	.file	"34896.c"
	.intel_syntax noprefix
	.text
	.globl	pipe_fd
	.bss
	.align 8
	.type	pipe_fd, @object
	.size	pipe_fd, 8
pipe_fd:
	.zero	8
	.section	.rodata
	.align 8
.LC0:
	.string	"Failure in child: read from pipe returned != 0\n"
	.align 8
.LC1:
	.string	"mount(NULL, \"./mnt1\", \"tmpfs\", 0, NULL)"
.LC2:
	.string	"tmpfs"
.LC3:
	.string	"./mnt1"
	.align 8
.LC4:
	.string	"mount(\"none\", \"/\", NULL, MS_REC|MS_PRIVATE, NULL)"
.LC5:
	.string	"/"
.LC6:
	.string	"none"
.LC7:
	.string	"mounting proc"
.LC8:
	.string	"mkdir(\"./mnt1/proc\", 777)"
.LC9:
	.string	"./mnt1/proc"
	.align 8
.LC10:
	.string	"mount(0, \"./mnt1/proc\", \"proc\", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL)"
.LC11:
	.string	"proc"
.LC12:
	.string	"cp busybox yolo"
.LC13:
	.string	"cp busybox ./mnt1/busybox"
.LC14:
	.string	"cp failed"
.LC15:
	.string	"pivot_root"
.LC16:
	.string	"mkdir(\"./mnt1/oldroot\", 777)"
.LC17:
	.string	"./mnt1/oldroot"
	.align 8
.LC18:
	.string	"pivot_root(\"./mnt1\", \"./mnt1/oldroot\")"
.LC19:
	.string	"chdir(\"/\")"
.LC20:
	.string	"unount old root"
	.align 8
.LC21:
	.string	"umount2(\"/oldroot\", MNT_DETACH)"
.LC22:
	.string	"/oldroot"
	.align 8
.LC23:
	.string	"execl busybox sh (you still have capabilities!)"
.LC24:
	.string	"sh"
.LC25:
	.string	"busybox"
.LC26:
	.string	"/busybox"
.LC27:
	.string	"exec"
	.text
	.type	child_func, @function
child_func:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	eax, DWORD PTR pipe_fd[rip+4]
	mov	edi, eax
	call	close@PLT
	mov	eax, DWORD PTR pipe_fd[rip]
	lea	rcx, -9[rbp]
	mov	edx, 1
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	test	rax, rax
	je	.L2
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 47
	mov	esi, 1
	lea	rdi, .LC0[rip]
	call	fwrite@PLT
	mov	edi, 1
	call	exit@PLT
.L2:
	lea	rdi, .LC1[rip]
	call	puts@PLT
	mov	r8d, 0
	mov	ecx, 0
	lea	rdx, .LC2[rip]
	lea	rsi, .LC3[rip]
	mov	edi, 0
	call	mount@PLT
	cmp	eax, -1
	jne	.L3
	lea	rdi, .LC1[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L3:
	lea	rdi, .LC4[rip]
	call	puts@PLT
	mov	r8d, 0
	mov	ecx, 278528
	mov	edx, 0
	lea	rsi, .LC5[rip]
	lea	rdi, .LC6[rip]
	call	mount@PLT
	cmp	eax, -1
	jne	.L4
	lea	rdi, .LC4[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L4:
	lea	rdi, .LC7[rip]
	call	puts@PLT
	lea	rdi, .LC8[rip]
	call	puts@PLT
	mov	esi, 777
	lea	rdi, .LC9[rip]
	call	mkdir@PLT
	cmp	eax, -1
	jne	.L5
	lea	rdi, .LC8[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L5:
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	r8d, 0
	mov	ecx, 14
	lea	rdx, .LC11[rip]
	lea	rsi, .LC9[rip]
	mov	edi, 0
	call	mount@PLT
	cmp	eax, -1
	jne	.L6
	lea	rdi, .LC10[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L6:
	lea	rdi, .LC12[rip]
	call	puts@PLT
	lea	rdi, .LC13[rip]
	call	system@PLT
	test	eax, eax
	je	.L7
	lea	rdi, .LC14[rip]
	call	puts@PLT
	mov	edi, 1
	call	exit@PLT
.L7:
	lea	rdi, .LC15[rip]
	call	puts@PLT
	lea	rdi, .LC16[rip]
	call	puts@PLT
	mov	esi, 777
	lea	rdi, .LC17[rip]
	call	mkdir@PLT
	cmp	eax, -1
	jne	.L8
	lea	rdi, .LC16[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L8:
	lea	rdi, .LC18[rip]
	call	puts@PLT
	lea	rsi, .LC17[rip]
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	pivot_root@PLT
	cmp	eax, -1
	jne	.L9
	lea	rdi, .LC18[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L9:
	lea	rdi, .LC19[rip]
	call	puts@PLT
	lea	rdi, .LC5[rip]
	call	chdir@PLT
	cmp	eax, -1
	jne	.L10
	lea	rdi, .LC19[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L10:
	lea	rdi, .LC20[rip]
	call	puts@PLT
	lea	rdi, .LC21[rip]
	call	puts@PLT
	mov	esi, 2
	lea	rdi, .LC22[rip]
	call	umount2@PLT
	cmp	eax, -1
	jne	.L11
	lea	rdi, .LC21[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L11:
	lea	rdi, .LC23[rip]
	call	puts@PLT
	mov	ecx, 0
	lea	rdx, .LC24[rip]
	lea	rsi, .LC25[rip]
	lea	rdi, .LC26[rip]
	mov	eax, 0
	call	execl@PLT
	lea	rdi, .LC27[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
	.cfi_endproc
.LFE6:
	.size	child_func, .-child_func
	.globl	child_stack
	.bss
	.align 8
	.type	child_stack, @object
	.size	child_stack, 8
child_stack:
	.zero	8
	.section	.rodata
.LC28:
	.string	"ERROR: open %s: %s\n"
.LC29:
	.string	"write"
	.align 8
.LC30:
	.string	"ERROR: incomplete write %s: %s\n"
	.text
	.type	update_map, @function
update_map:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -40[rbp], rdi
	mov	QWORD PTR -48[rbp], rsi
	mov	rax, QWORD PTR -40[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	QWORD PTR -16[rbp], rax
	mov	DWORD PTR -24[rbp], 0
	jmp	.L14
.L16:
	mov	eax, DWORD PTR -24[rbp]
	movsx	rdx, eax
	mov	rax, QWORD PTR -40[rbp]
	add	rax, rdx
	movzx	eax, BYTE PTR [rax]
	cmp	al, 44
	jne	.L15
	mov	eax, DWORD PTR -24[rbp]
	movsx	rdx, eax
	mov	rax, QWORD PTR -40[rbp]
	add	rax, rdx
	mov	BYTE PTR [rax], 10
.L15:
	add	DWORD PTR -24[rbp], 1
.L14:
	mov	rax, QWORD PTR -16[rbp]
	cmp	DWORD PTR -24[rbp], eax
	jl	.L16
	mov	rax, QWORD PTR -48[rbp]
	mov	esi, 2
	mov	rdi, rax
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], -1
	jne	.L17
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rcx, rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -48[rbp]
	lea	rsi, .LC28[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	exit@PLT
.L17:
	mov	rdx, QWORD PTR -16[rbp]
	mov	rcx, QWORD PTR -40[rbp]
	mov	eax, DWORD PTR -20[rbp]
	mov	rsi, rcx
	mov	edi, eax
	call	write@PLT
	mov	QWORD PTR -8[rbp], rax
	cmp	QWORD PTR -8[rbp], 0
	jns	.L18
	lea	rdi, .LC29[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L18:
	mov	rax, QWORD PTR -16[rbp]
	cmp	QWORD PTR -8[rbp], rax
	je	.L19
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rcx, rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -48[rbp]
	lea	rsi, .LC30[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	exit@PLT
.L19:
	mov	eax, DWORD PTR -20[rbp]
	mov	edi, eax
	call	close@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	update_map, .-update_map
	.section	.rodata
.LC31:
	.string	"/proc/%ld/setgroups"
.LC32:
	.string	"ERROR: write %s: %s\n"
	.text
	.type	proc_setgroups_write, @function
proc_setgroups_write:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 48
	mov	DWORD PTR -4132[rbp], edi
	mov	QWORD PTR -4144[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	eax, DWORD PTR -4132[rbp]
	movsx	rdx, eax
	lea	rax, -4112[rbp]
	mov	rcx, rdx
	lea	rdx, .LC31[rip]
	mov	esi, 4096
	mov	rdi, rax
	mov	eax, 0
	call	snprintf@PLT
	lea	rax, -4112[rbp]
	mov	esi, 2
	mov	rdi, rax
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -4116[rbp], eax
	cmp	DWORD PTR -4116[rbp], -1
	jne	.L21
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	cmp	eax, 2
	je	.L26
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rcx, rax
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, -4112[rbp]
	lea	rsi, .LC28[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	jmp	.L20
.L21:
	mov	rax, QWORD PTR -4144[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	rdx, rax
	mov	rcx, QWORD PTR -4144[rbp]
	mov	eax, DWORD PTR -4116[rbp]
	mov	rsi, rcx
	mov	edi, eax
	call	write@PLT
	cmp	rax, -1
	jne	.L24
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rcx, rax
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, -4112[rbp]
	lea	rsi, .LC32[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L24:
	mov	eax, DWORD PTR -4116[rbp]
	mov	edi, eax
	call	close@PLT
	jmp	.L20
.L26:
	nop
.L20:
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L25
	call	__stack_chk_fail@PLT
.L25:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	proc_setgroups_write, .-proc_setgroups_write
	.section	.rodata
.LC33:
	.string	"starting main"
.LC34:
	.string	"pipe"
.LC35:
	.string	"mmap child stack"
.LC36:
	.string	"clone"
.LC37:
	.string	"/proc/%ld/uid_map"
.LC38:
	.string	"0 %ld 1"
.LC39:
	.string	"deny"
.LC40:
	.string	"/proc/%ld/gid_map"
.LC41:
	.string	"waitpid"
.LC42:
	.string	"child has terminated"
	.align 8
.LC43:
	.string	"munmap(child_stack, STACK_SIZE)"
	.text
	.globl	main
	.type	main, @function
main:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	r15
	push	r14
	push	r13
	push	r12
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 64
	.cfi_offset 15, -24
	.cfi_offset 14, -32
	.cfi_offset 13, -40
	.cfi_offset 12, -48
	mov	DWORD PTR -4180[rbp], edi
	mov	QWORD PTR -4192[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -40[rbp], rax
	xor	eax, eax
	lea	rdi, .LC33[rip]
	call	puts@PLT
	lea	rdi, pipe_fd[rip]
	call	pipe@PLT
	cmp	eax, -1
	jne	.L28
	lea	rdi, .LC34[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L28:
	mov	r9d, 0
	mov	r8d, -1
	mov	ecx, 131362
	mov	edx, 3
	mov	esi, 1048576
	mov	edi, 0
	call	mmap@PLT
	mov	QWORD PTR child_stack[rip], rax
	mov	rax, QWORD PTR child_stack[rip]
	cmp	rax, -1
	jne	.L29
	lea	rdi, .LC35[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L29:
	mov	rax, QWORD PTR child_stack[rip]
	add	rax, 1048576
	mov	ecx, 0
	mov	edx, 805437457
	mov	rsi, rax
	lea	rdi, child_func[rip]
	mov	eax, 0
	call	clone@PLT
	mov	DWORD PTR -4168[rbp], eax
	cmp	DWORD PTR -4168[rbp], -1
	jne	.L30
	lea	rdi, .LC36[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L30:
	mov	DWORD PTR -4164[rbp], 100
	mov	eax, DWORD PTR -4164[rbp]
	cdqe
	sub	rax, 1
	mov	QWORD PTR -4160[rbp], rax
	mov	eax, DWORD PTR -4164[rbp]
	cdqe
	mov	r14, rax
	mov	r15d, 0
	mov	eax, DWORD PTR -4164[rbp]
	cdqe
	mov	r12, rax
	mov	r13d, 0
	mov	eax, DWORD PTR -4164[rbp]
	cdqe
	mov	edx, 16
	sub	rdx, 1
	add	rax, rdx
	mov	ecx, 16
	mov	edx, 0
	div	rcx
	imul	rax, rax, 16
	mov	rcx, rax
	and	rcx, -4096
	mov	rdx, rsp
	sub	rdx, rcx
.L31:
	cmp	rsp, rdx
	je	.L32
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	jmp	.L31
.L32:
	mov	rdx, rax
	and	edx, 4095
	sub	rsp, rdx
	mov	rdx, rax
	and	edx, 4095
	test	rdx, rdx
	je	.L33
	and	eax, 4095
	sub	rax, 8
	add	rax, rsp
	or	QWORD PTR [rax], 0
.L33:
	mov	rax, rsp
	add	rax, 0
	mov	QWORD PTR -4152[rbp], rax
	mov	eax, DWORD PTR -4168[rbp]
	movsx	rdx, eax
	lea	rax, -4144[rbp]
	mov	rcx, rdx
	lea	rdx, .LC37[rip]
	mov	esi, 4096
	mov	rdi, rax
	mov	eax, 0
	call	snprintf@PLT
	call	getuid@PLT
	mov	edx, eax
	mov	eax, DWORD PTR -4164[rbp]
	movsx	rsi, eax
	mov	rax, QWORD PTR -4152[rbp]
	mov	rcx, rdx
	lea	rdx, .LC38[rip]
	mov	rdi, rax
	mov	eax, 0
	call	snprintf@PLT
	lea	rdx, -4144[rbp]
	mov	rax, QWORD PTR -4152[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	update_map
	mov	eax, DWORD PTR -4168[rbp]
	lea	rsi, .LC39[rip]
	mov	edi, eax
	call	proc_setgroups_write
	mov	eax, DWORD PTR -4168[rbp]
	movsx	rdx, eax
	lea	rax, -4144[rbp]
	mov	rcx, rdx
	lea	rdx, .LC40[rip]
	mov	esi, 4096
	mov	rdi, rax
	mov	eax, 0
	call	snprintf@PLT
	call	getgid@PLT
	mov	edx, eax
	mov	eax, DWORD PTR -4164[rbp]
	movsx	rsi, eax
	mov	rax, QWORD PTR -4152[rbp]
	mov	rcx, rdx
	lea	rdx, .LC38[rip]
	mov	rdi, rax
	mov	eax, 0
	call	snprintf@PLT
	lea	rdx, -4144[rbp]
	mov	rax, QWORD PTR -4152[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	update_map
	mov	eax, DWORD PTR pipe_fd[rip+4]
	mov	edi, eax
	call	close@PLT
	mov	eax, DWORD PTR -4168[rbp]
	mov	edx, 0
	mov	esi, 0
	mov	edi, eax
	call	waitpid@PLT
	cmp	eax, -1
	jne	.L34
	lea	rdi, .LC41[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L34:
	lea	rdi, .LC42[rip]
	call	puts@PLT
	lea	rdi, .LC43[rip]
	call	puts@PLT
	mov	rax, QWORD PTR child_stack[rip]
	mov	esi, 1048576
	mov	rdi, rax
	call	munmap@PLT
	cmp	eax, -1
	jne	.L35
	lea	rdi, .LC43[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L35:
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rdi, rax
	call	puts@PLT
	mov	edi, 0
	call	exit@PLT
	.cfi_endproc
.LFE9:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"34896.c"
	.text
	.comm	pipe_fd,8,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"Failure in child: read from pipe returned != 0\012\000"
	.align	2
.LC1:
	.ascii	"mount(NULL, \"./mnt1\", \"tmpfs\", 0, NULL)\000"
	.align	2
.LC2:
	.ascii	"tmpfs\000"
	.align	2
.LC3:
	.ascii	"./mnt1\000"
	.align	2
.LC4:
	.ascii	"mount(\"none\", \"/\", NULL, MS_REC|MS_PRIVATE, NUL"
	.ascii	"L)\000"
	.align	2
.LC5:
	.ascii	"/\000"
	.align	2
.LC6:
	.ascii	"none\000"
	.align	2
.LC7:
	.ascii	"mounting proc\000"
	.align	2
.LC8:
	.ascii	"mkdir(\"./mnt1/proc\", 777)\000"
	.align	2
.LC9:
	.ascii	"./mnt1/proc\000"
	.align	2
.LC10:
	.ascii	"mount(0, \"./mnt1/proc\", \"proc\", MS_NOSUID|MS_NO"
	.ascii	"DEV|MS_NOEXEC, NULL)\000"
	.align	2
.LC11:
	.ascii	"proc\000"
	.align	2
.LC12:
	.ascii	"cp busybox yolo\000"
	.align	2
.LC13:
	.ascii	"cp busybox ./mnt1/busybox\000"
	.align	2
.LC14:
	.ascii	"cp failed\000"
	.align	2
.LC15:
	.ascii	"pivot_root\000"
	.align	2
.LC16:
	.ascii	"mkdir(\"./mnt1/oldroot\", 777)\000"
	.align	2
.LC17:
	.ascii	"./mnt1/oldroot\000"
	.align	2
.LC18:
	.ascii	"pivot_root(\"./mnt1\", \"./mnt1/oldroot\")\000"
	.align	2
.LC19:
	.ascii	"chdir(\"/\")\000"
	.align	2
.LC20:
	.ascii	"unount old root\000"
	.align	2
.LC21:
	.ascii	"umount2(\"/oldroot\", MNT_DETACH)\000"
	.align	2
.LC22:
	.ascii	"/oldroot\000"
	.align	2
.LC23:
	.ascii	"execl busybox sh (you still have capabilities!)\000"
	.align	2
.LC24:
	.ascii	"sh\000"
	.align	2
.LC25:
	.ascii	"busybox\000"
	.align	2
.LC26:
	.ascii	"/busybox\000"
	.align	2
.LC27:
	.ascii	"exec\000"
	.align	2
.LC28:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	child_func, %function
child_func:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-16]
	ldr	r3, .L13
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L13+4
	ldr	r3, [r3, #4]
	mov	r0, r3
	bl	close
	ldr	r3, .L13+4
	ldr	r3, [r3]
	sub	r1, fp, #9
	mov	r2, #1
	mov	r0, r3
	bl	read
	mov	r3, r0
	cmp	r3, #0
	beq	.L2
	ldr	r3, .L13+8
	ldr	r3, [r3]
	mov	r2, #47
	mov	r1, #1
	ldr	r0, .L13+12
	bl	fwrite
	mov	r0, #1
	bl	exit
.L2:
	ldr	r0, .L13+16
	bl	puts
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #0
	ldr	r2, .L13+20
	ldr	r1, .L13+24
	mov	r0, #0
	bl	mount
	mov	r3, r0
	cmn	r3, #1
	bne	.L3
	ldr	r0, .L13+16
	bl	perror
	mov	r0, #1
	bl	exit
.L3:
	ldr	r0, .L13+28
	bl	puts
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #278528
	mov	r2, #0
	ldr	r1, .L13+32
	ldr	r0, .L13+36
	bl	mount
	mov	r3, r0
	cmn	r3, #1
	bne	.L4
	ldr	r0, .L13+28
	bl	perror
	mov	r0, #1
	bl	exit
.L4:
	ldr	r0, .L13+40
	bl	puts
	ldr	r0, .L13+44
	bl	puts
	ldr	r1, .L13+48
	ldr	r0, .L13+52
	bl	mkdir
	mov	r3, r0
	cmn	r3, #1
	bne	.L5
	ldr	r0, .L13+44
	bl	perror
	mov	r0, #1
	bl	exit
.L5:
	ldr	r0, .L13+56
	bl	puts
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #14
	ldr	r2, .L13+60
	ldr	r1, .L13+52
	mov	r0, #0
	bl	mount
	mov	r3, r0
	cmn	r3, #1
	bne	.L6
	ldr	r0, .L13+56
	bl	perror
	mov	r0, #1
	bl	exit
.L6:
	ldr	r0, .L13+64
	bl	puts
	ldr	r0, .L13+68
	bl	system
	mov	r3, r0
	cmp	r3, #0
	beq	.L7
	ldr	r0, .L13+72
	bl	puts
	mov	r0, #1
	bl	exit
.L7:
	ldr	r0, .L13+76
	bl	puts
	ldr	r0, .L13+80
	bl	puts
	ldr	r1, .L13+48
	ldr	r0, .L13+84
	bl	mkdir
	mov	r3, r0
	cmn	r3, #1
	bne	.L8
	ldr	r0, .L13+80
	bl	perror
	mov	r0, #1
	bl	exit
.L8:
	ldr	r0, .L13+88
	bl	puts
	ldr	r1, .L13+84
	ldr	r0, .L13+24
	bl	pivot_root
	mov	r3, r0
	cmn	r3, #1
	bne	.L9
	ldr	r0, .L13+88
	bl	perror
	mov	r0, #1
	bl	exit
.L9:
	ldr	r0, .L13+92
	bl	puts
	ldr	r0, .L13+32
	bl	chdir
	mov	r3, r0
	cmn	r3, #1
	bne	.L10
	ldr	r0, .L13+92
	bl	perror
	mov	r0, #1
	bl	exit
.L10:
	ldr	r0, .L13+96
	bl	puts
	ldr	r0, .L13+100
	bl	puts
	mov	r1, #2
	ldr	r0, .L13+104
	bl	umount2
	mov	r3, r0
	cmn	r3, #1
	bne	.L11
	ldr	r0, .L13+100
	bl	perror
	mov	r0, #1
	bl	exit
.L11:
	ldr	r0, .L13+108
	bl	puts
	mov	r3, #0
	ldr	r2, .L13+112
	ldr	r1, .L13+116
	ldr	r0, .L13+120
	bl	execl
	ldr	r0, .L13+124
	bl	perror
	mov	r0, #1
	bl	exit
.L14:
	.align	2
.L13:
	.word	.LC28
	.word	pipe_fd
	.word	stderr
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	777
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.size	child_func, .-child_func
	.comm	child_stack,4,4
	.section	.rodata
	.align	2
.LC29:
	.ascii	"ERROR: open %s: %s\012\000"
	.align	2
.LC30:
	.ascii	"write\000"
	.align	2
.LC31:
	.ascii	"ERROR: incomplete write %s: %s\012\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	update_map, %function
update_map:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #28
	str	r0, [fp, #-32]
	str	r1, [fp, #-36]
	ldr	r0, [fp, #-32]
	bl	strlen
	str	r0, [fp, #-24]
	mov	r3, #0
	str	r3, [fp, #-28]
	b	.L16
.L18:
	ldr	r3, [fp, #-28]
	ldr	r2, [fp, #-32]
	add	r3, r2, r3
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #44
	bne	.L17
	ldr	r3, [fp, #-28]
	ldr	r2, [fp, #-32]
	add	r3, r2, r3
	mov	r2, #10
	strb	r2, [r3]
.L17:
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
.L16:
	ldr	r3, [fp, #-24]
	ldr	r2, [fp, #-28]
	cmp	r2, r3
	blt	.L18
	mov	r1, #2
	ldr	r0, [fp, #-36]
	bl	open
	str	r0, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmn	r3, #1
	bne	.L19
	ldr	r3, .L22
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	ldr	r2, [fp, #-36]
	ldr	r1, .L22+4
	mov	r0, r4
	bl	fprintf
	mov	r0, #1
	bl	exit
.L19:
	ldr	r2, [fp, #-24]
	ldr	r1, [fp, #-32]
	ldr	r0, [fp, #-20]
	bl	write
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	bge	.L20
	ldr	r0, .L22+8
	bl	perror
	mov	r0, #1
	bl	exit
.L20:
	ldr	r3, [fp, #-24]
	ldr	r2, [fp, #-16]
	cmp	r2, r3
	beq	.L21
	ldr	r3, .L22
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	ldr	r2, [fp, #-36]
	ldr	r1, .L22+12
	mov	r0, r4
	bl	fprintf
	mov	r0, #1
	bl	exit
.L21:
	ldr	r0, [fp, #-20]
	bl	close
	nop
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L23:
	.align	2
.L22:
	.word	stderr
	.word	.LC29
	.word	.LC30
	.word	.LC31
	.size	update_map, .-update_map
	.section	.rodata
	.align	2
.LC32:
	.ascii	"/proc/%ld/setgroups\000"
	.align	2
.LC33:
	.ascii	"ERROR: write %s: %s\012\000"
	.align	2
.LC34:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	proc_setgroups_write, %function
proc_setgroups_write:
	@ args = 0, pretend = 0, frame = 4112
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #4096
	sub	sp, sp, #20
	sub	r3, fp, #4096
	sub	r3, r3, #12
	str	r0, [r3, #-12]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	str	r1, [r3, #-16]
	ldr	r3, .L31
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r0, fp, #4096
	sub	r0, r0, #12
	sub	r0, r0, #4
	ldr	r3, [r3, #-12]
	ldr	r2, .L31+4
	mov	r1, #4096
	bl	snprintf
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r4, r3
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r1, #2
	mov	r0, r3
	bl	open
	str	r0, [r4, #-8]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-8]
	cmn	r3, #1
	bne	.L25
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	cmp	r3, #2
	beq	.L30
	ldr	r3, .L31+8
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	sub	r2, fp, #4096
	sub	r2, r2, #12
	sub	r2, r2, #4
	ldr	r1, .L31+12
	mov	r0, r4
	bl	fprintf
	b	.L24
.L25:
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r0, [r3, #-16]
	bl	strlen
	mov	r3, r0
	sub	r2, fp, #4096
	sub	r2, r2, #12
	mov	r1, r2
	sub	r2, fp, #4096
	sub	r2, r2, #12
	mov	r0, r2
	mov	r2, r3
	ldr	r1, [r1, #-16]
	ldr	r0, [r0, #-8]
	bl	write
	mov	r3, r0
	cmn	r3, #1
	bne	.L28
	ldr	r3, .L31+8
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	sub	r2, fp, #4096
	sub	r2, r2, #12
	sub	r2, r2, #4
	ldr	r1, .L31+16
	mov	r0, r4
	bl	fprintf
.L28:
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r0, [r3, #-8]
	bl	close
	b	.L24
.L30:
	nop
.L24:
	ldr	r3, .L31
	ldr	r2, [r3]
	ldr	r3, [fp, #-16]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L29
	bl	__stack_chk_fail
.L29:
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L32:
	.align	2
.L31:
	.word	.LC34
	.word	.LC32
	.word	stderr
	.word	.LC29
	.word	.LC33
	.size	proc_setgroups_write, .-proc_setgroups_write
	.section	.rodata
	.align	2
.LC35:
	.ascii	"starting main\000"
	.align	2
.LC36:
	.ascii	"pipe\000"
	.align	2
.LC37:
	.ascii	"mmap child stack\000"
	.align	2
.LC38:
	.ascii	"clone\000"
	.align	2
.LC39:
	.ascii	"/proc/%ld/uid_map\000"
	.align	2
.LC40:
	.ascii	"0 %ld 1\000"
	.align	2
.LC41:
	.ascii	"deny\000"
	.align	2
.LC42:
	.ascii	"/proc/%ld/gid_map\000"
	.align	2
.LC43:
	.ascii	"waitpid\000"
	.align	2
.LC44:
	.ascii	"child has terminated\000"
	.align	2
.LC45:
	.ascii	"munmap(child_stack, STACK_SIZE)\000"
	.align	2
.LC46:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 4128
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #4096
	sub	sp, sp, #44
	sub	r3, fp, #4096
	sub	r3, r3, #12
	str	r0, [r3, #-28]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	str	r1, [r3, #-32]
	ldr	r3, .L40
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	ldr	r0, .L40+4
	bl	puts
	ldr	r0, .L40+8
	bl	pipe
	mov	r3, r0
	cmn	r3, #1
	bne	.L34
	ldr	r0, .L40+12
	bl	perror
	mov	r0, #1
	bl	exit
.L34:
	mov	r3, #0
	str	r3, [sp, #4]
	mvn	r3, #0
	str	r3, [sp]
	ldr	r3, .L40+16
	mov	r2, #3
	mov	r1, #1048576
	mov	r0, #0
	bl	mmap
	mov	r3, r0
	ldr	r2, .L40+20
	str	r3, [r2]
	ldr	r3, .L40+20
	ldr	r3, [r3]
	cmn	r3, #1
	bne	.L35
	ldr	r0, .L40+24
	bl	perror
	mov	r0, #1
	bl	exit
.L35:
	ldr	r3, .L40+20
	ldr	r3, [r3]
	add	r1, r3, #1048576
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r4, r3
	mov	r3, #0
	ldr	r2, .L40+28
	ldr	r0, .L40+32
	bl	clone
	str	r0, [r4, #-20]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-20]
	cmn	r3, #1
	bne	.L36
	ldr	r0, .L40+36
	bl	perror
	mov	r0, #1
	bl	exit
.L36:
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r2, r3
	mov	r3, #100
	str	r3, [r2, #-16]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-16]
	sub	r3, r3, #1
	sub	r2, fp, #4096
	sub	r2, r2, #12
	str	r3, [r2, #-12]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-16]
	mov	r0, r3
	mov	r1, #0
	mov	r2, #0
	mov	r3, #0
	lsl	r3, r1, #3
	orr	r3, r3, r0, lsr #29
	lsl	r2, r0, #3
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-16]
	mov	r0, r3
	mov	r1, #0
	mov	r2, #0
	mov	r3, #0
	lsl	r3, r1, #3
	orr	r3, r3, r0, lsr #29
	lsl	r2, r0, #3
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-16]
	sub	r2, fp, #4096
	sub	r2, r2, #12
	add	r3, r3, #7
	lsr	r3, r3, #3
	lsl	r3, r3, #3
	sub	sp, sp, r3
	add	r3, sp, #8
	add	r3, r3, #0
	str	r3, [r2, #-8]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r0, fp, #4096
	sub	r0, r0, #12
	sub	r0, r0, #4
	ldr	r3, [r3, #-20]
	ldr	r2, .L40+40
	mov	r1, #4096
	bl	snprintf
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r4, [r3, #-16]
	bl	getuid
	mov	r3, r0
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r0, r3
	mov	r3, r2
	ldr	r2, .L40+44
	mov	r1, r4
	ldr	r0, [r0, #-8]
	bl	snprintf
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	sub	r2, fp, #4096
	sub	r2, r2, #12
	mov	r1, r3
	ldr	r0, [r2, #-8]
	bl	update_map
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r1, .L40+48
	ldr	r0, [r3, #-20]
	bl	proc_setgroups_write
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r0, fp, #4096
	sub	r0, r0, #12
	sub	r0, r0, #4
	ldr	r3, [r3, #-20]
	ldr	r2, .L40+52
	mov	r1, #4096
	bl	snprintf
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r4, [r3, #-16]
	bl	getgid
	mov	r3, r0
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r0, r3
	mov	r3, r2
	ldr	r2, .L40+44
	mov	r1, r4
	ldr	r0, [r0, #-8]
	bl	snprintf
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	sub	r2, fp, #4096
	sub	r2, r2, #12
	mov	r1, r3
	ldr	r0, [r2, #-8]
	bl	update_map
	ldr	r3, .L40+8
	ldr	r3, [r3, #4]
	mov	r0, r3
	bl	close
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r2, #0
	mov	r1, #0
	ldr	r0, [r3, #-20]
	bl	waitpid
	mov	r3, r0
	cmn	r3, #1
	bne	.L37
	ldr	r0, .L40+56
	bl	perror
	mov	r0, #1
	bl	exit
.L37:
	ldr	r0, .L40+60
	bl	puts
	ldr	r0, .L40+64
	bl	puts
	ldr	r3, .L40+20
	ldr	r3, [r3]
	mov	r1, #1048576
	mov	r0, r3
	bl	munmap
	mov	r3, r0
	cmn	r3, #1
	bne	.L38
	ldr	r0, .L40+64
	bl	perror
	mov	r0, #1
	bl	exit
.L38:
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	mov	r0, r3
	bl	puts
	mov	r0, #0
	bl	exit
.L41:
	.align	2
.L40:
	.word	.LC46
	.word	.LC35
	.word	pipe_fd
	.word	.LC36
	.word	131362
	.word	child_stack
	.word	.LC37
	.word	805437457
	.word	child_func
	.word	.LC38
	.word	.LC39
	.word	.LC40
	.word	.LC41
	.word	.LC42
	.word	.LC43
	.word	.LC44
	.word	.LC45
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
