Attachment 1026677 Details for Bug 1221929 – AVC's for samba

AVC's for samba

audit.log (text/plain), 35.73 KB, created by surabhi on 2015-05-18 12:26:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: surabhi

Created: 2015-05-18 12:26:50 UTC

Size: 35.73 KB

patch

obsolete

>type=DAEMON_START msg=audit(1431927869.954:7367): auditd start, ver=2.3.7 format=raw kernel=2.6.32-559.el6.x86_64 auid=4294967295 pid=1377 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1431927870.102:5): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CRYPTO_KEY_USER msg=audit(1431927930.797:6): user pid=5407 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=5407 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431927930.797:7): user pid=5407 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=5407 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1431927931.367:8): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=5407 suid=74 rport=42200 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1431927931.367:9): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=5407 suid=74 rport=42200 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=USER_START msg=audit(1431927947.260:10): user pid=5430 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="uuidd" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1431927947.260:11): user pid=5430 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="uuidd" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1431927947.289:12): user pid=5430 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="uuidd" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1431927947.297:13): user pid=5430 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="uuidd" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_AUTH msg=audit(1431927963.387:14): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1431927963.390:15): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1431927963.397:16): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=5407 suid=74 rport=42200 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=USER_AUTH msg=audit(1431927963.398:17): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1431927963.403:18): user pid=5406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=LOGIN msg=audit(1431927963.403:19): pid=5406 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1431927963.654:20): user pid=5406 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_START msg=audit(1431927963.659:21): user pid=5406 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1431927964.545:22): user pid=5680 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1431927964.546:23): user pid=5680 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1431927964.555:24): user pid=5680 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=5680 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1431927964.555:25): user pid=5680 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=5680 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1431927964.556:26): user pid=5680 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_CHAUTHTOK msg=audit(1431927973.256:27): user pid=5699 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=PAM:chauthtok acct="root" exe="/usr/bin/passwd" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_CHAUTHTOK msg=audit(1431927973.256:28): user pid=5699 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=change password id=0 exe="/usr/bin/passwd" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1431928201.345:29): user pid=5746 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431928201.345:30): user pid=5746 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431928201.356:31): pid=5746 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1431928201.365:32): user pid=5746 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431928201.422:33): user pid=5746 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431928201.422:34): user pid=5746 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1431928801.466:35): user pid=5810 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431928801.466:36): user pid=5810 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431928801.470:37): pid=5810 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1431928801.476:38): user pid=5810 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431928801.524:39): user pid=5810 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431928801.525:40): user pid=5810 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1431929401.574:41): user pid=5937 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431929401.575:42): user pid=5937 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431929401.577:43): pid=5937 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1431929401.587:44): user pid=5937 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431929401.637:45): user pid=5937 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431929401.637:46): user pid=5937 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1431930001.655:47): user pid=5970 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431930001.655:48): user pid=5970 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431930001.656:49): pid=5970 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1431930001.661:50): user pid=5970 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431930001.694:51): user pid=5970 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431930001.694:52): user pid=5970 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930026.440:53): user pid=5979 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=5979 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930026.440:54): user pid=5979 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=5979 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1431930026.774:55): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=5979 suid=74 rport=56121 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1431930026.774:56): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=5979 suid=74 rport=56121 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=USER_AUTH msg=audit(1431930036.996:57): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1431930037.000:58): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930037.001:59): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=5979 suid=74 rport=56121 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=USER_AUTH msg=audit(1431930037.001:60): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1431930037.003:61): user pid=5978 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=LOGIN msg=audit(1431930037.003:62): pid=5978 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_ROLE_CHANGE msg=audit(1431930037.237:63): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_START msg=audit(1431930037.249:64): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1431930037.672:65): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_START msg=audit(1431930037.676:66): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930037.677:67): user pid=5983 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=5983 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930037.677:68): user pid=5983 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=5983 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRED_REFR msg=audit(1431930037.678:69): user pid=5983 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_END msg=audit(1431930039.421:70): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1431930039.425:71): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=USER_END msg=audit(1431930039.429:72): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1431930039.430:73): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dhcp159-154.sbu.lab.eng.bos.redhat.com addr=10.16.159.154 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930039.431:74): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=5978 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930039.431:75): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=5978 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431930039.431:76): user pid=5978 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=5978 suid=0 rport=56121 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.159.154 terminal=? res=success'
>type=AVC msg=audit(1431930264.825:77): avc:  denied  { write } for  pid=6245 comm="glusterd" name="glusterd.socket" dev=dm-0 ino=784323 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1431930264.825:77): arch=c000003e syscall=42 success=no exit=-111 a0=c a1=7ffd30b66260 a2=6e a3=7ff47f546873 items=0 ppid=6244 pid=6245 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="glusterd" exe="/usr/sbin/glusterfsd" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930264.826:78): avc:  denied  { unlink } for  pid=6245 comm="glusterd" name="glusterd.socket" dev=dm-0 ino=784323 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1431930264.826:78): arch=c000003e syscall=87 success=yes exit=0 a0=7ffd30b66262 a1=7ffd30b66260 a2=6f a3=7ff47f546873 items=0 ppid=6244 pid=6245 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="glusterd" exe="/usr/sbin/glusterfsd" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930277.984:79): avc:  denied  { execute } for  pid=6334 comm="glusterd" name="S29CTDBsetup.sh" dev=dm-0 ino=784303 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1431930277.984:79): avc:  denied  { execute_no_trans } for  pid=6334 comm="glusterd" path="/var/lib/glusterd/hooks/1/start/post/S29CTDBsetup.sh" dev=dm-0 ino=784303 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:glusterd_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1431930277.984:79): arch=c000003e syscall=59 success=yes exit=0 a0=7ff464008d10 a1=7ff464008ac0 a2=f71060 a3=7ff47162e9c0 items=0 ppid=6245 pid=6334 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="S29CTDBsetup.sh" exe="/bin/bash" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930277.989:80): avc:  denied  { execute } for  pid=6335 comm="S29CTDBsetup.sh" name="hostname" dev=dm-0 ino=130329 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1431930277.989:80): arch=c000003e syscall=21 success=yes exit=0 a0=13f9420 a1=1 a2=0 a3=7ffea9289200 items=0 ppid=6334 pid=6335 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="S29CTDBsetup.sh" exe="/bin/bash" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930277.989:81): avc:  denied  { execute_no_trans } for  pid=6335 comm="S29CTDBsetup.sh" path="/bin/hostname" dev=dm-0 ino=130329 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1431930277.989:81): arch=c000003e syscall=59 success=yes exit=0 a0=13f9420 a1=13f9700 a2=13fb300 a3=7ffea92892f0 items=0 ppid=6334 pid=6335 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="hostname" exe="/bin/hostname" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930278.019:82): avc:  denied  { execute } for  pid=6353 comm="S30samba-start." name="smbd" dev=dm-0 ino=925890 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:smbd_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1431930278.019:82): arch=c000003e syscall=21 success=yes exit=0 a0=182bc20 a1=1 a2=0 a3=7ffe73283800 items=0 ppid=6352 pid=6353 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="S30samba-start." exe="/bin/bash" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930278.019:83): avc:  denied  { execute_no_trans } for  pid=6353 comm="S30samba-start." path="/usr/sbin/smbd" dev=dm-0 ino=925890 scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:smbd_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1431930278.019:83): arch=c000003e syscall=59 success=yes exit=0 a0=182bc20 a1=1825420 a2=182b320 a3=7ffe732838f0 items=0 ppid=6352 pid=6353 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=AVC msg=audit(1431930278.187:84): avc:  denied  { signal } for  pid=6338 comm="S30samba-start." scontext=unconfined_u:system_r:glusterd_t:s0 tcontext=unconfined_u:system_r:smbd_t:s0 tclass=process
>type=SYSCALL msg=audit(1431930278.187:84): arch=c000003e syscall=62 success=yes exit=0 a0=1727 a1=1 a2=0 a3=7ffe73284020 items=0 ppid=6245 pid=6338 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="S30samba-start." exe="/bin/bash" subj=unconfined_u:system_r:glusterd_t:s0 key=(null)
>type=USER_ACCT msg=audit(1431930601.755:85): user pid=6413 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431930601.755:86): user pid=6413 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431930601.765:87): pid=6413 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1431930601.774:88): user pid=6413 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431930601.823:89): user pid=6413 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431930601.824:90): user pid=6413 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1431930661.836:91): user pid=6421 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431930661.836:92): user pid=6421 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431930661.836:93): pid=6421 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1431930661.846:94): user pid=6421 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431930662.082:95): user pid=6421 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431930662.082:96): user pid=6421 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=AVC msg=audit(1431930685.513:97): avc:  denied  { search } for  pid=6458 comm="smbd" name="glusterfs" dev=dm-0 ino=269456 scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:object_r:glusterd_conf_t:s0 tclass=dir
>type=SYSCALL msg=audit(1431930685.513:97): arch=c000003e syscall=4 success=no exit=-13 a0=7f950c39e965 a1=7ffdb6be6400 a2=7ffdb6be6400 a3=1 items=0 ppid=5927 pid=6458 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1431930685.514:98): avc:  denied  { search } for  pid=6458 comm="smbd" name="glusterfs" dev=dm-0 ino=269456 scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:object_r:glusterd_conf_t:s0 tclass=dir
>type=SYSCALL msg=audit(1431930685.514:98): arch=c000003e syscall=4 success=no exit=-13 a0=7f950c39e965 a1=7ffdb6be6460 a2=7ffdb6be6460 a3=1 items=0 ppid=5927 pid=6458 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1431930685.532:99): avc:  denied  { search } for  pid=6458 comm="smbd" scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir
>type=SYSCALL msg=audit(1431930685.532:99): arch=c000003e syscall=2 success=no exit=-13 a0=7f950c3a1f48 a1=0 a2=10 a3=7ffdb6be62e8 items=0 ppid=5927 pid=6458 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1431930685.533:100): avc:  denied  { name_bind } for  pid=6458 comm="smbd" src=1023 scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1431930685.533:100): arch=c000003e syscall=49 success=no exit=-13 a0=20 a1=7f952477b6b0 a2=10 a3=726f702064657672 items=0 ppid=5927 pid=6458 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:smbd_t:s0 key=(null)
>type=AVC msg=audit(1431930685.534:101): avc:  denied  { name_connect } for  pid=6458 comm="smbd" dest=24007 scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:object_r:gluster_port_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1431930685.534:101): arch=c000003e syscall=42 success=no exit=-13 a0=20 a1=7f952477b1b8 a2=10 a3=0 items=0 ppid=5927 pid=6458 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:system_r:smbd_t:s0 key=(null)
>type=USER_ACCT msg=audit(1431931201.103:102): user pid=6493 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431931201.103:103): user pid=6493 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431931201.104:104): pid=6493 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1431931201.114:105): user pid=6493 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431931201.131:106): user pid=6493 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431931201.131:107): user pid=6493 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1431931801.140:108): user pid=6530 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1431931801.141:109): user pid=6530 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1431931801.141:110): pid=6530 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=USER_START msg=audit(1431931801.150:111): user pid=6530 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1431931801.163:112): user pid=6530 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1431931801.163:113): user pid=6530 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1431932133.264:114): user pid=6554 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=6554 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431932133.264:115): user pid=6554 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=6554 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1431932133.842:116): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6554 suid=74 rport=42359 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1431932133.842:117): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6554 suid=74 rport=42359 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=USER_AUTH msg=audit(1431932148.565:118): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1431932148.568:119): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1431932148.568:120): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6554 suid=74 rport=42359 laddr=10.70.34.116 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=USER_AUTH msg=audit(1431932148.569:121): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1431932148.570:122): user pid=6553 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=LOGIN msg=audit(1431932148.570:123): pid=6553 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_ROLE_CHANGE msg=audit(1431932148.807:124): user pid=6553 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_START msg=audit(1431932148.811:125): user pid=6553 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1431932149.761:126): user pid=6553 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=USER_START msg=audit(1431932149.761:127): user pid=6553 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1431932149.762:128): user pid=6557 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:da:88:58:0a:77:89:86:bc:83:fa:26:58:bb:ee:d4 direction=? spid=6557 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1431932149.763:129): user pid=6557 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=24:02:4f:54:d2:6e:e4:5c:05:96:9a:a2:ba:f3:b4:67 direction=? spid=6557 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.50.214 terminal=? res=success'
>type=CRED_REFR msg=audit(1431932149.764:130): user pid=6557 uid=0 auid=0 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.10.50.214 addr=10.10.50.214 terminal=ssh res=success'

Actions: View

Attachments on bug 1221929: 1026645 | 1026677 | 1026709 | 1027682 | 1027683 | 1028708