Attachment 147659 Details for Bug 222498 – Permissive mode audit log

Permissive mode audit log

log-permissive.txt (text/plain), 6.40 KB, created by Tom London on 2007-02-08 15:47:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tom London

Created: 2007-02-08 15:47:18 UTC

Size: 6.40 KB

patch

obsolete

>type=AVC msg=audit(1170947576.367:6): avc:  denied  { execute_no_trans } for  pid=2414 comm="sh" name="ldconfig" dev=dm-0 ino=11337776 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
>type=AVC msg=audit(1170947576.367:6): avc:  denied  { read } for  pid=2414 comm="sh" name="ldconfig" dev=dm-0 ino=11337776 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1170947576.367:6): arch=40000003 syscall=11 success=yes exit=0 a0=9d7fdd8 a1=9d7fe58 a2=9d7f330 a3=0 items=0 ppid=2413 pid=2414 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ldconfig" exe="/sbin/ldconfig" subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
>type=AVC_PATH msg=audit(1170947576.367:6):  path="/sbin/ldconfig"
>type=AVC_PATH msg=audit(1170947576.367:6):  path="/sbin/ldconfig"
>type=LABEL_LEVEL_CHANGE msg=audit(1170947583.347:7): user pid=2619 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=HP5MP uri=hp:/par/HP_LaserJet_5MP?device=/dev/parport0 banners=none,none range=s0: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1170947583.418:8): user pid=2619 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=hp_LaserJet_1300 uri=hal:///org/freedesktop/Hal/devices/usb_device_3f0_1017_00CNCB954325_if0_printer_noserial banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1170947583.460:9): user pid=2619 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Innopath uri=file:/dev/null banners=none,none range=s0: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1170947583.461:10): user pid=2619 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Local uri=file:/dev/null banners=none,none range=s0: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1170947597.008:11): avc:  denied  { getattr } for  pid=3028 comm="hald" name="fdi-cache" dev=dm-0 ino=2031634 scontext=system_u:system_r:hald_t:s0 tcontext=user_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1170947597.008:11): arch=40000003 syscall=195 success=yes exit=0 a0=807ebef a1=bf9562f8 a2=4d489ff4 a3=0 items=0 ppid=3027 pid=3028 auid=4294967295 uid=68 gid=68 euid=68 suid=68 fsuid=68 egid=68 sgid=68 fsgid=68 tty=(none) comm="hald" exe="/usr/sbin/hald" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC_PATH msg=audit(1170947597.008:11):  path="/var/cache/hald/fdi-cache"
>type=AVC msg=audit(1170947597.077:12): avc:  denied  { read } for  pid=3028 comm="hald" name="fdi-cache" dev=dm-0 ino=2031634 scontext=system_u:system_r:hald_t:s0 tcontext=user_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1170947597.077:12): arch=40000003 syscall=5 success=yes exit=12 a0=807ebef a1=8000 a2=0 a3=8000 items=0 ppid=3027 pid=3028 auid=4294967295 uid=68 gid=68 euid=68 suid=68 fsuid=68 egid=68 sgid=68 fsgid=68 tty=(none) comm="hald" exe="/usr/sbin/hald" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_ERR msg=audit(1170947613.003:13): user pid=3234 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1170947626.858:14): user pid=3282 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=tbl : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1170947626.859:15): user pid=3282 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=tbl : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1170947626.861:16): user pid=3282 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=tbl : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1170947626.866:17): login pid=3282 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1170947626.898:18): user pid=3282 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=tbl : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1170947626.902:19): user pid=3282 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AVC msg=audit(1170947627.058:20): user pid=2490 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.ConsoleKit.Manager member=OpenSessionWithParameters dest=org.freedesktop.ConsoleKit spid=3282 tpid=2729 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus : exe="/bin/dbus-daemon" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=USER_AVC msg=audit(1170947627.068:21): user pid=2490 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.11 spid=2729 tpid=3282 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dbus : exe="/bin/dbus-daemon" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=USER_AUTH msg=audit(1170947666.507:22): user pid=3657 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1170947666.508:23): user pid=3657 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1170947667.149:24): user pid=3657 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1170947667.150:25): user pid=3657 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'

Actions: View

Attachments on bug 222498: 145495 | 147658 | 147659 | 148053 | 148176 | 148200 | 148734