Attachment 156121 Details for Bug 242240 – /var/log/audit/audit.log file

/var/log/audit/audit.log file

audit.log (text/plain), 109.69 KB, created by Fabian M. Schindler on 2007-06-04 20:13:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Fabian M. Schindler

Created: 2007-06-04 20:13:52 UTC

Size: 109.69 KB

patch

obsolete

>type=DAEMON_START msg=audit(1180693817.695:5557) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1762 res=success, auditd pid=1762
>type=CONFIG_CHANGE msg=audit(1180693817.408:34): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180693817.408:35): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180693817.408:36): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180693817.408:37): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=USYS_CONFIG msg=audit(1180693877.014:38): user pid=2624 uid=0 auid=4294967295 subj=system_u:system_r:firstboot_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ERR msg=audit(1180693914.509:39): user pid=2661 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180693931.506:40): user pid=2725 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180693931.506:41): user pid=2725 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180693931.506:42): user pid=2725 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180693931.506:43): login pid=2725 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1180693931.506:44): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb0" dev=tmpfs ino=5667 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:44): arch=40000003 syscall=196 success=no exit=-13 a0=9c99758 a1=bff29fbc a2=c11ff4 a3=9c99758 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:44):  path="/dev/fb0"
>type=AVC msg=audit(1180693931.506:45): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb1" dev=tmpfs ino=5668 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:45): arch=40000003 syscall=196 success=no exit=-13 a0=9c99748 a1=bff29fbc a2=c11ff4 a3=9c99748 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:45):  path="/dev/fb1"
>type=AVC msg=audit(1180693931.506:46): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb2" dev=tmpfs ino=5669 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:46): arch=40000003 syscall=196 success=no exit=-13 a0=9c99738 a1=bff29fbc a2=c11ff4 a3=9c99738 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:46):  path="/dev/fb2"
>type=AVC msg=audit(1180693931.506:47): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb3" dev=tmpfs ino=5670 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:47): arch=40000003 syscall=196 success=no exit=-13 a0=9c99728 a1=bff29fbc a2=c11ff4 a3=9c99728 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:47):  path="/dev/fb3"
>type=AVC msg=audit(1180693931.506:48): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb4" dev=tmpfs ino=5671 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:48): arch=40000003 syscall=196 success=no exit=-13 a0=9c97fe0 a1=bff29fbc a2=c11ff4 a3=9c97fe0 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:48):  path="/dev/fb4"
>type=AVC msg=audit(1180693931.506:49): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb5" dev=tmpfs ino=5672 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:49): arch=40000003 syscall=196 success=no exit=-13 a0=9c97fd0 a1=bff29fbc a2=c11ff4 a3=9c97fd0 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:49):  path="/dev/fb5"
>type=AVC msg=audit(1180693931.506:50): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb6" dev=tmpfs ino=5673 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:50): arch=40000003 syscall=196 success=no exit=-13 a0=9c97f80 a1=bff29fbc a2=c11ff4 a3=9c97f80 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:50):  path="/dev/fb6"
>type=AVC msg=audit(1180693931.506:51): avc:  denied  { getattr } for  pid=2757 comm="pam_console_app" name="fb7" dev=tmpfs ino=5674 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180693931.506:51): arch=40000003 syscall=196 success=no exit=-13 a0=9c986e8 a1=bff29fbc a2=c11ff4 a3=9c986e8 items=0 ppid=2725 pid=2757 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180693931.506:51):  path="/dev/fb7"
>type=USER_START msg=audit(1180693931.506:52): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180693931.506:53): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180695661.742:54): user pid=3164 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180695661.742:55): user pid=3164 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180695661.742:56): login pid=3164 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180695661.742:57): user pid=3164 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180695661.742:58): user pid=3164 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180695661.742:59): user pid=3164 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1180698242.348:60): avc:  denied  { search } for  pid=3743 comm="procmail" name="root" dev=sda1 ino=688129 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1180698242.348:60): arch=40000003 syscall=5 success=no exit=-13 a0=96e4d90 a1=8000 a2=0 a3=8000 items=0 ppid=3742 pid=3743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
>type=USER_ACCT msg=audit(1180699261.693:61): user pid=18001 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180699261.693:62): user pid=18001 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180699261.693:63): login pid=18001 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180699261.693:64): user pid=18001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180699261.693:65): user pid=18001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180699261.693:66): user pid=18001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1180700390.521:67): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb0" dev=tmpfs ino=5667 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:67): arch=40000003 syscall=196 success=no exit=-13 a0=94d9d68 a1=bf8b600c a2=416c8ff4 a3=94d9d68 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:67):  path="/dev/fb0"
>type=AVC msg=audit(1180700390.521:68): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb1" dev=tmpfs ino=5668 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:68): arch=40000003 syscall=196 success=no exit=-13 a0=94d9d58 a1=bf8b600c a2=416c8ff4 a3=94d9d58 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:68):  path="/dev/fb1"
>type=AVC msg=audit(1180700390.521:69): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb2" dev=tmpfs ino=5669 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:69): arch=40000003 syscall=196 success=no exit=-13 a0=94d9d48 a1=bf8b600c a2=416c8ff4 a3=94d9d48 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:69):  path="/dev/fb2"
>type=AVC msg=audit(1180700390.521:70): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb3" dev=tmpfs ino=5670 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:70): arch=40000003 syscall=196 success=no exit=-13 a0=94d9dd8 a1=bf8b600c a2=416c8ff4 a3=94d9dd8 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:70):  path="/dev/fb3"
>type=AVC msg=audit(1180700390.521:71): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb4" dev=tmpfs ino=5671 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:71): arch=40000003 syscall=196 success=no exit=-13 a0=94d9dc8 a1=bf8b600c a2=416c8ff4 a3=94d9dc8 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:71):  path="/dev/fb4"
>type=AVC msg=audit(1180700390.521:72): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb5" dev=tmpfs ino=5672 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:72): arch=40000003 syscall=196 success=no exit=-13 a0=94d9db8 a1=bf8b600c a2=416c8ff4 a3=94d9db8 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:72):  path="/dev/fb5"
>type=AVC msg=audit(1180700390.521:73): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb6" dev=tmpfs ino=5673 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:73): arch=40000003 syscall=196 success=no exit=-13 a0=94d9d18 a1=bf8b600c a2=416c8ff4 a3=94d9d18 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:73):  path="/dev/fb6"
>type=AVC msg=audit(1180700390.521:74): avc:  denied  { getattr } for  pid=27401 comm="pam_console_app" name="fb7" dev=tmpfs ino=5674 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180700390.521:74): arch=40000003 syscall=196 success=no exit=-13 a0=94d9d28 a1=bf8b600c a2=416c8ff4 a3=94d9d28 items=0 ppid=2725 pid=27401 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180700390.521:74):  path="/dev/fb7"
>type=USER_END msg=audit(1180700390.521:75): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180700390.521:76): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180700404.461:5558) auditd normal halt, sending auid=4294967295 pid=27873 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1762
>type=DAEMON_START msg=audit(1180782714.359:9971) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1771 res=success, auditd pid=1771
>type=CONFIG_CHANGE msg=audit(1180782714.423:34): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180782714.423:35): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180782714.423:36): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180782714.423:37): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=USER_ERR msg=audit(1180782735.420:38): user pid=2462 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180782749.417:39): user pid=2522 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180782749.417:40): user pid=2522 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180782749.417:41): user pid=2522 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180782749.417:42): login pid=2522 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1180782749.417:43): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb0" dev=tmpfs ino=5744 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:43): arch=40000003 syscall=196 success=no exit=-13 a0=9316758 a1=bfb493dc a2=416c8ff4 a3=9316758 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:43):  path="/dev/fb0"
>type=AVC msg=audit(1180782749.417:44): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb1" dev=tmpfs ino=5745 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:44): arch=40000003 syscall=196 success=no exit=-13 a0=9316748 a1=bfb493dc a2=416c8ff4 a3=9316748 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:44):  path="/dev/fb1"
>type=AVC msg=audit(1180782749.417:45): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb2" dev=tmpfs ino=5746 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:45): arch=40000003 syscall=196 success=no exit=-13 a0=9316738 a1=bfb493dc a2=416c8ff4 a3=9316738 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:45):  path="/dev/fb2"
>type=AVC msg=audit(1180782749.417:46): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb3" dev=tmpfs ino=5747 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:46): arch=40000003 syscall=196 success=no exit=-13 a0=9316728 a1=bfb493dc a2=416c8ff4 a3=9316728 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:46):  path="/dev/fb3"
>type=AVC msg=audit(1180782749.417:47): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb4" dev=tmpfs ino=5748 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:47): arch=40000003 syscall=196 success=no exit=-13 a0=9314fe0 a1=bfb493dc a2=416c8ff4 a3=9314fe0 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:47):  path="/dev/fb4"
>type=AVC msg=audit(1180782749.417:48): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb5" dev=tmpfs ino=5749 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:48): arch=40000003 syscall=196 success=no exit=-13 a0=9314fd0 a1=bfb493dc a2=416c8ff4 a3=9314fd0 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:48):  path="/dev/fb5"
>type=AVC msg=audit(1180782749.417:49): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb6" dev=tmpfs ino=5750 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:49): arch=40000003 syscall=196 success=no exit=-13 a0=9314f80 a1=bfb493dc a2=416c8ff4 a3=9314f80 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:49):  path="/dev/fb6"
>type=AVC msg=audit(1180782749.417:50): avc:  denied  { getattr } for  pid=2553 comm="pam_console_app" name="fb7" dev=tmpfs ino=5751 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180782749.417:50): arch=40000003 syscall=196 success=no exit=-13 a0=93156e8 a1=bfb493dc a2=416c8ff4 a3=93156e8 items=0 ppid=2522 pid=2553 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180782749.417:50):  path="/dev/fb7"
>type=USER_START msg=audit(1180782749.417:51): user pid=2522 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180782749.417:52): user pid=2522 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1180782807.908:53): user pid=2772 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180782807.908:54): user pid=2772 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180782808.408:55): user pid=2772 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180783057.870:56): user pid=2772 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1180783372.822:57): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb0" dev=tmpfs ino=5744 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:57): arch=40000003 syscall=196 success=no exit=-13 a0=85cfd68 a1=bfe153bc a2=416c8ff4 a3=85cfd68 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:57):  path="/dev/fb0"
>type=AVC msg=audit(1180783372.822:58): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb1" dev=tmpfs ino=5745 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:58): arch=40000003 syscall=196 success=no exit=-13 a0=85cfd58 a1=bfe153bc a2=416c8ff4 a3=85cfd58 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:58):  path="/dev/fb1"
>type=AVC msg=audit(1180783372.822:59): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb2" dev=tmpfs ino=5746 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:59): arch=40000003 syscall=196 success=no exit=-13 a0=85cfd48 a1=bfe153bc a2=416c8ff4 a3=85cfd48 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:59):  path="/dev/fb2"
>type=AVC msg=audit(1180783372.822:60): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb3" dev=tmpfs ino=5747 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:60): arch=40000003 syscall=196 success=no exit=-13 a0=85cfdd8 a1=bfe153bc a2=416c8ff4 a3=85cfdd8 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:60):  path="/dev/fb3"
>type=AVC msg=audit(1180783372.822:61): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb4" dev=tmpfs ino=5748 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:61): arch=40000003 syscall=196 success=no exit=-13 a0=85cfdc8 a1=bfe153bc a2=416c8ff4 a3=85cfdc8 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:61):  path="/dev/fb4"
>type=AVC msg=audit(1180783372.822:62): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb5" dev=tmpfs ino=5749 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:62): arch=40000003 syscall=196 success=no exit=-13 a0=85cfdb8 a1=bfe153bc a2=416c8ff4 a3=85cfdb8 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:62):  path="/dev/fb5"
>type=AVC msg=audit(1180783372.822:63): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb6" dev=tmpfs ino=5750 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:63): arch=40000003 syscall=196 success=no exit=-13 a0=85cfd18 a1=bfe153bc a2=416c8ff4 a3=85cfd18 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:63):  path="/dev/fb6"
>type=AVC msg=audit(1180783372.822:64): avc:  denied  { getattr } for  pid=2871 comm="pam_console_app" name="fb7" dev=tmpfs ino=5751 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180783372.822:64): arch=40000003 syscall=196 success=no exit=-13 a0=85cfd28 a1=bfe153bc a2=416c8ff4 a3=85cfd28 items=0 ppid=2522 pid=2871 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180783372.822:64):  path="/dev/fb7"
>type=USER_END msg=audit(1180783372.822:65): user pid=2522 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180783372.822:66): user pid=2522 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180783381.987:9972) auditd normal halt, sending auid=4294967295 pid=3353 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1771
>type=DAEMON_START msg=audit(1180796926.862:8747) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1760 res=success, auditd pid=1760
>type=CONFIG_CHANGE msg=audit(1180796926.920:34): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180796926.920:35): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180796926.920:36): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180796926.920:37): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=USER_ERR msg=audit(1180796947.417:38): user pid=2449 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180796962.914:39): user pid=2513 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180796962.914:40): user pid=2513 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180796962.914:41): user pid=2513 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180796962.914:42): login pid=2513 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1180796962.914:43): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb0" dev=tmpfs ino=5584 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:43): arch=40000003 syscall=196 success=no exit=-13 a0=9141758 a1=bfe686fc a2=416c8ff4 a3=9141758 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:43):  path="/dev/fb0"
>type=AVC msg=audit(1180796962.914:44): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb1" dev=tmpfs ino=5585 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:44): arch=40000003 syscall=196 success=no exit=-13 a0=9141748 a1=bfe686fc a2=416c8ff4 a3=9141748 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:44):  path="/dev/fb1"
>type=AVC msg=audit(1180796962.914:45): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb2" dev=tmpfs ino=5586 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:45): arch=40000003 syscall=196 success=no exit=-13 a0=9141738 a1=bfe686fc a2=416c8ff4 a3=9141738 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:45):  path="/dev/fb2"
>type=AVC msg=audit(1180796962.914:46): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb3" dev=tmpfs ino=5587 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:46): arch=40000003 syscall=196 success=no exit=-13 a0=9141728 a1=bfe686fc a2=416c8ff4 a3=9141728 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:46):  path="/dev/fb3"
>type=AVC msg=audit(1180796962.914:47): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb4" dev=tmpfs ino=5588 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:47): arch=40000003 syscall=196 success=no exit=-13 a0=913ffe0 a1=bfe686fc a2=416c8ff4 a3=913ffe0 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:47):  path="/dev/fb4"
>type=AVC msg=audit(1180796962.914:48): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb5" dev=tmpfs ino=5589 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:48): arch=40000003 syscall=196 success=no exit=-13 a0=913ffd0 a1=bfe686fc a2=416c8ff4 a3=913ffd0 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:48):  path="/dev/fb5"
>type=AVC msg=audit(1180796962.914:49): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb6" dev=tmpfs ino=5590 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:49): arch=40000003 syscall=196 success=no exit=-13 a0=913ff80 a1=bfe686fc a2=416c8ff4 a3=913ff80 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:49):  path="/dev/fb6"
>type=AVC msg=audit(1180796962.914:50): avc:  denied  { getattr } for  pid=2545 comm="pam_console_app" name="fb7" dev=tmpfs ino=5591 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180796962.914:50): arch=40000003 syscall=196 success=no exit=-13 a0=91406e8 a1=bfe686fc a2=416c8ff4 a3=91406e8 items=0 ppid=2513 pid=2545 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180796962.914:50):  path="/dev/fb7"
>type=USER_START msg=audit(1180796962.914:51): user pid=2513 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180796962.914:52): user pid=2513 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1180797124.890:53): user pid=2831 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180797124.890:54): user pid=2831 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180797124.890:55): user pid=2831 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180797161.884:56): user pid=2831 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1180797165.883:57): user pid=2843 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180797165.883:58): user pid=2843 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180797165.883:59): user pid=2843 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180797173.382:60): user pid=2843 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1180797205.377:61): user pid=2874 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1180797205.377:62): user pid=2874 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1180797205.377:63): user pid=2874 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1180797205.377:64): user pid=2874 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=AVC msg=audit(1180797226.874:65): avc:  denied  { search } for  pid=2926 comm="cupsd" name="root" dev=sda1 ino=688129 scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1180797226.874:65): arch=40000003 syscall=5 success=no exit=-13 a0=bfd2b538 a1=8000 a2=0 a3=8000 items=0 ppid=2925 pid=2926 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="cupsd" exe="/usr/sbin/cupsd" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1180797226.874:66): avc:  denied  { search } for  pid=2926 comm="cupsd" name="root" dev=sda1 ino=688129 scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1180797226.874:66): arch=40000003 syscall=5 success=no exit=-13 a0=bfd2b538 a1=8000 a2=0 a3=8000 items=0 ppid=2925 pid=2926 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="cupsd" exe="/usr/sbin/cupsd" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=LABEL_LEVEL_CHANGE msg=audit(1180797326.859:67): user pid=2926 uid=0 auid=500 subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=file:/dev/null banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1180797326.859:68): user pid=2926 uid=0 auid=500 subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1180797327.359:69): user pid=2926 uid=0 auid=500 subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1180797383.350:70): user pid=2874 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1180797383.350:71): user pid=2874 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=AVC msg=audit(1180797433.342:72): avc:  denied  { write } for  pid=2994 comm="ccp" name="fifo0" dev=sda1 ino=984131 scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1180797433.342:72): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bf814840 a1=81 a2=0 a3=bf814840 items=0 ppid=2926 pid=2994 auid=500 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1180797434.342:73): avc:  denied  { setpgid } for  pid=2996 comm="pstocapt" scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1180797434.342:73): arch=40000003 syscall=57 per=400000 success=no exit=-13 a0=0 a1=0 a2=804bb88 a3=bfff7220 items=0 ppid=2993 pid=2996 auid=500 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) comm="pstocapt" exe="/usr/lib/cups/filter/pstocapt" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1180797533.827:74): user pid=3003 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180797533.827:75): user pid=3003 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180797533.827:76): user pid=3003 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=MAC_STATUS msg=audit(1180797546.325:77): enforcing=0 old_enforcing=1 auid=500
>type=USER_AVC msg=audit(1180797546.325:78): user pid=1917 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=USER_AVC msg=audit(1180797546.325:79): user pid=3010 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0 msg='avc:  received setenforce notice (enforcing=0) : exe="/bin/dbus-daemon" (sauid=0, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1180797546.325:77): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfcdc9e4 a2=1 a3=bfcdc9e4 items=0 ppid=3028 pid=3029 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setenforce" exe="/usr/sbin/setenforce" subj=system_u:system_r:unconfined_t:s0 key=(null)
>type=USER_END msg=audit(1180797546.325:80): user pid=3003 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1180797558.823:81): avc:  denied  { getattr } for  pid=3038 comm="pam_console_app" name="fb0" dev=tmpfs ino=5584 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180797558.823:81): arch=40000003 syscall=196 success=yes exit=0 a0=8992d58 a1=bf9856cc a2=416c8ff4 a3=8992d58 items=0 ppid=2513 pid=3038 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180797558.823:81):  path="/dev/fb0"
>type=AVC msg=audit(1180797558.823:82): avc:  denied  { setattr } for  pid=3038 comm="pam_console_app" name="fb0" dev=tmpfs ino=5584 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180797558.823:82): arch=40000003 syscall=15 success=yes exit=0 a0=8992d58 a1=180 a2=804f120 a3=8992d58 items=0 ppid=2513 pid=3038 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1180797558.823:83): user pid=2513 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180797558.823:84): user pid=2513 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180797576.500:8748) auditd normal halt, sending auid=4294967295 pid=3522 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1760
>type=DAEMON_START msg=audit(1180797668.726:1431) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1839 res=success, auditd pid=1839
>type=CONFIG_CHANGE msg=audit(1180797668.428:8): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180797668.428:9): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180797668.428:10): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180797668.428:11): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1180797676.427:12): user pid=2137 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=USER_ERR msg=audit(1180797689.925:13): user pid=2539 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180797706.422:14): user pid=2603 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180797706.422:15): user pid=2603 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180797706.422:16): user pid=2603 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180797706.422:17): login pid=2603 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1180797706.422:18): avc:  denied  { getattr } for  pid=2634 comm="pam_console_app" name="fb0" dev=tmpfs ino=5777 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180797706.422:18): arch=40000003 syscall=196 success=yes exit=0 a0=8bf3758 a1=bfe59eec a2=416c8ff4 a3=8bf3758 items=0 ppid=2603 pid=2634 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180797706.422:18):  path="/dev/fb0"
>type=AVC msg=audit(1180797706.422:19): avc:  denied  { setattr } for  pid=2634 comm="pam_console_app" name="fb0" dev=tmpfs ino=5777 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180797706.422:19): arch=40000003 syscall=212 success=yes exit=0 a0=8bf3758 a1=1f4 a2=ffffffff a3=8bf3758 items=0 ppid=2603 pid=2634 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1180797706.422:20): user pid=2603 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180797706.422:21): user pid=2603 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=AVC msg=audit(1180797755.915:22): avc:  denied  { write } for  pid=2852 comm="ccp" name="fifo0" dev=sda1 ino=984131 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1180797755.915:22): arch=40000003 syscall=5 per=400000 success=yes exit=4 a0=bfa91ab0 a1=81 a2=0 a3=bfa91ab0 items=0 ppid=2137 pid=2852 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1180797767.913:23): avc:  denied  { setpgid } for  pid=2858 comm="pstocapt" scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1180797767.913:23): arch=40000003 syscall=57 per=400000 success=yes exit=0 a0=0 a1=0 a2=804bb88 a3=bfbaddc0 items=0 ppid=2851 pid=2858 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) comm="pstocapt" exe="/usr/lib/cups/filter/pstocapt" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1180798349.824:24): user pid=2879 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180798349.824:25): user pid=2879 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180798349.824:26): user pid=2879 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180798358.323:27): user pid=2879 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180800061.063:28): user pid=3155 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180800061.063:29): user pid=3155 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180800061.063:30): login pid=3155 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180800061.063:31): user pid=3155 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180800061.063:32): user pid=3155 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180800061.063:33): user pid=3155 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1180801007.919:34): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180801007.919:35): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1180801007.919:36): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1180801007.919:37): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1180801053.912:38): user pid=3412 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180801053.912:39): user pid=3412 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180801053.912:40): user pid=3412 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180801135.399:41): user pid=3412 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1180801139.899:42): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1180801139.899:43): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=AVC msg=audit(1180802093.253:44): avc:  denied  { search } for  pid=4139 comm="procmail" name="root" dev=sda1 ino=688129 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1180802093.253:44): arch=40000003 syscall=5 success=no exit=-2 a0=960ad90 a1=8000 a2=0 a3=8000 items=0 ppid=4138 pid=4139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
>type=AVC msg=audit(1180802169.741:45): avc:  denied  { execmod } for  pid=5253 comm="ld-linux.so.2" name="libcaiowrap.so.1.0.0" dev=sda1 ino=280643 scontext=system_u:system_r:prelink_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1180802169.741:45): arch=40000003 syscall=125 success=yes exit=0 a0=688000 a1=1000 a2=5 a3=bfad4bc0 items=0 ppid=4297 pid=5253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ld-linux.so.2" exe="/lib/ld-2.6.so" subj=system_u:system_r:prelink_t:s0 key=(null)
>type=AVC_PATH msg=audit(1180802169.741:45):  path="/usr/lib/libcaiowrap.so.1.0.0"
>type=USER_AUTH msg=audit(1180803175.088:46): user pid=5846 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180803175.088:47): user pid=5846 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1180803175.088:48): user pid=5846 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1180803175.088:49): user pid=5846 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1180803192.585:50): user pid=5846 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1180803192.585:51): user pid=5846 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180803661.514:52): user pid=6160 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180803661.514:53): user pid=6160 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180803661.514:54): login pid=6160 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180803661.514:55): user pid=6160 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180803661.514:56): user pid=6160 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180803662.014:57): user pid=6160 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1180807260.965:58): user pid=7244 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180807260.965:59): user pid=7244 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180807260.965:60): login pid=7244 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180807260.965:61): user pid=7244 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180807260.965:62): user pid=7244 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180807260.965:63): user pid=7244 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1180810860.916:64): user pid=8065 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180810860.916:65): user pid=8065 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180810860.916:66): login pid=8065 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180810860.916:67): user pid=8065 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180810860.916:68): user pid=8065 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180810860.916:69): user pid=8065 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1180810890.911:70): user pid=8085 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180810890.911:71): user pid=8085 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1180810890.911:72): user pid=8085 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1180810890.911:73): user pid=8085 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1180811785.774:74): user pid=8672 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180811785.774:75): user pid=8672 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180811785.774:76): user pid=8672 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180811794.273:77): user pid=8672 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1180812127.222:78): user pid=8085 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1180812127.222:79): user pid=8085 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180814461.366:80): user pid=9719 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180814461.366:81): user pid=9719 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180814461.366:82): login pid=9719 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180814461.366:83): user pid=9719 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180814461.366:84): user pid=9719 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180814461.366:85): user pid=9719 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1180818061.817:86): user pid=10624 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180818061.817:87): user pid=10624 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180818061.817:88): login pid=10624 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180818061.817:89): user pid=10624 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180818061.817:90): user pid=10624 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180818061.817:91): user pid=10624 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1180821661.768:92): user pid=11454 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180821661.768:93): user pid=11454 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180821661.768:94): login pid=11454 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180821661.768:95): user pid=11454 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180821661.768:96): user pid=11454 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180821661.768:97): user pid=11454 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1180824309.864:98): user pid=12120 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180824309.864:99): user pid=12120 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180824309.864:100): user pid=12120 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180824334.860:101): user pid=12120 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180825260.719:102): user pid=12378 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180825260.719:103): user pid=12378 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180825260.719:104): login pid=12378 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180825260.719:105): user pid=12378 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180825260.719:106): user pid=12378 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180825260.719:107): user pid=12378 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1180825894.122:108): avc:  denied  { getattr } for  pid=12675 comm="pam_console_app" name="fb0" dev=tmpfs ino=5777 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180825894.122:108): arch=40000003 syscall=196 success=yes exit=0 a0=9c1bd68 a1=bfbf9c6c a2=416c8ff4 a3=9c1bd68 items=0 ppid=2603 pid=12675 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180825894.122:108):  path="/dev/fb0"
>type=AVC msg=audit(1180825894.122:109): avc:  denied  { setattr } for  pid=12675 comm="pam_console_app" name="fb0" dev=tmpfs ino=5777 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180825894.122:109): arch=40000003 syscall=212 success=yes exit=0 a0=9c1bd68 a1=0 a2=0 a3=9c1bd68 items=0 ppid=2603 pid=12675 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1180825894.122:110): user pid=2603 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180825894.122:111): user pid=2603 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180825904.602:1432) auditd normal halt, sending auid=4294967295 pid=13145 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1839
>type=DAEMON_START msg=audit(1180855406.328:1445) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1768 res=success, auditd pid=1768
>type=CONFIG_CHANGE msg=audit(1180855406.421:8): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180855406.421:9): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180855406.421:10): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180855406.421:11): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1180855413.919:12): user pid=2068 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=USER_ERR msg=audit(1180855427.917:13): user pid=2481 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180855451.914:14): user pid=2545 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180855451.914:15): user pid=2545 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180855451.914:16): user pid=2545 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180855451.914:17): login pid=2545 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1180855451.914:18): avc:  denied  { getattr } for  pid=2581 comm="pam_console_app" name="fb0" dev=tmpfs ino=5853 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180855451.914:18): arch=40000003 syscall=196 success=yes exit=0 a0=9ef1758 a1=bff5afec a2=416c8ff4 a3=9ef1758 items=0 ppid=2545 pid=2581 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180855451.914:18):  path="/dev/fb0"
>type=AVC msg=audit(1180855451.914:19): avc:  denied  { setattr } for  pid=2581 comm="pam_console_app" name="fb0" dev=tmpfs ino=5853 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180855451.914:19): arch=40000003 syscall=212 success=yes exit=0 a0=9ef1758 a1=1f4 a2=ffffffff a3=9ef1758 items=0 ppid=2545 pid=2581 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1180855451.914:20): user pid=2545 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180855451.914:21): user pid=2545 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=AVC msg=audit(1180856856.699:22): avc:  denied  { getattr } for  pid=3173 comm="pam_console_app" name="fb0" dev=tmpfs ino=5853 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180856856.699:22): arch=40000003 syscall=196 success=yes exit=0 a0=957cd68 a1=bf82ac0c a2=416c8ff4 a3=957cd68 items=0 ppid=2545 pid=3173 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180856856.699:22):  path="/dev/fb0"
>type=AVC msg=audit(1180856856.699:23): avc:  denied  { setattr } for  pid=3173 comm="pam_console_app" name="fb0" dev=tmpfs ino=5853 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180856856.699:23): arch=40000003 syscall=212 success=yes exit=0 a0=957cd68 a1=0 a2=0 a3=957cd68 items=0 ppid=2545 pid=3173 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1180856856.699:24): user pid=2545 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180856856.699:25): user pid=2545 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180856865.236:1446) auditd normal halt, sending auid=4294967295 pid=3655 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1768
>type=DAEMON_START msg=audit(1180892591.828:8740) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1756 res=success, auditd pid=1756
>type=CONFIG_CHANGE msg=audit(1180892591.919:8): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180892591.919:9): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180892591.919:10): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180892591.919:11): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1180892599.418:12): user pid=2079 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=USER_ERR msg=audit(1180892613.916:13): user pid=2591 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180892627.914:14): user pid=2655 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180892627.914:15): user pid=2655 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180892627.914:16): user pid=2655 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180892627.914:17): login pid=2655 uid=0 old auid=4294967295 new auid=501
>type=AVC msg=audit(1180892628.414:18): avc:  denied  { getattr } for  pid=2689 comm="pam_console_app" name="fb0" dev=tmpfs ino=5563 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180892628.414:18): arch=40000003 syscall=196 success=yes exit=0 a0=85cc758 a1=bfdf4e5c a2=416c8ff4 a3=85cc758 items=0 ppid=2655 pid=2689 auid=501 uid=0 gid=501 euid=0 suid=0 fsuid=0 egid=501 sgid=501 fsgid=501 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180892628.414:18):  path="/dev/fb0"
>type=AVC msg=audit(1180892628.414:19): avc:  denied  { setattr } for  pid=2689 comm="pam_console_app" name="fb0" dev=tmpfs ino=5563 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180892628.414:19): arch=40000003 syscall=212 success=yes exit=0 a0=85cc758 a1=1f5 a2=ffffffff a3=85cc758 items=0 ppid=2655 pid=2689 auid=501 uid=0 gid=501 euid=0 suid=0 fsuid=0 egid=501 sgid=501 fsgid=501 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1180892628.414:20): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180892628.414:21): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=501: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=AVC msg=audit(1180892876.876:22): avc:  denied  { getattr } for  pid=3047 comm="pam_console_app" name="fb0" dev=tmpfs ino=5563 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180892876.876:22): arch=40000003 syscall=196 success=yes exit=0 a0=9f1fd68 a1=bfde3e5c a2=416c8ff4 a3=9f1fd68 items=0 ppid=2655 pid=3047 auid=501 uid=0 gid=501 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180892876.876:22):  path="/dev/fb0"
>type=AVC msg=audit(1180892876.876:23): avc:  denied  { setattr } for  pid=3047 comm="pam_console_app" name="fb0" dev=tmpfs ino=5563 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180892876.876:23): arch=40000003 syscall=212 success=yes exit=0 a0=9f1fd68 a1=0 a2=0 a3=9f1fd68 items=0 ppid=2655 pid=3047 auid=501 uid=0 gid=501 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1180892876.876:24): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180892876.876:25): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1180892886.374:26): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180892886.374:27): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180892886.374:28): user pid=2655 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180892886.374:29): login pid=2655 uid=0 old auid=501 new auid=500
>type=USER_START msg=audit(1180892886.374:30): user pid=2655 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180892886.374:31): user pid=2655 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180893660.756:32): user pid=3509 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180893660.756:33): user pid=3509 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180893660.756:34): login pid=3509 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180893660.756:35): user pid=3509 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180893660.756:36): user pid=3509 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180893660.756:37): user pid=3509 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1180897021.244:38): avc:  denied  { search } for  pid=4975 comm="procmail" name="root" dev=sda1 ino=688129 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1180897021.244:38): arch=40000003 syscall=5 success=no exit=-2 a0=9342d90 a1=8000 a2=0 a3=8000 items=0 ppid=4974 pid=4975 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
>type=AVC msg=audit(1180897071.236:39): avc:  denied  { execmod } for  pid=5481 comm="ld-linux.so.2" name="libcaepcm.so.1.0" dev=sda1 ino=267079 scontext=system_u:system_r:prelink_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1180897071.236:39): arch=40000003 syscall=125 success=yes exit=0 a0=b48000 a1=ea000 a2=5 a3=bf898990 items=0 ppid=5267 pid=5481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ld-linux.so.2" exe="/lib/ld-2.6.so" subj=system_u:system_r:prelink_t:s0 key=(null)
>type=AVC_PATH msg=audit(1180897071.236:39):  path="/usr/lib/libcaepcm.so.1.0"
>type=USER_ACCT msg=audit(1180897261.707:40): user pid=5628 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180897261.707:41): user pid=5628 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180897261.707:42): login pid=5628 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180897261.707:43): user pid=5628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180897261.707:44): user pid=5628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180897261.707:45): user pid=5628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1180900860.658:46): user pid=6541 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180900860.658:47): user pid=6541 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180900860.658:48): login pid=6541 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180900860.658:49): user pid=6541 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180900860.658:50): user pid=6541 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180900860.658:51): user pid=6541 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1180904224.145:52): user pid=7594 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180904224.145:53): user pid=7594 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180904224.145:54): user pid=7594 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180904461.608:55): user pid=7751 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180904461.608:56): user pid=7751 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180904461.608:57): login pid=7751 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180904461.608:58): user pid=7751 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180904461.608:59): user pid=7751 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180904461.608:60): user pid=7751 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180905133.006:61): user pid=7594 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1180906398.313:62): user pid=8792 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180906398.313:63): user pid=8792 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180906398.313:64): user pid=8792 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180906513.295:65): user pid=8792 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1180906996.722:66): avc:  denied  { getattr } for  pid=9145 comm="pam_console_app" name="fb0" dev=tmpfs ino=5563 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180906996.722:66): arch=40000003 syscall=196 success=yes exit=0 a0=839ed68 a1=bfd20bec a2=416c8ff4 a3=839ed68 items=0 ppid=2655 pid=9145 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180906996.722:66):  path="/dev/fb0"
>type=AVC msg=audit(1180906996.722:67): avc:  denied  { setattr } for  pid=9145 comm="pam_console_app" name="fb0" dev=tmpfs ino=5563 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180906996.722:67): arch=40000003 syscall=212 success=yes exit=0 a0=839ed68 a1=0 a2=0 a3=839ed68 items=0 ppid=2655 pid=9145 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1180906996.722:68): user pid=2655 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180906996.722:69): user pid=2655 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180907005.560:8741) auditd normal halt, sending auid=4294967295 pid=9615 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1756
>type=DAEMON_START msg=audit(1180937234.930:4153) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1766 res=success, auditd pid=1766
>type=CONFIG_CHANGE msg=audit(1180937234.919:8): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180937234.919:9): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180937234.919:10): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180937234.919:11): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1180937245.917:12): user pid=1912 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=USER_ERR msg=audit(1180937257.415:13): user pid=2223 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180937581.366:14): user pid=2295 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180937581.366:15): user pid=2295 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180937581.366:16): user pid=2295 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180937581.366:17): login pid=2295 uid=0 old auid=4294967295 new auid=500
>type=AVC msg=audit(1180937581.366:18): avc:  denied  { getattr } for  pid=2398 comm="pam_console_app" name="fb0" dev=tmpfs ino=5787 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180937581.366:18): arch=40000003 syscall=196 success=yes exit=0 a0=9eb2758 a1=bf89e93c a2=416c8ff4 a3=9eb2758 items=0 ppid=2295 pid=2398 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180937581.366:18):  path="/dev/fb0"
>type=AVC msg=audit(1180937581.366:19): avc:  denied  { setattr } for  pid=2398 comm="pam_console_app" name="fb0" dev=tmpfs ino=5787 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180937581.366:19): arch=40000003 syscall=212 success=yes exit=0 a0=9eb2758 a1=1f4 a2=ffffffff a3=9eb2758 items=0 ppid=2295 pid=2398 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1180937581.366:20): user pid=2295 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180937581.366:21): user pid=2295 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1180939217.117:22): user pid=3311 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180939217.117:23): user pid=3311 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1180939217.117:24): user pid=3311 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1180939217.117:25): user pid=3311 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1180939419.586:26): user pid=3311 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1180939419.586:27): user pid=3311 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180940461.427:28): user pid=3736 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180940461.427:29): user pid=3736 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180940461.427:30): login pid=3736 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180940461.427:31): user pid=3736 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180940461.427:32): user pid=3736 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180940461.427:33): user pid=3736 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1180942298.646:34): avc:  denied  { getattr } for  pid=5057 comm="pam_console_app" name="fb0" dev=tmpfs ino=5787 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180942298.646:34): arch=40000003 syscall=196 success=yes exit=0 a0=93bdd68 a1=bf8fa16c a2=416c8ff4 a3=93bdd68 items=0 ppid=2295 pid=5057 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180942298.646:34):  path="/dev/fb0"
>type=AVC msg=audit(1180942298.646:35): avc:  denied  { setattr } for  pid=5057 comm="pam_console_app" name="fb0" dev=tmpfs ino=5787 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180942298.646:35): arch=40000003 syscall=212 success=yes exit=0 a0=93bdd68 a1=0 a2=0 a3=93bdd68 items=0 ppid=2295 pid=5057 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1180942298.646:36): user pid=2295 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1180942298.646:37): user pid=2295 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1180942306.115:4154) auditd normal halt, sending auid=4294967295 pid=5378 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1766
>type=DAEMON_START msg=audit(1180978364.227:5976) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1752 res=success, auditd pid=1752
>type=CONFIG_CHANGE msg=audit(1180978363.923:8): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180978363.923:9): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1180978363.923:10): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1180978363.923:11): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1180978370.422:12): user pid=1898 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=noname, addr=?, terminal=? res=success)'
>type=USER_ERR msg=audit(1180978381.920:13): user pid=2207 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1180979710.218:14): user pid=2280 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180979710.218:15): user pid=2280 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1180979710.218:16): user pid=2280 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1180979710.218:17): login pid=2280 uid=0 old auid=4294967295 new auid=501
>type=AVC msg=audit(1180979710.218:18): avc:  denied  { getattr } for  pid=2611 comm="pam_console_app" name="fb0" dev=tmpfs ino=5759 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180979710.218:18): arch=40000003 syscall=196 success=yes exit=0 a0=8fce758 a1=bfdc6e5c a2=416c8ff4 a3=8fce758 items=0 ppid=2280 pid=2611 auid=501 uid=0 gid=501 euid=0 suid=0 fsuid=0 egid=501 sgid=501 fsgid=501 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=AVC_PATH msg=audit(1180979710.218:18):  path="/dev/fb0"
>type=AVC msg=audit(1180979710.218:19): avc:  denied  { setattr } for  pid=2611 comm="pam_console_app" name="fb0" dev=tmpfs ino=5759 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=file
>type=SYSCALL msg=audit(1180979710.218:19): arch=40000003 syscall=212 success=yes exit=0 a0=8fce758 a1=1f5 a2=ffffffff a3=8fce758 items=0 ppid=2280 pid=2611 auid=501 uid=0 gid=501 euid=0 suid=0 fsuid=0 egid=501 sgid=501 fsgid=501 tty=(none) comm="pam_console_app" exe="/sbin/pam_console_apply" subj=system_u:system_r:pam_console_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1180979710.218:20): user pid=2280 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=sandra : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1180979710.218:21): user pid=2280 uid=0 auid=501 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=501: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1180980061.664:22): user pid=2962 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180980061.664:23): user pid=2962 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180980061.664:24): login pid=2962 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180980061.664:25): user pid=2962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180980061.664:26): user pid=2962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180980061.664:27): user pid=2962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1180981070.010:28): user pid=3198 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:20 res=success)'
>type=USER_ACCT msg=audit(1180981070.010:29): user pid=3198 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:20 res=success)'
>type=CRED_ACQ msg=audit(1180981070.010:30): user pid=3198 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:20 res=success)'
>type=LOGIN msg=audit(1180981070.010:31): login pid=3198 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1180981070.010:32): user pid=3198 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=fabian : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:20 res=success)'
>type=USER_LOGIN msg=audit(1180981070.010:33): user pid=3198 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=noname, addr=?, terminal=:20 res=success)'
>type=USER_AUTH msg=audit(1180981088.507:34): user pid=3430 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180981088.507:35): user pid=3430 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1180981088.507:36): user pid=3430 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1180981113.004:37): user pid=3430 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1180983661.115:38): user pid=4060 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180983661.115:39): user pid=4060 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180983661.115:40): login pid=4060 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180983661.115:41): user pid=4060 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180983661.115:42): user pid=4060 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180983661.115:43): user pid=4060 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1180987261.566:44): user pid=5015 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1180987261.566:45): user pid=5015 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1180987261.566:46): login pid=5015 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1180987261.566:47): user pid=5015 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1180987261.566:48): user pid=5015 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1180987261.566:49): user pid=5015 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1180987891.470:50): user pid=5297 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1180987891.470:51): user pid=5297 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1180987891.470:52): user pid=5297 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1180987891.470:53): user pid=5297 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'

Actions: View

Attachments on bug 242240: 156121