[Libguestfs] Libguestfs with Yara rules error

Luis Fueris luisfueris at gmail.com
Sat Dec 21 15:39:44 UTC 2019


Sorry Richard. Now I will attach you debug file.

El 21/12/2019 a las 16:38, Luis Fueris escribió:
>
> Hi Richard.
>
> Few days ago, I installed libyara a libguestfs properly. But when I 
> load a yara rule and scan it via guestfs_yara_scan, my binary 
> throughts following error:
>
> libguestfs: error: deserialise_yara_detection_list: Success
>
> And function exists with NULL value. As we can see this function is on 
> lib/yara.c from libguestfs git. I think that these yara functions are 
> an integration for yara C api. All debug and trace log is in 
> libguestfs-yara.debug file.
>
>
> El 10/12/2019 a las 09:46, Richard W.M. Jones escribió:
>> On Tue, Dec 10, 2019 at 09:19:47AM +0100, Luis wrote:
>>> I am using libguestfs 1.40.2 and yara 3.11.0 but when I execute my program
>>> it thoughts the following error:
>>>
>>> $> ./yara-guestfs
>>> libguestfs: error: yara_load: feature 'libyara' is not available in this
>>> build of libguestfs.  Read 'AVAILABILITY' in the guestfs(3) man page for
>>>
>>> If we check the manual, in guestfs appears guestfs_yara_load function so
>>> libyara is installed. I installed and compiled it from tarballs.
>> This function:
>>
>> https://github.com/libguestfs/libguestfs/blob/4aa4edf972bc8df8869cdcaa4ab4f40b63a626cf/daemon/yara.c#L308
>>
>> returns 1 if HAVE_YARA is defined.  This is defined by this
>> ./configure test:
>>
>> https://github.com/libguestfs/libguestfs/blob/4aa4edf972bc8df8869cdcaa4ab4f40b63a626cf/m4/guestfs-daemon.m4#L128
>>
>> In other words it depends how libguestfs was configured.  Where
>> did you get libguestfs from?  How was it compiled?
>>
>> Rich.
>>
-------------- next part --------------
libguestfs: trace: set_verbose true
libguestfs: trace: set_verbose = 0
libguestfs: create: flags = 0, handle = 0x55efedcf8520, program = yara-guestfs
libguestfs: trace: add_drive "deb-infected.img"
libguestfs: trace: add_drive = 0
libguestfs: trace: launch
libguestfs: trace: max_disks
libguestfs: trace: max_disks = 255
libguestfs: trace: get_tmpdir
libguestfs: trace: get_tmpdir = "/tmp"
libguestfs: trace: version
libguestfs: trace: version = <struct guestfs_version = major: 1, minor: 40, release: 2, extra: , >
libguestfs: trace: get_backend
libguestfs: trace: get_backend = "direct"
libguestfs: launch: program=yara-guestfs
libguestfs: launch: version=1.40.2
libguestfs: launch: backend registered: unix
libguestfs: launch: backend registered: uml
libguestfs: launch: backend registered: direct
libguestfs: launch: backend=direct
libguestfs: launch: tmpdir=/tmp/libguestfskKHFi3
libguestfs: launch: umask=0022
libguestfs: launch: euid=0
libguestfs: trace: get_cachedir
libguestfs: trace: get_cachedir = "/var/tmp"
libguestfs: begin building supermin appliance
libguestfs: run supermin
libguestfs: command: run: /usr/bin/supermin
libguestfs: command: run: \ --build
libguestfs: command: run: \ --verbose
libguestfs: command: run: \ --if-newer
libguestfs: command: run: \ --lock /var/tmp/.guestfs-0/lock
libguestfs: command: run: \ --copy-kernel
libguestfs: command: run: \ -f ext2
libguestfs: command: run: \ --host-cpu x86_64
libguestfs: command: run: \ /usr/local/lib/guestfs/supermin.d
libguestfs: command: run: \ -o /var/tmp/.guestfs-0/appliance.d
supermin: version: 5.1.19
supermin: package handler: debian/dpkg
supermin: acquiring lock on /var/tmp/.guestfs-0/lock
supermin: if-newer: output does not need rebuilding
libguestfs: finished building supermin appliance
libguestfs: begin testing qemu features
libguestfs: trace: get_cachedir
libguestfs: trace: get_cachedir = "/var/tmp"
libguestfs: checking for previously cached test results of /usr/bin/qemu-system-x86_64, in /var/tmp/.guestfs-0
libguestfs: loading previously cached test results
libguestfs: qemu version: 2.11
libguestfs: qemu mandatory locking: yes
libguestfs: qemu KVM: disabled
libguestfs: trace: get_backend_setting "force_tcg"
libguestfs: trace: get_backend_setting = NULL (error)
libguestfs: trace: get_sockdir
libguestfs: trace: get_sockdir = "/tmp"
libguestfs: finished testing qemu features
libguestfs: trace: get_backend_setting "gdb"
libguestfs: trace: get_backend_setting = NULL (error)
libguestfs: command: run: dmesg | grep -Eoh 'lpj=[[:digit:]]+'
libguestfs: read_lpj_from_dmesg: calculated lpj=8447984
/usr/bin/qemu-system-x86_64 \
    -global virtio-blk-pci.scsi=off \
    -no-user-config \
    -enable-fips \
    -nodefaults \
    -display none \
    -machine accel=kvm:tcg \
    -m 768 \
    -no-reboot \
    -rtc driftfix=slew \
    -no-hpet \
    -global kvm-pit.lost_tick_policy=discard \
    -kernel /var/tmp/.guestfs-0/appliance.d/kernel \
    -initrd /var/tmp/.guestfs-0/appliance.d/initrd \
    -object rng-random,filename=/dev/urandom,id=rng0 \
    -device virtio-rng-pci,rng=rng0 \
    -device virtio-scsi-pci,id=scsi \
    -drive file=/home/luis/Desktop/libguestfs-yara/deb-infected.img,cache=writeback,id=hd0,if=none \
    -device scsi-hd,drive=hd0 \
    -drive file=/var/tmp/.guestfs-0/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none,format=raw \
    -device scsi-hd,drive=appliance \
    -device virtio-serial-pci \
    -serial stdio \
    -device sga \
    -chardev socket,path=/tmp/libguestfsVlS0hV/guestfsd.sock,id=channel0 \
    -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
    -append "panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color"
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: failed to initialize KVM: No such file or directory
qemu-system-x86_64: Back to tcg accelerator
qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
libguestfs: responding to serial console Device Status Report
\x1b[1;256r\x1b[256;256H\x1b[6n
Google, Inc.
Serial Graphics Adapter 03/05/17
SGABIOS $Id: sgabios.S 8 2010-04-22 00:03:40Z nlaredo $ (generic at generic) Sun, 05 Mar 2017 16:09:17 +0100
Term: 80x24
4 0
\x1b[2J
SeaBIOS (version 1.10.2-1ubuntu1)


Booting from ROM...

\x1b[2J[    0.000000] Linux version 5.0.0-37-generic (buildd at lcy01-amd64-023) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #40~18.04.1-Ubuntu SMP Thu Nov 14 12:06:39 UTC 2019 (Ubuntu 5.0.0-37.40~18.04.1-generic 5.0.21)
[    0.000000] Command line: panic=1 console=ttyS0 edd=off meout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color
[    0.000000] KERNEL supported cpus:
[    0.000000]   Intel GenuineIntel
[    0.000000]   AMD AuthenticAMD
[    0.000000]   Hygon HygonGenuine
[    0.000000]   Centaur CentaurHauls
[    0.000000] x86/fpu: x87 FPU will use FXSAVE
[    0.000000] BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009f7ff] usable
[    0.000000] BIOS-e820: [mem 0x000000000009f800-0x000000000009ffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000002ffddfff] usable
[    0.000000] BIOS-e820: [mem 0x000000002ffde000-0x000000002fffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[    0.000000] NX (Execute Disable) protection: active
[    0.000000] SMBIOS 2.8 present.
[    0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[    0.000000] last_pfn = 0x2ffde max_arch_pfn = 0x400000000
[    0.000000] x86/PAT: Configuration [0-7]: WB  WC  UC- UC  WB  WP  UC- WT  
[    0.000000] found SMP MP-table at [mem 0x000f6a90-0x000f6a9f]
[    0.000000] check: Scanning 1 areas for low memory corruption
[    0.000000] RAMDISK: [mem 0x2ff4c000-0x2ffcffff]
[    0.000000] ACPI: Early table checksum verification disabled
[    0.000000] ACPI: RSDP 0x00000000000F68B0 000014 (v00 BOCHS )
[    0.000000] ACPI: RSDT 0x000000002FFE159D 00002C (v01 BOCHS  BXPCRSDT 00000001 BXPC 00000001)
[    0.000000] ACPI: FACP 0x000000002FFE1431 000074 (v01 BOCHS  BXPCFACP 00000001 BXPC 00000001)
[    0.000000] ACPI: DSDT 0x000000002FFE0040 0013F1 (v01 BOCHS  BXPCDSDT 00000001 BXPC 00000001)
[    0.000000] ACPI: FACS 0x000000002FFE0000 000040
[    0.000000] ACPI: APIC 0x000000002FFE1525 000078 (v01 BOCHS  BXPCAPIC 00000001 BXPC 00000001)
[    0.000000] No NUMA configuration found
[    0.000000] Faking a node at [mem 0x0000000000000000-0x000000002ffddfff]
[    0.000000] NODE_DATA(0) allocated [mem 0x2ff21000-0x2ff4bfff]
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000001000-0x0000000000ffffff]
[    0.000000]   DMA32    [mem 0x0000000001000000-0x000000002ffddfff]
[    0.000000]   Normal   empty
[    0.000000]   Device   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000001000-0x000000000009efff]
[    0.000000]   node   0: [mem 0x0000000000100000-0x000000002ffddfff]
[    0.000000] Zeroed struct page in unavailable ranges: 98 pages
[    0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000002ffddfff]
[    0.000000] ACPI: PM-Timer IO Port: 0x608
[    0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
[    0.000000] IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
[    0.000000] Using ACPI (MADT) for SMP configuration information
[    0.000000] smpboot: Allowing 1 CPUs, 0 hotplug CPUs
[    0.000000] PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
[    0.000000] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff]
[    0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000effff]
[    0.000000] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff]
[    0.000000] [mem 0x30000000-0xfffbffff] available for PCI devices
[    0.000000] Booting paravirtualized kernel on bare hardware
[    0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
[    0.000000] random: get_random_bytes called from start_kernel+0x97/0x516 with crng_init=0
[    0.000000] setup_percpu: NR_CPUS:8192 nr_cpumask_bits:1 nr_cpu_ids:1 nr_node_ids:1
[    0.000000] percpu: Embedded 46 pages/cpu s151552 r8192 d28672 u2097152
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 193383
[    0.000000] Policy zone: DMA32
[    0.000000] Kernel command line: panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color
[    0.000000] Memory: 738884K/785904K available (14339K kernel code, 2336K rwdata, 4416K rodata, 2588K init, 5192K bss, 47020K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] ftrace: allocating 41688 entries in 163 pages
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: \tRCU restricting CPUs from NR_CPUS=8192 to nr_cpu_ids=1.
[    0.000000] \tTasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[    0.000000] NR_IRQS: 524544, nr_irqs: 256, preallocated irqs: 16
[    0.000000] Console: colour *CGA 80x25
[    0.000000] printk: console [ttyS0] enabled
[    0.000000] ACPI: Core revision 20181213
[    0.008000] APIC: Switch to symmetric I/O mode setup
[    0.012000] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[    0.028000] tsc: Unable to calibrate against PIT
[    0.028000] tsc: using PMTIMER reference calibration
[    0.028000] tsc: Detected 2111.972 MHz processor
[    0.002532] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x1e715e1f384, max_idle_ns: 440795306599 ns
[    0.004518] Calibrating delay loop (skipped) preset value.. 4223.99 BogoMIPS (lpj=8447984)
[    0.005035] pid_max: default: 32768 minimum: 301
[    0.011698] LSM: Security Framework initializing
[    0.013053] Yama: becoming mindful.
[    0.015557] AppArmor: AppArmor initialized
[    0.022530] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[    0.024587] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.025304] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.025597] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.112787] Disabling memory control group subsystem
[    0.119884] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
[    0.120153] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
[    0.120768] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    0.121368] Spectre V2 : Spectre mitigation: LFENCE not serializing, switching to generic retpoline
[    0.121828] Spectre V2 : Mitigation: Full generic retpoline
[    0.122059] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
[    0.122548] Speculative Store Bypass: Vulnerable
[    0.995900] random: fast init done
[    1.274472] Freeing SMP alternatives memory: 36K
[    1.446535] smpboot: CPU0: AMD QEMU Virtual CPU version 2.5+ (family: 0x6, model: 0x6, stepping: 0x3)
[    1.458769] Performance Events: PMU not available due to virtualization, using software events only.
[    1.466561] rcu: Hierarchical SRCU implementation.
[    1.484339] NMI watchdog: Perf NMI watchdog permanently disabled
[    1.493498] smp: Bringing up secondary CPUs ...
[    1.494149] smp: Brought up 1 node, 1 CPU
[    1.494496] smpboot: Max logical packages: 1
[    1.495268] smpboot: Total of 1 processors activated (4223.99 BogoMIPS)
[    1.529829] devtmpfs: initialized
[    1.538042] x86/mm: Memory block size: 128MB
[    1.554944] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    1.555859] futex hash table entries: 256 (order: 2, 16384 bytes)
[    1.562935] pinctrl core: initialized pinctrl subsystem
[    1.577548] RTC time: 15:31:44, date: 2019-12-21
[    1.593598] NET: Registered protocol family 16
[    1.602482] audit: initializing netlink subsys (disabled)
[    1.608065] audit: type=2000 audit(1576942303.632:1): state=initialized audit_enabled=0 res=1
[    1.614668] EISA bus registered
[    1.615506] cpuidle: using governor ladder
[    1.615961] cpuidle: using governor menu
[    1.619940] ACPI: bus type PCI registered
[    1.620367] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
[    1.623506] PCI: Using configuration type 1 for base access
[    1.690507] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
[    1.708150] ACPI: Added _OSI(Module Device)
[    1.708508] ACPI: Added _OSI(Processor Device)
[    1.708709] ACPI: Added _OSI(3.0 _SCP Extensions)
[    1.708917] ACPI: Added _OSI(Processor Aggregator Device)
[    1.709321] ACPI: Added _OSI(Linux-Dell-Video)
[    1.709524] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio)
[    1.709752] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics)
[    1.776332] ACPI: 1 ACPI AML tables successfully acquired and loaded
[    1.819859] ACPI: Interpreter enabled
[    1.821711] ACPI: (supports S0 S3 S4 S5)
[    1.822040] ACPI: Using IOAPIC for interrupt routing
[    1.823054] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[    1.828677] ACPI: Enabled 2 GPEs in block 00 to 0F
[    1.950851] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
[    1.952152] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI]
[    1.953640] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge.
[    1.965109] acpiphp: Slot [2] registered
[    1.965668] acpiphp: Slot [3] registered
[    1.966080] acpiphp: Slot [4] registered
[    1.967605] acpiphp: Slot [5] registered
[    1.968045] acpiphp: Slot [6] registered
[    1.968539] acpiphp: Slot [7] registered
[    1.969148] acpiphp: Slot [8] registered
[    1.969751] acpiphp: Slot [9] registered
[    1.970498] acpiphp: Slot [10] registered
[    1.971002] acpiphp: Slot [11] registered
[    1.971449] acpiphp: Slot [12] registered
[    1.971506] acpiphp: Slot [13] registered
[    1.971506] acpiphp: Slot [14] registered
[    1.971506] acpiphp: Slot [15] registered
[    1.971506] acpiphp: Slot [16] registered
[    1.971815] acpiphp: Slot [17] registered
[    1.972346] acpiphp: Slot [18] registered
[    1.972954] acpiphp: Slot [19] registered
[    1.973495] acpiphp: Slot [20] registered
[    1.973932] acpiphp: Slot [21] registered
[    1.975807] acpiphp: Slot [22] registered
[    1.976204] acpiphp: Slot [23] registered
[    1.976852] acpiphp: Slot [24] registered
[    1.977275] acpiphp: Slot [25] registered
[    1.977691] acpiphp: Slot [26] registered
[    1.978086] acpiphp: Slot [27] registered
[    1.978578] acpiphp: Slot [28] registered
[    1.978977] acpiphp: Slot [29] registered
[    1.979613] acpiphp: Slot [30] registered
[    1.980010] acpiphp: Slot [31] registered
[    1.980645] PCI host bridge to bus 0000:00
[    1.980992] pci_bus 0000:00: root bus resource [io  0x0000-0x0cf7 window]
[    1.981237] pci_bus 0000:00: root bus resource [io  0x0d00-0xffff window]
[    1.981504] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[    1.983552] pci_bus 0000:00: root bus resource [mem 0x30000000-0xfebfffff window]
[    1.983802] pci_bus 0000:00: root bus resource [mem 0x100000000-0x17fffffff window]
[    1.984286] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.996852] pci 0000:00:01.1: legacy IDE quirk: reg 0x10: [io  0x01f0-0x01f7]
[    1.997153] pci 0000:00:01.1: legacy IDE quirk: reg 0x14: [io  0x03f6]
[    1.999597] pci 0000:00:01.1: legacy IDE quirk: reg 0x18: [io  0x0170-0x0177]
[    1.999830] pci 0000:00:01.1: legacy IDE quirk: reg 0x1c: [io  0x0376]
[    2.010714] pci 0000:00:01.3: quirk: [io  0x0600-0x063f] claimed by PIIX4 ACPI
[    2.011092] pci 0000:00:01.3: quirk: [io  0x0700-0x070f] claimed by PIIX4 SMB
[    2.058968] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11)
[    2.061564] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11)
[    2.063915] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11)
[    2.065930] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11)
[    2.066969] ACPI: PCI Interrupt Link [LNKS] (IRQs *9)
[    2.078908] SCSI subsystem initialized
[    2.084975] vgaarb: loaded
[    2.085913] usbcore: USB support disabled
[    2.087197] pps_core: LinuxPPS API ver. 1 registered
[    2.087560] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti at linux.it>
[    2.088000] PTP clock support registered
[    2.089294] EDAC MC: Ver: 3.0.0
[    2.091506] PCI: Using ACPI for IRQ routing
[    2.106673] NetLabel: Initializing
[    2.106858] NetLabel:  domain hash size = 128
[    2.106991] NetLabel:  protocols = UNLABELED CIPSOv4 CALIPSO
[    2.109763] NetLabel:  unlabeled traffic allowed by default
[    2.114488] clocksource: Switched to clocksource tsc-early
[    2.351523] VFS: Disk quotas dquot_6.6.0
[    2.352059] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[    2.363542] AppArmor: AppArmor Filesystem Enabled
[    2.366520] pnp: PnP ACPI init
[    2.388510] pnp: PnP ACPI: found 5 devices
[    2.502878] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[    2.512221] NET: Registered protocol family 2
[    2.538368] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes)
[    2.539873] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[    2.542354] TCP bind hash table entries: 8192 (order: 5, 131072 bytes)
[    2.543654] TCP: Hash tables configured (established 8192 bind 8192)
[    2.549670] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    2.551281] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[    2.561964] NET: Registered protocol family 1
[    2.564122] NET: Registered protocol family 44
[    2.566055] pci 0000:00:01.0: PIIX3: Enabling Passive Release
[    2.566938] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[    2.567444] pci 0000:00:01.0: Activating ISA DMA hang workarounds
[    2.590101] Unpacking initramfs...
[    2.625328] Freeing initrd memory: 528K
[    2.630661] check: Scanning for low memory corruption every 60 seconds
[    2.646913] Initialise system trusted keyrings
[    2.650852] Key type blacklist registered
[    2.652513] workingset: timestamp_bits=36 max_order=18 bucket_order=0
[    2.683857] zbud: loaded
[    2.695906] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.700395] fuse init (API version 7.28)
[    2.760487] Key type asymmetric registered
[    2.761184] Asymmetric key parser 'x509' registered
[    2.761652] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243)
[    2.762986] io scheduler mq-deadline registered
[    2.767055] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4
[    2.775092] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[    2.778273] ACPI: Power Button [PWRF]
[    3.371174] PCI Interrupt Link [LNKB] enabled at IRQ 10
[    3.653094] tsc: Refined TSC clocksource calibration: 2111.980 MHz
[    3.653515] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1e716596aee, max_idle_ns: 440795272898 ns
[    3.653924] clocksource: Switched to clocksource tsc
[    3.920707] PCI Interrupt Link [LNKC] enabled at IRQ 11
[    4.479268] PCI Interrupt Link [LNKD] enabled at IRQ 11
[    4.482034] Serial: 8250/16550 driver, 1 ports, IRQ sharing enabled
[    4.505319] 00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[    4.546609] Linux agpgart interface v0.103
[    4.583416] loop: module loaded
[    4.596736] scsi host0: ata_piix
[    4.599762] scsi host1: ata_piix
[    4.600693] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc0a0 irq 14
[    4.600950] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc0a8 irq 15
[    4.608811] libphy: Fixed MDIO Bus: probed
[    4.609026] tun: Universal TUN/TAP device driver, 1.6
[    4.609978] PPP generic driver version 2.4.2
[    4.612367] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
[    4.617831] serio: i8042 KBD port at 0x60,0x64 irq 1
[    4.618294] serio: i8042 AUX port at 0x60,0x64 irq 12
[    4.621830] mousedev: PS/2 mouse device common for all mice
[    4.627657] rtc_cmos 00:00: RTC can wake from S4
[    4.630339] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
[    4.634047] rtc_cmos 00:00: registered as rtc0
[    4.635032] rtc_cmos 00:00: alarms up to one day, y3k, 114 bytes nvram
[    4.635449] i2c /dev entries driver
[    4.637269] device-mapper: uevent: version 1.0.3
[    4.637269] device-mapper: ioctl: 4.39.0-ioctl (2018-04-03) initialised: dm-devel at redhat.com
[    4.637269] platform eisa.0: Probing EISA bus 0
[    4.637269] platform eisa.0: EISA: Cannot allocate resource for mainboard
[    4.637269] platform eisa.0: Cannot allocate resource for EISA slot 1
[    4.637269] platform eisa.0: Cannot allocate resource for EISA slot 2
[    4.637269] platform eisa.0: Cannot allocate resource for EISA slot 3
[    4.642684] platform eisa.0: Cannot allocate resource for EISA slot 4
[    4.642869] platform eisa.0: Cannot allocate resource for EISA slot 5
[    4.643050] platform eisa.0: Cannot allocate resource for EISA slot 6
[    4.643692] platform eisa.0: Cannot allocate resource for EISA slot 7
[    4.643868] platform eisa.0: Cannot allocate resource for EISA slot 8
[    4.644064] platform eisa.0: EISA: Detected 0 cards
[    4.644650] ledtrig-cpu: registered to indicate activity on CPUs
[    4.648426] NET: Registered protocol family 10
[    4.664736] Segment Routing with IPv6
[    4.665435] NET: Registered protocol family 17
[    4.666244] Key type dns_resolver registered
[    4.669635] mce: Using 10 MCE banks
[    4.670208] RAS: Correctable Errors collector initialized.
[    4.671137] sched_clock: Marking stable (4696462589, -28493756)->(4678340098, -10371265)
[    4.675214] registered taskstats version 1
[    4.675666] Loading compiled-in X.509 certificates
[    4.705237] Loaded X.509 cert 'Build time autogenerated kernel key: 88fcad88465f792265cf358553c118dce4c5c672'
[    4.706899] zswap: loaded using pool lzo/zbud
[    4.714966] Key type big_key registered
[    4.715185] Key type trusted registered
[    4.718072] Key type encrypted registered
[    4.718274] AppArmor: AppArmor sha1 policy hashing enabled
[    4.719089] ima: No TPM chip found, activating TPM-bypass!
[    4.719676] ima: Allocated hash algorithm: sha1
[    4.725202] No architecture policies found
[    4.726029] evm: Initialising EVM extended attributes:
[    4.726202] evm: security.selinux
[    4.726384] evm: security.SMACK64
[    4.726486] evm: security.SMACK64EXEC
[    4.726595] evm: security.SMACK64TRANSMUTE
[    4.726718] evm: security.SMACK64MMAP
[    4.727147] evm: security.apparmor
[    4.727252] evm: security.ima
[    4.727391] evm: security.capability
[    4.727532] evm: HMAC attrs: 0x1
[    4.731651]   Magic number: 15:683:538
[    4.733317] rtc_cmos 00:00: setting system clock to 2019-12-21T15:31:47 UTC (1576942307)
[    4.783452] Freeing unused decrypted memory: 2040K
[    4.823005] Freeing unused kernel image memory: 2588K
[    4.825699] Write protecting the kernel read-only data: 22528k
[    4.830250] Freeing unused kernel image memory: 2016K
[    4.832444] Freeing unused kernel image memory: 1728K
[    4.931027] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[    4.931424] Run /init as init process
supermin: mounting /proc
supermin: ext2 mini initrd starting up: 5.1.19
supermin: cmdline: panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color
supermin: uptime: 5.01 1.38
supermin: mounting /sys
supermin: internal insmod crc32-pclmul.ko
[    5.010119] PCLMULQDQ-NI instructions are not detected.
insmod: init_module: crc32-pclmul.ko: No such device
supermin: internal insmod crct10dif-pclmul.ko
insmod: init_module: crct10dif-pclmul.ko: No such device
supermin: internal insmod crc32_generic.ko
supermin: internal insmod nfit.ko
supermin: internal insmod virtio_blk.ko
supermin: internal insmod virtio-rng.ko
supermin: internal insmod crypto_engine.ko
[    5.065402] random: crng init done
supermin: internal insmod virtio_crypto.ko
supermin: internal insmod failover.ko
supermin: internal insmod net_failover.ko
supermin: internal insmod virtio_net.ko
supermin: internal insmod nd_btt.ko
supermin: internal insmod nd_pmem.ko
supermin: internal insmod rpmsg_core.ko
supermin: internal insmod virtio_rpmsg_bus.ko
supermin: internal insmod virtio_scsi.ko
[    5.144986] scsi host2: Virtio SCSI HBA
[    5.166941] scsi 2:0:0:0: Direct-Access     QEMU     QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
[    5.175048] scsi 2:0:1:0: Direct-Access     QEMU     QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
[    5.941297] sd 2:0:0:0: Power-on or device reset occurred
[    5.947312] sd 2:0:0:0: [sda] 6291456 512-byte logical blocks: (3.22 GB/3.00 GiB)
[    5.949078] sd 2:0:0:0: [sda] Write Protect is off
[    5.949985] sd 2:0:0:0: Attached scsi generic sg0 type 0
[    5.952740] sd 2:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[    5.954923] sd 2:0:1:0: Power-on or device reset occurred
[    5.959198] sd 2:0:1:0: [sdb] 8388608 512-byte logical blocks: (4.29 GB/4.00 GiB)
[    5.960132] sd 2:0:1:0: [sdb] Write Protect is off
[    5.961129] sd 2:0:1:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[    5.967933] sd 2:0:1:0: Attached scsi generic sg1 type 0
[    5.986747]  sda: sda1 sda2 < sda5 >
[    6.005864] sd 2:0:1:0: [sdb] Attached SCSI disk
[    6.012489] sd 2:0:0:0: [sda] Attached SCSI disk
supermin: internal insmod virtio_input.ko
supermin: internal insmod crc-itu-t.ko
supermin: internal insmod crc4.ko
supermin: internal insmod crc64.ko
supermin: internal insmod crc7.ko
supermin: internal insmod crc8.ko
supermin: internal insmod libcrc32c.ko
supermin: picked /sys/block/sdb/dev (8:16) as root device
supermin: creating /dev/root as block special 8:16
supermin: mounting new root on /root
[    6.077794] EXT4-fs (sdb): mounting ext2 file system using the ext4 subsystem
[    6.106757] EXT4-fs (sdb): mounted filesystem without journal. Opts: 
supermin: deleting initramfs files
supermin: chroot
Starting /init script ...
+ [[ panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color == *guestfs_network=1* ]]
+ [[ panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color == *guestfs_rescue=1* ]]
+ [[ panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color == *guestfs_noreboot=1* ]]
+ [[ panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color == *guestfs_boot_analysis=1* ]]
+ '[' '!' -d /sys ']'
+ mkdir -p /sys
+ mount -t sysfs /sys /sys
+ mkdir -p /run
+ mount -t tmpfs -o nosuid,size=20%,mode=0755 tmpfs /run
+ mkdir -p /run/lock
+ ln -s ../run/lock /var/lock
+ test -e /etc/mtab
+ ln -s /proc/mounts /etc/mtab
+ mount -t devtmpfs /dev /dev
+ mkdir -p /dev/pts
+ mount -t devpts /dev/pts /dev/pts
+ mkdir -p /dev/shm
+ mount -t tmpfs -o mode=1777 shmfs /dev/shm
+ [[ panic=1 console=ttyS0 edd=off udevtimeout=6000 udev.event-timeout=6000 no_timer_check lpj=8447984 printk.time=1 cgroup_disable=memory usbcore.nousb cryptomgr.notests tsc=reliable 8250.nr_uarts=1 root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=xterm-256color == *selinux=1* ]]
+ mkdir -p /run/tmpfiles.d
+ kmod static-nodes --format=tmpfiles --output=/run/tmpfiles.d/kmod.conf
++ dd if=/dev/urandom bs=16 count=1 status=none
++ od -x -A n
+ machine_id=' 4f9c de31 d721 37f5 3827 eadd f1d2 8fff'
+ echo 4f9cde31d72137f53827eaddf1d28fff
+ systemd-tmpfiles --prefix=/dev --prefix=/run --prefix=/var/run --create --boot
[/usr/lib/tmpfiles.d/systemd.conf:11] Unknown group 'utmp'.
[/usr/lib/tmpfiles.d/systemd.conf:19] Unknown user 'systemd-network'.
[/usr/lib/tmpfiles.d/systemd.conf:20] Unknown user 'systemd-network'.
[/usr/lib/tmpfiles.d/systemd.conf:21] Unknown user 'systemd-network'.
[/usr/lib/tmpfiles.d/systemd.conf:25] Unknown group 'systemd-journal'.
[/usr/lib/tmpfiles.d/systemd.conf:26] Unknown group 'systemd-journal'.
Failed to parse ACL "d:group:adm:r-x": No such file or directory. Ignoring
Failed to parse ACL "group:adm:r-x": No such file or directory. Ignoring
Failed to parse ACL "group:adm:r--": No such file or directory. Ignoring
Failed to parse ACL "d:group::r-x,d:group:adm:r-x": No such file or directory. Ignoring
Failed to parse ACL "group::r-x,group:adm:r-x": No such file or directory. Ignoring
Failed to parse ACL "d:group:adm:r-x": No such file or directory. Ignoring
Failed to parse ACL "group:adm:r-x": No such file or directory. Ignoring
Failed to parse ACL "group:adm:r--": No such file or directory. Ignoring
+ for f in /lib/systemd/systemd-udevd /usr/lib/systemd/systemd-udevd /sbin/udevd /lib/udev/udevd /usr/lib/udev/udevd
+ '[' -x /lib/systemd/systemd-udevd ']'
+ UDEVD=/lib/systemd/systemd-udevd
+ break
+ '[' -z /lib/systemd/systemd-udevd ']'
+ /lib/systemd/systemd-udevd --daemon
starting version 237
+ udevadm trigger
+ udevadm settle --timeout=600
+ shopt -s nullglob
+ for f in /sys/block/sd*/device/timeout
+ echo 300
+ for f in /sys/block/sd*/device/timeout
+ echo 300
+ for f in /sys/block/{h,s,ub,v}d*/queue/scheduler
+ echo noop
/init: line 116: echo: write error: Invalid argument
+ for f in /sys/block/{h,s,ub,v}d*/queue/scheduler
+ echo noop
/init: line 116: echo: write error: Invalid argument
+ shopt -u nullglob
+ ip addr add 127.0.0.1/8 brd + dev lo scope host
+ ip link set dev lo up
+ test '' = 1
+ mdadm -As --auto=yes --no-degraded
mdadm: No arrays found in config file or automatically
+ mkdir -p /tmp/lvm
+ touch /tmp/lvm/lvm.conf
+ LVM_SYSTEM_DIR=/tmp/lvm
+ export LVM_SYSTEM_DIR
+ lvmetad
+ modprobe dm_mod
+ lvm pvscan --cache --activate ay
+ mdadm -As --auto=yes --run
mdadm: No arrays found in config file or automatically
+ ldmtool create all
[
]
+ test 1 = 1
+ test '' '!=' 1
+ uname -a
Linux (none) 5.0.0-37-generic #40~18.04.1-Ubuntu SMP Thu Nov 14 12:06:39 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
+ ls -lR /dev
/dev:
total 0
crw------- 1 0 0  10, 235 Dec 21 15:31 autofs
drwxr-xr-x 2 0 0      300 Dec 21 15:31 block
drwxr-xr-x 2 0 0       80 Dec 21 15:31 bsg
crw------- 1 0 0  10, 234 Dec 21 15:31 btrfs-control
drwxr-xr-x 2 0 0     2280 Dec 21 15:31 char
crw------- 1 0 0   5,   1 Dec 21 15:31 console
lrwxrwxrwx 1 0 0       11 Dec 21 15:31 core -> /proc/kcore
crw------- 1 0 0  10,  58 Dec 21 15:31 cpu_dma_latency
crw------- 1 0 0  10, 203 Dec 21 15:31 cuse
drwxr-xr-x 6 0 0      120 Dec 21 15:31 disk
crw------- 1 0 0  10,  61 Dec 21 15:31 ecryptfs
lrwxrwxrwx 1 0 0       13 Dec 21 15:31 fd -> /proc/self/fd
crw-rw-rw- 1 0 0   1,   7 Dec 21 15:31 full
crw-rw-rw- 1 0 0  10, 229 Dec 21 15:31 fuse
crw------- 1 0 0  10, 228 Dec 21 15:31 hpet
crw------- 1 0 0  10, 183 Dec 21 15:31 hwrng
drwxr-xr-x 3 0 0      120 Dec 21 15:31 input
crw-r--r-- 1 0 0   1,  11 Dec 21 15:31 kmsg
drwxr-xr-x 2 0 0       60 Dec 21 15:31 lightnvm
crw------- 1 0 0  10, 237 Dec 21 15:31 loop-control
brw------- 1 0 0   7,   0 Dec 21 15:31 loop0
brw------- 1 0 0   7,   1 Dec 21 15:31 loop1
brw------- 1 0 0   7,   2 Dec 21 15:31 loop2
brw------- 1 0 0   7,   3 Dec 21 15:31 loop3
brw------- 1 0 0   7,   4 Dec 21 15:31 loop4
brw------- 1 0 0   7,   5 Dec 21 15:31 loop5
brw------- 1 0 0   7,   6 Dec 21 15:31 loop6
brw------- 1 0 0   7,   7 Dec 21 15:31 loop7
drwxr-xr-x 2 0 0       60 Dec 21 15:31 mapper
crw------- 1 0 0  10, 227 Dec 21 15:31 mcelog
crw------- 1 0 0   1,   1 Dec 21 15:31 mem
crw------- 1 0 0  10,  55 Dec 21 15:31 memory_bandwidth
drwxr-xr-x 2 0 0       60 Dec 21 15:31 net
crw------- 1 0 0  10,  57 Dec 21 15:31 network_latency
crw------- 1 0 0  10,  56 Dec 21 15:31 network_throughput
crw-rw-rw- 1 0 0   1,   3 Dec 21 15:31 null
crw------- 1 0 0   1,   4 Dec 21 15:31 port
crw------- 1 0 0 108,   0 Dec 21 15:31 ppp
crw------- 1 0 0  10,   1 Dec 21 15:31 psaux
crw-rw-rw- 1 0 0   5,   2 Dec 21 15:31 ptmx
drwxr-xr-x 2 0 0        0 Dec 21 15:31 pts
crw-rw-rw- 1 0 0   1,   8 Dec 21 15:31 random
crw------- 1 0 0  10,  62 Dec 21 15:31 rfkill
lrwxrwxrwx 1 0 0        4 Dec 21 15:31 rtc -> rtc0
crw------- 1 0 0 249,   0 Dec 21 15:31 rtc0
brw------- 1 0 0   8,   0 Dec 21 15:31 sda
brw------- 1 0 0   8,   1 Dec 21 15:31 sda1
brw------- 1 0 0   8,   2 Dec 21 15:31 sda2
brw------- 1 0 0   8,   5 Dec 21 15:31 sda5
brw------- 1 0 0   8,  16 Dec 21 15:31 sdb
crw------- 1 0 0  21,   0 Dec 21 15:31 sg0
crw------- 1 0 0  21,   1 Dec 21 15:31 sg1
drwxrwxrwt 2 0 0       40 Dec 21 15:31 shm
crw------- 1 0 0  10, 231 Dec 21 15:31 snapshot
drwxr-xr-x 2 0 0       80 Dec 21 15:31 snd
lrwxrwxrwx 1 0 0       15 Dec 21 15:31 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 0 0       15 Dec 21 15:31 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 0 0       15 Dec 21 15:31 stdout -> /proc/self/fd/1
crw-rw-rw- 1 0 0   5,   0 Dec 21 15:31 tty
crw------- 1 0 0   4,   0 Dec 21 15:31 tty0
crw------- 1 0 0   4,   1 Dec 21 15:31 tty1
crw------- 1 0 0   4,  10 Dec 21 15:31 tty10
crw------- 1 0 0   4,  11 Dec 21 15:31 tty11
crw------- 1 0 0   4,  12 Dec 21 15:31 tty12
crw------- 1 0 0   4,  13 Dec 21 15:31 tty13
crw------- 1 0 0   4,  14 Dec 21 15:31 tty14
crw------- 1 0 0   4,  15 Dec 21 15:31 tty15
crw------- 1 0 0   4,  16 Dec 21 15:31 tty16
crw------- 1 0 0   4,  17 Dec 21 15:31 tty17
crw------- 1 0 0   4,  18 Dec 21 15:31 tty18
crw------- 1 0 0   4,  19 Dec 21 15:31 tty19
crw------- 1 0 0   4,   2 Dec 21 15:31 tty2
crw------- 1 0 0   4,  20 Dec 21 15:31 tty20
crw------- 1 0 0   4,  21 Dec 21 15:31 tty21
crw------- 1 0 0   4,  22 Dec 21 15:31 tty22
crw------- 1 0 0   4,  23 Dec 21 15:31 tty23
crw------- 1 0 0   4,  24 Dec 21 15:31 tty24
crw------- 1 0 0   4,  25 Dec 21 15:31 tty25
crw------- 1 0 0   4,  26 Dec 21 15:31 tty26
crw------- 1 0 0   4,  27 Dec 21 15:31 tty27
crw------- 1 0 0   4,  28 Dec 21 15:31 tty28
crw------- 1 0 0   4,  29 Dec 21 15:31 tty29
crw------- 1 0 0   4,   3 Dec 21 15:31 tty3
crw------- 1 0 0   4,  30 Dec 21 15:31 tty30
crw------- 1 0 0   4,  31 Dec 21 15:31 tty31
crw------- 1 0 0   4,  32 Dec 21 15:31 tty32
crw------- 1 0 0   4,  33 Dec 21 15:31 tty33
crw------- 1 0 0   4,  34 Dec 21 15:31 tty34
crw------- 1 0 0   4,  35 Dec 21 15:31 tty35
crw------- 1 0 0   4,  36 Dec 21 15:31 tty36
crw------- 1 0 0   4,  37 Dec 21 15:31 tty37
crw------- 1 0 0   4,  38 Dec 21 15:31 tty38
crw------- 1 0 0   4,  39 Dec 21 15:31 tty39
crw------- 1 0 0   4,   4 Dec 21 15:31 tty4
crw------- 1 0 0   4,  40 Dec 21 15:31 tty40
crw------- 1 0 0   4,  41 Dec 21 15:31 tty41
crw------- 1 0 0   4,  42 Dec 21 15:31 tty42
crw------- 1 0 0   4,  43 Dec 21 15:31 tty43
crw------- 1 0 0   4,  44 Dec 21 15:31 tty44
crw------- 1 0 0   4,  45 Dec 21 15:31 tty45
crw------- 1 0 0   4,  46 Dec 21 15:31 tty46
crw------- 1 0 0   4,  47 Dec 21 15:31 tty47
crw------- 1 0 0   4,  48 Dec 21 15:31 tty48
crw------- 1 0 0   4,  49 Dec 21 15:31 tty49
crw------- 1 0 0   4,   5 Dec 21 15:31 tty5
crw------- 1 0 0   4,  50 Dec 21 15:31 tty50
crw------- 1 0 0   4,  51 Dec 21 15:31 tty51
crw------- 1 0 0   4,  52 Dec 21 15:31 tty52
crw------- 1 0 0   4,  53 Dec 21 15:31 tty53
crw------- 1 0 0   4,  54 Dec 21 15:31 tty54
crw------- 1 0 0   4,  55 Dec 21 15:31 tty55
crw------- 1 0 0   4,  56 Dec 21 15:31 tty56
crw------- 1 0 0   4,  57 Dec 21 15:31 tty57
crw------- 1 0 0   4,  58 Dec 21 15:31 tty58
crw------- 1 0 0   4,  59 Dec 21 15:31 tty59
crw------- 1 0 0   4,   6 Dec 21 15:31 tty6
crw------- 1 0 0   4,  60 Dec 21 15:31 tty60
crw------- 1 0 0   4,  61 Dec 21 15:31 tty61
crw------- 1 0 0   4,  62 Dec 21 15:31 tty62
crw------- 1 0 0   4,  63 Dec 21 15:31 tty63
crw------- 1 0 0   4,   7 Dec 21 15:31 tty7
crw------- 1 0 0   4,   8 Dec 21 15:31 tty8
crw------- 1 0 0   4,   9 Dec 21 15:31 tty9
crw------- 1 0 0   4,  64 Dec 21 15:31 ttyS0
crw------- 1 0 0   5,   3 Dec 21 15:31 ttyprintk
crw------- 1 0 0  10,  59 Dec 21 15:31 udmabuf
crw------- 1 0 0  10, 239 Dec 21 15:31 uhid
crw------- 1 0 0  10, 223 Dec 21 15:31 uinput
crw-rw-rw- 1 0 0   1,   9 Dec 21 15:31 urandom
crw------- 1 0 0  10, 240 Dec 21 15:31 userio
crw------- 1 0 0   7,   0 Dec 21 15:31 vcs
crw------- 1 0 0   7,   1 Dec 21 15:31 vcs1
crw------- 1 0 0   7, 128 Dec 21 15:31 vcsa
crw------- 1 0 0   7, 129 Dec 21 15:31 vcsa1
crw------- 1 0 0   7,  64 Dec 21 15:31 vcsu
crw------- 1 0 0   7,  65 Dec 21 15:31 vcsu1
drwxr-xr-x 2 0 0       60 Dec 21 15:31 vfio
crw------- 1 0 0  10,  63 Dec 21 15:31 vga_arbiter
crw------- 1 0 0  10, 137 Dec 21 15:31 vhci
crw------- 1 0 0  10, 238 Dec 21 15:31 vhost-net
crw------- 1 0 0  10, 241 Dec 21 15:31 vhost-vsock
drwxr-xr-x 2 0 0       60 Dec 21 15:31 virtio-ports
crw------- 1 0 0 242,   1 Dec 21 15:31 vport2p1
crw-rw-rw- 1 0 0   1,   5 Dec 21 15:31 zero

/dev/block:
total 0
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:0 -> ../loop0
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:1 -> ../loop1
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:2 -> ../loop2
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:3 -> ../loop3
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:4 -> ../loop4
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:5 -> ../loop5
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:6 -> ../loop6
lrwxrwxrwx 1 0 0 8 Dec 21 15:31 7:7 -> ../loop7
lrwxrwxrwx 1 0 0 6 Dec 21 15:31 8:0 -> ../sda
lrwxrwxrwx 1 0 0 7 Dec 21 15:31 8:1 -> ../sda1
lrwxrwxrwx 1 0 0 6 Dec 21 15:31 8:16 -> ../sdb
lrwxrwxrwx 1 0 0 7 Dec 21 15:31 8:2 -> ../sda2
lrwxrwxrwx 1 0 0 7 Dec 21 15:31 8:5 -> ../sda5

/dev/bsg:
total 0
crw------- 1 0 0 243, 0 Dec 21 15:31 2:0:0:0
crw------- 1 0 0 243, 1 Dec 21 15:31 2:0:1:0

/dev/char:
total 0
lrwxrwxrwx 1 0 0  6 Dec 21 15:31 108:0 -> ../ppp
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 10:1 -> ../psaux
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 10:183 -> ../hwrng
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 10:200 -> ../net/tun
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 10:223 -> ../uinput
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 10:227 -> ../mcelog
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 10:228 -> ../hpet
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 10:229 -> ../fuse
lrwxrwxrwx 1 0 0 11 Dec 21 15:31 10:231 -> ../snapshot
lrwxrwxrwx 1 0 0 17 Dec 21 15:31 10:236 -> ../mapper/control
lrwxrwxrwx 1 0 0 15 Dec 21 15:31 10:237 -> ../loop-control
lrwxrwxrwx 1 0 0 19 Dec 21 15:31 10:55 -> ../memory_bandwidth
lrwxrwxrwx 1 0 0 21 Dec 21 15:31 10:56 -> ../network_throughput
lrwxrwxrwx 1 0 0 18 Dec 21 15:31 10:57 -> ../network_latency
lrwxrwxrwx 1 0 0 18 Dec 21 15:31 10:58 -> ../cpu_dma_latency
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 10:59 -> ../udmabuf
lrwxrwxrwx 1 0 0 19 Dec 21 15:31 10:60 -> ../lightnvm/control
lrwxrwxrwx 1 0 0 11 Dec 21 15:31 10:61 -> ../ecryptfs
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 10:62 -> ../rfkill
lrwxrwxrwx 1 0 0 14 Dec 21 15:31 10:63 -> ../vga_arbiter
lrwxrwxrwx 1 0 0 13 Dec 21 15:31 13:63 -> ../input/mice
lrwxrwxrwx 1 0 0 15 Dec 21 15:31 13:64 -> ../input/event0
lrwxrwxrwx 1 0 0 15 Dec 21 15:31 13:65 -> ../input/event1
lrwxrwxrwx 1 0 0  6 Dec 21 15:31 1:1 -> ../mem
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 1:11 -> ../kmsg
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 1:3 -> ../null
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 1:4 -> ../port
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 1:5 -> ../zero
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 1:7 -> ../full
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 1:8 -> ../random
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 1:9 -> ../urandom
lrwxrwxrwx 1 0 0  6 Dec 21 15:31 21:0 -> ../sg0
lrwxrwxrwx 1 0 0  6 Dec 21 15:31 21:1 -> ../sg1
lrwxrwxrwx 1 0 0 11 Dec 21 15:31 242:1 -> ../vport2p1
lrwxrwxrwx 1 0 0 14 Dec 21 15:31 243:0 -> ../bsg/2:0:0:0
lrwxrwxrwx 1 0 0 14 Dec 21 15:31 243:1 -> ../bsg/2:0:1:0
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 249:0 -> ../rtc0
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:0 -> ../tty0
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:1 -> ../tty1
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:10 -> ../tty10
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:11 -> ../tty11
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:12 -> ../tty12
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:13 -> ../tty13
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:14 -> ../tty14
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:15 -> ../tty15
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:16 -> ../tty16
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:17 -> ../tty17
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:18 -> ../tty18
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:19 -> ../tty19
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:2 -> ../tty2
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:20 -> ../tty20
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:21 -> ../tty21
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:22 -> ../tty22
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:23 -> ../tty23
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:24 -> ../tty24
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:25 -> ../tty25
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:26 -> ../tty26
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:27 -> ../tty27
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:28 -> ../tty28
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:29 -> ../tty29
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:3 -> ../tty3
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:30 -> ../tty30
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:31 -> ../tty31
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:32 -> ../tty32
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:33 -> ../tty33
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:34 -> ../tty34
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:35 -> ../tty35
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:36 -> ../tty36
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:37 -> ../tty37
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:38 -> ../tty38
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:39 -> ../tty39
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:4 -> ../tty4
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:40 -> ../tty40
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:41 -> ../tty41
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:42 -> ../tty42
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:43 -> ../tty43
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:44 -> ../tty44
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:45 -> ../tty45
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:46 -> ../tty46
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:47 -> ../tty47
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:48 -> ../tty48
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:49 -> ../tty49
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:5 -> ../tty5
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:50 -> ../tty50
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:51 -> ../tty51
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:52 -> ../tty52
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:53 -> ../tty53
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:54 -> ../tty54
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:55 -> ../tty55
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:56 -> ../tty56
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:57 -> ../tty57
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:58 -> ../tty58
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:59 -> ../tty59
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:6 -> ../tty6
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:60 -> ../tty60
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:61 -> ../tty61
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:62 -> ../tty62
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:63 -> ../tty63
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 4:64 -> ../ttyS0
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:7 -> ../tty7
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:8 -> ../tty8
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 4:9 -> ../tty9
lrwxrwxrwx 1 0 0  6 Dec 21 15:31 5:0 -> ../tty
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 5:1 -> ../console
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 5:2 -> ../ptmx
lrwxrwxrwx 1 0 0 12 Dec 21 15:31 5:3 -> ../ttyprintk
lrwxrwxrwx 1 0 0  6 Dec 21 15:31 7:0 -> ../vcs
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 7:1 -> ../vcs1
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 7:128 -> ../vcsa
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 7:129 -> ../vcsa1
lrwxrwxrwx 1 0 0  7 Dec 21 15:31 7:64 -> ../vcsu
lrwxrwxrwx 1 0 0  8 Dec 21 15:31 7:65 -> ../vcsu1

/dev/disk:
total 0
drwxr-xr-x 2 0 0 140 Dec 21 15:31 by-id
drwxr-xr-x 2 0 0 100 Dec 21 15:31 by-partuuid
drwxr-xr-x 2 0 0 140 Dec 21 15:31 by-path
drwxr-xr-x 2 0 0 100 Dec 21 15:31 by-uuid

/dev/disk/by-id:
total 0
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 scsi-0QEMU_QEMU_HARDDISK_appliance -> ../../sdb
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 scsi-0QEMU_QEMU_HARDDISK_hd0 -> ../../sda
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 scsi-0QEMU_QEMU_HARDDISK_hd0-part1 -> ../../sda1
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 scsi-0QEMU_QEMU_HARDDISK_hd0-part2 -> ../../sda2
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 scsi-0QEMU_QEMU_HARDDISK_hd0-part5 -> ../../sda5

/dev/disk/by-partuuid:
total 0
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 416f1bd7-01 -> ../../sda1
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 416f1bd7-02 -> ../../sda2
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 416f1bd7-05 -> ../../sda5

/dev/disk/by-path:
total 0
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 pci-0000:00:03.0-scsi-0:0:0:0 -> ../../sda
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 pci-0000:00:03.0-scsi-0:0:0:0-part1 -> ../../sda1
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 pci-0000:00:03.0-scsi-0:0:0:0-part2 -> ../../sda2
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 pci-0000:00:03.0-scsi-0:0:0:0-part5 -> ../../sda5
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 pci-0000:00:03.0-scsi-0:0:1:0 -> ../../sdb

/dev/disk/by-uuid:
total 0
lrwxrwxrwx 1 0 0  9 Dec 21 15:31 80fad1af-af22-43a7-94d2-876c379a04ae -> ../../sdb
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 e026e491-448a-42d5-9fed-d07b49fc3dcd -> ../../sda1
lrwxrwxrwx 1 0 0 10 Dec 21 15:31 f0a103d0-f27b-4492-a32d-b3655ceb71bd -> ../../sda5

/dev/input:
total 0
drwxr-xr-x 2 0 0     60 Dec 21 15:31 by-path
crw------- 1 0 0 13, 64 Dec 21 15:31 event0
crw------- 1 0 0 13, 65 Dec 21 15:31 event1
crw------- 1 0 0 13, 63 Dec 21 15:31 mice

/dev/input/by-path:
total 0
lrwxrwxrwx 1 0 0 9 Dec 21 15:31 platform-i8042-serio-0-event-kbd -> ../event1

/dev/lightnvm:
total 0
crw------- 1 0 0 10, 60 Dec 21 15:31 control

/dev/mapper:
total 0
crw------- 1 0 0 10, 236 Dec 21 15:31 control

/dev/net:
total 0
crw-rw-rw- 1 0 0 10, 200 Dec 21 15:31 tun

/dev/pts:
total 0
c--------- 1 0 0 5, 2 Dec 21 15:31 ptmx

/dev/shm:
total 0

/dev/snd:
total 0
crw------- 1 0 0 116,  1 Dec 21 15:31 seq
crw------- 1 0 0 116, 33 Dec 21 15:31 timer

/dev/vfio:
total 0
crw------- 1 0 0 10, 196 Dec 21 15:31 vfio

/dev/virtio-ports:
total 0
lrwxrwxrwx 1 0 0 11 Dec 21 15:31 org.libguestfs.channel.0 -> ../vport2p1
+ cat /proc/mounts
/dev/root / ext2 rw,noatime 0 0
/proc /proc proc rw,relatime 0 0
/sys /sys sysfs rw,relatime 0 0
tmpfs /run tmpfs rw,nosuid,relatime,size=149564k,mode=755 0 0
/dev /dev devtmpfs rw,relatime,size=369460k,nr_inodes=92365,mode=755 0 0
/dev/pts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
shmfs /dev/shm tmpfs rw,relatime 0 0
+ cat /proc/mdstat
Personalities : 
unused devices: <none>
+ lvm config
+ lvm pvs
+ lvm vgs
+ lvm lvs
+ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
+ ip r
+ cat /etc/resolv.conf
cat: /etc/resolv.conf: No such file or directory
+ lsmod
Module                  Size  Used by
libcrc32c              16384  0
crc8                   16384  0
crc7                   16384  0
crc64                  16384  0
crc4                   16384  0
crc_itu_t              16384  0
virtio_input           16384  0
virtio_scsi            24576  1
virtio_rpmsg_bus       24576  0
rpmsg_core             16384  1 virtio_rpmsg_bus
nd_pmem                24576  0
nd_btt                 28672  1 nd_pmem
virtio_net             53248  0
net_failover           20480  1 virtio_net
failover               16384  1 net_failover
virtio_crypto          24576  0
crypto_engine          16384  1 virtio_crypto
virtio_rng             16384  0
virtio_blk             20480  0
nfit                   61440  0
crc32_generic          16384  0
+ date
Sat Dec 21 15:32:00 UTC 2019
+ echo -n 'clocksource: '
clocksource: + cat /sys/devices/system/clocksource/clocksource0/current_clocksource
tsc
+ echo -n 'uptime: '
uptime: + cat /proc/uptime
17.35 1.59
+ cmd=guestfsd
++ grep -Eo 'guestfs_channel=[^[:space:]]+' /proc/cmdline
+ eval
+ test x '!=' x
+ test 1 = 1
+ cmd='guestfsd --verbose'
+ test '' = 1
+ false
+ test '' = 1
+ echo guestfsd --verbose
guestfsd --verbose
+ guestfsd --verbose
lvm_system_dir = /tmp/lvm
OCaml daemon loaded
trying to open virtio-serial channel '/dev/virtio-ports/org.libguestfs.channel.0'
commandrvf: stdout=n stderr=y flags=0x0
commandrvf: udevadm --debug settle
calling: settle
libguestfs: recv_from_daemon: received GUESTFS_LAUNCH_FLAG
libguestfs: appliance is up
libguestfs: trace: launch = 0
libguestfs: trace: mount "/dev/sda1" "/"
guestfsd: <= mount (0x1) request length 64 bytes
commandrvf: stdout=n stderr=y flags=0x0
commandrvf: udevadm --debug settle -E /dev/sda1
calling: settle
command: mount '/dev/sda1' '/sysroot//'
[   18.214526] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null)
libguestfs: trace: mount = 0
libguestfs: trace: yara_load "./rules/Webshells/WShell_Drupalgeddon2_icos.yar"
guestfsd: => mount (0x1) took 0.50 secs
guestfsd: <= yara_load (0x1d8) request length 40 bytes
guestfsd: receive_file: reading length word
guestfsd: receive_file: got chunk: cancel = 0x0, len = 918, buf = 0x55df22ecbc70
guestfsd: receive_file: reading length word
guestfsd: receive_file: got chunk: cancel = 0x0, len = 0, buf = (nil)
guestfsd: receive_file: end of file, leaving function
libguestfs: trace: yara_load = 0
libguestfs: trace: yara_scan "/etc/init.d/kns813.ico"
libguestfs: trace: internal_yara_scan "/etc/init.d/kns813.ico" "/tmp/libguestfskKHFi3/yara_scan1"
guestfsd: => yara_load (0x1d8) took 0.06 secs
guestfsd: <= internal_yara_scan (0x1da) request length 68 bytes
libguestfs: trace: internal_yara_scan = 0
libguestfs: error: deserialise_yara_detection_list: Success
libguestfs: trace: yara_scan = NULL (error)
libguestfs: trace: close
libguestfs: closing guestfs handle 0x55efedcf8520 (state 2)
libguestfs: trace: internal_autosync
guestfsd: => internal_yara_scan (0x1da) took 0.07 secs
guestfsd: <= internal_autosync (0x11a) request length 40 bytes
umount-all: /proc/mounts: fsname=/dev/root dir=/ type=ext2 opts=rw,noatime freq=0 passno=0
umount-all: /proc/mounts: fsname=/proc dir=/proc type=proc opts=rw,relatime freq=0 passno=0
umount-all: /proc/mounts: fsname=/sys dir=/sys type=sysfs opts=rw,relatime freq=0 passno=0
umount-all: /proc/mounts: fsname=tmpfs dir=/run type=tmpfs opts=rw,nosuid,relatime,size=149564k,mode=755 freq=0 passno=0
umount-all: /proc/mounts: fsname=/dev dir=/dev type=devtmpfs opts=rw,relatime,size=369460k,nr_inodes=92365,mode=755 freq=0 passno=0
umount-all: /proc/mounts: fsname=/dev/pts dir=/dev/pts type=devpts opts=rw,relatime,mode=600,ptmxmode=000 freq=0 passno=0
umount-all: /proc/mounts: fsname=shmfs dir=/dev/shm type=tmpfs opts=rw,relatime freq=0 passno=0
umount-all: /proc/mounts: fsname=/dev/sda1 dir=/sysroot type=ext4 opts=rw,relatime freq=0 passno=0
commandrvf: stdout=n stderr=y flags=0x0
commandrvf: umount /sysroot
commandrvf: stdout=n stderr=y flags=0x0
commandrvf: udevadm --debug settle -E /dev/sdb
calling: settle
commandrvf: stdout=n stderr=y flags=0x0
commandrvf: udevadm --debug settle -E /dev/sda
calling: settle
fsync /dev/sda
libguestfs: trace: internal_autosync = 0
libguestfs: sending SIGTERM to process 1982
libguestfs: qemu maxrss 404184K
libguestfs: command: run: rm
libguestfs: command: run: \ -rf /tmp/libguestfskKHFi3
libguestfs: command: run: rm
libguestfs: command: run: \ -rf /tmp/libguestfsVlS0hV
[*] We are going to load ./rules/Webshells/WShell_Drupalgeddon2_icos.yar precompiled rule
[*] We are going to scan /etc/init.d/kns813.ico file
An error has been launched when scan /etc/init.d/kns813.ico file


More information about the Libguestfs mailing list