Attachment 144532 Details for Bug 220907 – Logs when cron is working as non-root.

Logs when cron is working as non-root.

audit_log_cron_working.txt (text/plain), 3.72 KB, created by Jose Plans on 2006-12-29 11:07:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jose Plans

Created: 2006-12-29 11:07:17 UTC

Size: 3.72 KB

patch

obsolete

>----
>time->Thu Dec 28 22:42:01 2006
>type=USER_ACCT msg=audit(1167367321.068:48994): user pid=2548 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s15:c0.
>c1023 msg='PAM: accounting acct=ealuser : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>----
>time->Thu Dec 28 22:42:01 2006
>type=SYSCALL msg=audit(1167367321.070:48995): arch=14 syscall=4 success=yes exit=43 a0=3 a1=80a2de8 a2=2b a3=fffffffffefefeff
> items=0 ppid=1344 pid=2548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="crond" e
>xe="/usr/sbin/crond" subj=system_u:system_r:crond_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1167367321.070:48995): avc:  granted  { setexec } for  pid=2548 comm="crond" scontext=system_u:system_r:cr
>ond_t:s0-s15:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tclass=process
>----
>time->Thu Dec 28 22:42:01 2006
>type=CRED_ACQ msg=audit(1167367321.076:48996): user pid=2548 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s15:c0.c
>1023 msg='PAM: setcred acct=ealuser : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>----
>time->Thu Dec 28 22:42:01 2006
>type=LOGIN msg=audit(1167367321.076:48997): login pid=2548 uid=0 old auid=4294967295 new auid=500
>----
>time->Thu Dec 28 22:42:01 2006
>type=SYSCALL msg=audit(1167367321.282:48998): arch=14 syscall=4 success=yes exit=0 a0=3 a1=0 a2=0 a3=fffffffffefefeff items=0
> ppid=2548 pid=2550 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="crond" exe="/usr/sbin/c
>rond" subj=system_u:system_r:crond_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1167367321.282:48998): avc:  granted  { setexec } for  pid=2550 comm="crond" scontext=system_u:system_r:cr
>ond_t:s0-s15:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tclass=process
>----
>time->Thu Dec 28 22:42:01 2006
>type=SYSCALL msg=audit(1167367321.379:48999): arch=14 syscall=4 success=yes exit=0 a0=3 a1=0 a2=0 a3=fffffffffefefeff items=0
> ppid=2548 pid=2551 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="crond" exe="/usr/sbin/c
>rond" subj=system_u:system_r:crond_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1167367321.379:48999): avc:  granted  { setexec } for  pid=2551 comm="crond" scontext=system_u:system_r:cr
>ond_t:s0-s15:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tclass=process
>----
>time->Thu Dec 28 22:42:01 2006
>type=SYSCALL msg=audit(1167367321.487:49000): arch=14 syscall=4 success=yes exit=0 a0=3 a1=0 a2=0 a3=fffffffffefefeff items=0
> ppid=2548 pid=2552 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="crond" exe="/usr/sbin/c
>rond" subj=system_u:system_r:crond_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1167367321.487:49000): avc:  granted  { setexec } for  pid=2552 comm="crond" scontext=system_u:system_r:cr
>ond_t:s0-s15:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tclass=process
>----
>time->Thu Dec 28 22:42:01 2006
>type=USER_START msg=audit(1167367321.505:49001): user pid=2548 uid=0 auid=500 subj=system_u:system_r:crond_t:s0-s15:c0.c1023 
>msg='PAM: session open acct=ealuser : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>----
>time->Thu Dec 28 22:42:01 2006
>type=SYSCALL msg=audit(1167367321.506:49002): arch=14 syscall=4 success=yes exit=0 a0=7 a1=0 a2=0 a3=fffffffffefefeff items=0
> ppid=1344 pid=2548 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="crond" 
>exe="/usr/sbin/crond" subj=system_u:system_r:crond_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1167367321.506:49002): avc:  granted  { setexec } for  pid=2548 comm="crond" scontext=system_u:system_r:cr
>ond_t:s0-s15:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s15:c0.c1023 tclass=process

Actions: View

Attachments on bug 220907: 144532