ELF>@@W@8 @66@@@9N9N0L0\0\$ 4`M`]`]  888$$Ptd;;;<<QtdRtd0L0\0\GNUm ́gI%q 4` L"!"aP@ @ HC@A @H.qstuvwxy{}z%u0X{]3+Ct[եހqc""i?bΕx| jsFBn *TKwwї|?x", iWnSu:&H88+ܖfM2v.N(\ ,{%jQfN"P <‘wNR#_&xk MwS9F   bv@ F+Sa  ok, % F"'V9Y"Fg18$fwl1 GrL2:NkU l4 ] 0wrB qY   Q_ dr g mi | y)dP1 pYi `r3b = 1 vS d14ep z/ Y Pt9 uJv`dp Y9f X  oY @oB 0i YY PhJT h@ {: rYU`ep obdp 0{ n} rJ zl+  u 2 Јs Pnl 0I S 0|G __gmon_start___ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__cxa_finalizemetric_namesmetric_text_onelinemetric_text_longbpf_buffer__pollmallocstrncpyheadstrerrorname_np__snprintf_chk__strcat_chkmemsetbpf_buffer__freebpf_object__destroy_skeletonfill_instids_log2round__asprintf_chkpow__stack_chk_failfill_instidspmNotifyErrexitpmIniFileLookup__isoc23_strtolensure_core_btfcallocbpf_object__open_skeletonbpf_buffer__newbpf_object__load_skeletonbpf_object__attach_skeletonbpf_buffer__openstrerror__errno_locationbpf_moduleall_modulesprobe_ringbufbpf_map__set_autocreatebpf_map__set_typebpf_map__set_key_sizebpf_map__set_value_sizebpf_map__fdring_buffer__newperf_buffer__newring_buffer__pollperf_buffer__pollring_buffer__freeperf_buffer__freestrncmpstrcmpopen_elf_by_fdelf_nextscngelf_getshdrelf_getdatagelf_getsymelf_strptrbtf__add_strbtf__freeclose_elfreallocbtf__name_by_offsetqsortopen_elfputcharbpf_prog_loadbpf_raw_tracepoint_opengetpidfopen__isoc23_fscanf__ctype_b_locmemcpymkostempunlinkstderr__fprintf_chkfeoffcloseksyms__freeksyms__loadstrlenksyms__map_addrksyms__get_symbolsyms__load_filegelf_getehdrstrdupbtf__new_emptyelf_getshdrstrndxsyms__load_pidsyms__map_addr_dsosyms_cache__newsyms_cache__freesyms_cache__get_symspartitions__freepartitions__loadfgets__isoc23_sscanfpartitions__get_by_devpartitions__get_by_nameprint_log2_hist__printf_chkputsprint_linear_histget_ktime_nsclock_gettimeis_kernel_modulefentry_can_attachbtf__load_vmlinux_btflibbpf_get_errorbtf__load_module_btfbtf__find_by_name_kindkprobe_existsfwritefaccessattracepoint_existsaccessvmlinux_btf_existsmodule_btf_existsprobe_tp_btflibbpf_find_vmlinux_btf_idgetpagesizebpf_map_create_binary_min_core_btfs_tar_gz_startuname__getdelimmkstempfdopen_binary_min_core_btfs_tar_gz_endinflateInit2_inflateinflateEndferrorcleanup_core_btfget_pid_binary_pathreadlinkget_pid_lib_pathstrrchrstrnlenstrcpyresolve_binary_pathpopenpcloseelf_versionelf_beginelf_kindelf_endelf_errmsgget_elf_func_offsetelf_getphdrnumgelf_getphdrdump_hashbpf_map_lookup_batchbpf_map_get_next_keybpf_map_lookup_elemlibpcp_web.so.1libpcp.so.3libbpf.so.1libelf.so.1libz.so.1libm.so.6libc.so.6GLIBC_2.29GLIBC_2.2.5PCP_WEB_1.8PCP_3.22GLIBC_2.14GLIBC_2.4GLIBC_2.7GLIBC_2.3GLIBC_2.8GLIBC_2.38GLIBC_2.32GLIBC_2.3.4GLIBC_2.17ELFUTILS_1.5ELFUTILS_1.6ELFUTILS_1.0LIBBPF_0.8.0LIBBPF_0.6.0LIBBPF_0.0.4LIBBPF_0.5.0LIBBPF_0.0.9LIBBPF_0.0.6LIBBPF_0.0.7LIBBPF_0.1.0LIBBPF_0.2.0LIBBPF_0.0.1         0ui   X   db  ( ii 3 ii = ii G ii Q [  f ti q } ui  @      P~0 P0 Tv0 Pq0 Yv0 Vv0 Wv0 Pu0 Pt0 Qv0$ 0\H8\H@\H\ΐ`\dh\np\xx\\\\\\\˒\֒\\\\\\\\*\5]>]H]T]a ]n(]}0]8]@]H]P]X]ccdId IdHdI dPT(dPQ0dPL8dN@dHHd@I`dՐhdpdxddd(d0d7dBdIdPdUd[dkdՐdddee(e0e7 eB(eI0eP8eU@e[Hek`ehepexeeeБeߑeeee#e3eDeTeʓeדeeffff f"(f,0f48f>@fIHfT_____&__2_7__]_````s `(`0`8`@`H`P`X` `` h` p`x`` ` `````{````````w`aaaa a (a0a!8a"@a#Ha$Pa%Xa'`a(ha)pa*xa+a,a-a.a/a0a1a3a4a5a6a8a9a:a;a<a=b>b?b@b bA(bB0bC8bD@bEHbFPbGXb`bHhbIpbJxbKbLbMbNbbObPbbbQbRbSbTbUbVbWbXcYccZc[ c\(c^0c_8c`@caHcbPccXcd`cehcfpcgxcchcicjckclcmcncocccpHHuHtH5%@%h%h%h%h%h%h%h%hp%h`%h P%zh @%rh 0%jh %bh %Zh%Rh%Jh%Bh%:h%2h%*h%"h%h%hp% h`%hP%h@%h0%h %h%h%h%h %h!%h"%h#%h$%h%%h&%h'p%h(`%h)P%zh*@%rh+0%jh, %bh-%Zh.%Rh/%Jh0%Bh1%:h2%2h3%*h4%"h5%h6%h7p% h8`%h9P%h:@%h;0%h< %h=%h>%h?%h@%hA%hB%hC%hD%hE%hF%hGp%hH`%hIP%zhJ@%rhK0%jhL %bhM%ZhN%RhO%JhP%BhQ%:hR%2hS%*hT%"hU%hV%hWp% hX`%hYP%hZ@%h[0%h\ %h]%h^%h_%h`%ha%hb%hc%hd%he%hf%hgp%hh`%hiP%zhj@%rhk0%jhl %bhm%Zhn%Rho%Jhp%Bhq%:hr%2hs%*ht%"hu%hv%hwp% hx`%hyP%hz@%f% fDH=AH:H9tHvHt H=H5 H)HH?HHHtHEHtfD=u+UH="Ht H=>9d]wf.f.fDHHff.fDHG4ff.@HctH=HH1HYHH1ff.@H 0Gf?HF~VF FF F0@@p(@`pHph@P@pP0PPPp@,@4@L@T@l@tǀǀHH  ( @H 00PǀPǀǀǀǀ ǀǀ,ǀ4ǀLǀT`h  HHHppǀlǀtǀǀHHDHAQff.f~DDH=uD1ff.UP"HSHoEHu HHEH{ HCHEHC8"8"H{0Hu0H{8Hu8H8H8tH8 H8 \HHǃ@"HPHH"HH@"HXC9|1lCH[]ÐH8H@"HH"Ht*HH"H@"H2CH1[]DHHf.UH-BSHBHt.IHL!B1  HH[]ÐAHL6B1  }HH[]AVL5AAUL-ATAUHH=K@S1A@#ItiHHH t,DHHt?tѺLHtAU(LPL8L>1(^XZf.SH=?H=h?Hd?HtH;HtHH;H;Hu!FHH"H@"HH;Ht'H@"HH"HuHSHH;Hu[fAWAVAUATUSH8dL,%(Ll$(A?D9DF+Hf1ILt$ fDL,1Et4D$LD$L$&LD$f/ L$H,1LL$H=L$~ HD$ DeHEHD9A܃f*D$L$t\tf/oL$+\[L,M1fD\@H,L1;HD$(dH+%(uH8[]A\A]A^A_ff.AWAVAUATUSHHHdL4%(Lt$IIHtp1IL%~<tA1LL~IH $HHHLIHH9uHD$dH+%(u1H[]A\A]A^A_ÿH5;1UATfH;USHH`dH,%(Hl$XHH$XD$D$D$(D$8D$HoHt 1H -H<HHCHt 1H<HIx HH-HHHTHH H;HEHCHE H0HE(HE0HHSHPH :HSHH ;HP(HS HH H :HPHHS(HH@H :HPhHSpHH`HPpHHE85HE@HHS0H+HHHPHSPH z:HPHS8HP HSXHP(HS@HH e:HP8HS`HHH D:HP@HSHHH0H >:HPPHShHHHHPXH%DHEHE ŅHCp`:HI:HsH{H+:HBH#:H8[H :H8= H59H1H=9H;H5dHH@4tDH5@1(f؉'H5@H1HT$XdH+%(H`[]A\HfH;HtHD(H581H9$fH5?1 ufDH5?11JfDH581% _HGHHtHff.@AT1UHSHt71HA'(XHHt?H(D` H[]A\ÐHAHH @AUIATIUHSHHH?NS t.u1LHHt>HCH1[]A\A]@HkE1ILLcH@DHuZH[]A\A]ff.G t$tfHHHtOSG Ht+tH[MDH/H[6fDHH[fDf.f.f.f.f.DU1SH?H59H{ H59H_H59HCtzH59H+tbH5~9HtJH5l9Ht2 H5[9Ht H5M9H@H[]ff.HFH9Gtr f.H6H?Df.HFH9Gtr f.H6H?Df.AWAVAUIATUSHt$Ht$XH$LIMt$ H5(HAG(fH<$'H|$@EH<$<1HD$@H$8dH+%(HD$@HH[]A\A]A^A_T$LH|$PHcH4HHtHt$@fHHcVHJHL<ЉNIG@AAGAG AG0^IIG@DAG(+AG(Ht$dHD$d^IHHt$hHe1L-'@HLHHtcHt$8HpHtۋ$Ht$hLgHHtLuH$t$dLIGH$IG jt$dLZH<$ft$d1@THHBHDt$HA@A@HD$@fAHD$h1LDt$`HHD$XAŃD$`uK?HHH$HMHL<$fDE1H$dH+%(HD[]A\A]A^A_H|$@H+DAE1HD$DAEHoH|$eH]s1AfDH8EA1HD$hLD$4}ILd$4L5u2I HH IA?zLI|L1Ht$LHcT$4AŅuHL$IHHcD$4H9t)H|$AHA1WH|$(HL$HA0HAA8HA11DAEwfHt'SHH0HtH{0[[fDf.DAUAA ATL:I USHӺH8dH%(HD$(1HHLHzHxNH9s"A1HT$(dH+%(uTH8[]A\A]HH=H~HXDHH81ǾAWALAVI AUATUSHXHT$Hl$ HL$H dH%(H$H1H5HDHlHH\$@L$@L-7@HH萿H1LLHWuҾ/LIHtH5H詾uIwLH4$H4$LHHD$聾$vHL$AD-<`LCHL$$H9suH|$L$Hn$H$HdH+%(HX[]A\A]A^A_HLHRH81HHrH= HqHPپHH81fAUATIUHSHxA<$dH%(H\$hHu2HD$hdH+%(rHxHH[]A\A]1MLHdducH5 HIHH‰HdHHLD61HT$hdH+%(Hx[]A\A]DHD$hdH+%(HxHL[]A\A]闺HH=HHHH=H H;LH,1 HH=zH LVH` H=QH _ff.fATIUSH蘾tL1H1Ņ1Ҿ`HHH̻u?A,$H[]A\H1H=HƿH[]A\fDH1H:H H1菾蘹fDHaHپ1HpH81ι@1fDLLL_HEDLLHJEAHE;}LL t職LmDe8uEthE1DeE1EEAAċEAA9tKHEDD}LHctϸHeHUdH+%(uOHe[A\A]A^A_]1fDHE1fDLmDesHL4Ӷ#HH-%s | 0x0umount("%s", %s) = %s%lu-%lupmdaInstid: realloc err: %dprocess_countmountsnoop_bpfheapargsmountsno.rodataumount_entryumount_exitfailed to open BPF objectfailed to load BPF object: %dUMOUNTProcess identifierThread identifierCommand nameoperationu/mount() return valueLatencyMNT_NSFilesystemSourceTargetDataFlagsu/mount(params)Number of the lost eventsmountsnoop.pidmountsnoop.tidmountsnoop.commmountsnoop.opmountsnoop.retmountsnoop.latmountsnoop.mnt_nsmountsnoop.fsmountsnoop.sourcemountsnoop.targetmountsnoop.datamountsnoop.flagsmountsnoop.callmountsnoop.lostMS_RDONLYMS_NOSUIDMS_NODEVMS_NOEXECMS_SYNCHRONOUSMS_REMOUNTMS_MANDLOCKMS_DIRSYNCMS_NOSYMFOLLOWMS_NOATIMEMS_NODIRATIMEMS_BINDMS_MOVEMS_RECMS_VERBOSEMS_SILENTMS_POSIXACLMS_UNBINDABLEMS_PRIVATEMS_SLAVEMS_SHAREDMS_RELATIMEMS_KERNMOUNTMS_I_VERSIONMS_STRICTATIMEMS_LAZYTIMEMS_SUBMOUNTMS_NOREMOTELOCKMS_NOSECMS_BORNMS_ACTIVEMS_NOUSERbashreadlinebiolatencybiosnoopexecsnoopexitsnoopfsslowermountsnoopnetatopoomkillopensnooprunqlatstatsnooptcpconnecttcpconnlatvfsstat//anon/dev/zero/anon_hugepage[stack/SYSV[heap][uprobes][vsyscall]GPLtest/proc/%ld/maps[vdso]failed to unlink %s: %s /proc/kallsyms%lx %c %s%*[^ ] .text/proc/partitions%u %u %llu %s%*lld -> %-*lld : %-8d | %-10d : %-8d |/proc/modules%s %*s %s %s%*[^ ] /sys/kernel/debug/tracing%*x %*c %s%*[^ ] /sys/kernel/tracing%s/events/%s/%s/format/sys/kernel/btf/%s/etc/os-releaseID=%64sVERSION_ID="%64swb1.3.1%o/proc/%d/exeNo such pid %d readlink truncation/proc/%d/maps%*x-%*x %*s %*x %*s %*u %s/libpath size too small Cannot find library %s which %ssnprintf which prog failedfgets which failedelf init failed Could not open %s elf_begin failed: %s elf kind %d is not ELF_K_ELF mount("%s", "%s", "%s", %s, "%s") = %sfailed to fetch necessary BTF for CO-RE: %sfailed to create ring/perf buffer: %dfailed to attach BPF programs: %dfailed to open ring/perf buffer: %d%llx-%llx %*s %*x %*x:%*x %*u%[^ ]/tmp/libbpf_%ld_vdso_image_XXXXXXfailed to create temp file: %s failed to write to vDSO image: %s %llx-%llx %4s %llx %llx:%llx %llu%[^ ]%*s%-*s : count distribution %-13s : count distribution /sys/kernel/debug/tracing/available_filter_functions/sys/kernel/tracing/available_filter_functions/sys/kernel/debug/kprobes/blacklistfailed to read symbol from kprobe blacklist failed to read symbol from available_filter_functions failed to read symbol from kallsyms Uprobes need a pid or a binary Can't find %s (Need a PID if this is a library) ELF@@)cju{z@"f^w #{ y{y{cgac aqyaqyqayc'ca0c8"q q8yrs!q8yrs!q0y rs!q8 y(rs!qyt@"y0y({*y yyc {aaw ]{z{j{{y{{ yyyc {aaw ]{z{j{ {{{yDual BSD/GPLII7   ( @*3 >  @CJP ]8ad@jnsv@{~@ {  @!@"%@'(#d$$  @ @& . 2 ),-"%@F%( .+J - ./F 0 0!3'F,P1Q7@@5I&V&v(c4u5D@6@789:;<>A=??@$B BC#$E)E@D. 7G<KANI\HJ@jB`bBpf$IHqy<L MFOSR @&,T8@/FV@d`LSZGe@q&O @`X` b oZ&  q$ s@/ s6 t< u N @ Y ` `  p w y z! y@! /@A #A #A A }A DB B &B$ ?C6 ?CD  CW D@Cn C C }D D D@D D DE @F ZG @H H H J J# J- J9 KG &@KN KZ Kn K K K K K K K K K K K K( K: KJ K^ &Lk @LNy N~ &@N ON ON DO DO OP D@P DP @Q Q DS DT T T U( /@U7 PU= PUC PVI @VV &W\ &@Wc PWn PW} &X &@X X [ [ \ @\ \ \ @] ] ]&@^&^s^%_+@_4_<_C`K@`S```an&axb@bbbc c@ccPdPe5@e`ee eO@f#f1/f>gG@gLgZgkhv@h&hhijPkP@kPkkoop(@p0Dp8Uq?U qD@qPqcDqq@rrss@tD@u&uv@vPv`vv!v6vI&w\P@wgPwPwx x x&y @y&z @zUz&z {@$.5@Q&cP@rP@<<&&@*CP@_esO@V /@ /@P'0?¤>NZd x @!,d&&@UUW<YZD@PP@PP4PB@ \H]O]T&@d^ht&{U@&[@[ZX @PP@PUU&&@&_"+ 00@DI&Q&`# k#0sa@`xZPPP@PPcP@df fnd"e(@2@7g:hGi@PmU?[?b?j?r 7Zhcj klfbp   rPP@PP%P2P@=PIPSceP@qP{cPP@PPPP@PP%P5P@HPYPkP}P@PPPvx y{y|&~UK????$  *&1@;HT(_D@iD (sPz@&&@Z&@&D@&/@3=PYY`& ls }Z& c=.C k 8&@ %((U@dU`UPU @P +3=GL X]@b`n&u&}$v@vI 7 P= P@8 P@`P@[@[ '*4$<@  F<B F@J`OTY^dj u@@$@/@")/@GM^k}D~&D<&< @ '0&@7&;G$Sd8wP}P@PPPP@P&     @ `$ D.  <D W @ [ Dk y  D D D        @ `!VOP!P@!P&!1!P|$D@$&$!3@$?$@$`$$&F$<$@@$A %&@%$$%B4,%DP/%E5%G@F%/_%Gu%Xz%P@%Y Z%[%e$/$%D%%%%%%&)&A&(K&)M&*K&U&;! e&@,l&x&&@&A&B&C&D&E&F&G&H I&J&K&LM'N 'O'Q'R-'S:'TH'Ua'Vx'W~'X'Y'Z'['\']'^'_'`'a'b'c(d(e(f-'(.//(@B(S(0e(v(@(C`(Cp((((((() ))!)))0)<)I)Q)W) 2e)O$/@ %&Ul)'(P@;w)P)P@)P)P`35678: `e&P)P@)&)&)) )@d`)4)4@*e&P*@*`)@2f#*D+*P3*P@(8*9=*DE*X*&,&@7??`*?k*?v*B~*P@*P<=*P*'@*P*P@*D*C $F P*HI $JVK* +P+L@+M+PtN#+P@'+PP0+P3+R@PP=+PG+S@Q+T[+Pd+Un+Ux+P+P@'P+P+P++O++C +C0+Q +++ ,,,!',%2,&=,(E,+N,.UW,U U[,U d,n,r,V@Ww,,&,&@,&,&,&,&@,&,&,&,&@,&,&,&,&@,&,&0+&,&@d&1"&,&% <\$_@d&,/,\,b@,d,b,&,&D -]^ &&_`[a-r,W&-06-cC-c@O-b$")Z-&@k-is-i-j-j-kk--P-@-`k- @!- -P@-P-P-..!.r,l(.5.m;.oB.wG.yM.}W. pc.Ug.U k.U@o.U`s.Uw.U{.U.nU`U. c.Bg.Bk.B .B0p@.U.U.s.tv*u vqr.P.P@o.Us.U w.U@{.U`U U@U 0.u.u.c.Ug.U k.U@o.U`s.Uw.U{.U.n.?`.?h.?p.?x.?/?8*x /U/@/o$/z+/|?/@-PM/P@[,{P??4 H</@///D/@//// x,%0D 050P@30P@0$030=0E0@I0V  . P3  .+4   B4 M4 U4f4  l4t4 H|444!44444444 55%5+595H5Y5a5s5~555>k555555W 56 6#636E6Z6Zh6x666666 66666Lv 7747C7S7d7p7z7"7int__ARRAY_SIZE_TYPE__typemax_entrieskey_sizevalue_sizeheapevents__u32unsigned intargtsflagssrcdestfsdataop__u64unsigned long longcharMOUNTUMOUNTkeyvalueargstrace_event_raw_sys_enterentid__datatrace_entrypreempt_countpidunsigned shortunsigned charlongunsigned longctxmount_entrytracepoint/syscalls/sys_enter_mount0:2:4/build/reproducible-path/pcp-6.3.8/src/pmdas/bpf/modules/mountsnoop.bpf.c const char *data = (const char *)ctx->args[4];0:2:3 __u64 flags = (__u64)ctx->args[3]; const char *fs = (const char *)ctx->args[2];0:2:20:2:1 const char *dest = (const char *)ctx->args[1];0:2:0 const char *src = (const char *)ctx->args[0]; __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 tid = (__u32)pid_tgid; struct arg arg = {}; if (target_pid && target_pid != pid) __u32 pid = pid_tgid >> 32; arg.ts = bpf_ktime_get_ns(); arg.data= data; arg.fs = fs; arg.dest = dest; arg.src = src; arg.flags = flags; bpf_map_update_elem(&args, &tid, &arg, BPF_ANY); return probe_entry(src, dest, fs, flags, data, MOUNT);trace_event_raw_sys_exitretmount_exittracepoint/syscalls/sys_exit_mount0:2 return probe_exit(ctx, (int)ctx->ret);probe_exit.textstatic int probe_exit(void *ctx, int ret) argp = bpf_map_lookup_elem(&args, &tid); if (!argp)bpf_ringbufwaitqworkmaskpagesnr_pagesspinlockconsumer_posproducer_poswait_queue_head_twait_queue_headlockheadspinlock_trlockraw_spinlockraw_lockarch_spinlock_tqspinlockvalatomic_tcounterlockedpendingu8__u8locked_pendingtailu16__u16list_headnextprevirq_worknodefuncirqwait__call_single_nodellistdstllist_nodeu_flagsa_flagsrcuwaittasku640/build/reproducible-path/pcp-6.3.8/src/pmdas/bpf/modules/./compat.bpf.h if (bpf_core_type_exists(struct bpf_ringbuf)) return bpf_ringbuf_reserve(&events, size, 0); if (!eventp) return bpf_map_lookup_elem(&heap, &zero); task = (struct task_struct *)bpf_get_current_task(); eventp->delta = bpf_ktime_get_ns() - argp->ts; eventp->flags = argp->flags; eventp->pid = pid; eventp->tid = tid;task_structthread_info__statestackusageptraceon_cpuwake_entrywakee_flipswakee_flip_decay_tslast_wakeerecent_used_cpuwake_cpuon_rqpriostatic_prionormal_priort_prioritysertdlsched_classcore_nodecore_cookiecore_occupationsched_task_groupuclamp_requclampstatspreempt_notifiersbtrace_seqpolicynr_cpus_allowedcpus_ptruser_cpus_ptrcpus_maskmigration_pendingmigration_disabledmigration_flagsrcu_read_lock_nestingrcu_read_unlock_specialrcu_node_entryrcu_blocked_nodercu_tasks_nvcswrcu_tasks_holdoutrcu_tasks_idxrcu_tasks_idle_cpurcu_tasks_holdout_listtrc_reader_nestingtrc_ipi_to_cputrc_reader_specialtrc_reader_checkedtrc_holdout_listsched_infotaskspushable_taskspushable_dl_tasksmmactive_mmvmacacherss_statexit_stateexit_codeexit_signalpdeath_signaljobctlpersonalitysched_reset_on_forksched_contributes_to_loadsched_migratedsched_psi_wake_requeuesched_remote_wakeupin_execvein_iowaitrestore_sigmaskin_user_faultno_cgroup_migrationfrozenuse_memdelayin_memstallin_eventfd_signalpasid_activatedreported_split_lockatomic_flagsrestart_blocktgidstack_canaryreal_parentparentchildrensiblinggroup_leaderptracedptrace_entrythread_pidpid_linksthread_groupthread_nodevfork_doneset_child_tidclear_child_tidworker_privateutimestimegtimeprev_cputimenvcswnivcswstart_timestart_boottimemin_fltmaj_fltposix_cputimersposix_cputimers_workptracer_credreal_credcredcached_requested_keycommnameidatasysvsemsysvshmlast_switch_countlast_switch_timefilesio_uringnsproxysignalsighandblockedreal_blockedsaved_sigmasksas_ss_spsas_ss_sizesas_ss_flagstask_worksaudit_contextloginuidsessionidseccompsyscall_dispatchparent_exec_idself_exec_idalloc_lockpi_lockwake_qpi_waiterspi_top_taskpi_blocked_onjournal_infobio_listplugreclaim_statebacking_dev_infoio_contextcapture_controlptrace_messagelast_siginfoioacpsi_flagsacct_rss_mem1acct_vm_mem1acct_timexpdmems_allowedmems_allowed_seqcpuset_mem_spread_rotorcpuset_slab_spread_rotorcgroupscg_listclosidrmidrobust_listcompat_robust_listpi_state_listpi_state_cachefutex_exit_mutexfutex_stateperf_event_ctxpperf_event_mutexperf_event_listpreempt_disable_ipmempolicyil_prevpref_node_forknuma_scan_seqnuma_scan_periodnuma_scan_period_maxnuma_preferred_nidnuma_migrate_retrynode_stamplast_task_numa_placementlast_sum_exec_runtimenuma_worknuma_groupnuma_faultstotal_numa_faultsnuma_faults_localitynuma_pages_migratedrseqrseq_sigrseq_event_masktlb_ubcsplice_pipetask_fragdelaysnr_dirtiednr_dirtied_pausedirty_paused_whentimer_slack_nsdefault_timer_slack_nscurr_ret_stackcurr_ret_depthret_stackftrace_timestamptrace_overruntracing_graph_pausetracetrace_recursionmemcg_in_oommemcg_oom_gfp_maskmemcg_oom_ordermemcg_nr_pages_over_highactive_memcgthrottle_queueutasksequential_iosequential_io_avgkmap_ctrlpagefault_disabledoom_reaper_listoom_reaper_timerstack_vm_areastack_refcountpatch_statesecuritybpf_storagebpf_ctxmce_vaddrmce_kflagsmce_addrmce_ripvmce_whole_page__mce_reservedmce_kill_memce_countkretprobe_instancesrethooksl1d_flush_killthreadsyscall_workstatuscpuu32refcount_trefcount_structrefssched_entityloadrun_nodegroup_nodeexec_startsum_exec_runtimevruntimeprev_sum_exec_runtimenr_migrationsdepthcfs_rqmy_qrunnable_weightavgload_weightweightinv_weightrb_node__rb_parent_colorrb_rightrb_leftsched_avglast_update_timeload_sumrunnable_sumutil_sumperiod_contribload_avgrunnable_avgutil_avgutil_estenqueuedewmasched_rt_entityrun_listtimeoutwatchdog_stamptime_sliceon_listbacksched_dl_entitydl_runtimedl_deadlinedl_perioddl_bwdl_densityruntimedeadlinedl_throttleddl_yieldeddl_non_contendingdl_overrundl_timerinactive_timerpi_ses64__s64long longhrtimer_softexpiresfunctionbasestateis_relis_softis_hardtimerqueue_nodeexpiresktime_thrtimer_restartHRTIMER_NORESTARTHRTIMER_RESTARTuclamp_sebucket_idactiveuser_definedsched_statisticswait_startwait_maxwait_countwait_sumiowait_countiowait_sumsleep_startsleep_maxsum_sleep_runtimeblock_startblock_maxsum_block_runtimeexec_maxslice_maxnr_migrations_coldnr_failed_migrations_affinenr_failed_migrations_runningnr_failed_migrations_hotnr_forced_migrationsnr_wakeupsnr_wakeups_syncnr_wakeups_migratenr_wakeups_localnr_wakeups_remotenr_wakeups_affinenr_wakeups_affine_attemptsnr_wakeups_passivenr_wakeups_idlecore_forceidle_sumhlist_headfirstcpumask_tcpumaskbitsrcu_specialbsneed_qsexp_hintneed_mbbool_Boolpcountrun_delaylast_arrivallast_queuedplist_nodeprio_listnode_listseqnumvmasvm_area_structvm_startvm_endvm_nextvm_prevvm_rbrb_subtree_gapvm_mmvm_page_protvm_flagsanon_vma_chainanon_vmavm_opsvm_pgoffvm_filevm_private_dataswap_readahead_infovm_policyvm_userfaultfd_ctxpgprot_tpgprotpgprotval_tsharedanon_namerbrb_subtree_lastatomic_long_tatomic64_ttask_rss_statcountarch_datafnfutexnanosleeppolluaddrbitsettimeuaddr2clockidclockid_t__kernel_clockid_ttimespec_typeTT_NONETT_NATIVETT_COMPATrmtpcompat_rmtpufdsnfdshas_timeouttv_sectv_nsecpid_t__kernel_pid_thlist_nodepprevraw_spinlock_tbasestimers_activeexpiry_activeposix_cputimer_basenextevttqheadtimerqueue_headrb_rootrb_root_cachedrb_leftmostscheduledcallback_headuidgidsuidsgideuidegidfsuidfsgidsecurebitscap_inheritablecap_permittedcap_effectivecap_bsetcap_ambientjit_keyringsession_keyringprocess_keyringthread_keyringrequest_key_authuseruser_nsucountsgroup_infokuid_tuid_t__kernel_uid32_tkgid_tgid_t__kernel_gid32_tkernel_cap_tkernel_cap_structcapnon_rcurcusysv_semundo_listsysv_shmshm_clistsigset_tsigsigpendinglistsize_t__kernel_size_t__kernel_ulong_tmodefilter_countfiltersyscall_user_dispatchselectoroffsetlenon_dispatchwake_q_nodekernel_siginfo_ttask_io_accountingrcharwcharsyscrsyscwread_byteswrite_bytescancelled_write_bytesnodemask_tseqcount_spinlock_tseqcount_spinlockseqcountseqcount_tsequencemutexownerwait_lockosqwait_listoptimistic_spin_queueperf_event_contextpmuactive_ctx_listpinned_groupsflexible_groupsevent_listpinned_activeflexible_activenr_eventsnr_activenr_useris_activenr_statnr_freqrotate_disablerotate_necessaryrefcounttimestamptimeoffsetparent_ctxparent_gengenerationpin_countnr_cgroupstask_ctx_dataperf_event_groupstreeindexshorttlbflush_unmap_batcharchflush_requiredwritablearch_tlbflush_unmap_batchrcu_userspage_fragpagesizegfp_ttimer_listentryllist_headthread_structtls_arrayspesdsfsindexgsindexfsbasegsbaseptrace_bpsvirtual_dr6ptrace_dr7cr2trap_nrerror_codeio_bitmapiopl_emuliopl_warnsig_on_uaccess_errpkrufpudesc_structlimit0base0base1dplplimit1avlldgbase2perf_eventevent_entrysibling_listactive_listgroup_indexmigrate_entryhlist_entryactive_entrynr_siblingsevent_capsgroup_capspmu_privateattach_statechild_counttotal_time_enabledtotal_time_runningtstampattrheader_sizeid_header_sizeread_sizehwchild_total_time_enabledchild_total_time_runningchild_mutexchild_listoncpuowner_entrymmap_mutexmmap_countrb_entryrcu_batchesrcu_pendingfasyncpending_wakeuppending_killpending_disablepending_addrevent_limitaddr_filtersaddr_filter_rangesaddr_filters_genaux_eventdestroynsclockoverflow_handleroverflow_handler_contextorig_overflow_handlerprogbpf_cookietp_eventftrace_opscgrpsb_listperf_event_statePERF_EVENT_STATE_DEADPERF_EVENT_STATE_EXITPERF_EVENT_STATE_ERRORPERF_EVENT_STATE_OFFPERF_EVENT_STATE_INACTIVEPERF_EVENT_STATE_ACTIVElocal64_talocal_tperf_event_attrconfigsample_typeread_formatdisabledinheritpinnedexclusiveexclude_userexclude_kernelexclude_hvexclude_idlemmapfreqinherit_statenable_on_execwatermarkprecise_ipmmap_datasample_id_allexclude_hostexclude_guestexclude_callchain_kernelexclude_callchain_usermmap2comm_execuse_clockidcontext_switchwrite_backwardnamespacesksymbolbpf_eventaux_outputcgrouptext_pokebuild_idinherit_threadremove_on_execsigtrap__reserved_1bp_typebranch_sample_typesample_regs_usersample_stack_usersample_regs_intraux_watermarksample_max_stack__reserved_2aux_sample_size__reserved_3sig_datasample_periodsample_freqwakeup_eventswakeup_watermarkbp_addrkprobe_funcuprobe_pathconfig1bp_lenkprobe_addrprobe_offsetconfig2__s32hw_perf_eventtargetprev_countinterrupts_seqinterruptsfreq_time_stampfreq_count_stamplast_tagconfig_baseevent_baseevent_base_rdpmcidxlast_cpuextra_regbranch_reghw_perf_event_extraregalloctp_listpwr_accptscinfobp_listarch_hw_breakpointaddressiommu_bankiommu_cntrpaddingconfconf1last_periodperiod_leftsaved_metricsaved_slotsperf_addr_filters_headnr_file_filtersperf_overflow_handler_tperf_sample_dataaddrrawbr_stackperiodtxndata_srciptid_entrystream_idcpu_entrycallchainaux_sizeregs_userregs_intrstack_user_sizephys_addrdata_page_sizecode_page_sizeperf_sample_weightfullvar1_dwvar2_wvar3_wperf_mem_data_srcmem_opmem_lvlmem_snoopmem_lockmem_dtlbmem_lvl_nummem_remotemem_snoopxmem_blkmem_hopsmem_rsvdtidreservedperf_regsabiregspt_regsr15r14r13r12bpbxr11r10r9r8axcxdxsidiorig_axcsssprivatesaved_funclocal_hashfunc_hashold_hashtrampolinetrampoline_sizeftrace_func_tftrace_regsftrace_ops_hashnotrace_hashfilter_hashregex_lockavx512_timestampfpstate__task_fpstatepermguest_perm__fpstatefpu_state_perm__state_perm__state_size__user_state_sizeuser_sizexfeaturesuser_xfeaturesxfdis_vallocis_guestis_confidentialin_usefpregs_statefsavefxsavesoftxsave__paddingfregs_statecwdswdtwdfipfcsfoofosst_spacefxregs_statefopmxcsrmxcsr_maskxmm_spaceriprdppadding1sw_reservedswregs_stateftopchangedlookaheadno_updatermalimitentry_eipxregs_statei387headerextended_state_areaxstate_headerxcomp_bv0:128 eventp->mnt_ns = BPF_CORE_READ(task, nsproxy, mnt_ns, ns.inum);uts_nsipc_nsmnt_nspid_ns_for_childrennet_nstime_nstime_ns_for_childrencgroup_ns0:3mnt_namespacerootns_lockseqeventmountspending_mountsns_commonstashedopsinum0:0:2 eventp->ret = ret; eventp->op = argp->op; bpf_get_current_comm(&eventp->comm, sizeof(eventp->comm)); if (argp->src) bpf_probe_read_user_str(eventp->src, sizeof(eventp->src), argp->src); eventp->src[0] = '\0'; if (argp->dest) bpf_probe_read_user_str(eventp->dest, sizeof(eventp->dest), argp->dest); eventp->dest[0] = '\0'; if (argp->fs) bpf_probe_read_user_str(eventp->fs, sizeof(eventp->fs), argp->fs); eventp->fs[0] = '\0'; if (argp->data) bpf_probe_read_user_str(eventp->data, sizeof(eventp->data), argp->data); eventp->data[0] = '\0'; if (bpf_core_type_exists(struct bpf_ringbuf)) { bpf_ringbuf_submit(buf, 0); return 0; return bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, buf, size); bpf_map_delete_elem(&args, &tid);}umount_entrytracepoint/syscalls/sys_enter_umount __u64 flags = (__u64)ctx->args[1]; const char *dest = (const char *)ctx->args[0]; return probe_entry(NULL, dest, NULL, flags, NULL, UMOUNT);umount_exittracepoint/syscalls/sys_exit_umounttarget_pidLICENSEreserve_buf.zero.maps.rodatalicensemm_structanon_vma_namevm_operations_structnetuser_namespacefilepipe_inode_infofasync_structuser_structproc_ns_operationsuts_namespaceipc_namespacecompletionmountpid_namespacetime_namespacecgroup_namespacecss_setbpf_local_storagemem_cgrouphrtimer_clock_basebpf_progfs_structblk_plugsignal_structsighand_structtrace_event_callevent_filterftrace_hashperf_cgroupperf_bufferperf_addr_filter_rangeperf_raw_recordperf_branch_stackperf_callchain_entryrequest_queueuserfaultfd_ctxkernel_siginfotask_grouprcu_node__kernel_timespecold_timespec32pollfdsem_undo_listfiles_structio_uring_taskseccomp_filterrt_mutex_waiterrobust_list_headcompat_robust_list_headfutex_pi_statetask_delay_infoftrace_ret_stackuprobe_taskvm_structbpf_run_ctxmath_emu_info TT< >*U.1]34>h#hh ! hF#(h|"0hd8hlHh pPh xhh xph xxh3hh xhP hn h h h h hP hhUh|#h| h|2hh h8h Xh ptx  xh;I h;hthh- h%(h0h8h@hHh Ph xh\/h\/hT0 h\/ hh0(hh0 0h0 @h0`h0 hh0ph0h1$h-1 (h-1(h>1,h14h1 8h18h1< h1D8h2 H@h2HHh 2Lhhk2Tx2222 h+3hhN3p]3h3h3#hdhl(h p0h xHh xPh xXh3h`h xhhP ph xh hP hn h hn hh34h|#h| h|>!b!!: !@(!vU,xh2XSV/~/N0p2]3!@!v4,x    0     F 8 x   P   0   EE F F $F > `? @ `@0 E E FHdJKL8MT OzRx $FJ w?;*3$"D \p pl x t  1 X T 4` 6EID  AAB v CAF 04h}AHH x DAB gDA8hBII G(K0[(D BBBpFBB A(D0[ (A BBBG y (C BBBF 48N@SHAPEXH`K0l8N@[8A0$EH4FBB B(A0A8Dpb 8A0A(B BBBA HFBB B(A0C8KP 8A0A(B BBBA 4pFLA G  AABA 8!(TFCD ~ ABB HDFED D(G0q (C ABBE t(A ADB 9$8YJT J M K M$ACD CAh66LBBB E(A0A8G 8A0A(B BBBA HlPFHE I(A0K (A BBBA A(F BBB,AAG L! AAD PTBBB B(A0A8G L! 8C0A(B BBBA 4<ADG  AAA t CAG th  1JXL!FIB B(A0A8G! 8D0A(B BBBF #44$JFAA t ABA FAB4@L$KDA VDBT dx$FBB B(A0A8G L##M#D#B#b# 8A0A(B BBBH (iE`} AA 8)lH  I V A ($)}EJ J AF T CA $P)BEFK fDA(x*YJDD wDA(8*FAD w ABK (*YJDD wDAL*YFIB B(A0A8G 8D0A(B BBBD L,34`,,JFAA t ABA FAB\D,YNJH B(D0A8GPXH`aXAPI 8A0A(B BBBH xPD-9NJH E(D0D8IP 8A0A(B BBBG XL 0.JH0| A 8h d.FIA A(D (C ABBA 4 .FDA d CBD ADBL @/rFIE B(A0A8Gj 8A0A(B BBBE @, p1FAA G I o H q _  AABE p 2/EZ A N 2lEDp\ AA h2EO CA  3:Hq` (3GFGB B(A0A8G[DAS0 8D0A(B BBBA X  x 71JV H AG8 8FMP A(L`K (A ABBA L 8FLJ B(A0A8IZ 8C0A(B BBBA \( d:FBF D(Dx (G ABBF  (A ABBF X (G ABBL 8 ;0FDA V ABD f ABG 4 <EHD t DAF f DAE  =EJP =FBB B(A0A8GK 8D0A(B BBBA ,l p?=EC M A HHΐdnx˒֒*5>HTan} @ 00\8\o`8 1 _ p+  ooojog`]6@F@V@f@v@@@@@@@@@AA&A6AFAVAfAvAAAAAAAAABB&B6BFBVBfBvBBBBBBBBBCC&C6CFCVCfCvCCCCCCCCCDD&D6DFDVDfDvDDDDDDDDDEE&E6EFEVEfEvEEEEEEEEEFF&F6FFFVFfFvFFFFFFFFFGG&G6GFGVGfGvGGGGGGGcI IHIPTPQPLNH@IՐ(07BIPU[kՐ(07BIPU[kБߑ#3DTʓד",4>IT.shstrtab.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.got.plt.data.bss 88$o``( 00881 8ojjDEoT ^Bp+p+ h@@c @ @nGGwHH-F@}00 Ы;;<>> 0\0L8\8L@\@L  `]`M r_OX_OcSt `fTV* TV