ELF>1@@8 @@@@  000}F}F""888HHH888PPDDStd888PPPtdQtdRtd888/lib64/ld-linux-x86-64.so.2@GNUGNU׺"?8:mb=xGNU[ D,[\]^_`abcda93/l YHKQC*CfeU8 8@HY%M* ?{ Y _Cp;$, #QF"hy-l{@ (&g_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable__cxa_finalize__libc_start_main_audit_syscalladded_audit_permadded_audit_archadded_audit_exeadded_audit_filterfsadded_audit_elfaudit_rule_free_dataaudit_rule_create_dataaudit_openaudit_msgstrcmpstrdupstrtok_raudit_rule_syscallbyname_datafree__stack_chk_fail__fdelt_chkstrcasecmpaudit_request_status__errno_locationselectaudit_get_replykillstrerrorstrchr__asprintf_chkstrstraudit_is_enabledmallocmemcpy__printf_chkaudit_closeaudit_flag_to_nameaudit_action_to_nameaudit_elf_to_machineaudit_operator_to_symbolaudit_detect_machineaudit_syscall_to_nameputsaudit_field_to_nameputcharaudit_errno_to_nameaudit_fstype_to_nameaudit_msg_type_to_nameaudit_machine_to_name__strcat_chk__snprintf_chkauparse_interp_adjust_typeauparse_do_interpretationset_aumessage_modeaudit_add_rule_dataaudit_delete_rule_dataexitaudit_request_rules_list_dataaudit_sendstrlen__xpg_basenameaudit_add_watch_diroptindopterrgetopt_longaudit_set_loginuid_immutableoptarg__ctype_b_locstrtoulaudit_set_backlog_wait_timeaudit_rule_fieldpair_data__ctype_tolower_locaudit_update_watch_permsaudit_set_rate_limitaudit_request_featuresaudit_trim_subtrees__strncat_chkaudit_set_enabledaudit_set_failureaudit_rule_interfield_comp_datastrncmpaudit_reset_lostaudit_number_to_errmsgaudit_reset_backlog_wait_time_actualaudit_machine_to_elfaudit_set_backlog_limitstderrfwriteaudit_make_equivalentaudit_log_user_messagefstatfdopenfgets_unlockedfcloseaudit_can_controlgeteuidlibaudit.so.1libauparse.so.0libc.so.6GLIBC_2.3GLIBC_2.14GLIBC_2.33GLIBC_2.8GLIBC_2.15GLIBC_2.4GLIBC_2.34GLIBC_2.2.5GLIBC_2.3.4   Pii Z doii zii ui ti 82@2 =@P`b08@HPX`hp x    Ƚнؽ ( 0!8"@#H$P%X&`'h(p)x*+,-./0123Ⱦ4о5ؾ6789:;<=> ?(@0A8B@CHDPEXF`GhHpIxJKLMNOPQRSȿTпUؿVWXYZc][_bd^ `(a@\HHHtHAUI1ATU1PjumMeH5jL&t}H5jLtiH5jL6XuGH5b1AŽ/t׃uI}H5mjAąucL1-)Ńt:=u =t Aąt AH=mD]A\A]H=WA1C AątI}?H=uD%AH=NPArf.1I^HHPTE11H=!kf.H=ɎHŽH9tH^Ht H=H5H)HH?HHHtHHtfD=u3UH=2Ht H=f c]f.ff.@gHH=Ïߍ ōߍӌŌ[MɉH2x1Hfty1H5_LDUHSHH5_HuH[]fDH5_HuH[]H5_HXt,H5_HDu(dfDH[]H5O_Hu\fIfDUH5!_HωuU]H5_Hu.]HH5^]AWAVAHAUATUSHHD-dH%(H$81AA>uAX2IHuHl$HY^HHHL|$ ƈLH1HHt L_HH1HHuH ҌHD$4HT$,H3AH3Q H ucHD$DHT$[LH5+[LH5[LAH$#AAAH$#x tRDAj-$A8NH5_GH1A H5Z1AͅA LH5HtH[]A\A]fHtX,A<$t;LuA<$t1=tH[]A\A]LL}LHmt,mAWAVAUATUSH(dH%(HD$1GI1E1Ll$L%bY2@P A IHA9_A %=u1A LLO7kH|$H5H|$H|$Hun|pwhniHVHA9_a1HT$dH+%(u'H([]A\A]A^A_19fH=FtIA8otH1H5)Dn11H5WV1fAUIATIUSHHHMt&LHHtLLH:HIH;LeLmHEtHCHhHkCH[]A\A]H+ff.AWAVAUATUSHH $HH $HhE1L5xdH%(H$X$1H$Hl$@HL$ HHc= EH"IHHJ ĠHD$@HD$H@~=|8Au11IH1xDV1ɺLD[D$ AH$P$8 H5XHH$P$1@H$X$dH+%(Hh$[]A\A]A^A_AA(tDDvDoA@AH$(DH5W1GPAtgAuH$P$@t@ HkTH fTHDʋPH5SW1~@A/if=9H$P$?tHtH$P$ LH|ʀD[AH$P$ D@DH H jSAt"H dSAtEH ZSH?SHDHXSAt"HSSAtEH+SH,SHDH5U1}HH$X$H5?DHD@HP @P1}XZH$P$H5UP$1}$$<0H$P$H5UP(1X} D|HjHkHf.H(DEDMEr L AP1LHft iuUHH9tсjuHH9uDȃD$Dȃ  DD{}I|LH5QH1Q|E D$(E1L-QHQID9uB % uF F DD%}AxzD$(/~D%}DEzILH1{D9usDyD$AƋEÃ\$,bD$,KHE HfHH9z 8t11L%OE1L-P@LDH5+Q1zDAADD#D tً=|uGExDDyHt_LHtL1zH=Ox yADH5P1DzHR;H$H5O1 zH $HtHR|t$,\$D$DEL EOHD$1MHD$ HD$mDHD$DLL $xL $ELHH5UO1|yA$HD$I;]A$ tE$$wAxIH$E$ B Cpef wH *UHcH>DwEHLH5uN1Ix;]Jf. vHzHtH@HzHUHzHt(fHH[H}ovHfvHuHfzHczaz,Lt$D1H5MJ5wA$ILt$sAiH>TJcH>HD$DT$DHEH5M1wA$HD$Ƅ$L$AAvAOA(DD$LEH5KM1wDAH{wE$IEHDuMLHH5N1v[HD$D\$DHEH5L1vDuELHH5L1fvfDMvH5A$6vfDIDuMLHH5K1uf.pDHED$HD$|$w=x$DtELHH5PM1yu @HD$H|$8DH,KL1tH|$8Lt$PL-SA$HD$LLL=K:tHH;$\$/DL1tLL1tHHuH5J1t̃ DA5vsLH5SLH1`tE$DOsA$H5-LHE1)t@DrHtA$|rE$DrHE[D$,D$D$($H|$8qCH5}I1sADȃ1HE H8HH9uD$D$,D$(D$2D(rDH޿H1 sD$DrD$H#|$(JsDH$qH $H5iHH1rqH50HH1rkH5H1rD$,D$D$(D$nDDH5^J1;r^HD$81HD$ hLߺH5*HpILߺH5#LoILߺH5GoImArfD$OH5>J1qD$?D$,D$(D$,EL$LK L$LߺD$TD$( Lt$pD$PHD$ HD$hHD$XHD$HD$`19oL$LLL\$x/qHt$P pDIoMLHH5F1pLnNDoH5FH1p)DoH5FH1qpDkoH5FH1LpDFoH5FH1'pD!oH5FH1pDnH5FH1opDnH5oFH1oKDnH5\FH1o&DnH5JFH1noDhnH58FH1IoDCnH5!FH1$oDnH5 FH1nDmH5EH1nmDmH5EH1nHDmH5EH1n#DmH5EH1knDemH5EH1FnD@mH5EH1!nDmH5qEH1mDlH5\EH1mjDlH5EEH1mEDlH5/EH1m DlH5EH1hmDblH5EH1CmD=lH5DH1mkff.ATu:D%nE:uwpmDA\m=t =On1kH5o=_m ]m_m5m11AkEEoAEA܅T=mk@E1#ADl=t=mtH=OoH5`Dj1kH5.o=l llk11AjE1iHDH5.1AkSitSHCuWH5-1AMkH=qnH5CiNH5Qn kt}DEkHH5nC1AjDkH&H5m kudž i QkOk=Ak{jAdž i 'k)k=kjAH=,h=ji5jDAWAVAUATUSHH $HH $HdH%(H$#1AKiD$gH\$@1E1HEfHl$HIcL$`hDD$0HD$ IHD$(HJ D@HD$ HD$fHD$HD$@jg8u11IHDhx1ɺLDg~_H$t$9pu>$tP=u"=+kH$#AUDAA(BH\$ H\$(HtbHfDH@HD$(Ht*HHDVhHD$(Hu@HH[H}?fH6fHu1H$#dH+%(H$[]A\A]A^A_fDH$#.؉DhH5u4H1gH$# HH|$Ht؉gH5=@H1gEffD/ff.ATIUSHdH%(H$1eH=MA<$/tF1H5?"gH$dH+%(HĠ[]A\f.LgHH#fHJeHHdH9H5w?LgHtH531f*LeHH531efLdHvA|/HPLHbeiuD$1%=@@Ǎ|?iLH5Gief1H52ef?LRdH@O@It$DA|/HHu@fD1H5?2leEcff.AWL=eAVL5f8AUATE1UHSHXt$(dH%(HD$H1HD$HcfH9~HTD$( H5?1`d=d:ce890=\ftlg4b8o AHD$HdH+%(JHXD[]A\A]A^A_L-jeMgKdIUHDPNa1L1ItcA<$ƅV=(d"cmf.= d cuedaet=9 =aeAH531c=,e8fAHD$@c= A1H|$@H dHt8aB Ht$@DH=eaE H|$@R`AaGH=cH5bMyD$U=b L-cMH6eLHD$h`Aă 1tGPb11LID HAw E a r HA9wH|$$abD$DDbEH53^g`L_D%M`ALDL^L|\ID)`H57,i  =j^]`_`9t\H5.1l]^"UH=^H0111\=]Q[fAh^9 A@H=Y^Hi01KA11o\=1]\o@]H5]H=_ZY Hx_P jP]A- $ uoHcs]HD8-t1H561[O]xkuɀxuË]HuH=][=1\LD$ L$@Dd$l \= L%\AźH5/5LCY[MD$L\[=[~YDžN HcD$U11LIsWA$m='XU g@xWHD$@H5z21;WfDWЃEAMH5+1AVfH5)1V{D}eT8oH ZXH=[/kVkfD WЃED-VAL%WA@=VH5(@=V!H5'k@LD$LAH5<4SLD$H=XLPTAŃH%WH5K/VDd$E= VH5V|$(f=DHt$@sUH|$@SpH5/1THH5B/@DLH=WSHWP jlp)V2HH5"2HH5%"{U)9 A݋\$, HcyUHD8-H5p"2LH5.1S$i:HcUHDH8-xkxUHuH=UrST9ډT$}+L%TH5)-LSHtHcT$HD8-tjH5#xix UH5a!LH5,1RH|$ Pxtux]H5,H5!LH5~ LH5 LH50%H5"1AAR5H5m"1A"RH5"1ARH|$ OkH5uS'RMS=eRQ%SS H%SH5*H-S,HPH\xL`K,LOH4=QLHO@H5/*1AQH RrHBH]<H5!1APH5R 1APH5kHRH5)H5*H5"H5*H5 1A=P1H5"1APH5"1AOHQH58)zH5@!bH5\VH5(1OH5*1OAH5H5*1H|$@Hb)lN=OE1AQ1jE1HT$PBOAZA[H|$@MP H5!=,Q=7RwDH5z(ANH5B(1AN#MQiLAwH5w(1AfNZ=Q)AgfAWAVAUATUSHH $H1H|$HdH%(H$1MyhKD ADANHڿH5)H1MH$dH+%(HD[]A\A]A^A_ÉHt$ M|$<D$8%=H5(ALH$IHDAELH߉D$ LH HKHtH_K$H$Hʼn@ u@ H tH1@u#@QH2@r@\u@SƄ1HT$H51ILHT$H51A%LJX@ u1Ƅ_LIHMM4$IH4H|$HcH'Aą5Lt$t$ LILnItY2uMI8o&1HL$T$ H5QK=jM=YMAfDHMIH8#tùH1HxAHfJHHD$H{&HHLLgH/LgA~|$HHL(IH9l$LJHHv\HL!f.t+HQ9HuH DH\DLE1LH/HT$H5cGA8 JHT$H5%H1IvHHT$H5%XKQH|$AHGLGLAGH514ILGf(G8XIH5$HGHHCannot open netlink audit socketWARNING - 32/64 bit syscall mismatch in line %d, you should specify an archWARNING - 32/64 bit syscall mismatch, you should specify an archFailed sending signal to auditd (%s)Failed sending signal to auditd (timeout)The audit system is in immutable mode, no rule changes allowedpid %u rate_limit %u backlog_limit %u lost %u backlog %u Error sending add rule data request (%s)Error sending delete rule data request (%s)usage: auditctl [options] -a Append rule to end of ist with ction -A Add rule at beginning of ist with ction -b Set max number of outstanding audit buffers allowed Default=64 -c Continue through errors in rules -C f=f Compare collected fields if available: Field name, operator(=,!=), field name -d Delete rule from ist with ction l=task,exit,user,exclude,filesystem a=never,always -D Delete all rules and watches -e [0..2] Set enabled flag -f [0..2] Set failure flag 0=silent 1=printk 2=panic -F f=v Build rule: field name, operator(=,!=,<,>,<=, >=,&,&=) value -h Help -i Ignore errors when reading rules from file -k Set filter key on audit rule -l List rules -m text Send a user-space message -p [r|w|x|a] Set permissions filter on watch r=read, w=write, x=execute, a=attribute -q make subtree part of mount point's dir watches -r Set limit in messages/sec (0=none) -R read rules from file -s Report status -S syscall Build rule: syscall name or number --signal Send the specified signal to the daemon -t Trim directory watches -v Version -w Insert watch at -W Remove watch at --loginuid-immutable Make loginuids unchangeable once set --backlog_wait_time Set the kernel backlog_wait_time --reset-lost Reset the lost record counter --reset_backlog_wait_time_actual Reset the actual backlog wait time counterError receiving rules list (%s)The path passed for the watch is too bigThe base name of the path is too bigWarning - relative path notation is not supportedWarning - wildcard notation is not supportedparameter passed without an option givenToo many options for status commandEnable must be 0, 1, or 2 was %sFailure must be 0, 1, or 2 was %sRate must be a numeric value was %sBacklog must be a numeric value was %sWrong number of options for list requestOnly -k or -i options are allowedSyscall auditing requested for task listMultiple rule insert/delete operations are not allowed Append rule - possible is deprecatedError: syscall auditing requested for task listMultiple rule insert/delete operations are not allowedDelete rule - possible is deprecatedError: syscall auditing being added to task listError: syscall auditing being added to user listError: syscall auditing being added to filesystem listError: syscall auditing cannot be put on exclude listList must be given before fieldThe -m option must be only the only option and takes 1 parameterIllegal character in audit eventError - nested rule files not supportedWrong number of options for Delete all requestwatch option can't be given with a syscallkey option needs a watch or syscall given prior to itpermission option needs a watch given prior to itpermission option needs a filterSyscall auditing requested for make equivalentError parsing equivalent partsError converting backlog_wait_timeBacklog_wait_time must be a numeric value was %sOption %s on line %d is invalidhicslDvtC:e:f:r:b:a:A:d:S:F:m:R:w:W:k:p:q:audit rules file %s doesn't existError - %s isn't owned by rootError - %s is not a regular fileThere was an error in line %d of %sYou must be root to run this program.reset_backlog_wait_time_actualexittaskuserexcludefilesystemalwaysneverpossible,TERMHUPUSR1USR2CONT%s is an unsupported signalThe audit system is disabledAuditd is not runningsilentprintkpanicunknowndisableenabledenabled+immutableunlockedNo rules-a %s,%s -F arch%s0x%X -F arch%sb64 -F arch%sb32 -F arch%s%s -S -F %s%s%d -F %s%s%s -F %s%s%.*s-w %.*s -F path=%.*s -F dir=%.*s -F exe=%.*s -k %s -F key=%swa -p %s -F perm=%s -F %s%s%u -C uid%sobj_uid -C gid%sobj_gid -C euid%sobj_uid -C egid%sobj_gid -C auid%sobj_uid -C suid%sobj_uid -C sgid%sobj_gid -C fsuid%sobj_uid -C fsgid%sobj_gid -C uid%sauid -C uid%seuid -C uid%sfsuid -C uid%ssuid -C auid%sfsuid -C auid%ssuid -C auid%seuid -C euid%ssuid -C euid%sfsuid -C suid%sfsuid -C gid%segid -C gid%sfsgid -C gid%ssgid -C egid%sfsgid -C egid%ssgid -C sgid%sfsgid -F %s%s0x%X -F %s%s-%s -F %s%sunset f%d%s%denabled %s failure %s enabled %u failure %u backlog_wait_time %u backlog_wait_time_actual %u loginuid_immutable %u %s Unknown: type=%d, len=%d -S allNLMSG_ERROR %d (%s) Rule existsError - no list specifiedError deleting rule (%s)The path must start with '/'..Only -i option is allowedThe audit system is disabled Error converting rateError converting backlogAppend rule - bad keyword %sAdd rule - bad keyword %sDelete rule - bad keyword %sError detecting machine typeError looking up elf type %dSyscall name unknown: %sElf type unknown: 0x%xarch=key=text=%sCan't create user eventOnly the -k option is allowedwatch option needs a pathkey option needs a valuekey option exceeds size limitkey %s has illegal characterpermission %s is too longPermission %c isn't supported3.0.8auditctl version %s lost: %ubacklog_wait_time_actual: %uOption %s is invalidOut of memory adding keyError opening %s (%s)Error fstat'ing %s (%s)Error - %s is world writablermError - fdopen failed (%s)auditctl--help-h-l-Rloginuid-immutablebacklog_wait_timereset-lost,<ݫ$ֲ Ejٳ#Hmܴ&Kpߵ)NԾRԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾԾOԾԾԾԾԾԾԾԾԾԾԾԾAԾԾԾԾԾԾԾԾԾԾԾԾ Ծ0QԾo~LԾԾG zԾ;8ؕ0(X(xt؞8ȟ8H8(HzRx 8&D4 D J @PADN T AAG ^ AAH J AAD $mA_ H _ I QLȕBBH B(A0A8G n 8A0A(B BBBA L hBBB A(A0G L@LHr 0D(A BBBA \(`BC K OX|h_BI D(D0n (A ABBJ B(A ABBHH0HWBBB B(A0A8D`  8A0A(B BBBH $^Di A 8@TBED A(L0^ (A ABBD d|eBBB B(A0A8G L@LI 8A0A(B BBBH IfIIIAI Bv H TBBB B(A0A8G L@LH 8A0A(B BBBG 0XBDA Gc  AABK \BII B(D0D8F= 8D0A(B BBBA DUBL=BBB B(A0A8G L2 8D0A(B BBBA ,<XFGA  BBA 222@P 0 pv8@o H   ooHoo|oH=PbGCC: (GNU) 11.2.0auditctl.debug٧:.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.init.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.got.data.bss.comment.gnu_debuglink 88P&$9 GoxQ HHx Y ao||noHH} 00 0 0MFpvpv l88@@HH  0