setrlimit hangs the process

setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1: Type: text/plain, Size: 471 bytes --]

Hi,

I'm using the latest golang:alpine Docker image to produce a
statically-linked Go binary. Even though I'm able to build the binary, when
I run it the process gets stuck during ebpf program loading. I've
investigated a bit and found the root cause is the call to setrlimit (this
is the offending line

https://github.com/iovisor/gobpf/blob/2e314be67b1854ad226f012f08a984e0e89b6da9/elf/elf.go#L105).
Are you aware of such behaviour in musl?


Thanks in advance

Nedim

[-- Attachment #2: Type: text/html, Size: 831 bytes --]

Re: setrlimit hangs the process

[Szabolcs Nagy]

* Rabbitstack <rabbitstack7@gmail.com> [2018-09-25 14:59:45 +0200]:
> I'm using the latest golang:alpine Docker image to produce a
> statically-linked Go binary. Even though I'm able to build the binary, when
> I run it the process gets stuck during ebpf program loading. I've
> investigated a bit and found the root cause is the call to setrlimit (this
> is the offending line
> 
> https://github.com/iovisor/gobpf/blob/2e314be67b1854ad226f012f08a984e0e89b6da9/elf/elf.go#L105).
> Are you aware of such behaviour in musl?
> 

well you could have described what goes wrong in more detail
(error message, strace output, target platform, are you root, ...)

i assume you are not running this on mips (since there is no
alpine docker image for mips), which has the issue of
SYSCALL_RLIM_INFINITY != RLIM_INFINITY
the kernel side value is different from userspace so musl
has to translate the value which may go wrong.

nor on x32 (which may have various issues with the raw
syscalls both in the go code and c code).

increasing rlimit is not allowed by default, so you have to
ensure you have permissions, musl should have no special
behaviour with respect to RLIMIT_MEMLOCK, so it's more likely
that you just don't have bpf and setrlimit permissions.

instead of using a complex system like go + c code + elf loader,
try a minimal c program to see if the bpf syscall succeeds at
all in your docker environment.

Re: setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1: Type: text/plain, Size: 4289 bytes --]

Sorry. Let me describe the problem in more detail.

The process only hangs when launched without root privileges on the host
(Arch Linux x64 with kernel 4.17.5-1) where Alpine docker container is
running. Once with root privileges, it starts up correctly (but this is
obvious since it doesn't hit setrlimit call). The odd side is that on other
hosts it hangs even when started with root. No error messages so far.
Strace output:

$ sudo strace -p 9285

futex(0x2cddfc0, FUTEX_WAIT_PRIVATE, 0, NULL

$ sudo strace -f -p 9285

.....
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
[pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
{tv_sec=1537887068, tv_nsec=51442144}) = -1 ETIMEDOUT (Connection timed out)
[pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
[pid  9287] lseek(10, 0, SEEK_SET)      = 0
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
[pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
{tv_sec=1537887068, tv_nsec=62384239}) = -1 ETIMEDOUT (Connection timed out)
[pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
[pid  9287] lseek(10, 0, SEEK_SET)      = 0
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
[pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
{tv_sec=1537887068, tv_nsec=73251219}) = -1 ETIMEDOUT (Connection timed out)
[pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
[pid  9287] lseek(10, 0, SEEK_SET)      = 0
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
[pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
{tv_sec=1537887068, tv_nsec=84458579}) = -1 ETIMEDOUT (Connection timed out)
[pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
[pid  9287] lseek(10, 0, SEEK_SET)      = 0
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
[pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
{tv_sec=1537887068, tv_nsec=95098614}) = -1 ETIMEDOUT (Connection timed out)
[pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
[pid  9287] lseek(10, 0, SEEK_SET)      = 0
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
[pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
{tv_sec=1537887068, tv_nsec=106005502}) = -1 ETIMEDOUT (Connection timed
out)
[pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
[pid  9287] lseek(10, 0, SEEK_SET)      = 0
[pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
[pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
.....


I'll try to build a tiny example to isolate the problem and hopefully
provide more feedback.

Thanks

On Tue, Sep 25, 2018 at 4:15 PM Szabolcs Nagy <nsz@port70.net> wrote:

> * Rabbitstack <rabbitstack7@gmail.com> [2018-09-25 14:59:45 +0200]:
> > I'm using the latest golang:alpine Docker image to produce a
> > statically-linked Go binary. Even though I'm able to build the binary,
> when
> > I run it the process gets stuck during ebpf program loading. I've
> > investigated a bit and found the root cause is the call to setrlimit
> (this
> > is the offending line
> >
> >
> https://github.com/iovisor/gobpf/blob/2e314be67b1854ad226f012f08a984e0e89b6da9/elf/elf.go#L105
> ).
> > Are you aware of such behaviour in musl?
> >
>
> well you could have described what goes wrong in more detail
> (error message, strace output, target platform, are you root, ...)
>
> i assume you are not running this on mips (since there is no
> alpine docker image for mips), which has the issue of
> SYSCALL_RLIM_INFINITY != RLIM_INFINITY
> the kernel side value is different from userspace so musl
> has to translate the value which may go wrong.
>
> nor on x32 (which may have various issues with the raw
> syscalls both in the go code and c code).
>
> increasing rlimit is not allowed by default, so you have to
> ensure you have permissions, musl should have no special
> behaviour with respect to RLIMIT_MEMLOCK, so it's more likely
> that you just don't have bpf and setrlimit permissions.
>
> instead of using a complex system like go + c code + elf loader,
> try a minimal c program to see if the bpf syscall succeeds at
> all in your docker environment.
>
>

[-- Attachment #2: Type: text/html, Size: 5355 bytes --]

Re: setrlimit hangs the process

[Rich Felker]

On Tue, Sep 25, 2018 at 04:54:37PM +0200, Rabbitstack wrote:
> Sorry. Let me describe the problem in more detail.
> 
> The process only hangs when launched without root privileges on the host
> (Arch Linux x64 with kernel 4.17.5-1) where Alpine docker container is
> running. Once with root privileges, it starts up correctly (but this is
> obvious since it doesn't hit setrlimit call). The odd side is that on other
> hosts it hangs even when started with root. No error messages so far.
> Strace output:
> 
> $ sudo strace -p 9285
> 
> futex(0x2cddfc0, FUTEX_WAIT_PRIVATE, 0, NULL
> 
> $ sudo strace -f -p 9285
> 
> ......
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=51442144}) = -1 ETIMEDOUT (Connection timed out)
> [pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
> [pid  9287] lseek(10, 0, SEEK_SET)      = 0
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=62384239}) = -1 ETIMEDOUT (Connection timed out)
> [pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
> [pid  9287] lseek(10, 0, SEEK_SET)      = 0
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=73251219}) = -1 ETIMEDOUT (Connection timed out)
> [pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
> [pid  9287] lseek(10, 0, SEEK_SET)      = 0
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=84458579}) = -1 ETIMEDOUT (Connection timed out)
> [pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
> [pid  9287] lseek(10, 0, SEEK_SET)      = 0
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=95098614}) = -1 ETIMEDOUT (Connection timed out)
> [pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
> [pid  9287] lseek(10, 0, SEEK_SET)      = 0
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=106005502}) = -1 ETIMEDOUT (Connection timed
> out)
> [pid  9287] getdents64(10, /* 0 entries */, 2048) = 0
> [pid  9287] lseek(10, 0, SEEK_SET)      = 0
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> ......
> 
> 
> I'll try to build a tiny example to isolate the problem and hopefully
> provide more feedback.

The trace here shows a thread, tid 9285, the main thread, not
responding to the broadcast signals that are necessary to stop all
threads for the purpose of changing resource limits, uids/gids/etc.
I'm guessing some part of the Go runtime has bypassed libc and blocked
libc-internal signals in the main thread. A full strace rather than a
truncated one like the above would show this happening. If you can
produce one that doesn't expose private data that would be helpful; if
not, perhaps it's possible to write a minimal Go program that
reproduces the issue and strace it instead.

Rich

Re: setrlimit hangs the process

[Szabolcs Nagy]

* Rich Felker <dalias@libc.org> [2018-09-25 11:13:36 -0400]:
> The trace here shows a thread, tid 9285, the main thread, not
> responding to the broadcast signals that are necessary to stop all
> threads for the purpose of changing resource limits, uids/gids/etc.

ah i didnt know this is used for setrlimit too.

that explains what goes wrong.

> I'm guessing some part of the Go runtime has bypassed libc and blocked
> libc-internal signals in the main thread. A full strace rather than a
> truncated one like the above would show this happening. If you can
> produce one that doesn't expose private data that would be helpful; if
> not, perhaps it's possible to write a minimal Go program that
> reproduces the issue and strace it instead.
> 
> Rich

Re: setrlimit hangs the process

[Szabolcs Nagy]

* Rabbitstack <rabbitstack7@gmail.com> [2018-09-25 16:54:37 +0200]:
> Sorry. Let me describe the problem in more detail.
> 
> The process only hangs when launched without root privileges on the host
> (Arch Linux x64 with kernel 4.17.5-1) where Alpine docker container is
> running. Once with root privileges, it starts up correctly (but this is
> obvious since it doesn't hit setrlimit call). The odd side is that on other
> hosts it hangs even when started with root. No error messages so far.
> Strace output:
> 
> $ sudo strace -p 9285
> 
> futex(0x2cddfc0, FUTEX_WAIT_PRIVATE, 0, NULL
> 
> $ sudo strace -f -p 9285
> 
> .....
> [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> {tv_sec=1537887068, tv_nsec=51442144}) = -1 ETIMEDOUT (Connection timed out)

it looks like musl tries to sync a setuid call across
all threads (which is necessary since the linux syscall
only changes the uid for the current thread instead of
all threads so you can end up with different privileges
in the same address space which is dangerous as well as
non-posix conform setuid behaviour)

it's possible that the setuid syncing is somehow wrong
in musl, but it's more likely that there are threads
that are not created by the c runtime (but from go) and
thus the sync cannot possibly work.

so try to look for where set*id is called and ensure it
is not called or called before any threads are created
(or at least before any go threads are created)

note that syscall.Set*id from go does not work either,
it does not sync the threads (which is dangerously
broken for a runtime that's always multi-threaded).

> On Tue, Sep 25, 2018 at 4:15 PM Szabolcs Nagy <nsz@port70.net> wrote:
> > * Rabbitstack <rabbitstack7@gmail.com> [2018-09-25 14:59:45 +0200]:
> > > I'm using the latest golang:alpine Docker image to produce a
> > > statically-linked Go binary. Even though I'm able to build the binary,
> > when
> > > I run it the process gets stuck during ebpf program loading. I've
> > > investigated a bit and found the root cause is the call to setrlimit
> > (this
> > > is the offending line
> > >
> > >
> > https://github.com/iovisor/gobpf/blob/2e314be67b1854ad226f012f08a984e0e89b6da9/elf/elf.go#L105
> > ).
> > > Are you aware of such behaviour in musl?
> > >
> >
> > well you could have described what goes wrong in more detail
> > (error message, strace output, target platform, are you root, ...)
> >
> > i assume you are not running this on mips (since there is no
> > alpine docker image for mips), which has the issue of
> > SYSCALL_RLIM_INFINITY != RLIM_INFINITY
> > the kernel side value is different from userspace so musl
> > has to translate the value which may go wrong.
> >
> > nor on x32 (which may have various issues with the raw
> > syscalls both in the go code and c code).
> >
> > increasing rlimit is not allowed by default, so you have to
> > ensure you have permissions, musl should have no special
> > behaviour with respect to RLIMIT_MEMLOCK, so it's more likely
> > that you just don't have bpf and setrlimit permissions.
> >
> > instead of using a complex system like go + c code + elf loader,
> > try a minimal c program to see if the bpf syscall succeeds at
> > all in your docker environment.
> >
> >

Re: setrlimit hangs the process

[Rich Felker]

On Tue, Sep 25, 2018 at 05:36:05PM +0200, Szabolcs Nagy wrote:
> * Rabbitstack <rabbitstack7@gmail.com> [2018-09-25 16:54:37 +0200]:
> > Sorry. Let me describe the problem in more detail.
> > 
> > The process only hangs when launched without root privileges on the host
> > (Arch Linux x64 with kernel 4.17.5-1) where Alpine docker container is
> > running. Once with root privileges, it starts up correctly (but this is
> > obvious since it doesn't hit setrlimit call). The odd side is that on other
> > hosts it hangs even when started with root. No error messages so far.
> > Strace output:
> > 
> > $ sudo strace -p 9285
> > 
> > futex(0x2cddfc0, FUTEX_WAIT_PRIVATE, 0, NULL
> > 
> > $ sudo strace -f -p 9285
> > 
> > .....
> > [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> > [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> > [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> > {tv_sec=1537887068, tv_nsec=51442144}) = -1 ETIMEDOUT (Connection timed out)
> 
> it looks like musl tries to sync a setuid call across
> all threads (which is necessary since the linux syscall
> only changes the uid for the current thread instead of
> all threads so you can end up with different privileges
> in the same address space which is dangerous as well as
> non-posix conform setuid behaviour)
> 
> it's possible that the setuid syncing is somehow wrong
> in musl, but it's more likely that there are threads
> that are not created by the c runtime (but from go) and
> thus the sync cannot possibly work.

It actually can kinda work with such threads. musl's stop-the-world
__synccall pokes all kernel-level threads in the same process (thread
group) as the caller using signals and /proc/self/task to ensure it
didn't miss any, so it will work as long as they haven't blocked
libc-internal signals. There may be problems with the thread pointer
being invalid, though. The __synccall framework itself does not use
the TCB, but other stuff in the callback might. This should probably
be fixed.

> so try to look for where set*id is called and ensure it
> is not called or called before any threads are created
> (or at least before any go threads are created)
> 
> note that syscall.Set*id from go does not work either,
> it does not sync the threads (which is dangerously
> broken for a runtime that's always multi-threaded).

Yep, that's unsafe to use. Any use is likely exploitable.

Rich

Re: setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1: Type: text/plain, Size: 50049 bytes --]

Hi,

Sorry for the delay. I managed to build a minimal example that only uses
gobpf to load ebpf program into the kernel. Surprisingly, it works fine (it
doesn't hang the process). Here I attach the full strace output:

execve("./muslrlimit/musltest", ["./muslrlimit/musltest"], 0x7ffbffff96b0
/* 65 vars */) = 0
arch_prctl(ARCH_SET_FS, 0xe79100)       = 0
set_tid_address(0xe79138)               = 4454
brk(NULL)                               = 0x2e7c000
brk(0x2e7d000)                          = 0x2e7d000
sched_getaffinity(0, 8192, [0, 1, 2, 3]) = 40
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbff6c1000
mmap(0xc000000000, 67108864, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xc000000000
mmap(0xc000000000, 67108864, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xc000000000
mmap(NULL, 33554432, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7efbfd6c1000
mmap(NULL, 2162688, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd4b1000
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd4a1000
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd491000
rt_sigprocmask(SIG_SETMASK, NULL, [], 8) = 0
sigaltstack(NULL, {ss_sp=NULL, ss_flags=SS_DISABLE, ss_size=0}) = 0
sigaltstack({ss_sp=0xc000002000, ss_flags=0, ss_size=32768}, NULL) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
gettid()                                = 4454
rt_sigaction(SIGHUP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigprocmask(SIG_UNBLOCK, [RT_1 RT_2], NULL, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGINT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGINT, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGQUIT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGQUIT, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGILL, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGILL, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGTRAP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGTRAP, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGABRT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGABRT, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGBUS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGBUS, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGFPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGFPE, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGUSR1, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGUSR1, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGSEGV, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGUSR2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGUSR2, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGPIPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGPIPE, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGALRM, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGTERM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGTERM, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGSTKFLT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGSTKFLT, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGCHLD, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGURG, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGURG, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGXCPU, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGXCPU, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGXFSZ, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGXFSZ, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGVTALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGVTALRM, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGPROF, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGPROF, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGWINCH, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGWINCH, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGIO, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGIO, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGPWR, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGPWR, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGSYS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGSYS, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRTMIN, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_1, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_2, {sa_handler=0x4589b0, sa_mask=~[],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x458a70}, NULL, 8) = 0
rt_sigaction(SIGRT_3, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_3, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_4, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_4, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_5, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_5, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_6, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_6, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_7, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_7, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_8, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_8, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_9, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_9, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_10, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_10, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_11, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_11, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_12, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_12, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_13, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_13, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_14, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_14, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_15, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_15, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_16, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_16, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_17, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_17, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_18, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_18, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_19, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_19, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_20, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_20, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_21, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_21, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_22, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_22, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_23, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_23, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_24, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_24, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_25, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_25, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_26, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_26, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_27, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_27, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_28, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_28, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_29, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_29, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_30, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_30, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_31, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_31, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigaction(SIGRT_32, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_32, {sa_handler=0x4589b0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x7dff74}, NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RT_1 RT_2], NULL, 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd47a000
mprotect(0x7efbfd47c000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd490eb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd490f20, tls=0x7efbfd490ee8,
child_tidptr=0x7efbfd490f20) = 4455
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd463000
mprotect(0x7efbfd465000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd479eb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd479f20, tls=0x7efbfd479ee8,
child_tidptr=0x7efbfd479f20) = 4456
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd44c000
mprotect(0x7efbfd44e000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd462eb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd462f20, tls=0x7efbfd462ee8,
child_tidptr=0x7efbfd462f20) = 4457
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
futex(0xc000046bc0, FUTEX_WAKE_PRIVATE, 1) = 1
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd435000
mprotect(0x7efbfd437000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd44beb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd44bf20, tls=0x7efbfd44bee8,
child_tidptr=0x7efbfd44bf20) = 4458
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/tmp/alpine/muslrlimit/musltest",
128) = 31
fcntl(0, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd3f5000
fcntl(1, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
fcntl(2, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
openat(AT_FDCWD, "/proc/sys/net/core/somaxconn", O_RDONLY|O_CLOEXEC) = 3
epoll_create1(EPOLL_CLOEXEC)            = 4
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET,
{u32=4248805120, u64=139620750696192}}) = 0
fcntl(3, F_GETFL)                       = 0x8000 (flags
O_RDONLY|O_LARGEFILE)
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0
read(3, "128\n", 65536)                 = 4
read(3, "", 65532)                      = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc00009bc74) = 0
close(3)                                = 0
openat(AT_FDCWD, "/proc/version_signature", O_RDONLY|O_CLOEXEC) = -1 ENOENT
(No such file or directory)
openat(AT_FDCWD, "/proc/version", O_RDONLY|O_CLOEXEC) = 3
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET,
{u32=4248805120, u64=139620750696192}}) = 0
fcntl(3, F_GETFL)                       = 0x8000 (flags
O_RDONLY|O_LARGEFILE)
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "Linux version 4.17.5-1-ARCH (bui"..., 512) = 131
read(3, "", 1405)                       = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc0001238e4) = 0
close(3)                                = 0
uname({sysname="Linux", nodename="archrabbit", ...}) = 0
mmap(NULL, 1439992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd295000
openat(AT_FDCWD, "/proc/version_signature", O_RDONLY|O_CLOEXEC) = -1 ENOENT
(No such file or directory)
openat(AT_FDCWD, "/proc/version", O_RDONLY|O_CLOEXEC) = 3
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET,
{u32=4248805120, u64=139620750696192}}) = 0
fcntl(3, F_GETFL)                       = 0x8000 (flags
O_RDONLY|O_LARGEFILE)
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "Linux version 4.17.5-1-ARCH (bui"..., 512) = 131
read(3, "", 1405)                       = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc000123544) = 0
close(3)                                = 0
uname({sysname="Linux", nodename="archrabbit", ...}) = 0
bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERF_EVENT_ARRAY, key_size=4,
value_size=4, max_entries=1024, map_flags=0, inner_map_fd=0, map_name="",
map_ifindex=0}, 48) = 3
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=45,
insns=0xc0001de180, license="GPL", log_level=1, log_size=524288,
log_buf="", kern_version=KERNEL_VERSION(4, 17, 5), prog_flags=0}, 48) = -1
EPERM (Operation not permitted)
prlimit64(0, RLIMIT_MEMLOCK, NULL, {rlim_cur=RLIM64_INFINITY,
rlim_max=RLIM64_INFINITY}) = 0
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1 RT_2], [], 8) = 0
rt_sigprocmask(SIG_BLOCK, ~[], NULL, 8) = 0
rt_sigaction(SIGRT_2, {sa_handler=0x7e3132, sa_mask=~[],
sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7dff74}, NULL, 8) = 0
getpid()                                = 4454
gettid()                                = 4454
open("/proc/self/task", O_RDONLY|O_CLOEXEC|O_DIRECTORY) = 5
fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
kill(4454, SIGRT_2)                     = 0
kill(4454, SIGRT_2)                     = 0
kill(4454, SIGRT_2)                     = 0
kill(4454, SIGRT_2)                     = 0
getdents64(5, /* 7 entries */, 2048)    = 168
getdents64(5, /* 0 entries */, 2048)    = 0
close(5)                                = 0
futex(0x7efbfd44b75c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7efbfd46265c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7efbfd47965c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7efbfd49075c, FUTEX_WAKE_PRIVATE, 1) = 1
rt_sigaction(SIGRT_2, {sa_handler=SIG_IGN, sa_mask=~[],
sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7dff74}, NULL, 8) = 0
prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=RLIM64_INFINITY,
rlim_max=RLIM64_INFINITY}, NULL) = 0
futex(0x7efbfd44b75c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7efbfd46265c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7efbfd47965c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x7efbfd49075c, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xe79050, FUTEX_WAKE_PRIVATE, 2147483647) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=45,
insns=0xc0001de180, license="GPL", log_level=1, log_size=524288,
log_buf="", kern_version=KERNEL_VERSION(4, 17, 5), prog_flags=0}, 48) = -1
EPERM (Operation not permitted)
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
write(2, "\33[31mERRO\33[0m[0000] unable to in"..., 143) = 143
exit_group(0)                           = ?
+++ exited with 0 +++

Conversely, the offending binary does not even issue the bpf syscall, which
is quite strange. Once I remove ebpf code from the program, it does start
fine, so I'm prety sure ebpf prog loading is the culpirt here. Here's
strace output:

execve("./agent", ["./agent", "--token=1"], 0x7ffbffff96a8 /* 65 vars */) =
0
arch_prctl(ARCH_SET_FS, 0x2d0d9a0)      = 0
set_tid_address(0x2d0d9d8)              = 4361
brk(NULL)                               = 0x4d11000
brk(0x4d12000)                          = 0x4d12000
sched_getaffinity(0, 8192, [0, 1, 2, 3]) = 40
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbff6c1000
mmap(0xc000000000, 67108864, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xc000000000
mmap(0xc000000000, 67108864, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xc000000000
mmap(NULL, 33554432, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x7efbfd6c1000
mmap(NULL, 2162688, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd4b1000
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd4a1000
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd491000
rt_sigprocmask(SIG_SETMASK, NULL, [], 8) = 0
sigaltstack(NULL, {ss_sp=NULL, ss_flags=SS_DISABLE, ss_size=0}) = 0
sigaltstack({ss_sp=0xc000002000, ss_flags=0, ss_size=32768}, NULL) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
gettid()                                = 4361
rt_sigaction(SIGHUP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigprocmask(SIG_UNBLOCK, [RT_1 RT_2], NULL, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGINT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGINT, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGQUIT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGQUIT, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGILL, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGILL, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGTRAP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGTRAP, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGABRT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGABRT, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGBUS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGBUS, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGFPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGFPE, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGUSR1, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGUSR1, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGSEGV, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGUSR2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGUSR2, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGPIPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGPIPE, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGALRM, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGTERM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGTERM, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGSTKFLT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGSTKFLT, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGCHLD, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGURG, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGURG, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGXCPU, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGXCPU, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGXFSZ, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGXFSZ, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGVTALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGVTALRM, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGPROF, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGPROF, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGWINCH, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGWINCH, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGIO, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGIO, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGPWR, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGPWR, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGSYS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8)
= 0
rt_sigaction(SIGSYS, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRTMIN, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_1, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_2, {sa_handler=0x45dea0, sa_mask=~[],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x45df60}, NULL, 8) = 0
rt_sigaction(SIGRT_3, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_3, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_4, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_4, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_5, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_5, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_6, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_6, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_7, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_7, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_8, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_8, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_9, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_9, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_10, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_10, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_11, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_11, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_12, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_12, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_13, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_13, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_14, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_14, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_15, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_15, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_16, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_16, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_17, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_17, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_18, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_18, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_19, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_19, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_20, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_20, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_21, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_21, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_22, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_22, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_23, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_23, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_24, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_24, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_25, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_25, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_26, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_26, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_27, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_27, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_28, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_28, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_29, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_29, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_30, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_30, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_31, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_31, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigaction(SIGRT_32, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0},
8) = 0
rt_sigaction(SIGRT_32, {sa_handler=0x45dea0, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RT_1 RT_2], NULL, 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd47a000
mprotect(0x7efbfd47c000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd490eb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd490f20, tls=0x7efbfd490ee8,
child_tidptr=0x7efbfd490f20) = 4362
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd463000
mprotect(0x7efbfd465000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd479eb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd479f20, tls=0x7efbfd479ee8,
child_tidptr=0x7efbfd479f20) = 4363
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd435000
mprotect(0x7efbfd437000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd44beb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd44bf20, tls=0x7efbfd44bee8,
child_tidptr=0x7efbfd44bf20) = 4365
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd41e000
mprotect(0x7efbfd420000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd434eb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd434f20, tls=0x7efbfd434ee8,
child_tidptr=0x7efbfd434f20) = 4366
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/tmp/alpine/agent", 128) = 27
fcntl(0, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd3de000
fcntl(1, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
fcntl(2, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
futex(0xc000086140, FUTEX_WAKE_PRIVATE, 1) = 1
openat(AT_FDCWD, "/sys/kernel/mm/hugepages", O_RDONLY|O_CLOEXEC) = 3
epoll_create1(EPOLL_CLOEXEC)            = 4
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET,
{u32=4248710912, u64=139620750601984}}) = -1 EPERM (Operation not permitted)
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc0000d3b74) = -1 EPERM (Operation not
permitted)
getdents64(3, /* 4 entries */, 8192)    = 128
getdents64(3, /* 0 entries */, 8192)    = 0
lstat("/sys/kernel/mm/hugepages/hugepages-2048kB", {st_mode=S_IFDIR|0755,
st_size=0, ...}) = 0
lstat("/sys/kernel/mm/hugepages/hugepages-1048576kB",
{st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/net/core/somaxconn", O_RDONLY|O_CLOEXEC) = 3
epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET,
{u32=4248710912, u64=139620750601984}}) = 0
fcntl(3, F_GETFL)                       = 0x8000 (flags
O_RDONLY|O_LARGEFILE)
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK|O_LARGEFILE) = 0
read(3, "128\n", 65536)                 = 4
read(3, "", 65532)                      = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, 0xc0000d3bfc) = 0
close(3)                                = 0
getrandom("\x61\x80\xec\x0d\xa6\xac\xb2\xb2", 8, 0) = 8
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
mmap(NULL, 1439992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd27e000
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x2cdc340, FUTEX_WAIT_PRIVATE, 0, NULL) = 0
futex(0xc000060f40, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060f40, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060f40, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060f40, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060f40, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd227000
getpid()                                = 4361
futex(0xc000060f40, FUTEX_WAKE_PRIVATE, 1) = 1
uname({sysname="Linux", nodename="archrabbit", ...}) = 0
getuid()                                = 1000
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
readv(3, [{iov_base="", iov_len=0},
{iov_base="root:x:0:0:root:/root:/bin/bash\n"..., iov_len=1024}], 2) = 1024
lseek(3, -105, SEEK_CUR)                = 919
close(3)                                = 0
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc000060840, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x2cdb4c0, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=100000}) = -1
ETIMEDOUT (Connection timed out)
epoll_pwait(4, [], 128, 0, NULL, 2)     = 0
futex(0xc000060bc0, FUTEX_WAKE_PRIVATE, 1) = 1
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1 RT_2], [], 8) = 0
mmap(NULL, 94208, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd1f9000
mprotect(0x7efbfd1fb000, 86016, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7efbfd20feb8,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID|0x400000,
parent_tidptr=0x7efbfd20ff20, tls=0x7efbfd20fee8,
child_tidptr=0x7efbfd20ff20) = 4369
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
mmap(NULL, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7efbfd1e9000
futex(0xc0003db9c0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc0003db9c0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0xc0003db9c0, FUTEX_WAKE_PRIVATE, 1) = 1
sched_yield()                           = 0
futex(0x2cdb3f0, FUTEX_WAKE_PRIVATE, 1) = 0
mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
= 0x7efbfd169000
futex(0xc00036a4c0, FUTEX_WAKE_PRIVATE, 1) = 1
getuid()                                = 1000
getgid()                                = 1000
futex(0xc00036a4c0, FUTEX_WAKE_PRIVATE, 1) = 1
rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE SEGV TERM
STKFLT CHLD PROF SYS RTMIN RT_1], NULL, 8) = 0
futex(0xc00036a4c0, FUTEX_WAKE_PRIVATE, 1) = 1
rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE SEGV TERM
STKFLT CHLD PROF SYS RTMIN RT_1], NULL, 8) = 0
futex(0xc00036a4c0, FUTEX_WAKE_PRIVATE, 1) = 1
futex(0x2cdc340, FUTEX_WAIT_PRIVATE, 0, NULL) = ? ERESTARTSYS (To be
restarted if SA_RESTART is set)
--- SIGINT {si_signo=SIGINT, si_code=SI_KERNEL} ---
futex(0x2d0e6e0, FUTEX_WAKE_PRIVATE, 1) = 0
rt_sigreturn({mask=~[HUP INT QUIT ILL TRAP ABRT BUS FPE KILL SEGV TERM
STKFLT CHLD STOP PROF SYS RTMIN RT_1]}) = 202
futex(0x2cdc340, FUTEX_WAIT_PRIVATE, 0, NULL) = ? ERESTARTSYS (To be
restarted if SA_RESTART is set)
--- SIGINT {si_signo=SIGINT, si_code=SI_KERNEL} ---
rt_sigreturn({mask=~[HUP INT QUIT ILL TRAP ABRT BUS FPE KILL SEGV TERM
STKFLT CHLD STOP PROF SYS RTMIN RT_1]}) = 202
futex(0x2cdc340, FUTEX_WAIT_PRIVATE, 0, NULL) = ? ERESTARTSYS (To be
restarted if SA_RESTART is set)
--- SIGINT {si_signo=SIGINT, si_code=SI_KERNEL} ---
rt_sigreturn({mask=~[HUP INT QUIT ILL TRAP ABRT BUS FPE KILL SEGV TERM
STKFLT CHLD STOP PROF SYS RTMIN RT_1]}) = 202
futex(0x2cdc340, FUTEX_WAIT_PRIVATE, 0, NULL) = ? ERESTARTSYS (To be
restarted if SA_RESTART is set)
--- SIGTERM {si_signo=SIGTERM, si_code=SI_USER, si_pid=4392, si_uid=1000}
---
rt_sigprocmask(SIG_UNBLOCK, [TERM], NULL, 8) = 0
gettid()                                = 4361
tkill(4361, SIGTERM)                    = 0
--- SIGTERM {si_signo=SIGTERM, si_code=SI_TKILL, si_pid=4361, si_uid=1000}
---
rt_sigaction(SIGTERM, {sa_handler=SIG_DFL, sa_mask=~[RTMIN RT_1 RT_2],
sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO,
sa_restorer=0x14b7849}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [TERM], NULL, 8) = 0
gettid()                                = 4361
tkill(4361, SIGTERM)                    = 0
--- SIGTERM {si_signo=SIGTERM, si_code=SI_TKILL, si_pid=4361, si_uid=1000}
---
+++ killed by SIGTERM +++

Hope this will be helpful

Regards,

Nedim

On Tue, Sep 25, 2018 at 6:39 PM Rich Felker <dalias@libc.org> wrote:

> On Tue, Sep 25, 2018 at 05:36:05PM +0200, Szabolcs Nagy wrote:
> > * Rabbitstack <rabbitstack7@gmail.com> [2018-09-25 16:54:37 +0200]:
> > > Sorry. Let me describe the problem in more detail.
> > >
> > > The process only hangs when launched without root privileges on the
> host
> > > (Arch Linux x64 with kernel 4.17.5-1) where Alpine docker container is
> > > running. Once with root privileges, it starts up correctly (but this is
> > > obvious since it doesn't hit setrlimit call). The odd side is that on
> other
> > > hosts it hangs even when started with root. No error messages so far.
> > > Strace output:
> > >
> > > $ sudo strace -p 9285
> > >
> > > futex(0x2cddfc0, FUTEX_WAIT_PRIVATE, 0, NULL
> > >
> > > $ sudo strace -f -p 9285
> > >
> > > .....
> > > [pid  9287] getdents64(10, /* 14 entries */, 2048) = 336
> > > [pid  9287] tgkill(9285, 9285, SIGRT_2) = 0
> > > [pid  9287] futex(0x7efbff70008c, FUTEX_LOCK_PI_PRIVATE,
> > > {tv_sec=1537887068, tv_nsec=51442144}) = -1 ETIMEDOUT (Connection
> timed out)
> >
> > it looks like musl tries to sync a setuid call across
> > all threads (which is necessary since the linux syscall
> > only changes the uid for the current thread instead of
> > all threads so you can end up with different privileges
> > in the same address space which is dangerous as well as
> > non-posix conform setuid behaviour)
> >
> > it's possible that the setuid syncing is somehow wrong
> > in musl, but it's more likely that there are threads
> > that are not created by the c runtime (but from go) and
> > thus the sync cannot possibly work.
>
> It actually can kinda work with such threads. musl's stop-the-world
> __synccall pokes all kernel-level threads in the same process (thread
> group) as the caller using signals and /proc/self/task to ensure it
> didn't miss any, so it will work as long as they haven't blocked
> libc-internal signals. There may be problems with the thread pointer
> being invalid, though. The __synccall framework itself does not use
> the TCB, but other stuff in the callback might. This should probably
> be fixed.
>
> > so try to look for where set*id is called and ensure it
> > is not called or called before any threads are created
> > (or at least before any go threads are created)
> >
> > note that syscall.Set*id from go does not work either,
> > it does not sync the threads (which is dangerously
> > broken for a runtime that's always multi-threaded).
>
> Yep, that's unsafe to use. Any use is likely exploitable.
>
> Rich
>

[-- Attachment #2: Type: text/html, Size: 54170 bytes --]

Re: setrlimit hangs the process

[Rich Felker]

On Thu, Oct 04, 2018 at 04:54:43PM +0200, Rabbitstack wrote:
> Hi,
> 
> Sorry for the delay. I managed to build a minimal example that only uses
> gobpf to load ebpf program into the kernel. Surprisingly, it works fine (it
> doesn't hang the process). Here I attach the full strace output:

The only strace that's going to be helpful is one where it's hanging
due to setrlimit, and strace needs to be run with -f or you only see
the main thread's activity.

Rich

Re: setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1: Type: text/plain, Size: 716 bytes --]

Please use the following link to download strace since  daemon is refusing
to deliver the mail.

https://www.dropbox.com/s/syhbzxvijf7s4v1/agent.strace?dl=0


On Thu, Oct 4, 2018 at 5:04 PM Rich Felker <dalias@libc.org> wrote:

> On Thu, Oct 04, 2018 at 04:54:43PM +0200, Rabbitstack wrote:
> > Hi,
> >
> > Sorry for the delay. I managed to build a minimal example that only uses
> > gobpf to load ebpf program into the kernel. Surprisingly, it works fine
> (it
> > doesn't hang the process). Here I attach the full strace output:
>
> The only strace that's going to be helpful is one where it's hanging
> due to setrlimit, and strace needs to be run with -f or you only see
> the main thread's activity.
>
> Rich
>

[-- Attachment #2: Type: text/html, Size: 1157 bytes --]

Re: setrlimit hangs the process

[Rich Felker]

On Thu, Oct 04, 2018 at 05:41:52PM +0200, Rabbitstack wrote:
> Please use the following link to download strace since  daemon is refusing
> to deliver the mail.
> 
> https://www.dropbox.com/s/syhbzxvijf7s4v1/agent.strace?dl=0

Here is the bug:

6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>

Apparently Go has its own version of sigfillset, rather than calling
the libc one, and it's hard-coded the glibc values for which signals
are reserved for the implementation (just RTMIN and RT_1) rather than
honoring SIGRTMIN (which resolves at runtime via a function call),
which would exempt RT_2 from being blocked too.

It needs to be fixed on the Go side. I'll look at it later if nobody
else more familiar with Go gets to it sooner.

Rich

Re: setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

Thanks Rich for the quick feedback. Let me know if you need any help.

Regards,

Nedim

On Thu, Oct 4, 2018 at 5:53 PM Rich Felker <dalias@libc.org> wrote:

> On Thu, Oct 04, 2018 at 05:41:52PM +0200, Rabbitstack wrote:
> > Please use the following link to download strace since  daemon is
> refusing
> > to deliver the mail.
> >
> > https://www.dropbox.com/s/syhbzxvijf7s4v1/agent.strace?dl=0
>
> Here is the bug:
>
> 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE
> SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>
>
> Apparently Go has its own version of sigfillset, rather than calling
> the libc one, and it's hard-coded the glibc values for which signals
> are reserved for the implementation (just RTMIN and RT_1) rather than
> honoring SIGRTMIN (which resolves at runtime via a function call),
> which would exempt RT_2 from being blocked too.
>
> It needs to be fixed on the Go side. I'll look at it later if nobody
> else more familiar with Go gets to it sooner.
>
> Rich
>

[-- Attachment #2: Type: text/html, Size: 1517 bytes --]

Re: setrlimit hangs the process

[Rich Felker]

On Thu, Oct 04, 2018 at 11:53:02AM -0400, Rich Felker wrote:
> On Thu, Oct 04, 2018 at 05:41:52PM +0200, Rabbitstack wrote:
> > Please use the following link to download strace since  daemon is refusing
> > to deliver the mail.
> > 
> > https://www.dropbox.com/s/syhbzxvijf7s4v1/agent.strace?dl=0
> 
> Here is the bug:
> 
> 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>
> 
> Apparently Go has its own version of sigfillset, rather than calling
> the libc one, and it's hard-coded the glibc values for which signals
> are reserved for the implementation (just RTMIN and RT_1) rather than
> honoring SIGRTMIN (which resolves at runtime via a function call),
> which would exempt RT_2 from being blocked too.
> 
> It needs to be fixed on the Go side. I'll look at it later if nobody
> else more familiar with Go gets to it sooner.

If these are the right source files:

https://golang.org/src/runtime/os_linux_generic.go#L33
https://golang.org/src/runtime/sys_linux_amd64.s#L290

Then they're not even making any attempt to avoid stomping on
implementation-internal signals, and there's nothing musl could do to
prevent this. This suggests to me that something in your codebase is
explicitly avoiding RTMIN and RT_1 (33 and 34). Making it also avoid
RT_2 (35) would be a short-term hack you could use to get past this
problem, but there's no guarantee assignments won't change in the
future (this is why SIGRTMIN and SIGRTMAX macros expand to functions
calls). Really if a Go program wants to use libc, it needs to avoid
bypassing libc in ways that change the process state (like signal mask
or disposition).

Rich

Re: setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1: Type: text/plain, Size: 1987 bytes --]

 Should we raise an issue in Go upstream repository since there is nothing
actionable from musl side?

El vie., 5 oct. 2018 2:47, Rich Felker <dalias@libc.org> escribió:

> On Thu, Oct 04, 2018 at 11:53:02AM -0400, Rich Felker wrote:
> > On Thu, Oct 04, 2018 at 05:41:52PM +0200, Rabbitstack wrote:
> > > Please use the following link to download strace since  daemon is
> refusing
> > > to deliver the mail.
> > >
> > > https://www.dropbox.com/s/syhbzxvijf7s4v1/agent.strace?dl=0
> >
> > Here is the bug:
> >
> > 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE
> SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>
> >
> > Apparently Go has its own version of sigfillset, rather than calling
> > the libc one, and it's hard-coded the glibc values for which signals
> > are reserved for the implementation (just RTMIN and RT_1) rather than
> > honoring SIGRTMIN (which resolves at runtime via a function call),
> > which would exempt RT_2 from being blocked too.
> >
> > It needs to be fixed on the Go side. I'll look at it later if nobody
> > else more familiar with Go gets to it sooner.
>
> If these are the right source files:
>
> https://golang.org/src/runtime/os_linux_generic.go#L33
> https://golang.org/src/runtime/sys_linux_amd64.s#L290
>
> Then they're not even making any attempt to avoid stomping on
> implementation-internal signals, and there's nothing musl could do to
> prevent this. This suggests to me that something in your codebase is
> explicitly avoiding RTMIN and RT_1 (33 and 34). Making it also avoid
> RT_2 (35) would be a short-term hack you could use to get past this
> problem, but there's no guarantee assignments won't change in the
> future (this is why SIGRTMIN and SIGRTMAX macros expand to functions
> calls). Really if a Go program wants to use libc, it needs to avoid
> bypassing libc in ways that change the process state (like signal mask
> or disposition).
>
> Rich
>

[-- Attachment #2: Type: text/html, Size: 2739 bytes --]

Re: setrlimit hangs the process

[Rich Felker]

On Tue, Oct 09, 2018 at 09:37:06PM +0200, Rabbitstack wrote:
>  Should we raise an issue in Go upstream repository since there is nothing
> actionable from musl side?

Yes, I think so.

Rich


> El vie., 5 oct. 2018 2:47, Rich Felker <dalias@libc.org> escribió:
> 
> > On Thu, Oct 04, 2018 at 11:53:02AM -0400, Rich Felker wrote:
> > > On Thu, Oct 04, 2018 at 05:41:52PM +0200, Rabbitstack wrote:
> > > > Please use the following link to download strace since  daemon is
> > refusing
> > > > to deliver the mail.
> > > >
> > > > https://www.dropbox.com/s/syhbzxvijf7s4v1/agent.strace?dl=0
> > >
> > > Here is the bug:
> > >
> > > 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE
> > SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>
> > >
> > > Apparently Go has its own version of sigfillset, rather than calling
> > > the libc one, and it's hard-coded the glibc values for which signals
> > > are reserved for the implementation (just RTMIN and RT_1) rather than
> > > honoring SIGRTMIN (which resolves at runtime via a function call),
> > > which would exempt RT_2 from being blocked too.
> > >
> > > It needs to be fixed on the Go side. I'll look at it later if nobody
> > > else more familiar with Go gets to it sooner.
> >
> > If these are the right source files:
> >
> > https://golang.org/src/runtime/os_linux_generic.go#L33
> > https://golang.org/src/runtime/sys_linux_amd64.s#L290
> >
> > Then they're not even making any attempt to avoid stomping on
> > implementation-internal signals, and there's nothing musl could do to
> > prevent this. This suggests to me that something in your codebase is
> > explicitly avoiding RTMIN and RT_1 (33 and 34). Making it also avoid
> > RT_2 (35) would be a short-term hack you could use to get past this
> > problem, but there's no guarantee assignments won't change in the
> > future (this is why SIGRTMIN and SIGRTMAX macros expand to functions
> > calls). Really if a Go program wants to use libc, it needs to avoid
> > bypassing libc in ways that change the process state (like signal mask
> > or disposition).
> >
> > Rich
> >

Re: setrlimit hangs the process

[Szabolcs Nagy]

* Rabbitstack <rabbitstack7@gmail.com> [2018-10-09 21:37:06 +0200]:
>  Should we raise an issue in Go upstream repository since there is nothing
> actionable from musl side?
> 

have you figured out where the siprocmask came from?
it might not be the go runtime but some c lib that you linked in.

> El vie., 5 oct. 2018 2:47, Rich Felker <dalias@libc.org> escribió:
> > >
> > > Here is the bug:
> > >
> > > 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE
> > SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>

the go runtime should not make this call, it probably comes from
somewhere else.

i think you should try to create a minimal reproducer go code
that makes this syscall.

Re: setrlimit hangs the process

[Rich Felker]

On Tue, Oct 09, 2018 at 10:36:41PM +0200, Szabolcs Nagy wrote:
> * Rabbitstack <rabbitstack7@gmail.com> [2018-10-09 21:37:06 +0200]:
> >  Should we raise an issue in Go upstream repository since there is nothing
> > actionable from musl side?
> > 
> 
> have you figured out where the siprocmask came from?
> it might not be the go runtime but some c lib that you linked in.

Well the sigset_t was created in Go code or via some other code that
bypasses libc. The libc functions cannot create a sigset_t with the
implementation-internal signals masked.

> > El vie., 5 oct. 2018 2:47, Rich Felker <dalias@libc.org> escribió:
> > > >
> > > > Here is the bug:
> > > >
> > > > 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS FPE
> > > SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>
> 
> the go runtime should not make this call, it probably comes from
> somewhere else.
> 
> i think you should try to create a minimal reproducer go code
> that makes this syscall.

I looked at the Go implementations of the functions for sigset_t
manipulation and sigprocmask. They all bypass libc. So either it's an
error to use them at all in programs that link with libc, or a bug in
Go that they don't respect SIGRTMIN, etc.

Rich

Re: setrlimit hangs the process

[Rabbitstack]

[-- Attachment #1.1: Type: text/plain, Size: 2626 bytes --]

Hi

I managed to reproduce the problem with minimal code snippet and can
confirm it's definitely the Go stdlib signal handler that messes things up.
Here's the code:

package main

import (

   bpflib "github.com/iovisor/gobpf/elf"
   "os/signal"
   "os"
   "fmt"
)

func main() {
   sig := make(chan os.Signal)
   signal.Notify(sig, os.Kill, os.Interrupt)

   mod := bpflib.NewModule("/tmp/sched.o")
   fmt.Println("loading ebpf module")
   err := mod.Load(nil)
   if err != nil {
      panic(err)
   }
   err = mod.EnableKprobes(50)
   if err != nil {
      panic(err)
   }
   fmt.Println("loaded ebpf module")
   rxChan := make(chan []byte)
   lostChan := make(chan uint64)

   pmap, err := bpflib.InitPerfMap(
      mod,
      "sched",
      rxChan,
      lostChan,
   )

   if err != nil {
      panic(err)
   }

   go func() {
      for {
         select {
         case pe := <-rxChan:
            fmt.Println(pe)
         case l := <-lostChan:
            fmt.Println(l)
         }
      }
   }()
   pmap.PollStart()
   fmt.Println("listening on ebpf map")
   <-sig
}

The main thread hangs right after the call to module constructor.


On Tue, Oct 9, 2018 at 10:40 PM Rich Felker <dalias@libc.org> wrote:

> On Tue, Oct 09, 2018 at 10:36:41PM +0200, Szabolcs Nagy wrote:
> > * Rabbitstack <rabbitstack7@gmail.com> [2018-10-09 21:37:06 +0200]:
> > >  Should we raise an issue in Go upstream repository since there is
> nothing
> > > actionable from musl side?
> > >
> >
> > have you figured out where the siprocmask came from?
> > it might not be the go runtime but some c lib that you linked in.
>
> Well the sigset_t was created in Go code or via some other code that
> bypasses libc. The libc functions cannot create a sigset_t with the
> implementation-internal signals masked.
>
> > > El vie., 5 oct. 2018 2:47, Rich Felker <dalias@libc.org> escribió:
> > > > >
> > > > > Here is the bug:
> > > > >
> > > > > 6208  rt_sigprocmask(SIG_SETMASK, ~[HUP INT QUIT ILL TRAP ABRT BUS
> FPE
> > > > SEGV TERM STKFLT CHLD PROF SYS RTMIN RT_1],  <unfinished ...>
> >
> > the go runtime should not make this call, it probably comes from
> > somewhere else.
> >
> > i think you should try to create a minimal reproducer go code
> > that makes this syscall.
>
> I looked at the Go implementations of the functions for sigset_t
> manipulation and sigprocmask. They all bypass libc. So either it's an
> error to use them at all in programs that link with libc, or a bug in
> Go that they don't respect SIGRTMIN, etc.
>
> Rich
>

[-- Attachment #1.2: Type: text/html, Size: 5086 bytes --]

[-- Attachment #2: sched.o --]
[-- Type: application/octet-stream, Size: 7560 bytes --]