ ] ? free_pcppages_bulk+0x5a/0x570 [ 19.508459] [ ] ? free_hot_cold_page+0x2ce/0x340 [ 19.510592] [ ] ? free_hot_cold_page_list+0x49/0x90 [ 19.512677] [ ] ? release_pages+0x39e/0x480 [ 19.514773] [ ] ? free_pages_and_swap_cache+0xda/0x110 [ 19.516829] [ ] ? tlb_flush_mmu_free+0x4b/0x90 [ 19.518898] [ ] ? tlb_finish_mmu+0x41/0xa0 [ 19.520920] [ ] ? exit_mmap+0x182/0x220 [ 19.522951] [ ] ? mmput+0xc8/0x200 [ 19.524957] [ ] ? do_exit+0x3f8/0xfe0 [ 19.526928] [ ] ? do_group_exit+0x66/0x100 [ 19.528909] [ ] ? rap_sys_exit_group+0x21/0x40 [ 19.530844] [ ] ? entry_SYSCALL_64_fastpath+0x22/0xf0 [ 19.532800] Code: 48 81 78 f0 26 f0 64 cd 75 21 5b 48 0f ba 2c 24 3f c3 89 c6 48 89 df eb 0b 20 d9 07 fe ff ff ff ff cc cc cc e8 4d 89 7d ff eb d0 83 66 0f 1f 84 00 00 00 00 00 cc cc cc cc cc cc 48 b8 da 0f [ 19.536991] RIP [ ] _raw_spin_lock+0x55/0x70 [ 19.538971] RSP [ 19.540919] --[ end trace 8817d06dd9d7b6a1 ]--- [ 19.542893] Kernel panic - not syncing: grsec: halting the system due to suspicious kernel crash caused by root [ 20.623761] Shutting down cpus with NMI [ 20.625676] Kernel offset: disabled [ 20.627547] Kernel panic -not syncing: grsec: halting the system due to suspicious kernel crash caused by root
This one is great. Shows how elegant and considerate grsec (now its fork grsec-unoff) is. Nothing much happened (well, I hope, but I may stand corrected yet), the grsec-unoff protected the system, but it eventually didn't allow any more control of the system by any users, and wrote in the logs (what I saw on the screen is only what I presented to visitors in the "manu" trace above) that a reboot is needed. I love it. Shame on whoever pretty much banished grsec, for the majority of users --only advanced users can benefit, it requires more than common users' knowledge-- banished grsec from GNU/Linux by playing dirty games against spender and PaX Team... But see the elegance and kindness of grsec-unoff below...
First before the Call Trace proper, then the Call Trace, and then the rest until the reboot, which was mechanical, via the hardware switch.
Nov 23 15:28:52 gdOv kernel: [ 6962.150133] grsec: (default:D:/) exec of /usr/bin/pinentry-curses (pinentry --display :0 ) by /usr/bin/pinentry-curses[gpg-agent:5554] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/gpg-agent[gpg-agent:5553] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:28:58 gdOv kernel: [ 6968.999246] grsec: (default:D:/) exec of /bin/ls (ls --color=auto -ltr ) by /bin/ls[bash:5555] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:10 gdOv kernel: [ 6980.306120] grsec: (default:D:/) exec of /usr/bin/diff (diff fakeroot_make_deb-pkg_171123_091654_gdOv5_linux-image-4.9.64-grsec171123-09.tar.xz ../ ) by /usr/bin/diff[bash:5560] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:12 gdOv kernel: [ 6982.205887] grsec: (default:D:/) exec of /bin/ls (ls --color=auto -l ) by /bin/ls[bash:5561] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:13 gdOv kernel: [ 6983.741227] grsec: (default:D:/) exec of /bin/rm (rm fakeroot_make_deb-pkg_171123_091654_gdOv5_linux-image-4.9.64-grsec171123-09.tar.xz ) by /bin/rm[bash:5566] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:31 gdOv kernel: [ 7001.497802] grsec: (default:D:/) exec of /bin/mv (mv -iv fakeroot_deb-pkg_4.9.64-grsec-unoff.tar.xz fakeroot_make_deb-pkg_171123_091654_gdOv5_linux-image-4.9.64-grsec171123-09.ta) by /bin/mv[bash:5569] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:32 gdOv kernel: [ 7002.650426] grsec: (default:D:/) exec of /bin/ls (ls --color=auto -l ) by /bin/ls[bash:5570] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:47 gdOv kernel: [ 7017.724203] grsec: (default:D:/) exec of /usr/bin/gpg (gpg -d fakeroot_make_deb-pkg_171123_091654_gdOv5_linux-image-4.9.64-grsec171123-09.tar.xz.gg ) by /usr/bin/gpg[bash:5573] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000 Nov 23 15:29:49 gdOv kernel: [ 7019.501831] grsec: (default:D:/) exec of /bin/ls (ls --color=auto -ltr ) by /bin/ls[bash:5575] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:4888] uid/euid:1000/1000 gid/egid:1000/1000
Nov 23 15:29:59 gdOv kernel: [ 7029.164330] BUG: unable to handle kernel paging request at ffffffbfa0373d48 Nov 23 15:29:59 gdOv kernel: [ 7029.167335] IP: [] remove_vma+0x41/0x100 Nov 23 15:29:59 gdOv kernel: [ 7029.168894] PGD 20ac067 Nov 23 15:29:59 gdOv kernel: [ 7029.168910] PUD 0 Nov 23 15:29:59 gdOv kernel: [ 7029.170422] Nov 23 15:29:59 gdOv kernel: [ 7029.171987] Oops: 0000 [#1] SMP Nov 23 15:29:59 gdOv kernel: [ 7029.173529] Modules linked in: crc32c_generic nfnetlink_queue nfnetlink_log nfnetlink bluetooth rfkill nf_log_ipv4 nf_log_common xt_LOG xt_tcpudp xt_conntrack iptable_filter iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_raw ip_tables x_tables cx22702 isl6421 cx24123 cx88_dvb cx88_vp3054_i2c videobuf2_dvb wm8775 dvb_core ir_rc5_decoder ir_lirc_codec lirc_dev rc_hauppauge tuner_simple tuner_types tda9887 cx8800 tda8290 videobuf2_dma_sg videobuf2_memops mxm_wmi edac_mce_amd videobuf2_v4l2 tuner edac_core kvm_amd snd_hda_codec_realtek evdev snd_hda_codec_generic amdkfd kvm cx88_alsa cx8802 cx88xx tveeprom v4l2_common irqbypass radeon videobuf2_core videodev pcspkr k10temp media serio_raw ttm snd_hda_intel snd_hda_codec drm_kms_helper snd_hda_core Nov 23 15:29:59 gdOv kernel: [ 7029.180974] snd_hwdep drm nuvoton_cir rc_core snd_pcm i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt snd_timer shpchp sg snd wmi soundcore sp5100_tco button acpi_cpufreq ext4 crc16 jbd2 fscrypto mbcache xts gf128mul algif_skcipher af_alg dm_crypt dm_mod sr_mod cdrom sd_mod ata_generic uas usb_storage ohci_pci ahci psmouse libahci pata_atiixp libata r8169 mii firewire_ohci firewire_core crc_itu_t sky2 ohci_hcd ehci_pci xhci_pci ehci_hcd xhci_hcd i2c_piix4 scsi_mod usbcore fjes Nov 23 15:29:59 gdOv kernel: [ 7029.188833] CPU: 1 PID: 5273 Comm: mplayer Not tainted 4.9.64-unofficial+grsec171123-09 #1 Nov 23 15:29:59 gdOv kernel: [ 7029.190840] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./970 Extreme4, BIOS P2.60 11/11/2013 Nov 23 15:29:59 gdOv kernel: [ 7029.192853] task: ffff88031d28b280 task.stack: ffffc900045b0000 Nov 23 15:29:59 gdOv kernel: [ 7029.194885] RIP: 0010:[ ] [ ] remove_vma+0x41/0x100 Nov 23 15:29:59 gdOv kernel: [ 7029.196908] RSP: 0018:ffffc900045b3d20 EFLAGS: 00010286 Nov 23 15:29:59 gdOv kernel: [ 7029.198959] RAX: ffffffbfa0373d00 RBX: ffff88020a02c000 RCX: ffff8802b965d670 Nov 23 15:29:59 gdOv kernel: [ 7029.201037] RDX: ffffffff81241f6d RSI: ffff88031e1b7000 RDI: ffff88020a02c000 Nov 23 15:29:59 gdOv kernel: [ 7029.203089] RBP: ffff88031f0ade40 R08: ffff8802bd5d4cc0 R09: ffff8802bd5d43c0 Nov 23 15:29:59 gdOv kernel: [ 7029.205162] R10: ffff88031f127600 R11: ffff8802bd5d53c0 R12: ffff88031f7a1300 Nov 23 15:29:59 gdOv kernel: [ 7029.207196] R13: 0000000000000000 R14: 0000000000000001 R15: ffff88031f7a16c8 Nov 23 15:29:59 gdOv kernel: [ 7029.209281] FS: 000003b2635d12c0(0000) GS:ffff88032fc80000(0000) knlGS:0000000000000000 Nov 23 15:29:59 gdOv kernel: [ 7029.211394] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Nov 23 15:29:59 gdOv kernel: [ 7029.213486] CR2: ffffffbfa0373d48 CR3: 0000000001ca5000 CR4: 00000000000006f0 Nov 23 15:29:59 gdOv kernel: [ 7029.215632] Stack: Nov 23 15:29:59 gdOv kernel: [ 7029.217736] 0000000000000a2d ffff88031f7a1300 ffffffff812451eb ffff88031e10f6c0 Nov 23 15:29:59 gdOv kernel: [ 7029.219918] ffff88031f7a1300 ffffffffffffffff ffffffffffffffff ffffffffffff4111 Nov 23 15:29:59 gdOv kernel: [ 7029.222069] ffffc900045b3d68 0000000000000000 0000000800000000 ffffea000b9143c0 Nov 23 15:29:59 gdOv kernel: [ 7029.224153] Call Trace: Nov 23 15:29:59 gdOv kernel: [ 7029.226206] [ ] ? exit_mmap+0x1bb/0x220 Nov 23 15:29:59 gdOv kernel: [ 7029.228269] [ ] ? mmput+0xc8/0x200 Nov 23 15:29:59 gdOv kernel: [ 7029.230287] [ ] ? do_exit+0x3f8/0xfe0 Nov 23 15:29:59 gdOv kernel: [ 7029.232322] [ ] ? do_group_exit+0x66/0x100 Nov 23 15:29:59 gdOv kernel: [ 7029.234323] [ ] ? rap_sys_exit_group+0x21/0x40 Nov 23 15:29:59 gdOv kernel: [ 7029.236343] [ ] ? entry_SYSCALL_64_fastpath+0x22/0xf0 Nov 23 15:29:59 gdOv kernel: [ 7029.238329] Code: cc 48 8b 6b 50 eb 0b 12 65 6f c1 ff ff ff ff cc cc cc e8 83 e7 6e 00 48 83 7b 28 00 0f 85 b2 00 00 00 48 8b 43 38 48 85 c0 74 39 <48> 8b 40 48 48 85 c0 74 30 48 ba 00 00 00 00 00 00 00 80 48 09 Nov 23 15:29:59 gdOv kernel: [ 7029.242638] RIP [ ] remove_vma+0x41/0x100 Nov 23 15:29:59 gdOv kernel: [ 7029.244699] RSP Nov 23 15:29:59 gdOv kernel: [ 7029.246772] CR2: ffffffbfa0373d48 Nov 23 15:29:59 gdOv kernel: [ 7029.256815] ---[ end trace fd8a1e3be03444b9 ]--- Nov 23 15:29:59 gdOv kernel: [ 7029.256818] grsec: banning user with uid 1000 until system restart for suspicious kernel crash
Here the fixing, and the explanation, but nothing broke no disorder had been allowed to take place.
Nov 23 15:29:59 gdOv kernel: [ 7029.257073] Fixing recursive fault but reboot is needed!
Nov 23 15:29:59 gdOv kernel: [ 7029.290992] grsec: (default:D:/) special role admin (id 1) exited by /bin/bash[bash:4949] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/sudo[sudo:4948] uid/euid:0/0 gid/egid:0/0
Nov 23 15:29:59 gdOv kernel: [ 7029.333648] grsec: (default:D:/) exec of /sbin/agetty (/sbin/getty 38400 tty6 ) by /sbin/agetty[init:5578] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Nov 23 15:30:01 gdOv kernel: [ 7031.950183] grsec: (default:D:/) chdir to /var/www by /usr/sbin/cron[cron:5580] uid/euid:33/33 gid/egid:33/33, parent /usr/sbin/cron[cron:5579] uid/euid:0/0 gid/egid:0/0
Nov 23 15:30:01 gdOv kernel: [ 7031.950558] grsec: (default:D:/) exec of /bin/dash (/bin/sh -c if test -f /var/lib/lurker/db; then /usr/bin/lurker-prune; fi ) by /bin/dash[cron:5580] uid/euid:33/33 gid/egid:33/33, parent /usr/sbin/cron[cron:5579] uid/euid:0/0 gid/egid:0/0
Nov 23 15:30:01 gdOv kernel: [ 7031.953581] grsec: (default:D:/) exec of /usr/bin/lurker-prune (/usr/bin/lurker-prune ) by /usr/bin/lurker-prune[sh:5581] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5580] uid/euid:33/33 gid/egid:33/33
Nov 23 15:30:01 gdOv kernel: [ 7031.960725] grsec: (default:D:/) chdir to /var/lib/lurker by /usr/bin/lurker-prune[lurker-prune:5581] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5580] uid/euid:33/33 gid/egid:33/33
Nov 23 15:30:01 gdOv kernel: [ 7031.960777] grsec: (default:D:/) chdir to /var/www by /usr/bin/lurker-prune[lurker-prune:5581] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5580] uid/euid:33/33 gid/egid:33/33
Nov 23 15:30:01 gdOv kernel: [ 7031.961129] grsec: (default:D:/) chdir to /var/lib/lurker/www by /usr/bin/lurker-prune[lurker-prune:5581] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5580] uid/euid:33/33 gid/egid:33/33
Nov 23 15:39:01 gdOv kernel: [ 7571.986491] grsec: (default:D:/) chdir to /root by /usr/sbin/cron[cron:5583] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/cron[cron:5582] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.986729] grsec: (default:D:/) exec of /bin/dash (/bin/sh -c [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi ) by /bin/dash[cron:5583] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/cron[cron:5582] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.988818] grsec: (default:D:/) exec of /usr/lib/php/sessionclean (/usr/lib/php/sessionclean ) by /usr/lib/php/sessionclean[sh:5584] uid/euid:0/0 gid/egid:0/0, parent /bin/dash[sh:5583] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.991696] grsec: (default:D:/) exec of /usr/bin/sort (sort -rn -t: -k2,2 ) by /usr/bin/sort[sessionclean:5586] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5584] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.992080] grsec: (default:D:/) exec of /usr/sbin/phpquery (/usr/sbin/phpquery -V ) by /usr/sbin/phpquery[sessionclean:5589] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.993504] grsec: (default:D:/) exec of /usr/bin/expr (expr 2 - 1 ) by /usr/bin/expr[phpquery:5590] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/phpquery[phpquery:5589] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.994616] grsec: (default:D:/) exec of /usr/bin/sort (sort -u -t: -k 1,1 ) by /usr/bin/sort[sessionclean:5587] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5584] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.995943] grsec: (default:D:/) exec of /usr/bin/sort (sort -rn ) by /usr/bin/sort[phpquery:5593] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/phpquery[phpquery:5589] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.996882] grsec: (default:D:/) exec of /usr/bin/find (find /usr/lib/php -mindepth 1 -maxdepth 1 -regex .*[0-9]\.[0-9] -printf %f\n ) by /usr/bin/find[phpquery:5595] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/phpquery[phpquery:5594] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7571.998822] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5595] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/phpquery[phpquery:5594] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.000600] grsec: (default:D:/) exec of /usr/bin/php7.0 (php7.0 -c /etc/php/7.0/apache2/php.ini -d error_reporting='~E_ALL' -r foreach(ini_get_all("session") as $k => $v) echo "$k=".$v[) by /usr/bin/php7.0[sessionclean:5596] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.022798] grsec: (default:D:/) exec of /bin/sed (sed -ne s/^session\.save_handler=\(.*\)$/\1/p ) by /bin/sed[sessionclean:5599] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5597] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.026042] grsec: (default:D:/) exec of /bin/sed (sed -ne s/^session\.save_path=\(.*;\)\?\(.*\)$/\2/p ) by /bin/sed[sessionclean:5603] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5600] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.029289] grsec: (default:D:/) exec of /bin/sed (sed -ne s/^session\.gc_maxlifetime=\(.*\)$/\1/p ) by /bin/sed[sessionclean:5606] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5604] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.035941] grsec: (default:D:/) exec of /bin/sed (sed -e s,@VERSION@,7.0, ) by /bin/sed[sessionclean:5609] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5607] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.041182] grsec: (default:D:/) exec of /usr/bin/php7.0 (php7.0 -c /etc/php/7.0/cli/php.ini -d error_reporting='~E_ALL' -r foreach(ini_get_all("session") as $k => $v) echo "$k=".$v["loc) by /usr/bin/php7.0[sessionclean:5610] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.064695] grsec: (default:D:/) exec of /bin/sed (sed -ne s/^session\.save_handler=\(.*\)$/\1/p ) by /bin/sed[sessionclean:5613] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5611] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.071069] grsec: (default:D:/) exec of /bin/sed (sed -ne s/^session\.save_path=\(.*;\)\?\(.*\)$/\2/p ) by /bin/sed[sessionclean:5616] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5614] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.074379] grsec: (default:D:/) exec of /bin/sed (sed -ne s/^session\.gc_maxlifetime=\(.*\)$/\1/p ) by /bin/sed[sessionclean:5619] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5617] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.077770] grsec: (default:D:/) exec of /bin/sed (sed -e s,@VERSION@,7.0, ) by /bin/sed[sessionclean:5622] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5620] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.082641] grsec: (default:D:/) exec of /sbin/killall5 (pidof apache2 php7.0 ) by /sbin/killall5[sessionclean:5623] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.083107] grsec: (default:D:/) chdir to /proc by /sbin/killall5[pidof:5623] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.099103] grsec: (default:D:/) exec of /usr/bin/find (find /proc/2535/fd -ignore_readdir_race -lname /var/lib/php/sessions/sess_* -exec touch -c {} ; ) by /usr/bin/find[sessionclean:5624] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.102358] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5624] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.103041] grsec: (default:D:/) exec of /usr/bin/find (find /proc/2534/fd -ignore_readdir_race -lname /var/lib/php/sessions/sess_* -exec touch -c {} ; ) by /usr/bin/find[sessionclean:5625] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.104446] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5625] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.105404] grsec: (default:D:/) exec of /usr/bin/find (find /proc/2533/fd -ignore_readdir_race -lname /var/lib/php/sessions/sess_* -exec touch -c {} ; ) by /usr/bin/find[sessionclean:5626] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.108393] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5626] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.109271] grsec: (default:D:/) exec of /usr/bin/find (find /proc/2532/fd -ignore_readdir_race -lname /var/lib/php/sessions/sess_* -exec touch -c {} ; ) by /usr/bin/find[sessionclean:5627] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.114474] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5627] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.115875] grsec: (default:D:/) exec of /usr/bin/find (find /proc/2531/fd -ignore_readdir_race -lname /var/lib/php/sessions/sess_* -exec touch -c {} ; ) by /usr/bin/find[sessionclean:5628] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.121073] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5628] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.122475] grsec: (default:D:/) exec of /usr/bin/find (find /proc/2528/fd -ignore_readdir_race -lname /var/lib/php/sessions/sess_* -exec touch -c {} ; ) by /usr/bin/find[sessionclean:5629] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.123780] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5629] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5585] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.125189] grsec: (default:D:/) exec of /usr/bin/find (find -O3 /var/lib/php/sessions/ -ignore_readdir_race -depth -mindepth 1 -name sess_* -type f -cmin +24 -delete ) by /usr/bin/find[sessionclean:5630] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5588] uid/euid:0/0 gid/egid:0/0
Nov 23 15:39:01 gdOv kernel: [ 7572.131733] grsec: (default:D:/) chdir to /root by /usr/bin/find[find:5630] uid/euid:0/0 gid/egid:0/0, parent /usr/lib/php/sessionclean[sessionclean:5588] uid/euid:0/0 gid/egid:0/0
Nov 23 15:41:02 gdOv kernel: [ 7692.150911] grsec: (default:D:/) chdir to /root by /usr/sbin/cron[cron:5632] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/cron[cron:5631] uid/euid:0/0 gid/egid:0/0
Nov 23 15:41:02 gdOv kernel: [ 7692.151240] grsec: (default:D:/) exec of /bin/dash (/bin/sh -c cd / && run-parts --report /etc/cron.hourly ) by /bin/dash[cron:5632] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/cron[cron:5631] uid/euid:0/0 gid/egid:0/0
Nov 23 15:41:02 gdOv kernel: [ 7692.153803] grsec: (default:D:/) chdir to / by /bin/dash[sh:5632] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/cron[cron:5631] uid/euid:0/0 gid/egid:0/0
Nov 23 15:41:02 gdOv kernel: [ 7692.154577] grsec: (default:D:/) exec of /bin/run-parts (run-parts --report /etc/cron.hourly ) by /bin/run-parts[sh:5633] uid/euid:0/0 gid/egid:0/0, parent /bin/dash[sh:5632] uid/euid:0/0 gid/egid:0/0
Nov 23 15:45:01 gdOv kernel: [ 7931.171446] grsec: (default:D:/) chdir to /var/www by /usr/sbin/cron[cron:5635] uid/euid:33/33 gid/egid:33/33, parent /usr/sbin/cron[cron:5634] uid/euid:0/0 gid/egid:0/0
Nov 23 15:45:01 gdOv kernel: [ 7931.171774] grsec: (default:D:/) exec of /bin/dash (/bin/sh -c if test -f /var/lib/lurker/db; then /usr/bin/lurker-prune; fi ) by /bin/dash[cron:5635] uid/euid:33/33 gid/egid:33/33, parent /usr/sbin/cron[cron:5634] uid/euid:0/0 gid/egid:0/0
Nov 23 15:45:01 gdOv kernel: [ 7931.174969] grsec: (default:D:/) exec of /usr/bin/lurker-prune (/usr/bin/lurker-prune ) by /usr/bin/lurker-prune[sh:5636] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5635] uid/euid:33/33 gid/egid:33/33
Nov 23 15:45:01 gdOv kernel: [ 7931.179183] grsec: (default:D:/) chdir to /var/lib/lurker by /usr/bin/lurker-prune[lurker-prune:5636] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5635] uid/euid:33/33 gid/egid:33/33
Nov 23 15:45:01 gdOv kernel: [ 7931.179233] grsec: (default:D:/) chdir to /var/www by /usr/bin/lurker-prune[lurker-prune:5636] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5635] uid/euid:33/33 gid/egid:33/33
Nov 23 15:45:01 gdOv kernel: [ 7931.179654] grsec: (default:D:/) chdir to /var/lib/lurker/www by /usr/bin/lurker-prune[lurker-prune:5636] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5635] uid/euid:33/33 gid/egid:33/33
Nov 23 16:00:01 gdOv kernel: [ 8831.211308] grsec: (default:D:/) chdir to /var/www by /usr/sbin/cron[cron:5643] uid/euid:33/33 gid/egid:33/33, parent /usr/sbin/cron[cron:5642] uid/euid:0/0 gid/egid:0/0
Nov 23 16:00:01 gdOv kernel: [ 8831.211671] grsec: (default:D:/) exec of /bin/dash (/bin/sh -c if test -f /var/lib/lurker/db; then /usr/bin/lurker-prune; fi ) by /bin/dash[cron:5643] uid/euid:33/33 gid/egid:33/33, parent /usr/sbin/cron[cron:5642] uid/euid:0/0 gid/egid:0/0
Nov 23 16:00:01 gdOv kernel: [ 8831.214935] grsec: (default:D:/) exec of /usr/bin/lurker-prune (/usr/bin/lurker-prune ) by /usr/bin/lurker-prune[sh:5644] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5643] uid/euid:33/33 gid/egid:33/33
Nov 23 16:00:01 gdOv kernel: [ 8831.224614] grsec: (default:D:/) chdir to /var/lib/lurker by /usr/bin/lurker-prune[lurker-prune:5644] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5643] uid/euid:33/33 gid/egid:33/33
Nov 23 16:00:01 gdOv kernel: [ 8831.224648] grsec: (default:D:/) chdir to /var/www by /usr/bin/lurker-prune[lurker-prune:5644] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5643] uid/euid:33/33 gid/egid:33/33
Nov 23 16:00:01 gdOv kernel: [ 8831.224860] grsec: (default:D:/) chdir to /var/lib/lurker/www by /usr/bin/lurker-prune[lurker-prune:5644] uid/euid:33/33 gid/egid:33/33, parent /bin/dash[sh:5643] uid/euid:33/33 gid/egid:33/33
Nov 23 16:07:00 gdOv kernel: [ 9250.466775] usb 3-2: USB disconnect, device number 4
Nov 23 16:07:01 gdOv kernel: [ 9251.843633] usb 3-3: USB disconnect, device number 2
Nov 23 16:07:01 gdOv kernel: [ 9252.014225] usb 3-4: USB disconnect, device number 5
At this place between the above line at 16:07:01 and the below at 16:11:03 (and the writing down what remained on the frozen screen I started right after 15:30 and as you can see the manual copying took me 36 minutes and some seconds).
Nov 23 16:11:03 gdOv kernel: [ 44.936286] grsec: exec of /usr/bin/tput (/usr/bin/tput setaf 3 ) by /usr/bin/tput[mountall-bootcl:1674] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.937614] grsec: exec of /usr/bin/tput (/usr/bin/tput op ) by /usr/bin/tput[mountall-bootcl:1675] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.938898] grsec: exec of /usr/bin/tput (/usr/bin/tput civis ) by /usr/bin/tput[mountall-bootcl:1676] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.940220] grsec: exec of /usr/bin/tput (/usr/bin/tput sc ) by /usr/bin/tput[mountall-bootcl:1677] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.943409] grsec: exec of /usr/bin/tput (/usr/bin/tput hpa 0 ) by /usr/bin/tput[mountall-bootcl:1678] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.946624] grsec: exec of /bin/echo (/bin/echo -ne [ [32m ok [39;49m ) by /bin/echo[mountall-bootcl:1679] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.948867] grsec: exec of /usr/bin/tput (/usr/bin/tput rc ) by /usr/bin/tput[mountall-bootcl:1680] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.950144] grsec: exec of /usr/bin/tput (/usr/bin/tput cnorm ) by /usr/bin/tput[mountall-bootcl:1681] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.951950] grsec: exec of /usr/bin/tput (/usr/bin/tput hpa 60 ) by /usr/bin/tput[mountall-bootcl:1682] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.953605] grsec: exec of /usr/bin/tput (/usr/bin/tput setaf 1 ) by /usr/bin/tput[mountall-bootcl:1683] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.955238] grsec: exec of /usr/bin/tput (/usr/bin/tput setaf 1 ) by /usr/bin/tput[mountall-bootcl:1684] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.958311] grsec: exec of /usr/bin/tput (/usr/bin/tput setaf 3 ) by /usr/bin/tput[mountall-bootcl:1685] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.961098] grsec: exec of /usr/bin/tput (/usr/bin/tput op ) by /usr/bin/tput[mountall-bootcl:1686] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/mountall-bootclean.sh[mountall-bootcl:1657] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.966750] grsec: exec of /sbin/openrc-run (/sbin/openrc-run /etc/init.d/urandom --lockfd 17 start ) by /sbin/openrc-run[openrc:1687] uid/euid:0/0 gid/egid:0/0, parent /sbin/openrc[openrc:260] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.968482] grsec: chdir to / by /sbin/openrc-run[openrc-run:1687] uid/euid:0/0 gid/egid:0/0, parent /sbin/openrc[openrc:260] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.978589] grsec: exec of /lib/rc/sh/openrc-run.sh (/lib/rc/sh/openrc-run.sh /etc/init.d/urandom start ) by /lib/rc/sh/openrc-run.sh[openrc-run:1688] uid/euid:0/0 gid/egid:0/0, parent /sbin/openrc-run[openrc-run:1687] uid/euid:0/0 gid/egid:0/0 Nov 23 16:11:03 gdOv kernel: [ 44.980312] grsec: exec of /lib/rc/bin/eval_ecolors (eval_ecolors ) by /lib/rc/bin/eval_ecolors[openrc-run.sh:1690] uid/euid:0/0 gid/egid:0/0, parent /lib/rc/sh/openrc-run.sh[openrc-run.sh:1688] uid/euid:0/0 gid/egid:0/0
---
The verifiable files necessary for this study, if any, are listed in the main page of this section.
---
