groupadd, useradd, etc

[Bill Gradwohl]

Mogens Kjaer wrote:

> If you search backwards from here, there should be an open call
> returning 5, something like:
>
> open(bla...) = 5
>
Here are the opens immediately before the mremaps start. I believe the 
one you're after is for /etc/gshadow

Thank you for taking an interest in this issue.

open("/etc/.pwd.lock", O_WRONLY|O_CREAT, 0600) = 3
fcntl64(3, F_GETFD)                     = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
rt_sigaction(SIGALRM, {0x8fb440, ~[], SA_RESTORER, 0x856a48}, {SIG_DFL}, 
8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM], [], 8) = 0
alarm(15)                               = 0
fcntl64(3, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
alarm(0)                                = 15
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGALRM, {SIG_DFL}, NULL, 8) = 0
getpid()                                = 4210
open("/etc/group.4210", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 4
write(4, "4210\0", 5)                   = 5
close(4)                                = 0
link("/etc/group.4210", "/etc/group.lock") = -1 EEXIST (File exists)
open("/etc/group.lock", O_RDWR|O_LARGEFILE) = 4
read(4, "4208\0", 31)                   = 5
close(4)                                = 0
kill(4208, SIG_0)                       = -1 ESRCH (No such process)
unlink("/etc/group.lock")               = 0
link("/etc/group.4210", "/etc/group.lock") = 0
stat64("/etc/group.4210", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/group.4210")               = 0
open("/etc/group", O_RDWR|O_LARGEFILE)  = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=2643, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7
df2000
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 2643
read(4, "", 4096)                       = 0
open("/etc/gshadow.4210", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 5
write(5, "4210\0", 5)                   = 5
close(5)                                = 0
link("/etc/gshadow.4210", "/etc/gshadow.lock") = -1 EEXIST (File exists)
open("/etc/gshadow.lock", O_RDWR|O_LARGEFILE) = 5
read(5, "4208\0", 31)                   = 5
close(5)                                = 0
kill(4208, SIG_0)                       = -1 ESRCH (No such process)
unlink("/etc/gshadow.lock")             = 0
link("/etc/gshadow.4210", "/etc/gshadow.lock") = 0
stat64("/etc/gshadow.4210", {st_mode=S_IFREG|0600, st_size=5, ...}) = 0
unlink("/etc/gshadow.4210")             = 0
open("/etc/gshadow", O_RDWR|O_LARGEFILE) = 5
fstat64(5, {st_mode=S_IFREG|0400, st_size=95441786, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7
df1000
read(5, "root:::root,helen,ronl\nbin:::roo"..., 4096) = 4096
read(5, "e,,are,re,are,,hare,!,re,e,are,,"..., 4096) = 4096
read(5, ",!,re,are,share,,re,are,are,are,"..., 4096) = 4096
brk(0x86bb000)                          = 0x86bb000
brk(0x86dc000)                          = 0x86dc000
read(5, ",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"..., 4096) = 4096
brk(0x86fd000)                          = 0x86fd000
read(5, ",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"..., 4096) = 4096
brk(0x8727000)                          = 0x8727000
brk(0x8748000)                          = 0x8748000
brk(0x8769000)                          = 0x8769000


-- 
Bill Gradwohl
bill at ycc.com
http://www.ycc.com
spamSTOMPER Protected email