Attachment 152572 Details for Bug 236316 – All of the audit.log entries during the login and passwd reset process

All of the audit.log entries during the login and passwd reset process

AVCs (text/plain), 7.82 KB, created by Matt Anderson on 2007-04-13 18:22:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matt Anderson

Created: 2007-04-13 18:22:32 UTC

Size: 7.82 KB

patch

obsolete

>type=USER_AUTH msg=audit(1176487640.893:9158): user pid=6570 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='PAM: authentication acct=eal2 : exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1176487640.909:9159): user pid=6570 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='PAM: accounting acct=eal2 : exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=ssh res=failed)'
>type=AVC msg=audit(1176487654.815:9160): avc:  denied  { write } for  pid=6570 comm="sshd" name=".pwd.lock" dev=dm-0 ino=983286 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.815:9160): arch=40000003 syscall=5 success=yes exit=8 a0=5d48eb a1=41 a2=180 a3=ffffffff items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1176487654.815:9161): avc:  denied  { lock } for  pid=6570 comm="sshd" name=".pwd.lock" dev=dm-0 ino=983286 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.815:9161): arch=40000003 syscall=221 success=yes exit=0 a0=8 a1=7 a2=bff0c23c a3=bff0c23c items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1176487654.815:9161):  path="/etc/.pwd.lock"
>type=AVC msg=audit(1176487654.822:9162): avc:  denied  { write } for  pid=6570 comm="sshd" name="security" dev=dm-0 ino=983249 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>type=AVC msg=audit(1176487654.822:9162): avc:  denied  { add_name } for  pid=6570 comm="sshd" name="nopasswd" scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>type=AVC msg=audit(1176487654.822:9162): avc:  denied  { create } for  pid=6570 comm="sshd" name="nopasswd" scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.822:9162): arch=40000003 syscall=5 success=yes exit=9 a0=e698d1 a1=8241 a2=1b6 a3=9bdd718 items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1176487654.822:9163): avc:  denied  { setattr } for  pid=6570 comm="sshd" name="nopasswd" dev=dm-0 ino=983862 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.822:9163): arch=40000003 syscall=207 success=yes exit=0 a0=9 a1=0 a2=0 a3=0 items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1176487654.823:9164): avc:  denied  { write } for  pid=6570 comm="sshd" name="nopasswd" dev=dm-0 ino=983862 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.823:9164): arch=40000003 syscall=4 success=yes exit=91 a0=9 a1=b7f33000 a2=5b a3=5b items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1176487654.823:9164):  path="/etc/security/nopasswd"
>type=AVC msg=audit(1176487654.824:9165): avc:  denied  { remove_name } for  pid=6570 comm="sshd" name="nopasswd" dev=dm-0 ino=983862 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>type=AVC msg=audit(1176487654.824:9165): avc:  denied  { rename } for  pid=6570 comm="sshd" name="nopasswd" dev=dm-0 ino=983862 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1176487654.824:9165): avc:  denied  { unlink } for  pid=6570 comm="sshd" name="opasswd" dev=dm-0 ino=983887 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.824:9165): arch=40000003 syscall=38 success=yes exit=0 a0=e698d1 a1=e69852 a2=e6ba80 a3=e6fc60 items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1176487654.825:9166): avc:  denied  { create } for  pid=6570 comm="sshd" name="nshadow" scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.825:9166): arch=40000003 syscall=5 success=yes exit=9 a0=e69920 a1=8241 a2=1b6 a3=9bdd9a0 items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1176487654.825:9167): avc:  denied  { setattr } for  pid=6570 comm="sshd" name="nshadow" dev=dm-0 ino=983887 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.825:9167): arch=40000003 syscall=207 success=yes exit=0 a0=9 a1=0 a2=0 a3=0 items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=AVC msg=audit(1176487654.825:9168): avc:  denied  { rename } for  pid=6570 comm="sshd" name="nshadow" dev=dm-0 ino=983887 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>type=AVC msg=audit(1176487654.825:9168): avc:  denied  { unlink } for  pid=6570 comm="sshd" name="shadow" dev=dm-0 ino=983888 scontext=system_u:system_r:sshd_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>type=SYSCALL msg=audit(1176487654.825:9168): arch=40000003 syscall=38 success=yes exit=0 a0=e69920 a1=e69914 a2=e6ba80 a3=0 items=0 ppid=6568 pid=6570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1176487654.840:9169): user pid=6570 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='PAM: chauthtok acct=eal2 : exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1176487654.857:9170): user pid=6568 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='PAM: setcred acct=eal2 : exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=ssh res=success)'
>type=LOGIN msg=audit(1176487654.858:9171): login pid=6568 uid=0 old auid=4294967295 new auid=502
>type=USER_START msg=audit(1176487654.871:9172): user pid=6568 uid=0 auid=502 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='PAM: session open acct=eal2 : exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1176487654.887:9173): user pid=6571 uid=0 auid=502 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='PAM: setcred acct=eal2 : exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1176487654.903:9174): user pid=6568 uid=0 auid=502 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='uid=502: exe="/usr/sbin/sshd" (hostname=tuna.zko.hp.com, addr=16.116.12.22, terminal=/dev/pts/3 res=success)'
>

Actions: View

Attachments on bug 236316: 152572 | 153253