root@fritz:/var/mod/root# ps |grep vsftpd
2281 root 3476 S vsftpd
2940 root 1624 S grep vsftpd
root@fritz:/var/mod/root# strace -p 3476
strace: attach: ptrace(PTRACE_SEIZE, 3476): No such process
root@fritz:/var/mod/root# strace -p 2281
strace: Process 2281 attached
accept(4, {sa_family=AF_INET, sin_port=htons(58459), sin_addr=inet_addr("192.168.10.20")}, [28->16]) = 5
clone(child_stack=NULL, flags=CLONE_NEWIPC|CLONE_NEWPID|SIGCHLD) = 3077
close(5) = 0
accept(4,
root@fritz:/var/mod/root# ps |grep vsftpd
2281 root 3476 S vsftpd
3077 root 3480 S vsftpd
3079 root 3492 S vsftpd
3156 root 1624 S grep vsftpd
root@fritz:/var/mod/root# strace -p 3077
strace: Process 3077 attached
read(5, "\1", 1) = 1
read(5, "\4\0\0\0", 4) = 4
read(5, "root", 4) = 4
read(5, "\4\0\0\0", 4) = 4
read(5, "root", 4) = 4
read(5, "\0\0\0\0", 4) = 4
read(5, "\0\0\0\0", 4) = 4
open("/etc/passwd", O_RDONLY) = 6
ioctl(6, TCGETS, 0xbee55a10) = -1 ENOTTY (Inappropriate ioctl for device)
read(6, "asec::101:101::/nonexistent:/nos"..., 4096) = 2469
close(6) = 0
open("/etc/shadow", O_RDONLY) = 6
ioctl(6, TCGETS, 0xbee55a10) = -1 ENOTTY (Inappropriate ioctl for device)
read(6, "bittorrent:!:0:0:99999:7:::\nftp:"..., 4096) = 111
close(6) = 0
gettimeofday({tv_sec=213, tv_usec=691363}, NULL) = 0
gettimeofday({tv_sec=213, tv_usec=693587}, NULL) = 0
gettimeofday({tv_sec=213, tv_usec=693905}, NULL) = 0
fcntl64(4, F_SETLKW64, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
write(4, "Thu Jan 1 01:03:33 1970 [pid 1]"..., 73) = 73
fcntl64(4, F_SETLK64, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
open("/mod/etc/vsftpd.chroot_list", O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 6
fstat64(6, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6f37000
mprotect(0xb6f38000, 4096, PROT_NONE) = 0
mprotect(0xb6f37000, 4096, PROT_READ) = 0
read(6, "", 0) = 0
mprotect(0xb6f37000, 4096, PROT_READ) = 0
munmap(0xb6f37000, 8192) = 0
close(6) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x25358, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0xb6c22f28}, NULL, 8) = 0
write(5, "\1", 1) = 1
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 2
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
sigreturn({mask=[]}) = 2
close(5) = 0
socketpair(AF_UNIX, SOCK_STREAM, 0, [5, 6]) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x25358, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0xb6c22f28}, NULL, 8) = 0
rt_sigaction(SIGALRM, {sa_handler=0x25350, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0xb6c22f28}, NULL, 8) = 0
clone(
root@fritz:/var/mod/root# strace -p 3079
strace: Process 3079 attached
recv(0, "USER root\r\n", 4096, MSG_PEEK) = 11
read(0, "USER root\r\n", 11) = 11
gettimeofday({tv_sec=206, tv_usec=445716}, NULL) = 0
gettimeofday({tv_sec=206, tv_usec=446199}, NULL) = 0
fcntl64(4, F_SETLKW64, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
write(4, "Thu Jan 1 01:03:26 1970 [pid 2]"..., 82) = 82
fcntl64(4, F_SETLK64, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
gettimeofday({tv_sec=206, tv_usec=450031}, NULL) = 0
gettimeofday({tv_sec=206, tv_usec=450504}, NULL) = 0
fcntl64(4, F_SETLKW64, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
write(4, "Thu Jan 1 01:03:26 1970 [pid 2]"..., 113) = 113
fcntl64(4, F_SETLK64, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
write(0, "331 Please specify the password."..., 34) = 34
rt_sigaction(SIGALRM, {sa_handler=0x25358, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0xb6c22f28}, NULL, 8) = 0
setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=300, tv_usec=0}}, {it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=249, tv_usec=459144}}) = 0
recv(0, "PASS root\r\n", 4096, MSG_PEEK) = 11
read(0, "PASS root\r\n", 11) = 11
gettimeofday({tv_sec=213, tv_usec=677370}, NULL) = 0
gettimeofday({tv_sec=213, tv_usec=677867}, NULL) = 0
fcntl64(4, F_SETLKW64, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
write(4, "Thu Jan 1 01:03:33 1970 [pid 2]"..., 95) = 95
fcntl64(4, F_SETLK64, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0
write(6, "\1", 1) = 1
write(6, "\4\0\0\0", 4) = 4
write(6, "root", 4) = 4
write(6, "\4\0\0\0", 4) = 4
write(6, "root", 4) = 4
write(6, "\0\0\0\0", 4) = 4
write(6, "\0\0\0\0", 4) = 4
read(6, "\1", 1) = 1
exit_group(0) = ?
+++ exited with 0 +++
