Attachment 156198 Details for Bug 239449 – audit.log just after virtual machine startup

audit.log just after virtual machine startup

audit.log (text/plain), 4.95 KB, created by Michal Babej on 2007-06-05 10:24:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michal Babej

Created: 2007-06-05 10:24:04 UTC

Size: 4.95 KB

patch

obsolete

>type=DAEMON_START msg=audit(1181037403.626:7111) auditd start, ver=1.5.3, format=raw, auid=500 pid=25025 res=success, auditd pid=25025
>type=CONFIG_CHANGE msg=audit(1181037403.720:274): audit_enabled=1 old=1 by auid=500 subj=user_u:system_r:auditd_t:s0
>type=CONFIG_CHANGE msg=audit(1181037403.724:275): audit_backlog_limit=320 old=320 by auid=500 subj=user_u:system_r:auditctl_t:s0
>type=CRED_DISP msg=audit(1181037452.039:276): user pid=24615 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1181037452.039:277): user pid=24615 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1181037458.439:278): user pid=25071 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1181037458.439:279): user pid=25071 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1181037458.451:280): user pid=25071 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1181037473.736:281): dev=vif9.0 prom=256 old_prom=0 auid=4294967295
>type=SYSCALL msg=audit(1181037473.736:281): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=89a2 a2=7fff7ba0b530 a3=21000 items=0 ppid=25158 pid=25216 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1181037473.836:282): avc:  denied  { create } for  pid=25241 comm="mkdir" name="block" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
>type=SYSCALL msg=audit(1181037473.836:282): arch=c000003e syscall=83 success=yes exit=0 a0=7fffdfde3e9e a1=1ff a2=0 a3=607460 items=0 ppid=25142 pid=25241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mkdir" exe="/bin/mkdir" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1181037473.980:283): avc:  denied  { rmdir } for  pid=25288 comm="rm" name="block" dev=dm-1 ino=3738017 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
>type=SYSCALL msg=audit(1181037473.980:283): arch=c000003e syscall=263 success=yes exit=0 a0=ffffffffffffff9c a1=60f270 a2=200 a3=60f270 items=0 ppid=25142 pid=25288 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="rm" exe="/bin/rm" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1181037486.753:284): user pid=25330 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1181037486.757:285): user pid=25330 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1181037486.777:286): user pid=25330 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1181037486.777:287): user pid=25330 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1181037661.259:288): user pid=25831 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1181037661.259:289): user pid=25831 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1181037661.259:290): login pid=25831 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1181037661.291:291): user pid=25831 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1181037661.311:292): user pid=25831 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1181037661.311:293): user pid=25831 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'

Actions: View

Attachments on bug 239449: 154339 | 154341 | 156198