eBPF观测实验：CVE-2026-31431 Copy Fail
实验目标
1、分析CVE-2026-31431的POC做了什么
2、可能的原因
3、其他可能性
4、eBPF程序设计
实验
该漏洞利用内核加密模块（AF_ALG）与零拷贝机制（splice）的逻辑缺陷，实现了对只读系统文件的内存级篡改。
结合了Linux内核命令说明与AI分析，通过逐步理解得出的结论。
也有可能不对哈，毕竟我只是初学者。看个乐子就好了。
实验数据
因此通过strace工具进行数据主要采集获得以下数据：
注意以下内容并非完整的脚本运行过程产生的数据，只是采集了主要部分，全部数据太大了，大概有一万多条
#######################准备阶段##################################################
14:08:14.711857 execve("/usr/bin/python3", ["python3", "copy-fail-CVE-2026-31431.py"], 0x7ffc5569a920 /* 26 vars */) = 0 <0.001017>
14:08:14.714008 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000055>
14:08:14.714522 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 3 <0.000083>
14:08:14.714726 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000055>
14:08:14.715498 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libexpat.so.1", O_RDONLY|O_CLOEXEC) = 3 <0.000058>
14:08:14.715678 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000055>
14:08:14.717194 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = 3 <0.000051>
14:08:14.717382 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832 <0.000061>
14:08:14.718948 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 <0.000112>
14:08:14.719182 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\237\2\0\0\0\0\0"..., 832) = 832 <0.000042>
14:08:14.722344 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3 <0.000018>
14:08:14.722640 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 3 <0.000019>
14:08:14.724453 openat(AT_FDCWD, "/usr/bin/pyvenv.cfg", O_RDONLY) = -1 ENOENT (No such file or directory) <0.000014>
14:08:14.724621 openat(AT_FDCWD, "/usr/pyvenv.cfg", O_RDONLY) = -1 ENOENT (No such file or directory) <0.000016>
14:08:14.724838 openat(AT_FDCWD, "/usr/bin/pybuilddir.txt", O_RDONLY) = -1 ENOENT (No such file or directory) <0.000011>
14:08:14.726180 openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 3 <0.000015>
14:08:14.726317 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 561 <0.000010>
14:08:14.726393 read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 342 <0.000022>
14:08:14.726807 openat(AT_FDCWD, "/usr/lib/python3.10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000036>
14:08:14.727299 openat(AT_FDCWD, "/usr/lib/python3.10/encodings/__pycache__/__init__.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000014>
14:08:14.727554 read(3, "o\r\r\n\0\0\0\0\341\275\ti\364\25\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 3876) = 3875 <0.000010>
14:08:14.727646 read(3, "", 1) = 0 <0.000009>
14:08:14.727911 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/codecs.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000053>
14:08:14.728124 read(3, "o\r\r\n\0\0\0\0\341\275\tij\217\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 33220) = 33219 <0.000025>
14:08:14.728257 read(3, "", 1) = 0 <0.000009>
14:08:14.728800 openat(AT_FDCWD, "/usr/lib/python3.10/encodings", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000049>
14:08:14.729160 openat(AT_FDCWD, "/usr/lib/python3.10/encodings/__pycache__/aliases.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000051>
14:08:14.729396 read(3, "o\r\r\n\0\0\0\0\341\275\ti==\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 10922) = 10921 <0.000030>
14:08:14.729498 read(3, "", 1) = 0 <0.000036>
14:08:14.729907 openat(AT_FDCWD, "/usr/lib/python3.10/encodings/__pycache__/utf_8.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000017>
14:08:14.730126 read(3, "o\r\r\n\0\0\0\0\341\275\ti\355\3\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1598) = 1597 <0.000016>
14:08:14.730206 read(3, "", 1) = 0 <0.000044>
14:08:14.731992 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/io.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000060>
14:08:14.732222 read(3, "o\r\r\n\0\0\0\0\341\275\tid\20\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 3664) = 3663 <0.000010>
14:08:14.732263 read(3, "", 1) = 0 <0.000037>
14:08:14.732535 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/abc.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000017>
14:08:14.732736 read(3, "o\r\r\n\0\0\0\0\341\275\tiz\31\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 6752) = 6751 <0.000012>
14:08:14.732811 read(3, "", 1) = 0 <0.000009>
14:08:14.733920 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/site.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000027>
14:08:14.734156 read(3, "o\r\r\n\0\0\0\0\341\275\tis\\\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 17923) = 17922 <0.000024>
14:08:14.734236 read(3, "", 1) = 0 <0.000023>
14:08:14.734650 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/os.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000030>
14:08:14.734952 read(3, "o\r\r\n\0\0\0\0\341\275\ti\205\232\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 31600) = 31599 <0.000030>
14:08:14.735078 read(3, "", 1) = 0 <0.000008>
14:08:14.735939 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/stat.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000030>
14:08:14.736231 read(3, "o\r\r\n\0\0\0\0\341\275\tim\25\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4274) = 4273 <0.000027>
14:08:14.736313 read(3, "", 1) = 0 <0.000026>
14:08:14.736681 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/_collections_abc.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000038>
14:08:14.736895 read(3, "o\r\r\n\0\0\0\0\341\275\ti\34~\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32926) = 32925 <0.000030>
14:08:14.736976 read(3, "", 1) = 0 <0.000022>
14:08:14.737964 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/posixpath.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000022>
14:08:14.738155 read(3, "o\r\r\n\0\0\0\0\341\275\ti\373>\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 10561) = 10560 <0.000016>
14:08:14.738218 read(3, "", 1) = 0 <0.000024>
14:08:14.738512 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/genericpath.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000034>
14:08:14.738736 read(3, "o\r\r\n\0\0\0\0\341\275\tio\23\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 3908) = 3907 <0.000011>
14:08:14.738848 read(3, "", 1) = 0 <0.000008>
14:08:14.739337 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/_sitebuiltins.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000014>
14:08:14.739556 read(3, "o\r\r\n\0\0\0\0\341\275\ti8\f\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 3548) = 3547 <0.000009>
14:08:14.739662 read(3, "", 1) = 0 <0.000008>
14:08:14.740177 openat(AT_FDCWD, "/usr/local/lib/python3.10/dist-packages", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000013>
14:08:14.740422 openat(AT_FDCWD, "/usr/lib/python3/dist-packages", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000012>
14:08:14.741012 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/sitecustomize.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000016>
14:08:14.741238 read(3, "o\r\r\n\0\0\0\0\223\21Hb\233\0\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 226) = 225 <0.000011>
14:08:14.741313 read(3, "", 1) = 0 <0.000043>
14:08:14.741597 openat(AT_FDCWD, "/usr/lib/python3.10/lib-dynload", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000068>
14:08:14.741945 openat(AT_FDCWD, "/usr/local/lib/python3.10/dist-packages", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000050>
14:08:14.742231 openat(AT_FDCWD, "/usr/lib/python3/dist-packages", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000053>
14:08:14.742736 openat(AT_FDCWD, "/usr/lib/python3/dist-packages/__pycache__/apport_python_hook.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000054>
14:08:14.742985 read(3, "o\r\r\n\0\0\0\0\345v\216f\177\37\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4662) = 4661 <0.000010>
14:08:14.743058 read(3, "", 1) = 0 <0.000033>
14:08:14.743435 openat(AT_FDCWD, "/home/adminuser/Desktop/copy-fail-CVE-2026-31431.py", O_RDONLY|O_CLOEXEC) = 3 <0.000018>
14:08:14.743644 read(3, " shell\r\ng.system(\"su\")", 4096) = 22 <0.000010>
14:08:14.743823 read(3, "#!/usr/bin/env python3\r\nimport o"..., 1899) = 1898 <0.000009>
14:08:14.743891 read(3, "", 1) = 0 <0.000018>
14:08:14.744163 openat(AT_FDCWD, "/home/adminuser/Desktop/copy-fail-CVE-2026-31431.py", O_RDONLY) = 3 <0.000044>
14:08:14.744381 read(3, "#!/usr/bin/env python3\r\nimport o"..., 4096) = 1898 <0.000010>
14:08:14.744483 read(3, "#!/usr/bin/env python3\r\nimport o"..., 4096) = 1898 <0.000012>
14:08:14.744808 read(3, "", 4096) = 0 <0.000010>
14:08:14.745309 openat(AT_FDCWD, "/home/adminuser/Desktop", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000059>
14:08:14.745631 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/socket.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000014>
14:08:14.745871 read(3, "o\r\r\n\0\0\0\0\341\275\ti\261\217\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 28964) = 28963 <0.000056>
14:08:14.745986 read(3, "", 1) = 0 <0.000009>
14:08:14.746515 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/selectors.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000018>
14:08:14.746751 read(3, "o\r\r\n\0\0\0\0\341\275\tiPL\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 17106) = 17105 <0.000055>
14:08:14.746884 read(3, "", 1) = 0 <0.000009>
14:08:14.747282 openat(AT_FDCWD, "/usr/lib/python3.10/collections/__pycache__/__init__.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000052>
14:08:14.747498 read(3, "o\r\r\n\0\0\0\0\341\275\ti\306\310\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 48454) = 48453 <0.000031>
14:08:14.747634 read(3, "", 1) = 0 <0.000010>
14:08:14.748207 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/keyword.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000052>
14:08:14.748450 read(3, "o\r\r\n\0\0\0\0\341\275\ti%\4\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 928) = 927 <0.000012>
14:08:14.748524 read(3, "", 1) = 0 <0.000013>
14:08:14.748879 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/operator.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000040>
14:08:14.749092 read(3, "o\r\r\n\0\0\0\0\341\275\ti\377)\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 13509) = 13508 <0.000032>
14:08:14.749203 read(3, "", 1) = 0 <0.000007>
14:08:14.749628 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/reprlib.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000013>
14:08:14.749818 read(3, "o\r\r\n\0\0\0\0\341\275\ti\223\24\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 5251) = 5250 <0.000010>
14:08:14.749859 read(3, "", 1) = 0 <0.000036>
14:08:14.750959 openat(AT_FDCWD, "/usr/lib/python3.10/collections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 <0.000019>
14:08:14.751238 openat(AT_FDCWD, "/usr/lib/python3.10/collections/__pycache__/abc.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000013>
14:08:14.751417 read(3, "o\r\r\n\0\0\0\0\341\275\tiw\0\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 239) = 238 <0.000010>
14:08:14.751488 read(3, "", 1) = 0 <0.000056>
14:08:14.752137 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/enum.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000017>
14:08:14.752351 read(3, "o\r\r\n\0\0\0\0\341\275\ti\227\233\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 26064) = 26063 <0.000050>
14:08:14.752467 read(3, "", 1) = 0 <0.000032>
14:08:14.752862 openat(AT_FDCWD, "/usr/lib/python3.10/__pycache__/types.cpython-310.pyc", O_RDONLY|O_CLOEXEC) = 3 <0.000013>
14:08:14.753038 read(3, "o\r\r\n\0\0\0\0\341\275\ti\205'\0\0\343\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 9526) = 9525 <0.000009>
14:08:14.753104 read(3, "", 1) = 0 <0.000039>
14:08:14.754667 openat(AT_FDCWD, "/usr/bin/su", O_RDONLY|O_CLOEXEC) = 3 <0.000070>
#######################利用阶段##################################################
14:08:14.754850 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000019>
14:08:14.755023 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000016>
14:08:14.755152 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000009>
14:08:14.755342 splice(3, [0], 7, NULL, 4, 0) = 4 <0.000043>
14:08:14.755439 splice(6, NULL, 5, NULL, 4, 0) = 4 <0.000031>
14:08:14.755722 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000020>
14:08:14.755883 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000037>
14:08:14.755973 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.756181 splice(3, [0], 9, NULL, 8, 0) = 8 <0.000042>
14:08:14.756256 splice(8, NULL, 5, NULL, 8, 0) = 8 <0.000039>
14:08:14.756534 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000017>
14:08:14.756697 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.756774 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000050>
14:08:14.756999 splice(3, [0], 11, NULL, 12, 0) = 12 <0.000011>
14:08:14.757080 splice(10, NULL, 5, NULL, 12, 0) = 12 <0.000015>
14:08:14.757337 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000030>
14:08:14.757451 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000027>
14:08:14.757536 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.757716 splice(3, [0], 13, NULL, 16, 0) = 16 <0.000026>
14:08:14.757795 splice(12, NULL, 5, NULL, 16, 0) = 16 <0.000023>
14:08:14.758031 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000017>
14:08:14.758125 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.758210 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000029>
14:08:14.758381 splice(3, [0], 15, NULL, 20, 0) = 20 <0.000030>
14:08:14.758449 splice(14, NULL, 5, NULL, 20, 0) = 20 <0.000009>
14:08:14.758717 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000013>
14:08:14.758837 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000010>
14:08:14.758882 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000016>
14:08:14.759089 splice(3, [0], 17, NULL, 24, 0) = 24 <0.000014>
14:08:14.759168 splice(16, NULL, 5, NULL, 24, 0) = 24 <0.000008>
14:08:14.759407 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.759519 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000053>
14:08:14.759606 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000013>
14:08:14.759786 splice(3, [0], 19, NULL, 28, 0) = 28 <0.000008>
14:08:14.759826 splice(18, NULL, 5, NULL, 28, 0) = 28 <0.000017>
14:08:14.760104 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000017>
14:08:14.760217 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000042>
14:08:14.760300 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000015>
14:08:14.760504 splice(3, [0], 21, NULL, 32, 0) = 32 <0.000014>
14:08:14.760571 splice(20, NULL, 5, NULL, 32, 0) = 32 <0.000011>
14:08:14.760990 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000049>
14:08:14.761125 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000031>
14:08:14.761215 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000023>
14:08:14.761401 splice(3, [0], 23, NULL, 36, 0) = 36 <0.000030>
14:08:14.761534 splice(22, NULL, 5, NULL, 36, 0) = 36 <0.000016>
14:08:14.762201 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000326>
14:08:14.762654 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000124>
14:08:14.762927 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000014>
14:08:14.763128 splice(3, [0], 25, NULL, 40, 0) = 40 <0.000028>
14:08:14.763209 splice(24, NULL, 5, NULL, 40, 0) = 40 <0.000030>
14:08:14.763469 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000035>
14:08:14.763718 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000022>
14:08:14.763814 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000042>
14:08:14.764077 splice(3, [0], 27, NULL, 44, 0) = 44 <0.000029>
14:08:14.764197 splice(26, NULL, 5, NULL, 44, 0) = 44 <0.000014>
14:08:14.764530 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000040>
14:08:14.764673 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000034>
14:08:14.764777 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000031>
14:08:14.764995 splice(3, [0], 29, NULL, 48, 0) = 48 <0.000015>
14:08:14.765083 splice(28, NULL, 5, NULL, 48, 0) = 48 <0.000023>
14:08:14.765401 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.765540 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000027>
14:08:14.765623 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000024>
14:08:14.765796 splice(3, [0], 31, NULL, 52, 0) = 52 <0.000016>
14:08:14.765874 splice(30, NULL, 5, NULL, 52, 0) = 52 <0.000030>
14:08:14.766171 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000034>
14:08:14.766285 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.766368 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.766543 splice(3, [0], 33, NULL, 56, 0) = 56 <0.000026>
14:08:14.766628 splice(32, NULL, 5, NULL, 56, 0) = 56 <0.000013>
14:08:14.766877 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000029>
14:08:14.766988 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000030>
14:08:14.767070 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.767275 splice(3, [0], 35, NULL, 60, 0) = 60 <0.000012>
14:08:14.767362 splice(34, NULL, 5, NULL, 60, 0) = 60 <0.000032>
14:08:14.767621 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.767744 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000011>
14:08:14.767818 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000043>
14:08:14.768014 splice(3, [0], 37, NULL, 64, 0) = 64 <0.000039>
14:08:14.768116 splice(36, NULL, 5, NULL, 64, 0) = 64 <0.000034>
14:08:14.768377 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000030>
14:08:14.768534 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.768618 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000009>
14:08:14.768785 splice(3, [0], 39, NULL, 68, 0) = 68 <0.000014>
14:08:14.768859 splice(38, NULL, 5, NULL, 68, 0) = 68 <0.000033>
14:08:14.769117 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000017>
14:08:14.769229 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000011>
14:08:14.769312 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000037>
14:08:14.769492 splice(3, [0], 41, NULL, 72, 0) = 72 <0.000014>
14:08:14.769579 splice(40, NULL, 5, NULL, 72, 0) = 72 <0.000008>
14:08:14.769826 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000044>
14:08:14.769970 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000042>
14:08:14.770078 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000039>
14:08:14.770280 splice(3, [0], 43, NULL, 76, 0) = 76 <0.000014>
14:08:14.770362 splice(42, NULL, 5, NULL, 76, 0) = 76 <0.000038>
14:08:14.770642 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000015>
14:08:14.770763 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000027>
14:08:14.770865 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000017>
14:08:14.771069 splice(3, [0], 45, NULL, 80, 0) = 80 <0.000015>
14:08:14.771152 splice(44, NULL, 5, NULL, 80, 0) = 80 <0.000033>
14:08:14.771431 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.771569 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000026>
14:08:14.771693 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000042>
14:08:14.771891 splice(3, [0], 47, NULL, 84, 0) = 84 <0.000014>
14:08:14.771970 splice(46, NULL, 5, NULL, 84, 0) = 84 <0.000009>
14:08:14.772209 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.772345 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000044>
14:08:14.772429 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000043>
14:08:14.772643 splice(3, [0], 49, NULL, 88, 0) = 88 <0.000051>
14:08:14.772729 splice(48, NULL, 5, NULL, 88, 0) = 88 <0.000013>
14:08:14.773004 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.773117 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000044>
14:08:14.773197 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000042>
14:08:14.773406 splice(3, [0], 51, NULL, 92, 0) = 92 <0.000013>
14:08:14.773487 splice(50, NULL, 5, NULL, 92, 0) = 92 <0.000011>
14:08:14.773734 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000013>
14:08:14.773841 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000014>
14:08:14.773908 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.774109 splice(3, [0], 53, NULL, 96, 0) = 96 <0.000014>
14:08:14.774189 splice(52, NULL, 5, NULL, 96, 0) = 96 <0.000008>
14:08:14.774424 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000015>
14:08:14.774533 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.774627 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000008>
14:08:14.774792 splice(3, [0], 55, NULL, 100, 0) = 100 <0.000014>
14:08:14.774865 splice(54, NULL, 5, NULL, 100, 0) = 100 <0.000020>
14:08:14.775132 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000045>
14:08:14.775274 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.775362 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000046>
14:08:14.775566 splice(3, [0], 57, NULL, 104, 0) = 104 <0.000013>
14:08:14.775654 splice(56, NULL, 5, NULL, 104, 0) = 104 <0.000008>
14:08:14.775896 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000044>
14:08:14.776038 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.776119 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.776319 splice(3, [0], 59, NULL, 108, 0) = 108 <0.000014>
14:08:14.776401 splice(58, NULL, 5, NULL, 108, 0) = 108 <0.000038>
14:08:14.776686 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000012>
14:08:14.776793 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000014>
14:08:14.776875 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000024>
14:08:14.777099 splice(3, [0], 61, NULL, 112, 0) = 112 <0.000013>
14:08:14.777174 splice(60, NULL, 5, NULL, 112, 0) = 112 <0.000035>
14:08:14.777444 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000048>
14:08:14.777597 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000011>
14:08:14.777669 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000045>
14:08:14.777879 splice(3, [0], 63, NULL, 116, 0) = 116 <0.000014>
14:08:14.777948 splice(62, NULL, 5, NULL, 116, 0) = 116 <0.000008>
14:08:14.778189 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000015>
14:08:14.778332 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.778380 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000010>
14:08:14.778585 splice(3, [0], 65, NULL, 120, 0) = 120 <0.000014>
14:08:14.778677 splice(64, NULL, 5, NULL, 120, 0) = 120 <0.000008>
14:08:14.778917 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000016>
14:08:14.779108 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000014>
14:08:14.779217 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000042>
14:08:14.779470 splice(3, [0], 67, NULL, 124, 0) = 124 <0.000017>
14:08:14.779566 splice(66, NULL, 5, NULL, 124, 0) = 124 <0.000014>
14:08:14.779836 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000049>
14:08:14.779987 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.780035 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000015>
14:08:14.780252 splice(3, [0], 69, NULL, 128, 0) = 128 <0.000014>
14:08:14.780336 splice(68, NULL, 5, NULL, 128, 0) = 128 <0.000050>
14:08:14.780621 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000054>
14:08:14.780779 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000041>
14:08:14.780887 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000046>
14:08:14.781134 splice(3, [0], 71, NULL, 132, 0) = 132 <0.000025>
14:08:14.781231 splice(70, NULL, 5, NULL, 132, 0) = 132 <0.000017>
14:08:14.781510 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000018>
14:08:14.781635 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.781730 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000026>
14:08:14.781947 splice(3, [0], 73, NULL, 136, 0) = 136 <0.000010>
14:08:14.782017 splice(72, NULL, 5, NULL, 136, 0) = 136 <0.000034>
14:08:14.782300 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000017>
14:08:14.782415 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.782492 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000054>
14:08:14.782705 splice(3, [0], 75, NULL, 140, 0) = 140 <0.000014>
14:08:14.782753 splice(74, NULL, 5, NULL, 140, 0) = 140 <0.000016>
14:08:14.783028 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000034>
14:08:14.783161 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000014>
14:08:14.783311 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000044>
14:08:14.783691 splice(3, [0], 77, NULL, 144, 0) = 144 <0.000123>
14:08:14.783852 splice(76, NULL, 5, NULL, 144, 0) = 144 <0.000015>
14:08:14.784339 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000018>
14:08:14.784577 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000169>
14:08:14.784823 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000008>
14:08:14.785182 splice(3, [0], 79, NULL, 148, 0) = 148 <0.000009>
14:08:14.785225 splice(78, NULL, 5, NULL, 148, 0) = 148 <0.000017>
14:08:14.785511 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000014>
14:08:14.785706 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000015>
14:08:14.785795 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000026>
14:08:14.785973 splice(3, [0], 81, NULL, 152, 0) = 152 <0.000014>
14:08:14.786037 splice(80, NULL, 5, NULL, 152, 0) = 152 <0.000025>
14:08:14.786540 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000014>
14:08:14.786676 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.786724 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000017>
14:08:14.786977 splice(3, [0], 83, NULL, 156, 0) = 156 <0.000014>
14:08:14.787058 splice(82, NULL, 5, NULL, 156, 0) = 156 <0.000046>
14:08:14.787347 socket(AF_ALG, SOCK_SEQPACKET|SOCK_CLOEXEC, 0) = 4 <0.000015>
14:08:14.787479 setsockopt(4, SOL_ALG, ALG_SET_KEY, "\10\0\1\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 0 <0.000013>
14:08:14.787574 setsockopt(4, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) = 0 <0.000013>
14:08:14.787778 splice(3, [0], 85, NULL, 160, 0) = 160 <0.000013>
14:08:14.787889 splice(84, NULL, 5, NULL, 160, 0) = 160 <0.000014>
strace: Process 3841 attached
[pid 3841] 14:08:14.801666 execve("/bin/sh", ["sh", "-c", "su"], 0x7ffe582ed530 /* 26 vars */) = 0 <0.000366>
[pid 3841] 14:08:14.802416 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000026>
[pid 3841] 14:08:14.802650 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 <0.000017>
[pid 3841] 14:08:14.802744 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\237\2\0\0\0\0\0"..., 832) = 832 <0.000062>
strace: Process 3842 attached
[pid 3842] 14:08:14.804323 execve("/usr/bin/su", ["su"], 0x5d74512546e8 /* 27 vars */) = 0 <0.000398>
[pid 3842] 14:08:14.804831 execve("/bin/sh", NULL, NULL) = 0 <0.000311>
[pid 3842] 14:08:14.805836 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000069>
[pid 3842] 14:08:14.806466 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 <0.000117>
[pid 3842] 14:08:14.806682 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\237\2\0\0\0\0\0"..., 832) = 832 <0.000048>
[pid 3842] 14:08:14.813190 openat(AT_FDCWD, "/dev/tty", O_RDWR) = 3 <0.000487>
[pid 3842] 14:08:14.815952 write(2, "# ", 2# ) = 2 <0.000079>
[pid 3842] 14:08:14.816197 read(0,
"\n", 8192) = 1 <4.614630>
[pid 3842] 14:08:19.430977 write(2, "# ", 2# ) = 2 <0.000048>
[pid 3842] 14:08:19.431165 read(0,
"\n", 8192) = 1 <0.818812>
[pid 3842] 14:08:20.250077 write(2, "# ", 2# ) = 2 <0.000012>
[pid 3842] 14:08:20.250141 read(0,
"\n", 8192) = 1 <0.505861>
[pid 3842] 14:08:20.756090 write(2, "# ", 2# ) = 2 <0.000013>
准备阶段分析
在利用的初始阶段，Python 脚本主要在进行环境准备，加载 socket、os 等必要的模块。但在这一系列看似常规的操作中，有一行关键的系统调用为后续的漏洞利用埋下了伏笔：
openat(AT_FDCWD, "/usr/bin/su", O_RDONLY|O_CLOEXEC) = 3
目标锁定：攻击脚本使用 openat 系统调用，以只读模式（O_RDONLY）打开了目标文件 /usr/bin/su。
获取权柄：内核返回了文件描述符（FD）3。
此时，攻击者虽然只拥有“读取”权限，但已经成功让内核将 /usr/bin/su 的内存页（Page Cache）映射到了当前进程空间，并拿到了操作该文件的“钥匙”（FD 3）。
利用阶段
通过分析 POC 的执行流，可以发现 Shellcode 的写入并非一蹴而就，而是通过循环通信、分块写入完成的。这一阶段的核心在于利用 socket 创建加密通道，并结合 splice 进行数据流转。
创建加密通道：利用 socket(AF_ALG, ...) 创建了一个加密套接字，并通过 setsockopt 协商加密算法（如 AES-GCM）。
1、创建加密通道：利用 socket(AF_ALG, ...) 创建了一个加密套接字，并通过 setsockopt 协商加密算法（如 AES-GCM）。
2、建立数据管道：利用 splice 系统调用，将 FD 3（/usr/bin/su）与加密套接字连接起来。
核心原理
要理解这个漏洞，必须清楚两个核心技术的特性及其在攻击中的角色。
- Splice 的“零拷贝”特性：借而非送
通常的数据传输（如 read/write）涉及数据的复制（Copy），即把数据从内核态拷贝到用户态，再拷贝回内核态。而 splice 是一种零拷贝机制。
本质：它不进行数据复制，而是直接共享内存页的引用（指针）。
攻击视角：攻击者通过 splice，将 /usr/bin/su 所在的只读内存页地址，“借”给了加密模块。这就像是你把图书馆的孤本（只读文件）直接抱到了复印室（加密模块），而不是复印一份带过去。
2、AF_ALG 的校验缺失
AF_ALG 是内核提供的加密接口。正常情况下，加密操作需要一个可写的缓冲区来存放加密后的密文或认证标签。
漏洞点：内核在处理 AF_ALG 的写入请求时，存在逻辑缺陷。它默认加密模块操作的内存区域是合法的、可写的输出缓冲区，因此未对该区域的写入权限进行二次校验。
整体利用过程
结合上述分析，可以将整个漏洞利用过程重构为以下四个步骤，这实际上是一个利用内核信任机制的“欺骗”过程：
1、攻击者通过 socket 在内核中申请了一块 AF_ALG 加密区域，并配置好算法。此时，内核认为这块区域是用于加密运算的“工作区”。
2、攻击者利用 splice 的零拷贝特性，将 FD 3（/usr/bin/su 的只读内存页）的地址映射到了 AF_ALG 的操作列表中。
3、攻击者向 AF_ALG 发送加密请求。加密模块在处理数据时，需要将结果（如认证标签）写回内存。由于之前的“偷梁换柱”，加密模块手中的目标地址实际上指向了 /usr/bin/su。
4、内核执行写入操作。由于操作发起者是受信任的加密模块（AF_ALG），内核的信任机制（“迷雾层”）生效，它误以为这是在写入普通的输出缓冲区，从而绕过了对“只读保护区”的检查。
eBPF代码检测
开发环境
- 操作系统：Ubuntu 22.04 LTS
- 内核版本：Kernel 6.8.0-110-generic
- 开发语言：Python 3.8
设计权重
- 内核探针：挂载到socket、bind、splice三个系统调用，捕获攻击行为。
- 评分权重：对每个进程进行动态评分，当累计得分超过阈值(70)时判定为攻击。
- 状态追踪：利用eBPF的BPF_HASH数据结构，在探针之间传递进程状态(如待关联的AF_ALG文件描述符)。
Tips：呃，我的系统不知道为什么libbpf+core编写的代码过不了BTF校验，加载不进去，因此采用了Python框架的BCC架构
#!/usr/bin/env python3
from bcc import BPF
import time
bpf_text = """
#include <uapi/linux/ptrace.h>
#include <uapi/linux/un.h>
#include <linux/socket.h>
// 数据结构定义
BPF_HASH(suspicion_score, u32, u32); // 评分系统
BPF_HASH(pending_afalg_fds, u32, int); // 状态机
// 定义魔术数字
#define MAGIC_AEAD 0x64616561 // "daea" -> "aead"
#define MAGIC_AUTH 0x68747561 // "htua" -> "auth"
TRACEPOINT_PROBE(syscalls, sys_enter_socket) {
u32 pid = bpf_get_current_pid_tgid() >> 32;
if (args->family == 38) { // AF_ALG
u32 *score = suspicion_score.lookup(&pid);
u32 new_score = (score ? *score : 0) + 10;
suspicion_score.update(&pid, &new_score);
int zero = 0;
pending_afalg_fds.update(&pid, &zero);
bpf_trace_printk("SOCKET[AF_ALG_REQ] PID:%d SCORE:%d\\n", pid, new_score);
}
return 0;
}
TRACEPOINT_PROBE(syscalls, sys_enter_bind) {
u32 pid = bpf_get_current_pid_tgid() >> 32;
int *pending = pending_afalg_fds.lookup(&pid);
if (!pending) return 0;
// 严格检查长度，防止越界 (2字节 family + 32字节 name)
if (args->addrlen < 34) return 0;
u16 sa_family = 0;
bpf_probe_read_user(&sa_family, sizeof(sa_family), args->umyaddr);
if (sa_family != 38) return 0;
char alg_name[32];
bpf_probe_read_user(&alg_name, sizeof(alg_name), (char*)args->umyaddr + 2);
int detected = 0;
// 使用魔术数字快速检测高危算法 "aead"
for (int i = 0; i < 28; i++) { // 32 - 4
int magic_val = 0;
// 注意：这里使用 alg_name[i] 的地址，验证器能识别边界
bpf_probe_read_user(&magic_val, 4, &alg_name[i]);
if (magic_val == MAGIC_AEAD) {
detected = 1;
bpf_trace_printk("BIND[CRITICAL] PID:%d ALG:aead\\n", pid);
break;
}
}
// 【启发式检测】检测 "authencesn" 的前缀 "auth"
// 基于攻击面约束的启发式检测。由于漏洞利用强依赖 authencesn 模板，
// 匹配前缀 "auth" 在实生产环境中具有极高的置信度，且避免了多次内存读取带来的性能损耗。
if (!detected) {
int auth_magic = 0;
bpf_probe_read_user(&auth_magic, 4, &alg_name[0]);
if (auth_magic == MAGIC_AUTH) {
detected = 1;
bpf_trace_printk("BIND[CRITICAL] PID:%d ALG:auth*\\n", pid);
}
}
// 命中高危算法，增加 40 分权重
if (detected) {
u32 *score = suspicion_score.lookup(&pid);
u32 new_score = (score ? *score : 0) + 40;
suspicion_score.update(&pid, &new_score);
}
pending_afalg_fds.delete(&pid);
return 0;
}
TRACEPOINT_PROBE(syscalls, sys_enter_sendmsg) {
u32 pid = bpf_get_current_pid_tgid() >> 32;
u32 *score = suspicion_score.lookup(&pid);
if (score && *score > 0) {
bpf_trace_printk("SENDMSG[TRACK] PID:%d FD:%d\\n", pid, args->fd);
}
return 0;
}
TRACEPOINT_PROBE(syscalls, sys_enter_splice) {
u32 pid = bpf_get_current_pid_tgid() >> 32;
u32 *score = suspicion_score.lookup(&pid);
if (score) {
bpf_trace_printk("SPLICE[DATA] PID:%d IN:%d OUT:%d\\n", pid, args->fd_in, args->fd_out);
bpf_trace_printk("SPLICE[LEN] %d OFF_IN:0x%lx\\n", args->len, args->off_in);
// 阈值逻辑：10(Socket) + 40(Bind) + 20(Splice) = 70
if (*score >= 50) {
u32 new_score = *score + 20;
suspicion_score.update(&pid, &new_score);
if (new_score >= 70) {
bpf_trace_printk("ALERT[CRITICAL] CVE-2026-31431 DETECTED! PID:%d SCORE:%d\\n", pid, new_score);
}
}
}
return 0;
}
"""
def main():
print("=" * 60)
print(" CVE-2026-31431 检测系统")
print("=" * 60)
try:
b = BPF(text=bpf_text)
except Exception as e:
print(f" BPF 编译失败: {e}")
return
print("\n监控中... (按 Ctrl+C 停止)\n")
try:
while True:
line = b.trace_readline().decode('utf-8', errors='replace').strip()
if "ALERT[CRITICAL]" in line:
print(f"漏洞利用检测: {line}")
elif line:
print(line)
except KeyboardInterrupt:
print("\n退出。")
if __name__ == "__main__":
main()****
总结
漏洞总结
CVE-2026-31431 的本质，是攻击者利用 splice 将只读文件的内存地址伪装成加密模块的输出缓冲区，利用内核加密子系统对自身的过度信任，成功实现了对受保护内存区域的非法篡改。
最后笔者也通过了一定的实验，发现了其实不一定写su这个命令，本质上来说只要是拥有SUID的命令区域都可以写入进行提权，之所以用su这个命令。
我进行将/usr/bin/su改为了ls命令，依旧会进入到一个命令窗口（只不过我清理缓存之后，好像无法恢复了，滑稽）
我认为大概率是因为su命令的特殊性
1、容错性与强制性：su 在切换用户时，会强制加载新的环境变量和 Shell 配置，这种机制使得它对内存中的指令流有更高的“执行意愿”
2、环境重置：只要写入的 Shellcode 没有导致程序在初始化阶段直接崩溃（Segmentation Fault），su 在尝试创建新环境的过程中，往往会忽略部分非致命的异常，强行接管控制权并执行后续的恶意代码。
其他：
理论上来说，我认为也不一定需要Python脚本，也不一定只写su，只要你玩的够花，用什么脚本写哪里其实都行，只要符合这些操作流程。
eBPF程序总结
1、在程序分析上面strace虽然消耗的资源庞大，但是提供信息的方式非常友好。也许eBPF在对于正在运行的程序进行特定的捕捉非常友好，但是在脚本分析以及一次性攻击程序分析方面strace依旧拥有着不小的优势。
2、其实用BCC的框架不是那么好写(没有自动补全和检测),而且我的Ubuntu的BCC框架是V0.18，无法支持LSM。我尝试进行升级之后系统又不认我的BCC框架(苦恼.jpg，也可能是我哪里没配置好)。
3、本来我是打算写论文的，但是想了想这玩意不是那么好，那么有价值，干脆就直接放出来了。以后设计个更好的系统。根据我的实验性能检测来说，这个脚本跑起来压根不怎么消耗性能。（具体数据我就不放出来了）。
4、感兴趣的朋友可以参照我的进行libbpf+core进行补充LSM部分直接实时拦截。
浙公网安备 33010602011771号