./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2397948005 <...> Warning: Permanently added '10.128.0.57' (ED25519) to the list of known hosts. execve("./syz-executor2397948005", ["./syz-executor2397948005"], 0x7ffc9ee04f50 /* 10 vars */) = 0 brk(NULL) = 0x55558bb4e000 brk(0x55558bb4ed00) = 0x55558bb4ed00 arch_prctl(ARCH_SET_FS, 0x55558bb4e380) = 0 set_tid_address(0x55558bb4e650) = 5816 set_robust_list(0x55558bb4e660, 24) = 0 rseq(0x55558bb4eca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2397948005", 4096) = 28 getrandom("\x05\x59\x74\x2f\xa1\x24\x54\x6a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558bb4ed00 brk(0x55558bb6fd00) = 0x55558bb6fd00 brk(0x55558bb70000) = 0x55558bb70000 mprotect(0x7f09d0db4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558bb4e650) = 5817 ./strace-static-x86_64: Process 5817 attached [pid 5816] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5817] set_robust_list(0x55558bb4e660, 24./strace-static-x86_64: Process 5818 attached ) = 0 [pid 5816] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5818 [pid 5816] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5818] set_robust_list(0x55558bb4e660, 24./strace-static-x86_64: Process 5819 attached ) = 0 [pid 5817] mkdir("./syzkaller.r7QBoJ", 0700 [pid 5819] set_robust_list(0x55558bb4e660, 24) = 0 [pid 5818] mkdir("./syzkaller.wVFGsy", 0700 [pid 5816] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5819 [pid 5819] mkdir("./syzkaller.ZPEX9M", 0700 [pid 5818] <... mkdir resumed>) = 0 [pid 5817] <... mkdir resumed>) = 0 [ 56.442308][ T29] audit: type=1400 audit(1733488804.522:88): avc: denied { execmem } for pid=5816 comm="syz-executor239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5816] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5820 attached [pid 5819] <... mkdir resumed>) = 0 [pid 5817] chmod("./syzkaller.r7QBoJ", 0777 [pid 5818] chmod("./syzkaller.wVFGsy", 0777 [pid 5820] set_robust_list(0x55558bb4e660, 24 [pid 5819] chmod("./syzkaller.ZPEX9M", 0777 [pid 5818] <... chmod resumed>) = 0 [pid 5817] <... chmod resumed>) = 0 [pid 5820] <... set_robust_list resumed>) = 0 [pid 5817] chdir("./syzkaller.r7QBoJ") = 0 [pid 5818] chdir("./syzkaller.wVFGsy" [pid 5817] unshare(CLONE_NEWPID [pid 5816] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5820 [pid 5820] mkdir("./syzkaller.IEA8qz", 0700 [pid 5819] <... chmod resumed>) = 0 [pid 5818] <... chdir resumed>) = 0 [pid 5817] <... unshare resumed>) = 0 [pid 5816] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5819] chdir("./syzkaller.ZPEX9M" [pid 5818] unshare(CLONE_NEWPID [pid 5819] <... chdir resumed>) = 0 [pid 5818] <... unshare resumed>) = 0 [pid 5820] <... mkdir resumed>) = 0 [pid 5819] unshare(CLONE_NEWPID [pid 5818] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5821 attached [pid 5821] set_robust_list(0x55558bb4e660, 24 [pid 5820] chmod("./syzkaller.IEA8qz", 0777 [pid 5819] <... unshare resumed>) = 0 [pid 5817] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5822 attached [pid 5821] <... set_robust_list resumed>) = 0 [pid 5819] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5823 attached [pid 5816] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5821 [pid 5818] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5822 [pid 5823] set_robust_list(0x55558bb4e660, 24 [pid 5821] mkdir("./syzkaller.9WUa5P", 0700./strace-static-x86_64: Process 5824 attached [pid 5823] <... set_robust_list resumed>) = 0 [pid 5823] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5822] set_robust_list(0x55558bb4e660, 24 [pid 5820] <... chmod resumed>) = 0 [pid 5824] set_robust_list(0x55558bb4e660, 24 [pid 5822] <... set_robust_list resumed>) = 0 [pid 5820] chdir("./syzkaller.IEA8qz" [pid 5824] <... set_robust_list resumed>) = 0 [pid 5819] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5823 [pid 5817] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5824 [pid 5824] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5823] <... prctl resumed>) = 0 [pid 5822] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5820] <... chdir resumed>) = 0 [pid 5823] getppid() = 0 [pid 5823] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5824] <... prctl resumed>) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5821] <... mkdir resumed>) = 0 [pid 5824] getppid( [pid 5822] <... prctl resumed>) = 0 [pid 5820] unshare(CLONE_NEWPID [pid 5824] <... getppid resumed>) = 0 [pid 5823] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5822] getppid( [pid 5821] chmod("./syzkaller.9WUa5P", 0777 [pid 5820] <... unshare resumed>) = 0 [pid 5824] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5822] <... getppid resumed>) = 0 [pid 5824] <... prlimit64 resumed>NULL) = 0 [pid 5824] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5822] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5824] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5822] <... prlimit64 resumed>NULL) = 0 [pid 5820] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5824] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5823] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5822] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5821] <... chmod resumed>) = 0 [pid 5824] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5824] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5823] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5824] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 ./strace-static-x86_64: Process 5825 attached [pid 5824] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5823] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5824] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5824] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5823] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5822] <... prlimit64 resumed>NULL) = 0 [pid 5821] chdir("./syzkaller.9WUa5P" [pid 5825] set_robust_list(0x55558bb4e660, 24 [pid 5822] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5825] <... set_robust_list resumed>) = 0 [pid 5821] <... chdir resumed>) = 0 [pid 5822] <... prlimit64 resumed>NULL) = 0 [pid 5824] <... prlimit64 resumed>NULL) = 0 [pid 5823] <... prlimit64 resumed>NULL) = 0 [pid 5822] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5821] unshare(CLONE_NEWPID [pid 5820] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5825 [pid 5824] unshare(CLONE_NEWNS [pid 5823] unshare(CLONE_NEWNS [pid 5825] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5824] <... unshare resumed>) = 0 [pid 5823] <... unshare resumed>) = 0 [pid 5822] <... prlimit64 resumed>NULL) = 0 [pid 5821] <... unshare resumed>) = 0 [pid 5822] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5821] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] <... prctl resumed>) = 0 [pid 5822] <... prlimit64 resumed>NULL) = 0 [pid 5824] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5823] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL./strace-static-x86_64: Process 5826 attached [pid 5825] getppid( [pid 5824] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5822] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5826] set_robust_list(0x55558bb4e660, 24 [pid 5823] unshare(CLONE_NEWIPC [pid 5826] <... set_robust_list resumed>) = 0 [pid 5823] <... unshare resumed>) = 0 [pid 5826] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5824] unshare(CLONE_NEWIPC) = 0 [pid 5826] <... prctl resumed>) = 0 [pid 5825] <... getppid resumed>) = 0 [pid 5823] unshare(CLONE_NEWCGROUP [pid 5822] <... prlimit64 resumed>NULL) = 0 [pid 5821] <... clone resumed>, child_tidptr=0x55558bb4e650) = 5826 [pid 5826] getppid() = 0 [pid 5825] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5824] unshare(CLONE_NEWCGROUP [pid 5823] <... unshare resumed>) = 0 [pid 5822] unshare(CLONE_NEWNS [pid 5826] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5824] <... unshare resumed>) = 0 [pid 5823] unshare(CLONE_NEWUTS [pid 5822] <... unshare resumed>) = 0 [pid 5826] <... prlimit64 resumed>NULL) = 0 [pid 5825] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, [pid 5824] unshare(CLONE_NEWUTS [pid 5823] <... unshare resumed>) = 0 [pid 5826] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5824] <... unshare resumed>) = 0 [pid 5826] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5825] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, [pid 5824] unshare(CLONE_SYSVSEM [pid 5823] unshare(CLONE_SYSVSEM [pid 5826] <... prlimit64 resumed>NULL) = 0 [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5824] <... unshare resumed>) = 0 [pid 5823] <... unshare resumed>) = 0 [pid 5822] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5826] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5825] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5826] <... prlimit64 resumed>NULL) = 0 [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5825] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5824] <... openat resumed>) = 3 [pid 5823] <... openat resumed>) = 3 [pid 5826] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5826] <... prlimit64 resumed>NULL) = 0 [pid 5822] unshare(CLONE_NEWIPC [pid 5826] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5825] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, [pid 5823] write(3, "16777216", 8 [pid 5826] <... prlimit64 resumed>NULL) = 0 [pid 5825] <... prlimit64 resumed>NULL) = 0 [pid 5824] write(3, "16777216", 8 [pid 5822] <... unshare resumed>) = 0 [pid 5826] unshare(CLONE_NEWNS [pid 5825] unshare(CLONE_NEWNS [pid 5824] <... write resumed>) = 8 [pid 5823] <... write resumed>) = 8 [pid 5822] unshare(CLONE_NEWCGROUP [pid 5826] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5824] close(3 [pid 5823] close(3 [pid 5822] <... unshare resumed>) = 0 [pid 5825] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5826] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 5824] <... close resumed>) = 0 [pid 5823] <... close resumed>) = 0 [pid 5822] unshare(CLONE_NEWUTS [pid 5826] <... mount resumed>) = 0 [pid 5825] <... mount resumed>) = 0 [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5822] <... unshare resumed>) = 0 [pid 5826] unshare(CLONE_NEWIPC [pid 5825] unshare(CLONE_NEWIPC [pid 5824] <... openat resumed>) = 3 [pid 5823] <... openat resumed>) = 3 [pid 5822] unshare(CLONE_SYSVSEM [pid 5826] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5822] <... unshare resumed>) = 0 [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5826] unshare(CLONE_NEWCGROUP [pid 5825] unshare(CLONE_NEWCGROUP [pid 5824] write(3, "536870912", 9 [pid 5823] write(3, "536870912", 9 [pid 5826] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5824] <... write resumed>) = 9 [pid 5823] <... write resumed>) = 9 [pid 5822] <... openat resumed>) = 3 [pid 5826] unshare(CLONE_NEWUTS [pid 5825] unshare(CLONE_NEWUTS [pid 5824] close(3 [pid 5826] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5824] <... close resumed>) = 0 [pid 5823] close(3 [pid 5822] write(3, "16777216", 8 [pid 5826] unshare(CLONE_SYSVSEM [pid 5825] unshare(CLONE_SYSVSEM [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5823] <... close resumed>) = 0 [pid 5822] <... write resumed>) = 8 [pid 5826] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5824] <... openat resumed>) = 3 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5822] close(3 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 5822] <... close resumed>) = 0 [pid 5826] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5823] <... openat resumed>) = 3 [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5826] write(3, "16777216", 8 [pid 5825] write(3, "16777216", 8 [pid 5824] write(3, "1024", 4 [pid 5823] write(3, "1024", 4 [pid 5822] <... openat resumed>) = 3 [pid 5826] <... write resumed>) = 8 [pid 5825] <... write resumed>) = 8 [pid 5824] <... write resumed>) = 4 [pid 5823] <... write resumed>) = 4 [pid 5826] close(3 [pid 5825] close(3 [pid 5824] close(3 [pid 5822] write(3, "536870912", 9 [pid 5826] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5824] <... close resumed>) = 0 [pid 5823] close(3 [pid 5822] <... write resumed>) = 9 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5823] <... close resumed>) = 0 [pid 5822] close(3 [pid 5826] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5824] <... openat resumed>) = 3 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5822] <... close resumed>) = 0 [pid 5826] write(3, "536870912", 9) = 9 [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5826] close(3 [pid 5825] write(3, "536870912", 9 [pid 5824] write(3, "8192", 4 [pid 5823] <... openat resumed>) = 3 [pid 5822] <... openat resumed>) = 3 [pid 5826] <... close resumed>) = 0 [pid 5825] <... write resumed>) = 9 [pid 5824] <... write resumed>) = 4 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5825] close(3 [pid 5824] close(3 [pid 5823] write(3, "8192", 4 [pid 5822] write(3, "1024", 4 [pid 5826] <... openat resumed>) = 3 [pid 5825] <... close resumed>) = 0 [pid 5824] <... close resumed>) = 0 [pid 5826] write(3, "1024", 4 [ 56.522164][ T29] audit: type=1400 audit(1733488804.592:89): avc: denied { mounton } for pid=5824 comm="syz-executor239" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5823] <... write resumed>) = 4 [pid 5822] <... write resumed>) = 4 [pid 5826] <... write resumed>) = 4 [pid 5825] <... openat resumed>) = 3 [pid 5824] <... openat resumed>) = 3 [pid 5823] close(3 [pid 5822] close(3 [pid 5826] close(3 [pid 5823] <... close resumed>) = 0 [pid 5826] <... close resumed>) = 0 [pid 5822] <... close resumed>) = 0 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5824] write(3, "1024", 4 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5826] <... openat resumed>) = 3 [pid 5825] write(3, "1024", 4 [pid 5824] <... write resumed>) = 4 [pid 5823] <... openat resumed>) = 3 [pid 5822] <... openat resumed>) = 3 [pid 5824] close(3 [pid 5826] write(3, "8192", 4 [pid 5825] <... write resumed>) = 4 [pid 5824] <... close resumed>) = 0 [pid 5823] write(3, "1024", 4 [pid 5822] write(3, "8192", 4 [pid 5826] <... write resumed>) = 4 [pid 5825] close(3 [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5823] <... write resumed>) = 4 [pid 5822] <... write resumed>) = 4 [pid 5826] close(3 [pid 5825] <... close resumed>) = 0 [pid 5824] <... openat resumed>) = 3 [pid 5823] close(3 [pid 5822] close(3 [pid 5826] <... close resumed>) = 0 [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 5823] <... close resumed>) = 0 [pid 5822] <... close resumed>) = 0 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5825] <... openat resumed>) = 3 [pid 5824] write(3, "1024", 4 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5826] <... openat resumed>) = 3 [pid 5824] <... write resumed>) = 4 [pid 5823] <... openat resumed>) = 3 [pid 5826] write(3, "1024", 4 [pid 5825] write(3, "8192", 4 [pid 5824] close(3 [pid 5822] <... openat resumed>) = 3 [pid 5826] <... write resumed>) = 4 [pid 5825] <... write resumed>) = 4 [pid 5824] <... close resumed>) = 0 [pid 5823] write(3, "1024", 4 [pid 5826] close(3 [pid 5825] close(3 [pid 5824] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5823] <... write resumed>) = 4 [pid 5822] write(3, "1024", 4 [pid 5826] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5824] <... openat resumed>) = 3 [pid 5823] close(3 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 5822] <... write resumed>) = 4 [pid 5823] <... close resumed>) = 0 [pid 5826] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5824] write(3, "1024 1048576 500 1024", 21 [pid 5822] close(3 [pid 5824] <... write resumed>) = 21 [pid 5823] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5822] <... close resumed>) = 0 [pid 5826] write(3, "1024", 4 [pid 5825] write(3, "1024", 4 [pid 5824] close(3 [pid 5823] <... openat resumed>) = 3 [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5826] <... write resumed>) = 4 [pid 5825] <... write resumed>) = 4 [pid 5824] <... close resumed>) = 0 [pid 5822] <... openat resumed>) = 3 [pid 5826] close(3 [pid 5825] close(3 [pid 5824] getpid( [pid 5823] write(3, "1024 1048576 500 1024", 21 [pid 5826] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5824] <... getpid resumed>) = 1 [pid 5823] <... write resumed>) = 21 [pid 5822] write(3, "1024", 4 [pid 5826] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 5824] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5823] close(3 [pid 5822] <... write resumed>) = 4 [pid 5826] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5824] <... capget resumed>{effective=1< [pid 5825] write(3, "1024", 4 [pid 5824] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5823] <... close resumed>) = 0 [pid 5822] close(3 [pid 5826] <... write resumed>) = 21 [pid 5825] <... write resumed>) = 4 [pid 5824] <... capset resumed>) = 0 [pid 5823] getpid( [pid 5822] <... close resumed>) = 0 [pid 5826] close(3 [pid 5825] close(3 [pid 5824] unshare(CLONE_NEWNET [pid 5823] <... getpid resumed>) = 1 [pid 5822] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5826] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5823] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5825] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 5823] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5822] <... openat resumed>) = 3 [pid 5823] <... capset resumed>) = 0 [pid 5826] <... getpid resumed>) = 1 [pid 5825] <... openat resumed>) = 3 [pid 5826] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5823] unshare(CLONE_NEWNET [pid 5822] write(3, "1024 1048576 500 1024", 21 [pid 5826] <... capget resumed>{effective=1< [pid 5826] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5822] <... write resumed>) = 21 [pid 5826] <... capset resumed>) = 0 [pid 5825] <... write resumed>) = 21 [pid 5822] close(3 [pid 5826] unshare(CLONE_NEWNET [pid 5825] close(3 [pid 5822] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5822] getpid( [pid 5825] getpid( [pid 5822] <... getpid resumed>) = 1 [pid 5825] <... getpid resumed>) = 1 [pid 5822] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5825] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, [pid 5822] <... capget resumed>{effective=1<{effective=1< [pid 5825] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5822] <... capset resumed>) = 0 [pid 5825] <... capset resumed>) = 0 [pid 5822] unshare(CLONE_NEWNET [pid 5825] unshare(CLONE_NEWNET [pid 5824] <... unshare resumed>) = 0 [pid 5824] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5824] write(3, "0 65535", 7) = 7 [pid 5824] close(3) = 0 [pid 5824] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 5824] write(3, "100000", 6) = 6 [pid 5823] <... unshare resumed>) = 0 [pid 5824] close(3 [pid 5823] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5824] <... close resumed>) = 0 [pid 5823] <... openat resumed>) = 3 [pid 5822] <... unshare resumed>) = 0 [pid 5823] write(3, "0 65535", 7 [pid 5824] mkdir("./syz-tmp", 0777 [pid 5823] <... write resumed>) = 7 [pid 5823] close(3 [pid 5822] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5823] <... close resumed>) = 0 [pid 5822] <... openat resumed>) = 3 [pid 5822] write(3, "0 65535", 7 [pid 5826] <... unshare resumed>) = 0 [pid 5825] <... unshare resumed>) = 0 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5822] <... write resumed>) = 7 [pid 5824] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5822] close(3 [pid 5826] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 5824] <... mount resumed>) = 0 [pid 5823] <... openat resumed>) = 3 [pid 5822] <... close resumed>) = 0 [pid 5822] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5826] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5824] mkdir("./syz-tmp/newroot", 0777 [pid 5823] write(3, "100000", 6 [pid 5822] <... openat resumed>) = 3 [pid 5826] write(3, "0 65535", 7 [pid 5825] write(3, "0 65535", 7 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] <... write resumed>) = 6 [pid 5822] write(3, "100000", 6 [pid 5826] <... write resumed>) = 7 [pid 5825] <... write resumed>) = 7 [pid 5826] close(3 [pid 5825] close(3 [pid 5823] close(3 [pid 5822] <... write resumed>) = 6 [pid 5826] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5823] <... close resumed>) = 0 [pid 5822] close(3 [pid 5826] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5825] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 5824] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5823] mkdir("./syz-tmp", 0777 [pid 5822] <... close resumed>) = 0 [pid 5826] <... openat resumed>) = 3 [pid 5825] <... openat resumed>) = 3 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5822] mkdir("./syz-tmp", 0777 [pid 5825] write(3, "100000", 6 [pid 5826] write(3, "100000", 6 [pid 5824] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] <... mkdir resumed>) = 0 [pid 5826] <... write resumed>) = 6 [pid 5825] <... write resumed>) = 6 [pid 5824] <... mount resumed>) = 0 [pid 5826] close(3 [pid 5825] close(3 [pid 5826] <... close resumed>) = 0 [pid 5825] <... close resumed>) = 0 [pid 5822] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5826] mkdir("./syz-tmp", 0777 [pid 5825] mkdir("./syz-tmp", 0777 [pid 5822] <... mount resumed>) = 0 [pid 5826] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [ 56.776990][ T29] audit: type=1400 audit(1733488804.852:90): avc: denied { mounton } for pid=5824 comm="syz-executor239" path="/root/syzkaller.r7QBoJ/syz-tmp" dev="sda1" ino=1932 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 56.801560][ T29] audit: type=1400 audit(1733488804.852:91): avc: denied { mount } for pid=5824 comm="syz-executor239" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [pid 5824] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5823] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5824] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5824] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5823] mkdir("./syz-tmp/newroot", 0777 [pid 5824] <... mount resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5823] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 5823] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5823] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5824] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5823] <... mkdir resumed>) = 0 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5824] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] <... mount resumed>) = 0 [pid 5824] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5823] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 5826] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5825] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 5824] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mkdir("./syz-tmp/newroot", 0777 [pid 5825] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5822] <... mkdir resumed>) = 0 [pid 5823] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5823] <... mount resumed>) = 0 [pid 5822] <... mkdir resumed>) = 0 [pid 5825] mkdir("./syz-tmp/newroot", 0777 [pid 5824] <... mount resumed>) = 0 [pid 5823] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5822] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5824] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5823] <... mkdir resumed>) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5823] <... mount resumed>) = 0 [pid 5822] <... mkdir resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5824] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5824] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5823] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5826] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5822] <... mkdir resumed>) = 0 [pid 5823] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5824] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5826] mkdir("./syz-tmp/newroot", 0777 [pid 5824] <... mount resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5822] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5826] <... mkdir resumed>) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5826] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 5826] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5825] mkdir("./syz-tmp/newroot/dev", 0700 [pid 5824] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] mkdir("./syz-tmp/pivot", 0777 [pid 5822] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5826] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 5826] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5822] <... mkdir resumed>) = 0 [pid 5826] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 5825] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5824] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5823] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5822] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5826] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 5825] <... mount resumed>) = 0 [pid 5826] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5826] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 5826] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5825] mkdir("./syz-tmp/newroot/proc", 0700 [pid 5824] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5823] <... pivot_root resumed>) = 0 [pid 5822] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5826] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5826] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 5826] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5826] mkdir("./syz-tmp/pivot", 0777 [pid 5825] <... mkdir resumed>) = 0 [pid 5824] <... mount resumed>) = 0 [pid 5823] chdir("/" [pid 5822] <... mount resumed>) = 0 [pid 5826] <... mkdir resumed>) = 0 [pid 5825] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 5824] mkdir("./syz-tmp/pivot", 0777 [pid 5823] <... chdir resumed>) = 0 [pid 5822] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5826] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5825] <... mount resumed>) = 0 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] umount2("./pivot", MNT_DETACH [pid 5822] <... mount resumed>) = -1 ENOENT (No such file or directory) [ 56.824237][ T29] audit: type=1400 audit(1733488804.872:92): avc: denied { mounton } for pid=5824 comm="syz-executor239" path="/root/syzkaller.r7QBoJ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 56.852711][ T29] audit: type=1400 audit(1733488804.902:93): avc: denied { mount } for pid=5824 comm="syz-executor239" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [pid 5826] <... pivot_root resumed>) = 0 [pid 5825] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 5824] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5823] <... umount2 resumed>) = 0 [pid 5822] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5826] chdir("/" [pid 5825] <... mkdir resumed>) = 0 [pid 5824] <... pivot_root resumed>) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5824] chdir("/") = 0 [pid 5823] chroot("./newroot" [pid 5824] umount2("./pivot", MNT_DETACH [pid 5823] <... chroot resumed>) = 0 [ 56.877892][ T29] audit: type=1400 audit(1733488804.922:94): avc: denied { mounton } for pid=5823 comm="syz-executor239" path="/root/syzkaller.ZPEX9M/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [pid 5823] chdir("/" [pid 5826] <... chdir resumed>) = 0 [pid 5825] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5822] mkdir("./syz-tmp/pivot", 0777 [pid 5826] umount2("./pivot", MNT_DETACH [pid 5825] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 5823] <... chdir resumed>) = 0 [pid 5822] <... mkdir resumed>) = 0 [pid 5823] mkdir("/dev/binderfs", 0777 [pid 5825] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5824] <... umount2 resumed>) = 0 [pid 5823] <... mkdir resumed>) = 0 [pid 5822] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5825] <... mount resumed>) = 0 [pid 5824] chroot("./newroot" [pid 5822] <... pivot_root resumed>) = 0 [pid 5824] <... chroot resumed>) = 0 [pid 5825] mkdir("./syz-tmp/newroot/sys", 0700 [pid 5824] chdir("/" [pid 5823] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5825] <... mkdir resumed>) = 0 [pid 5824] <... chdir resumed>) = 0 [pid 5825] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 5824] mkdir("/dev/binderfs", 0777 [pid 5825] <... mount resumed>) = 0 [pid 5824] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5822] chdir("/" [pid 5824] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5822] <... chdir resumed>) = 0 [pid 5824] <... mount resumed>) = 0 [pid 5822] umount2("./pivot", MNT_DETACH [pid 5825] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5825] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 5825] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 5824] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5825] mkdir("./syz-tmp/pivot", 0777 [pid 5824] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5826] <... umount2 resumed>) = 0 [pid 5825] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = 0 [pid 5822] <... umount2 resumed>) = 0 [pid 5822] chroot("./newroot" [pid 5826] chroot("./newroot" [pid 5825] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 5824] mkdir("./0", 0777 [pid 5823] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5822] <... chroot resumed>) = 0 [pid 5826] <... chroot resumed>) = 0 [pid 5824] <... mkdir resumed>) = 0 [pid 5823] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5822] chdir("/" [pid 5826] chdir("/" [pid 5824] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5822] <... chdir resumed>) = 0 [pid 5826] <... chdir resumed>) = 0 [pid 5826] mkdir("/dev/binderfs", 0777 [pid 5825] <... pivot_root resumed>) = 0 [pid 5823] mkdir("./0", 0777./strace-static-x86_64: Process 5834 attached [pid 5826] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5825] chdir("/" [pid 5823] <... mkdir resumed>) = 0 [pid 5822] mkdir("/dev/binderfs", 0777 [pid 5834] set_robust_list(0x55558bb4e660, 24 [pid 5826] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5825] <... chdir resumed>) = 0 [pid 5823] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5822] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5834] <... set_robust_list resumed>) = 0 [pid 5826] <... mount resumed>) = 0 [pid 5825] umount2("./pivot", MNT_DETACH [pid 5822] mount("binder", "/dev/binderfs", "binder", 0, NULL./strace-static-x86_64: Process 5835 attached [pid 5835] set_robust_list(0x55558bb4e660, 24 [pid 5834] chdir("./0" [pid 5826] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5824] <... clone resumed>, child_tidptr=0x55558bb4e650) = 2 [pid 5823] <... clone resumed>, child_tidptr=0x55558bb4e650) = 2 [pid 5835] <... set_robust_list resumed>) = 0 [pid 5834] <... chdir resumed>) = 0 [pid 5822] <... mount resumed>) = 0 [pid 5825] <... umount2 resumed>) = 0 [pid 5835] chdir("./0" [pid 5826] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5834] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5825] chroot("./newroot" [pid 5835] <... chdir resumed>) = 0 [pid 5834] <... prctl resumed>) = 0 [pid 5834] setpgid(0, 0 [pid 5822] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5835] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5826] mkdir("./0", 0777 [pid 5825] <... chroot resumed>) = 0 [pid 5835] <... prctl resumed>) = 0 [pid 5834] <... setpgid resumed>) = 0 [pid 5826] <... mkdir resumed>) = 0 [pid 5825] chdir("/" [pid 5835] setpgid(0, 0 [pid 5822] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 5835] <... setpgid resumed>) = 0 [pid 5834] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5826] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5825] <... chdir resumed>) = 0 [pid 5835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5822] mkdir("./0", 0777 [ 56.906724][ T29] audit: type=1400 audit(1733488804.922:95): avc: denied { mounton } for pid=5823 comm="syz-executor239" path="/root/syzkaller.ZPEX9M/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4972 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 56.934587][ T29] audit: type=1400 audit(1733488804.942:96): avc: denied { unmount } for pid=5823 comm="syz-executor239" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 56.955034][ T29] audit: type=1400 audit(1733488805.012:97): avc: denied { mounton } for pid=5823 comm="syz-executor239" path="/dev/binderfs" dev="devtmpfs" ino=2723 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [pid 5825] mkdir("/dev/binderfs", 0777 [pid 5822] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5836 attached [pid 5835] <... openat resumed>) = 3 [pid 5834] <... openat resumed>) = 3 [pid 5825] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5836] set_robust_list(0x55558bb4e660, 24 [pid 5835] write(3, "1000", 4 [pid 5826] <... clone resumed>, child_tidptr=0x55558bb4e650) = 2 [pid 5825] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 5822] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5836] <... set_robust_list resumed>) = 0 [pid 5835] <... write resumed>) = 4 [pid 5834] write(3, "1000", 4./strace-static-x86_64: Process 5837 attached [pid 5836] chdir("./0" [pid 5835] close(3 [pid 5834] <... write resumed>) = 4 [pid 5825] <... mount resumed>) = 0 [pid 5837] set_robust_list(0x55558bb4e660, 24 [pid 5835] <... close resumed>) = 0 [pid 5837] <... set_robust_list resumed>) = 0 [pid 5836] <... chdir resumed>) = 0 [pid 5835] symlink("/dev/binderfs", "./binderfs" [pid 5825] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 5834] close(3 [pid 5822] <... clone resumed>, child_tidptr=0x55558bb4e650) = 2 [pid 5837] chdir("./0" [pid 5836] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5835] <... symlink resumed>) = 0 [pid 5834] <... close resumed>) = 0 [pid 5825] <... mount resumed>) = -1 EBUSY (Device or resource busy) executing program [pid 5837] <... chdir resumed>) = 0 [pid 5836] <... prctl resumed>) = 0 [pid 5835] write(1, "executing program\n", 18 [pid 5834] symlink("/dev/binderfs", "./binderfs" [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5836] setpgid(0, 0 [pid 5835] <... write resumed>) = 18 [pid 5834] <... symlink resumed>) = 0 [pid 5825] mkdir("./0", 0777 [pid 5837] <... prctl resumed>) = 0 [pid 5836] <... setpgid resumed>) = 0 [pid 5835] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR [pid 5834] write(1, "executing program\n", 18executing program [pid 5837] setpgid(0, 0 [pid 5836] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5834] <... write resumed>) = 18 [pid 5837] <... setpgid resumed>) = 0 [pid 5835] <... openat resumed>) = 3 [pid 5834] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR [pid 5825] <... mkdir resumed>) = 0 [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5836] <... openat resumed>) = 3 [pid 5835] ioctl(3, USB_RAW_IOCTL_INIT [pid 5834] <... openat resumed>) = 3 [pid 5825] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5837] <... openat resumed>) = 3 [pid 5836] write(3, "1000", 4 [pid 5835] <... ioctl resumed>, 0x7ffd2d5ff1a0) = 0 [pid 5834] ioctl(3, USB_RAW_IOCTL_INIT, 0x7ffd2d5ff1a0) = 0 ./strace-static-x86_64: Process 5838 attached [pid 5837] write(3, "1000", 4 [pid 5836] <... write resumed>) = 4 [pid 5835] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN [pid 5834] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN [pid 5838] set_robust_list(0x55558bb4e660, 24 [pid 5837] <... write resumed>) = 4 [pid 5836] close(3 [pid 5825] <... clone resumed>, child_tidptr=0x55558bb4e650) = 2 [pid 5838] <... set_robust_list resumed>) = 0 [pid 5837] close(3 [pid 5836] <... close resumed>) = 0 [pid 5835] <... ioctl resumed>, 0) = 0 [pid 5834] <... ioctl resumed>, 0) = 0 [pid 5838] chdir("./0" [pid 5837] <... close resumed>) = 0 [pid 5836] symlink("/dev/binderfs", "./binderfs"