Attachment 149687 Details for Bug 215343 – Audit log when failing to start SDL domain

Audit log when failing to start SDL domain

audit.log (text/plain), 5.20 KB, created by Chris Lalancette on 2007-03-09 14:40:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Lalancette

Created: 2007-03-09 14:40:47 UTC

Size: 5.20 KB

patch

obsolete

>type=DAEMON_START msg=audit(1173451314.712:1005) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=2147 res=success, auditd pid=2147
>type=CONFIG_CHANGE msg=audit(1173451314.810:5): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0
>type=CONFIG_CHANGE msg=audit(1173451315.194:6): audit_backlog_limit=256 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0
>type=ANOM_PROMISCUOUS msg=audit(1173451327.238:7): dev=vif0.0 prom=256 old_prom=0 auid=4294967295
>type=SYSCALL msg=audit(1173451327.238:7): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfff6ce0 a3=1 items=0 ppid=2886 pid=3112 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1173451330.307:8): dev=peth0 prom=256 old_prom=0 auid=4294967295
>type=SYSCALL msg=audit(1173451330.307:8): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf880570 a3=1 items=0 ppid=2886 pid=3127 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=USER_AUTH msg=audit(1173451342.871:9): user pid=3369 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1173451342.871:10): user pid=3369 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1173451342.883:11): login pid=3369 uid=0 old auid=4294967295 new auid=0
>type=USER_ROLE_CHANGE msg=audit(1173451342.923:12): user pid=3369 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1173451342.923:13): user pid=3369 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1173451342.923:14): user pid=3369 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1173451342.959:15): user pid=3369 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=AVC msg=audit(1173451577.018:16): avc:  denied  { read write } for  pid=3739 comm="ifconfig" name="rhel5fvtest.dsk" dev=sda1 ino=229191 scontext=system_u:system_r:ifconfig_t:s0 tcontext=root:object_r:xen_image_t:s0 tclass=file
>type=SYSCALL msg=audit(1173451577.018:16): arch=40000003 syscall=11 success=yes exit=0 a0=816cf30 a1=816d448 a2=816d340 a3=816d208 items=0 ppid=3724 pid=3739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ifconfig" exe="/sbin/ifconfig" subj=system_u:system_r:ifconfig_t:s0 key=(null)
>type=AVC_PATH msg=audit(1173451577.018:16):  path="/var/lib/xen/images/rhel5fvtest.dsk"
>type=ANOM_PROMISCUOUS msg=audit(1173451577.022:17): dev=tap0 prom=256 old_prom=0 auid=4294967295
>type=SYSCALL msg=audit(1173451577.022:17): arch=40000003 syscall=54 success=yes exit=0 a0=4 a1=89a2 a2=bfe58310 a3=1 items=0 ppid=3724 pid=3749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=AVC msg=audit(1173451577.342:18): avc:  denied  { search } for  pid=3692 comm="qemu-dm" name="tmp" dev=sda1 ino=8151265 scontext=system_u:system_r:xend_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1173451577.342:18): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bff7b3a0 a2=4dd70b24 a3=13 items=0 ppid=2877 pid=3692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="qemu-dm" exe="/usr/lib/xen/bin/qemu-dm" subj=system_u:system_r:xend_t:s0 key=(null)
>type=AVC msg=audit(1173451577.354:19): avc:  denied  { search } for  pid=3692 comm="qemu-dm" name="tmp" dev=sda1 ino=8151265 scontext=system_u:system_r:xend_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1173451577.354:19): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bff7b390 a2=4dd70b24 a3=13 items=0 ppid=2877 pid=3692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="qemu-dm" exe="/usr/lib/xen/bin/qemu-dm" subj=system_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1173451577.658:20): dev=tap0 prom=0 old_prom=256 auid=4294967295
>type=ANOM_PROMISCUOUS msg=audit(1173451577.706:21): dev=vif1.0 prom=256 old_prom=0 auid=4294967295
>type=SYSCALL msg=audit(1173451577.706:21): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfad6f10 a3=1 items=0 ppid=3719 pid=3866 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)

Actions: View

Attachments on bug 215343: 144486 | 144487 | 144488 | 149394 | 149687