Attachment 157556 Details for Bug 244915 – auditlogafterboot-21

auditlogafterboot-21

Auditlogafterboot-21.txt (text/plain), 5.73 KB, created by Darwin H. Webb on 2007-06-21 17:05:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Darwin H. Webb

Created: 2007-06-21 17:05:28 UTC

Size: 5.73 KB

patch

obsolete

># This is audit.log after bootup - selinux-targeted .21, autorelabel
># cron looks good
># smb printer shows - see other attachment for printer avc's
># 
>
>type=DAEMON_START msg=audit(1182424494.608:6844) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=2132 res=success, auditd pid=2132
>type=CONFIG_CHANGE msg=audit(1182424494.434:68): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1182424494.434:69): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1182424494.434:70): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1182424494.434:71): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1182424499.434:72): user pid=2421 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=HPLaserJ.2 uri=smb://WORKGROUP 100/URANUS-37/HPLaserJ.2 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=Ruthie-07, addr=127.0.0.1, terminal=? res=success)'
>type=USER_ERR msg=audit(1182424508.932:73): user pid=2810 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1182424533.928:74): user pid=2875 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=darwinhwebb : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1182424533.928:75): user pid=2875 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=darwinhwebb : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1182424533.928:76): user pid=2875 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=darwinhwebb : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1182424533.928:77): login pid=2875 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1182424533.928:78): user pid=2875 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=darwinhwebb : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1182424533.928:79): user pid=2875 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=Ruthie-07, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1182427261.012:80): user pid=3259 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1182427261.012:81): user pid=3259 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1182427261.012:82): login pid=3259 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1182427261.012:83): user pid=3259 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1182427261.012:84): user pid=3259 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1182427261.012:85): user pid=3259 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1182430860.963:86): user pid=4210 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1182430860.963:87): user pid=4210 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1182430860.963:88): login pid=4210 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1182430860.963:89): user pid=4210 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1182430860.963:90): user pid=4210 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1182430860.963:91): user pid=4210 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1182432919.649:92): user pid=4294 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1182432919.649:93): user pid=4294 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1182432919.649:94): user pid=4294 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1182432919.649:95): user pid=4294 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'

Actions: View

Attachments on bug 244915: 157556 | 157557