ELF>5%@@8 @@@@888<<  P   TTTDDPtdQtdRtd hh/lib64/ld-linux-x86-64.so.2GNU GNU9d\ۤG,bGb A@ bdgBE| qXb,& 9BY0`lqc.n tu" GT ) $M?2`iK X7Z$} Q" F[1 D I 8  0flibauparse.so.0audit_detect_machine_ITM_deregisterTMCloneTableaudit_msg_type_to_nameaudit_flag_to_nameaudit_elf_to_machineaudit_syscall_to_name__gmon_start___Jv_RegisterClasses_ITM_registerTMCloneTableaudit_machine_to_nameaudit_errno_to_name_finiauparse_do_interpretation_initauparse_interp_adjust_typelibaudit.so.1_audit_elfaudit_sendaudit_openaudit_set_loginuid_immutableaudit_set_enabledaudit_number_to_errmsg_audit_exeaddedaudit_rule_syscallbyname_dataaudit_msgaudit_machine_to_elfaudit_can_controlaudit_is_enabledaudit_set_rate_limitaudit_set_backlog_limitaudit_strsplit_audit_syscalladdedaudit_add_watch_diraudit_make_equivalentaudit_rule_fieldpair_dataaudit_closeaudit_add_rule_dataaudit_request_rules_list_dataaudit_log_user_message_audit_permaddedaudit_field_to_nameaudit_update_watch_permsaudit_fstype_to_nameaudit_request_status_audit_filterfsaddedaudit_action_to_nameaudit_reset_lostaudit_set_failure_audit_archaddedaudit_request_featuresaudit_rule_interfield_comp_dataaudit_trim_subtreesaudit_get_replyaudit_operator_to_symbolset_aumessage_modeaudit_delete_rule_datalibcap-ng.so.0libc.so.6__xpg_basename__printf_chkexitoptind__strdup__fdelt_chkstrncpyputs__stack_chk_failputcharfgets_unlockedselectstrlenstrstr__errno_locationmemcmpmemcpyfclosestrtoulmalloc__ctype_b_locoptargstderr__snprintf_chkgetopt_long__strncat_chk__fxstatfwritegeteuidstrchr__strtok_rfdopen__ctype_tolower_loc__cxa_finalize__xstatopterr__strcat_chkstrcmpstrerror__asprintf_chk__libc_start_mainfree_edata__bss_start_endkeyGLIBC_2.3GLIBC_2.14GLIBC_2.8GLIBC_2.15GLIBC_2.4GLIBC_2.2.5GLIBC_2.3.4ii MWii blii wui ti  & %   j@ 1j    ( + 0 1 ;ȏ EЏ H؏ L S Z \ a       ( 0  8  @  H  P X ` h p x          ȍ Ѝ  ؍ ! " # $ % & ' ) * ,( -0 .8 /@ 2H 3P 4X 5` 6h 7p 8x 9 : < = > ? @ A B CȎ DЎ F؎ G I J K M N O P Q R( T0 U8 V@ WH XP YX [` ]h ^p _x `HH}q Ht;H5n %n @%n h%n h%zn h%rn h%jn h%bn h%Zn h%Rn hp%Jn h`%Bn h P%:n h @%2n h 0%*n h %"n h %n h%n h% n h%n h%m h%m h%m h%m h%m h%m hp%m h`%m hP%m h@%m h0%m h %m h%m h%m h%m h %m h!%zm h"%rm h#%jm h$%bm h%%Zm h&%Rm h'p%Jm h(`%Bm h)P%:m h*@%2m h+0%*m h, %"m h-%m h.%m h/% m h0%m h1%l h2%l h3%l h4%l h5%l h6%l h7p%l h8`%l h9P%l h:@%l h;0%l h< %l h=%l h>%l h?%l h@%l hA%zl hB%rl hC%jl hD%bl hE%Zl hF%Rl hGp%Jl hH`%Bl hIP%:l hJ@%2l hK0%*l hL %"l hM%l hN%l hO% l hP%l hQ%2l f%Zl fATI1U1SNw!ID$8-xRx1lj l VI|$'H=il ^hl I\$H5EHt!;-u{CIHtoH=>HtLH=>HtiH=> HtFH=>HƸ8tF@A1fDA1fDA1fDA1fDACh 0@HHg H=h h g xg jg Hf g g Hg Hf Hf Hf HHg 1HHf x 1H@f yH5@1NHwt-M8otHH5+=1 1H5@11@f.Su9He sf f [_e =tHWe 8tH=Sf H5U1 e e H5(f =e 11rۋe ۅMf=je ;1&fBe =tHd 8tH=e H5jT1 d d H5ye =d >11QH;H5|?18cfD;tDH=;uHH5 ?1H5(;1[fDH5d ktW'H몉HVH5d kuߋ c c =c dž i0O c c =c dž i'H=>=c ATUSHHdH%(H$1H=^;/tAH5;:1H$dH3 %(HĠ[]A\fDHHHH}HIrI%H59HHtH5:E1N*HaHH5IE1%H Hv-HH:/tHtH</HtHHiuD$1%=@@Ǎ|?iH5b Hf.H5D1}?HH"0DH5D1=b3HH=8HtJH=8 Hָ@@8tH=y8Hְ8tf*a 1a 0AUI,ATUHSHHHtL`,LHtH[]A\A]LHBt=,A}t#LuA}t=` t1LLHt,Df.Hw1҅~` HfDAUAATUSH(L%_ dH%(H$1A,$>1HHHHB` H|$ @Hp _t#EA,$uBH5B1 DA,$H$dH3%(u^H([]A\A]H51BD1A$UA$@EA$5@f.USHtL'tH[]k1ۃ8H[]K8ouHu^ H=5HfAUATUHSH,HHH HHIM<,u@IAE<,tI]D<,HSHuMt}LHt I@H,ttXHKf,HAtgHuHt8IHHLwtu H541L1LD$ D$ H[]A\A]HHKHHH[]A\A]ÐAWAVAUIATE1USHFHX] dH%(H$H1H\\ Lt$4t$$D$4H\ H] HD$@HD$@H \ H:EML%t(ww HcHH=a7A^fDH[ (fD9~$AtH5E1ADH\ 8t|\ ur[ HD$8ӃH \ H|$8HH18Ht$8H=/\ QH|$8fDAD#H$HdH3%(pHX[]A\A]A^A_f.Hq4H5p41A0HZ A= [ EAf/ H`Z 8 =Z A@HYZ L8MtIHDP H5{>L1A!fHY  HY ,HHHXxL`G,LH1=Z LHgrD5Y  H{Y L MLGA1H81AHʋ r  w x HA9wH=Y "]HX Af HX Ht*<~ Hfg Hu=X E1E11$}s @=X A@@ Y A.fDHW DEMHW DE:H X DE'HW 8H5?1AX A=W hH5Y?1A_rf.HYW H8H011=W ! =sW NfHV H8H011n=(W 1H5)>1AfHV L8Mt,IHDPH5:L1A>QfL=9V H5-M'LHtHU F V V  H5;1AHU H8H V HU U oAESfDHU E1U A%U me  DV EEt-ljD$T$H5T HT H=U H0o  rHT E\=T LHT |$$H04@RU L%cT I<$;U H591A$7U U AfL=S H5*M'LgHtHS $ T T lH5T LT d S =S E HcL$4HS AHH4 OH5 <1A*f=zS pi@9=;S A/=%S AHS R L=R H=eS I7=uHNS P jHCR R =YL=(R MH=*LιIMLLL$LS LL$AI!сကtH5R DIPLDIL+Q 1I>IIcH=*LιLϾLL$rHLL$tH5*Lʿ12MHhR 8&!R H=RR HcҹL"H;R H!%tDHJHDHH+P )ЉQ =Q L=P MMH5})1At P H581AAT@H581A2f.=nP H P H8HJOP 3fD12H53H1AD1f2@YH53H1AnfauLAH5(1A':fH5!(1Af.I7A`hIE8-xi xO @5@HN HcID8--xk#xHcmO IuH=O @mwH5!21A/Bf.H551AH551AH521A(N YL=M MN E 11LHD$ HL$=M C@+Y11LHD$HL$ M=}M @=VM "L=L MMCD$HL H5k$H1L$AH5y%1AH5L 3&A#H5 %1A:MDH531H5%1HD$8 8oH5"1f.H=&H|$LκH|$-Ƅ$@xL@HD$(-LLD$HHzH@HL$(LD$ysyyuysuyyusH=%HH=H$HH=5$HH="$Ht{H5$1&H=#LvH=#L_H=#LHH59$1XMH=1K LAHK P jpH,J H=2K H56LL$J LL$P3H5.1AH5&/1AHhI HcID8-QH58.1O HcI H5!A1(;H I HcIDHt58-u0xku*xu$HcI IuH='J @H5-1AH5811AI$H5 1A|H511A^qH5H LXtLH5-1 xixH @IH51AIH51AH5m1AH5.1}`G 1ۉƒEHDG 9}QL=WG H5T$(MLLL$Ht*HcT$(LL$ID8-uxtuxu H5-1AHt$8AMH5-1H5,1{H51{1qH5 ¿1ZH5-1B%H5),1%H5|+1H5Z1H5ZH51H51y1HulDHHt0\t3@t u7H1HufDfD@t1fDDf.SHHtbHKHft+QHHt)uA Hf.A\HfDAH[s[@f.AW1AVAUATUSHdH%(H$1H|$HT$ ƿe|$<D$8%=HT$H5-1AH$dH3%(DH[]A\A]A^A_8taHT$H5H1As8AHT$H5nH1DgHT$H5,1E1GHT$H5,H5PYHIH$AAELH߉D$ H HHtH݋EH!ကt$DHEHDHH)@ uHKDHq@ t@u A\HHdHI8#tH1HxIHcHHVL`HD$L`HAGD$ fD;l$}#LIM|$1HIuHT$HcHJAL|$t$ LLRr b8oHL$T$ H5)+1=B tY= B -B LE1HT$H58?H5HLA`H51L@H|$AmL%HHGGfHHGHHu fDHHBHuHW@f.HGHtH@HGf.AUIATIUSHHMHt[LHHtLLH HHMH;LeHEt4HCHhHkCH[]A\A]fHH+ϐf.ATIUSHHu #HH;HkHHuID$AD$[]I$A\f.AWAVAUAATUSH$dH%(H$#1TA"H\$@1HHIcEeHl$DE1AL?)ѺHH T@HD$ HHD$H$H$@HD$HD$@S8u11IHDxH4$1ɺDu~!H$D9xAAA'~H|$|HD$(HuDH|$HHHD2y؉H5)H¿1oH$#dH3%(H$[]A\A]A^A_Ð$ZtD=1H$#H$#H|$ HH$#؉9 HH$Ht$Ht$`Ht$ Ht$XHt$@@H(DEE A@H 1H=t iJHH9t%juHH9u}PG>1fHH=!| t}HH5&HH1Ed H AE1AHD;e uDDH6 DAxD8zAH7 DE<H6 DDEH5Z#H¿1AHD;ekDt$HOAŋEP1DHH=? | t11E1A@DDDHc҅D tbH6 8EDDHHH^"fH5"1DAAvt$L\$,DED$(YDDIH54"HL1/D$(D$LD$HD$,EL HD$8HD$0E11MAiAk<ApBAUAjAf!AoDA8AAE7|$,wH45 _|$H5I#HEL1DI;]EEAA tAxDDl$iHI}A AF AE|$N%IDD$ DD$H5 HM1LAGI;]S ^H=g4 2HQH=R4 1&fDDL$(J%AEu#H5/ 1hAIDH5 1EA?(HA?|$I+H5HML1rf.DD$(J%AEuH51[|$E7AH5f!HE1E/Ƅ$A.A AAt$(HT$DH5411@AgAE7|$H5HEL1_J%AH5fAH|$@N%H_1]H|$XAL-FHT$ LIHt^Hl$Lt$ l$(&H5<1M1LL`Ht#HuH51!Hl$H|$X艿|@H51`|$E7H5HEL1+A?!AH57 HcHH|$H5о&H|$H5赾H|$H5) 蚾HD$rf8E7DHD$0YA?;HA?*D H5VH¿1pDHD$8 }HD$X1+Hu21H5,1HL$HL$HaHkH5D1ec諾A D$LELt$L  L$HD$xD$dD$HLD$`HD$0HD$hHD$8HD$p1fLLL$>Ht$ |$IѾH5UHML1LAA?1)fE7EiHHD$[|$sLD$H5 HL1EDHH5HD1D$,D$L'H=H1|$H5yH¿1ӿF|$սH5FH¿1诿"|$豽H5H¿1苿|$荽H5H¿1g|$iH5H¿1C|$EH5{H¿1|$!H5GH¿1n|$H5H¿1׾J|$ټH5H¿1賾&|$赼H5H¿1菾|$葼H5zH¿1k|$mH5FH¿1G|$IH5H¿1#|$%H5H¿1r|$H5H¿1۽N|$ݻH5}H¿1跽*|$蹻H5FH¿1蓽|$蕻H5H¿1o|$qH5H¿1K|$MH5H¿1'|$)H5mH¿1v|$H57H¿1߼R|$H5H¿1軼.|$轺H5H¿1藼 |$虺H5H¿1s1mHPH5O1N!H516D$,?D$LCD$HP蟹f.DAWAAVIAUIATL%p$ UH-p$ SL)1HHHtLLDAHH9uH[]A\A]A^A_Ðf.HHtaskexituserfilesystemexcludeThe audit system is disabledRule existsError - no list specifiedThe path must start with '/'..neverpossiblealwaysThe audit system is disabled Syscall name unknown: %sOnly -i option is allowedError converting rateError converting backlogAppend rule - bad keyword %sAdd rule - bad keyword %sDelete rule - bad keyword %sError detecting machine typeError looking up elf type %dElf type unknown: 0x%xarch=key=Only the -k option is allowedwatch option needs a pathkey option needs a valuekey option exceeds size limitids-fileexecmkexelowmedhiids key is badkey %s has illegal characterPermission %c isn't supported2.8.5auditctl version %s lost: %uOut of memory adding keyids key type is badinfids key severity is badError opening %s (%s)Error fstat'ing %s (%s)Error - %s is world writablermError - fdopen failed (%s)auditctl--helploginuid-immutablereset-lostCannot open netlink audit socketThe audit system is in immutable mode, no rule changes allowedError sending add rule data request (%s)Error sending delete rule data request (%s)usage: auditctl [options] -a Append rule to end of ist with ction -A Add rule at beginning of ist with ction -b Set max number of outstanding audit buffers allowed Default=64 -c Continue through errors in rules -C f=f Compare collected fields if available: Field name, operator(=,!=), field name -d Delete rule from ist with ction l=task,exit,user,exclude a=never,always -D Delete all rules and watches -e [0..2] Set enabled flag -f [0..2] Set failure flag 0=silent 1=printk 2=panic -F f=v Build rule: field name, operator(=,!=,<,>,<=, >=,&,&=) value -h Help -i Ignore errors when reading rules from file -k Set filter key on audit rule -l List rules -m text Send a user-space message -p [r|w|x|a] Set permissions filter on watch r=read, w=write, x=execute, a=attribute -q make subtree part of mount point's dir watches -r Set limit in messages/sec (0=none) -R read rules from file -s Report status -S syscall Build rule: syscall name or number -t Trim directory watches -v Version -w Insert watch at -W Remove watch at --loginuid-immutable Make loginuids unchangeable once set --reset-lost Reset the lost record counterThe path passed for the watch is too bigThe base name of the path is too bigWarning - relative path notation is not supportedWarning - wildcard notation is not supportedWARNING - 32/64 bit syscall mismatch in line %d, you should specify an archWARNING - 32/64 bit syscall mismatch, you should specify an archToo many options for status commandEnable must be 0, 1, or 2 was %sFailure must be 0, 1, or 2 was %sRate must be a numeric value was %sBacklog must be a numeric value was %sWrong number of options for list requestOnly -k or -i options are allowedSyscall auditing requested for task listMultiple rule insert/delete operations are not allowed Append rule - possible is deprecatedError: syscall auditing requested for task listMultiple rule insert/delete operations are not allowedDelete rule - possible is deprecatedError: syscall auditing being added to task listError: syscall auditing being added to user listError: syscall auditing being added to filesystem listError: syscall auditing cannot be put on exclude listList must be given before fieldThe -m option must be only the only option and takes 1 parameterIllegal character in audit eventError - nested rule files not supportedWrong number of options for Delete all requestwatch option can't be given with a syscallkey option needs a watch or syscall given prior to itpermission option needs a watch given prior to itpermission option needs a filterSyscall auditing requested for make equivalentbacklog_wait_time is not supported on your kernelhicslDvtC:e:f:r:b:a:A:d:S:F:m:R:w:W:k:p:q:parameter passed without an option givenError parsing equivalent partsfile %s doesn't exist, skippingError - %s isn't owned by rootError - %s is not a regular fileThere was an error in line %d of %sYou must be root to run this program.@80P`P0`0к(Error receiving rules list (%s)Error deleting rule (%s)disableenabledenabled+immutableunknownsilentprintkpanic,unlockedNo rules -F arch%s0x%X -F arch%sb64 -F arch%sb32 -F arch%s%s -S -F %s%s%d -F %s%s%s -F %s%s%.*s-w %.*s -F path=%.*s -F dir=%.*s -F exe=%.*s -k %s -F key=%sa -p %s -F perm=%s -F %s%s%u -C uid%sobj_uid -C gid%sobj_gid -C euid%sobj_uid -C egid%sobj_gid -C auid%sobj_uid -C suid%sobj_uid -C sgid%sobj_gid -C fsuid%sobj_uid -C fsgid%sobj_gid -C uid%sauid -C uid%seuid -C uid%sfsuid -C uid%ssuid -C auid%sfsuid -C auid%ssuid -C auid%seuid -C euid%ssuid -C euid%sfsuid -C suid%sfsuid -C gid%segid -C gid%sfsgid -C gid%ssgid -C egid%sfsgid -C egid%ssgid -C sgid%sfsgid -F %s%s0x%X -F %s%s-%s f%d%s%dNLMSG_ERROR %d (%s) enabled %s failure %s enabled %u failure %u loginuid_immutable %u %s Unknown: type=%d, len=%d -a %s,%s -S allpid %u rate_limit %u backlog_limit %u lost %u backlog %u jF"nJ&rN*v;!@`%0@PP pH`Я0h  @ @P @`0H`xpzRx *zRx $؜0FJ w?;*3$"<D<BGA A(GH (A ABBA hD E HRD_ A $Cu H  G 4 BAA J_  AABG <ث}<T@BJA D(D0l (A ABBI *De<ج"BEA A(G (A ABBD 4ȭAAF k CAI Q FAH L$ OBBA D(O@ (A ABBD W (G ABBE Lt )BBB E(D0C8N 8A0A(B BBBK xrAg H ALBDB B(A0A8G2 8A0A(B BBBA ,LBFE ` ABA |X`X"p<xBED A(L0X (A ABBJ ,SBDA @AJLLhBBB E(A0A8GH 8A0A(B BBBB L(aBBB B(A0A8D` 8A0A(B BBBD HP,h,L4BBB B(A0A8J 8A0A(B BBBA D0eBEE E(H0H8M@l8A0A(B BBBX&% ?q 0 f  o   ،  oooo2o fv&6FVfv  & 6 F V f v !!&!6!F!V!f!v!!!!!!!!!""&"6"F"V"f"v"""""""""##&#6#F#V#f#v# j1jauditctl.debug9K7zXZִF!t/G]?Eh=ڊ2Nз0@sY]6:oVst?J9:>!ssbM + =:`vZuN?I.\kowYqqUǞt!1[>V 퐫1go4>%-]I<(Ho:-(8laWBN Ηh?r\lY*;G[OO.~(lU!O7I|WxLE ص𻕜{q˙D)8D*u޿waŗHo7qB2da԰Zdyk«r 317IaDpzI9*e*ޗ#;yG//\SF o h)ӂ.@*e%!]x7"yv{+AnZ)4=iu,gЖ+ӾeA<:r1|I; DC?.}k3ЧϓΜE*߳$~ڣr.Ĝ~& ?4٦cE*R4W5+ h-Ԑ۔ܻR8MmF>cϐ4{C`nP[Vt9U~&]k1֙ǗMj_oJ cb  F No22[ojtB~00yPP0####Bff ff((     ، ،(  h