Attachment 198101 Details for Bug 289141 – audit log from newly installed OS

audit log from newly installed OS

audit.log (text/plain), 91.54 KB, created by Dave Pawson on 2007-09-18 06:39:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dave Pawson

Created: 2007-09-18 06:39:54 UTC

Size: 91.54 KB

patch

obsolete

>type=DAEMON_START msg=audit(1189786957.733:372) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1940 res=success, auditd pid=1940
>type=CONFIG_CHANGE msg=audit(1189786957.493:38): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189786957.493:39): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189786957.493:40): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189786957.493:41): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189786986.989:42): user pid=2250 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=MAC_STATUS msg=audit(1189787082.974:43): enforcing=0 old_enforcing=1 auid=4294967295
>type=USER_AVC msg=audit(1189787082.974:44): user pid=2100 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1189787082.974:43): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfee4384 a2=1 a3=bfee4384 items=0 ppid=2707 pid=2708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setenforce" exe="/usr/sbin/setenforce" subj=system_u:system_r:firstboot_t:s0 key=(null)
>type=USYS_CONFIG msg=audit(1189787094.472:45): user pid=2747 uid=0 auid=4294967295 subj=system_u:system_r:firstboot_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ERR msg=audit(1189787169.461:46): user pid=2787 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189787182.959:47): user pid=2857 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189787182.959:48): user pid=2857 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189787182.959:49): user pid=2857 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189787182.959:50): login pid=2857 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189787182.959:51): user pid=2857 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189787182.959:52): user pid=2857 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1189787206.955:53): user pid=3096 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189787206.955:54): user pid=3096 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189787206.955:55): user pid=3096 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189788184.939:56): user pid=3096 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189788188.938:57): user pid=2857 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189788188.938:58): user pid=2857 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1189788194.161:373) auditd normal halt, sending auid=4294967295 pid=3790 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1940
>type=DAEMON_START msg=audit(1189788401.742:4928) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=2012 res=success, auditd pid=2012
>type=CONFIG_CHANGE msg=audit(1189788401.730:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189788401.730:7): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189788401.730:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189788401.730:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189788406.229:10): user pid=2320 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_ERR msg=audit(1189788415.728:11): user pid=2752 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189788452.722:12): user pid=2824 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189788452.722:13): user pid=2824 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189788452.722:14): user pid=2824 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189788452.722:15): login pid=2824 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189788452.722:16): user pid=2824 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189788452.722:17): user pid=2824 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1189788535.709:18): user pid=3074 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189788535.709:19): user pid=3074 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189788535.709:20): user pid=3074 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189789260.926:21): user pid=3103 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1189789260.926:22): user pid=3103 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1189789260.926:23): login pid=3103 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1189789260.926:24): user pid=3103 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1189789260.926:25): user pid=3103 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1189789260.926:26): user pid=3103 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1189792816.092:27): avc:  denied  { search } for  pid=3264 comm="procmail" name="root" dev=sda2 ino=62160897 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1189792816.092:27): arch=40000003 syscall=5 success=no exit=-2 a0=8d24d90 a1=8000 a2=0 a3=8000 items=0 ppid=3263 pid=3264 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
>type=USER_ACCT msg=audit(1189792861.588:28): user pid=11689 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1189792861.588:29): user pid=11689 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1189792861.588:30): login pid=11689 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1189792861.588:31): user pid=11689 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1189792861.588:32): user pid=11689 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1189792861.588:33): user pid=11689 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1189793256.831:34): user pid=32282 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189793256.831:35): user pid=32282 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189793256.831:36): user pid=32282 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189793256.831:37): user pid=32282 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1189794394.715:38): user pid=32282 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189794394.715:39): user pid=32282 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189794530.706:40): user pid=3289 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_AUTH msg=audit(1189794535.705:41): user pid=4362 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189794535.705:42): user pid=4362 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189794535.705:43): user pid=4362 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189794535.705:44): user pid=4362 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_CHAUTHTOK msg=audit(1189794619.199:45): user pid=12300 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=dbus exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=AVC msg=audit(1189794776.186:46): avc:  denied  { search } for  pid=28674 comm="procmail" name="root" dev=sda2 ino=62160897 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
>type=SYSCALL msg=audit(1189794776.186:46): arch=40000003 syscall=5 success=no exit=-2 a0=9da7d88 a1=8000 a2=0 a3=8000 items=0 ppid=28673 pid=28674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
>type=USER_CHAUTHTOK msg=audit(1189794847.680:47): user pid=28745 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=apache exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189794854.680:48): user pid=28754 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct=wbpriv exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795082.158:49): user pid=31050 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=gdm exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795082.158:50): user pid=31051 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=changing user shell acct=gdm exe="/usr/sbin/usermod" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1189795097.656:51): user pid=31128 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct=tcpdump exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795097.656:52): user pid=31129 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=tcpdump exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795100.156:53): user pid=31178 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=rpcuser exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=AVC msg=audit(1189795101.156:54): avc:  denied  { search } for  pid=31228 comm="rpc.statd" name="sbin" dev=sda2 ino=42500098 scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=dir
>type=AVC msg=audit(1189795101.156:54): avc:  denied  { execute } for  pid=31228 comm="rpc.statd" name="sm-notify" dev=sda2 ino=42520816 scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=AVC msg=audit(1189795101.156:54): avc:  denied  { execute_no_trans } for  pid=31228 comm="rpc.statd" name="sm-notify" dev=sda2 ino=42520816 scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=AVC msg=audit(1189795101.156:54): avc:  denied  { read } for  pid=31228 comm="rpc.statd" name="sm-notify" dev=sda2 ino=42520816 scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1189795101.156:54): arch=40000003 syscall=11 success=yes exit=0 a0=80008a12 a1=bfcf30dc a2=bfcf332c a3=80d1b008 items=0 ppid=31227 pid=31228 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sm-notify" exe="/usr/sbin/sm-notify" subj=system_u:system_r:rpcd_t:s0 key=(null)
>type=AVC_PATH msg=audit(1189795101.156:54):  path="/usr/sbin/sm-notify"
>type=AVC_PATH msg=audit(1189795101.156:54):  path="/usr/sbin/sm-notify"
>type=AVC msg=audit(1189795102.156:55): avc:  denied  { search } for  pid=31228 comm="sm-notify" scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir
>type=SYSCALL msg=audit(1189795102.156:55): arch=40000003 syscall=5 success=no exit=-2 a0=80002aa4 a1=1 a2=4 a3=3 items=0 ppid=31227 pid=31228 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sm-notify" exe="/usr/sbin/sm-notify" subj=system_u:system_r:rpcd_t:s0 key=(null)
>type=USER_CHAUTHTOK msg=audit(1189795197.476:56): user pid=31511 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct=ntp exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795197.476:57): user pid=31512 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=ntp exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795198.976:58): user pid=31516 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=nscd exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795277.465:59): user pid=31669 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct=rpm exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1189795277.465:60): user pid=31670 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct=rpm exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=LABEL_LEVEL_CHANGE msg=audit(1189795305.461:61): user pid=31710 uid=0 auid=500 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1189795330.957:62): user pid=31725 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189795330.957:63): user pid=31725 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189795331.457:64): user pid=31725 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=MAC_POLICY_LOAD msg=audit(1189795404.947:65): policy loaded auid=500
>type=SYSCALL msg=audit(1189795404.947:65): arch=40000003 syscall=4 success=yes exit=1571286 a0=4 a1=b7de3000 a2=17f9d6 a3=bf8d3438 items=0 ppid=31991 pid=31993 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0 key=(null)
>type=USER_AVC msg=audit(1189795404.947:66): user pid=2172 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=DAEMON_END msg=audit(1189795680.210:4929) auditd normal halt, sending auid=500 pid=1556 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=2012
>type=DAEMON_START msg=audit(1189795680.419:5495): auditd start, ver=1.5.6, format=raw, auid=500 pid=1572 res=success, auditd pid=1572
>type=CONFIG_CHANGE msg=audit(1189795680.409:69): audit_enabled=1 old=1 by auid=500 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189795680.409:70): audit_enabled=1 old=1 by auid=500 res=1
>type=CONFIG_CHANGE msg=audit(1189795680.409:71): audit_backlog_limit=320 old=320 by auid=500 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189795680.409:72): audit_backlog_limit=320 old=320 by auid=500 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189795760.397:73): user pid=1742 uid=0 auid=500 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_END msg=audit(1189795814.537:74): user pid=31725 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1189795816.537:75): user pid=4362 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189795816.537:76): user pid=4362 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189795840.533:77): user pid=2824 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189795840.533:78): user pid=2824 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1189795849.435:5496): auditd normal halt, sending auid=4294967295 pid=2937 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1572
>type=DAEMON_START msg=audit(1189795935.960:2273): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1910 res=success, auditd pid=1910
>type=CONFIG_CHANGE msg=audit(1189795936.060:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189795936.060:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189795936.068:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189795936.068:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189795940.828:8): user pid=2219 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_ERR msg=audit(1189795951.546:9): user pid=2654 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189795965.175:10): user pid=2749 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189795965.178:11): user pid=2749 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189795965.179:12): user pid=2749 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189795965.183:13): login pid=2749 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189795965.195:14): user pid=2749 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189795965.197:15): user pid=2749 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1189795981.778:16): user pid=2749 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189795981.778:17): user pid=2749 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1189795984.265:18): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2444 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1189795989.904:2274): auditd normal halt, sending auid=4294967295 pid=3499 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1910
>type=DAEMON_START msg=audit(1189838751.135:2039): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1915 res=success, auditd pid=1915
>type=CONFIG_CHANGE msg=audit(1189838751.235:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189838751.235:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189838751.243:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189838751.243:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189838755.862:8): user pid=2224 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_ERR msg=audit(1189838766.146:9): user pid=2657 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189839057.221:10): user pid=2751 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189839057.224:11): user pid=2751 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189839057.225:12): user pid=2751 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189839057.229:13): login pid=2751 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189839057.242:14): user pid=2751 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189839057.243:15): user pid=2751 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1189839134.895:16): user pid=3038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189839134.895:17): user pid=3038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189839134.945:18): user pid=3038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189839134.946:19): user pid=3038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189839661.851:20): user pid=3133 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1189839719.383:21): user pid=3038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189839719.384:22): user pid=3038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189839729.814:23): user pid=3169 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189839729.815:24): user pid=3169 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189839729.828:25): user pid=3169 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189839729.828:26): user pid=3169 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1189839741.940:27): user pid=3169 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189839741.941:28): user pid=3169 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189839746.551:29): user pid=2751 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189839746.552:30): user pid=2751 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1189839748.962:31): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2449 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1189839754.753:2040): auditd normal halt, sending auid=4294967295 pid=3724 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1915
>type=DAEMON_START msg=audit(1189842237.727:1822): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1922 res=success, auditd pid=1922
>type=CONFIG_CHANGE msg=audit(1189842237.827:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189842237.827:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189842237.847:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189842237.847:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189842242.662:8): user pid=2238 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_ERR msg=audit(1189842252.196:9): user pid=2671 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189842326.777:10): user pid=2765 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189842326.780:11): user pid=2765 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189842326.782:12): user pid=2765 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189842326.785:13): login pid=2765 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189842326.799:14): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189842326.800:15): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1189842341.980:16): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189842341.980:17): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189842342.045:18): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189842342.048:19): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1189842423.064:20): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189842423.065:21): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189842428.233:22): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189842428.234:23): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1189842430.645:24): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2463 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1189842436.427:1823): auditd normal halt, sending auid=4294967295 pid=3598 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1922
>type=DAEMON_START msg=audit(1189842568.811:6455): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1923 res=success, auditd pid=1923
>type=CONFIG_CHANGE msg=audit(1189842568.911:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189842568.911:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189842568.918:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189842568.918:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1189842573.413:8): user pid=2234 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_ERR msg=audit(1189842583.406:9): user pid=2667 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189842630.146:10): user pid=2761 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189842630.149:11): user pid=2761 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189842630.149:12): user pid=2761 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189842630.153:13): login pid=2761 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189842630.166:14): user pid=2761 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189842630.168:15): user pid=2761 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1189842686.741:16): user pid=3041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189842686.742:17): user pid=3041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189842686.799:18): user pid=3041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189842686.799:19): user pid=3041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1189843065.869:20): user pid=3041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189843065.869:21): user pid=3041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189843147.761:22): user pid=3094 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189843147.761:23): user pid=3094 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189843147.775:24): user pid=3094 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189843147.776:25): user pid=3094 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1189843188.702:26): user pid=3094 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189843188.703:27): user pid=3094 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189843199.321:28): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189843199.322:29): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189843199.337:30): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189843199.338:31): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189843261.891:32): user pid=3173 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1189843262.613:33): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189843262.614:34): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189845336.700:35): user pid=3269 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1189845336.700:36): user pid=3269 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1189845336.944:37): user pid=3269 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1189845336.954:38): user pid=3269 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1189846862.145:39): user pid=3358 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1189847536.965:40): user pid=29764 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189847536.966:41): user pid=29764 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189847537.136:42): user pid=29764 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1189849505.589:43): user pid=2620 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct=jackuser exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189849692.701:44): user pid=29764 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189850462.158:45): user pid=2906 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1189852573.354:46): user pid=3269 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1189852573.399:47): user pid=3269 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1189854061.646:48): user pid=6293 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1189854979.747:49): avc:  denied  { execmod } for  pid=2817 comm="firefox-bin" name="nppdf.so" dev=sda2 ino=24346625 scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:object_r:lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1189854979.747:49): arch=40000003 syscall=125 success=yes exit=0 a0=20a1000 a1=108000 a2=5 a3=bfbc8a40 items=0 ppid=1 pid=2817 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox-bin" exe="/usr/lib/firefox-2.0.0.5/firefox-bin" subj=user_u:system_r:unconfined_t:s0 key=(null)
>type=AVC_PATH msg=audit(1189854979.747:49):  path="/usr/lib/mozilla/plugins/nppdf.so"
>type=USER_AUTH msg=audit(1189855026.973:50): user pid=6336 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189855026.973:51): user pid=6336 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189855027.120:52): user pid=6336 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189855027.120:53): user pid=6336 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189857661.306:54): user pid=6941 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1189857887.935:55): user pid=7654 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189857887.935:56): user pid=7654 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189857888.029:57): user pid=7654 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189857899.878:58): user pid=7654 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1189857908.042:59): user pid=7674 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189857908.042:60): user pid=7674 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189857908.050:61): user pid=7674 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189857931.376:62): user pid=7674 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189861262.094:63): user pid=8798 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1189863528.213:64): user pid=8887 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189863528.213:65): user pid=8887 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189863528.301:66): user pid=8887 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189863528.707:67): user pid=8887 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1189863605.128:68): user pid=8894 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189863605.129:69): user pid=8894 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189863605.135:70): user pid=8894 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189863605.266:71): user pid=8894 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189864861.586:72): user pid=9349 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1189866557.174:73): user pid=9708 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189866557.174:74): user pid=9708 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189866557.215:75): user pid=9708 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189866610.441:76): user pid=9712 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1189866610.442:77): user pid=9712 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1189866610.473:78): user pid=9712 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1189866610.474:79): user pid=9712 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_AUTH msg=audit(1189866926.500:80): user pid=9782 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_ACCT msg=audit(1189866926.500:81): user pid=9782 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=LOGIN msg=audit(1189866926.506:82): login pid=9782 uid=0 old auid=4294967295 new auid=0
>type=USER_ROLE_CHANGE msg=audit(1189866926.697:83): user pid=9782 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=root:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_START msg=audit(1189866926.727:84): user pid=9782 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=CRED_ACQ msg=audit(1189866926.728:85): user pid=9782 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_LOGIN msg=audit(1189866926.752:86): user pid=9782 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=CRED_DISP msg=audit(1189866929.148:87): user pid=9782 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_END msg=audit(1189866929.155:88): user pid=9782 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_AUTH msg=audit(1189866985.216:89): user pid=9839 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_ACCT msg=audit(1189866985.217:90): user pid=9839 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=LOGIN msg=audit(1189866985.219:91): login pid=9839 uid=0 old auid=4294967295 new auid=0
>type=USER_ROLE_CHANGE msg=audit(1189866985.348:92): user pid=9839 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=root:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_START msg=audit(1189866985.365:93): user pid=9839 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=CRED_ACQ msg=audit(1189866985.365:94): user pid=9839 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_LOGIN msg=audit(1189866985.369:95): user pid=9839 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=CRED_DISP msg=audit(1189866990.814:96): user pid=9839 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=USER_END msg=audit(1189866990.822:97): user pid=9839 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty5 res=success)'
>type=CRED_DISP msg=audit(1189866991.627:98): user pid=9712 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1189866991.628:99): user pid=9712 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1189866991.685:100): user pid=2761 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189866991.686:101): user pid=2761 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1189866993.573:102): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2459 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1189867000.291:6456): auditd normal halt, sending auid=4294967295 pid=10361 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1923
>type=DAEMON_START msg=audit(1189867087.144:705): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1909 res=success, auditd pid=1909
>type=CONFIG_CHANGE msg=audit(1189867087.243:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189867087.243:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189867087.262:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189867087.262:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=AVC msg=audit(1189867088.307:8): avc:  denied  { read } for  pid=1993 comm="setroubleshootd" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189867088.307:8): arch=40000003 syscall=5 success=yes exit=5 a0=bfe26360 a1=8000 a2=1b6 a3=8880ca8 items=0 ppid=1992 pid=1993 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
>type=AVC msg=audit(1189867091.652:9): avc:  denied  { getattr } for  pid=2208 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189867091.652:9): arch=40000003 syscall=195 success=yes exit=0 a0=80be918 a1=bf91c498 a2=95dff4 a3=80a71b0 items=0 ppid=2207 pid=2208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=AVC_PATH msg=audit(1189867091.652:9):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1189867091.654:10): avc:  denied  { read } for  pid=2208 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189867091.654:10): arch=40000003 syscall=5 success=yes exit=5 a0=bf9177e0 a1=8000 a2=1b6 a3=80ddca8 items=0 ppid=2207 pid=2208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=LABEL_LEVEL_CHANGE msg=audit(1189867092.186:11): user pid=2222 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1189867099.029:12): avc:  denied  { getattr } for  pid=2584 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189867099.029:12): arch=40000003 syscall=195 success=yes exit=0 a0=816fd28 a1=bf8d1688 a2=95dff4 a3=81581b0 items=0 ppid=2508 pid=2584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=AVC_PATH msg=audit(1189867099.029:12):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1189867099.037:13): avc:  denied  { read } for  pid=2584 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189867099.037:13): arch=40000003 syscall=5 success=yes exit=5 a0=bf8cc9d0 a1=8000 a2=1b6 a3=818eee8 items=0 ppid=2508 pid=2584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=USER_ERR msg=audit(1189867102.921:14): user pid=2680 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189867161.786:15): user pid=2774 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189867161.789:16): user pid=2774 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189867161.790:17): user pid=2774 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189867161.794:18): login pid=2774 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189867161.807:19): user pid=2774 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189867161.809:20): user pid=2774 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=marge, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1189867544.131:21): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189867544.131:22): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189867544.205:23): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189867544.205:24): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189867977.750:25): user pid=3234 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189867977.750:26): user pid=3234 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189867977.815:27): user pid=3234 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189868461.212:28): user pid=3302 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1189868937.035:29): user pid=3234 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1189869075.417:30): user pid=3343 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189869075.417:31): user pid=3343 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189869075.427:32): user pid=3343 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189869413.785:33): user pid=3343 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1189869456.516:34): user pid=3424 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189869456.516:35): user pid=3424 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189869456.527:36): user pid=3424 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189869559.812:37): user pid=3424 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1189869623.564:38): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189869623.565:39): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189869623.575:40): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189869658.442:41): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1189870622.219:42): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189870622.221:43): user pid=3133 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189870698.692:44): user pid=2774 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189870698.693:45): user pid=2774 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1189870710.121:46): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2470 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1189870715.744:706): auditd normal halt, sending auid=4294967295 pid=4087 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1909
>type=DAEMON_START msg=audit(1189923620.211:7249): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1910 res=success, auditd pid=1910
>type=CONFIG_CHANGE msg=audit(1189923620.311:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189923620.311:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1189923620.338:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1189923620.338:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=AVC msg=audit(1189923621.391:8): avc:  denied  { read } for  pid=1994 comm="setroubleshootd" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189923621.391:8): arch=40000003 syscall=5 success=yes exit=5 a0=bf9f70a0 a1=8000 a2=1b6 a3=8e22ca8 items=0 ppid=1993 pid=1994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
>type=AVC msg=audit(1189923624.922:9): avc:  denied  { getattr } for  pid=2207 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189923624.922:9): arch=40000003 syscall=195 success=yes exit=0 a0=92b5918 a1=bff84e78 a2=95dff4 a3=929e1b0 items=0 ppid=2206 pid=2207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=AVC_PATH msg=audit(1189923624.922:9):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1189923624.924:10): avc:  denied  { read } for  pid=2207 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189923624.924:10): arch=40000003 syscall=5 success=yes exit=5 a0=bff801c0 a1=8000 a2=1b6 a3=92d4ca8 items=0 ppid=2206 pid=2207 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=LABEL_LEVEL_CHANGE msg=audit(1189923625.503:11): user pid=2221 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1189923632.372:12): avc:  denied  { getattr } for  pid=2583 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189923632.372:12): arch=40000003 syscall=195 success=yes exit=0 a0=815cd28 a1=bf8b4e68 a2=95dff4 a3=81451b0 items=0 ppid=2507 pid=2583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=AVC_PATH msg=audit(1189923632.372:12):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1189923632.375:13): avc:  denied  { read } for  pid=2583 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1189923632.375:13): arch=40000003 syscall=5 success=yes exit=5 a0=bf8b01b0 a1=8000 a2=1b6 a3=817bee8 items=0 ppid=2507 pid=2583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=USER_ERR msg=audit(1189923636.229:14): user pid=2679 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1189923827.599:15): user pid=2776 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189923827.604:16): user pid=2776 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1189923827.605:17): user pid=2776 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1189923827.609:18): login pid=2776 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1189923827.622:19): user pid=2776 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1189923827.624:20): user pid=2776 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=marge, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1189926061.372:21): user pid=3317 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1189927588.738:22): user pid=3392 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1189927588.739:23): user pid=3392 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1189927588.811:24): user pid=3392 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1189927588.812:25): user pid=3392 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1189929227.764:26): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189929227.764:27): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1189929227.801:28): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1189929271.006:29): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1189929661.220:30): user pid=5916 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1189931435.710:31): user pid=3392 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189931435.712:32): user pid=3392 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1189931444.370:33): user pid=2776 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1189931444.370:34): user pid=2776 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1189931447.053:35): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2469 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1189931453.139:7250): auditd normal halt, sending auid=4294967295 pid=6707 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1910
>type=DAEMON_START msg=audit(1190011011.928:4929): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1899 res=success, auditd pid=1899
>type=CONFIG_CHANGE msg=audit(1190011012.028:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1190011012.028:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1190011012.056:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1190011012.056:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=AVC msg=audit(1190011013.076:8): avc:  denied  { read } for  pid=1983 comm="setroubleshootd" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190011013.076:8): arch=40000003 syscall=5 success=yes exit=5 a0=bf8e3f80 a1=8000 a2=1b6 a3=969fca8 items=0 ppid=1982 pid=1983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
>type=AVC msg=audit(1190011016.372:9): avc:  denied  { getattr } for  pid=2198 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190011016.372:9): arch=40000003 syscall=195 success=yes exit=0 a0=8103918 a1=bfa97608 a2=95dff4 a3=80ec1b0 items=0 ppid=2197 pid=2198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=AVC_PATH msg=audit(1190011016.372:9):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1190011016.374:10): avc:  denied  { read } for  pid=2198 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190011016.374:10): arch=40000003 syscall=5 success=yes exit=5 a0=bfa92950 a1=8000 a2=1b6 a3=8122ca8 items=0 ppid=2197 pid=2198 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=LABEL_LEVEL_CHANGE msg=audit(1190011017.055:11): user pid=2212 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1190011023.649:12): avc:  denied  { getattr } for  pid=2574 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190011023.649:12): arch=40000003 syscall=195 success=yes exit=0 a0=80b2d28 a1=bfb75128 a2=95dff4 a3=809b1b0 items=0 ppid=2498 pid=2574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=AVC_PATH msg=audit(1190011023.649:12):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1190011023.651:13): avc:  denied  { read } for  pid=2574 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190011023.651:13): arch=40000003 syscall=5 success=yes exit=5 a0=bfb70470 a1=8000 a2=1b6 a3=80d1ee8 items=0 ppid=2498 pid=2574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=USER_ERR msg=audit(1190011027.532:14): user pid=2670 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1190011151.946:15): user pid=2765 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1190011151.949:16): user pid=2765 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1190011151.951:17): user pid=2765 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1190011151.955:18): login pid=2765 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1190011151.986:19): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1190011151.987:20): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=marge, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1190012461.399:21): user pid=3242 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190016061.787:22): user pid=4912 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190019661.961:23): user pid=5777 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190023261.275:24): user pid=6219 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190026861.295:25): user pid=6669 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190030461.313:26): user pid=7480 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190034061.332:27): user pid=8085 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190037661.351:28): user pid=8476 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190041261.369:29): user pid=8800 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190044861.391:30): user pid=9281 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190048461.408:31): user pid=9517 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1190052061.426:32): user pid=9661 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1190055360.494:33): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1190055360.494:34): user pid=2765 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1190055363.161:35): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:dhcpc_t:s0 pid=2462 comm="dhcdbd" sig=6
>type=DAEMON_END msg=audit(1190055369.197:4930): auditd normal halt, sending auid=4294967295 pid=10657 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1899
>type=DAEMON_START msg=audit(1190097007.122:1421): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=1903 res=success, auditd pid=1903
>type=CONFIG_CHANGE msg=audit(1190097007.221:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1190097007.221:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1190097007.245:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1190097007.245:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=AVC msg=audit(1190097008.265:8): avc:  denied  { read } for  pid=1987 comm="setroubleshootd" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190097008.265:8): arch=40000003 syscall=5 success=yes exit=5 a0=bf855700 a1=8000 a2=1b6 a3=848dca8 items=0 ppid=1986 pid=1987 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null)
>type=AVC msg=audit(1190097011.727:9): avc:  denied  { getattr } for  pid=2200 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190097011.727:9): arch=40000003 syscall=195 success=yes exit=0 a0=9d9b918 a1=bf8633d8 a2=95dff4 a3=9d841b0 items=0 ppid=2199 pid=2200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=AVC_PATH msg=audit(1190097011.727:9):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1190097011.729:10): avc:  denied  { read } for  pid=2200 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:hplip_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190097011.729:10): arch=40000003 syscall=5 success=yes exit=5 a0=bf85e720 a1=8000 a2=1b6 a3=9dbaca8 items=0 ppid=2199 pid=2200 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 key=(null)
>type=LABEL_LEVEL_CHANGE msg=audit(1190097012.269:11): user pid=2214 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=ML-6060 uri=usb://Samsung/ML-6060 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1190097018.789:12): avc:  denied  { getattr } for  pid=2576 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190097018.789:12): arch=40000003 syscall=195 success=yes exit=0 a0=91d5d28 a1=bfba5968 a2=95dff4 a3=91be1b0 items=0 ppid=2500 pid=2576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=AVC_PATH msg=audit(1190097018.789:12):  path="/usr/lib/python2.5/site-packages/Amara-1.2.0.2-py2.5.egg"
>type=AVC msg=audit(1190097018.792:13): avc:  denied  { read } for  pid=2576 comm="python" name="Amara-1.2.0.2-py2.5.egg" dev=sda2 ino=75595786 scontext=system_u:system_r:cupsd_config_t:s0 tcontext=user_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1190097018.792:13): arch=40000003 syscall=5 success=yes exit=5 a0=bfba0cb0 a1=8000 a2=1b6 a3=91f4ee8 items=0 ppid=2500 pid=2576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:cupsd_config_t:s0 key=(null)
>type=USER_ERR msg=audit(1190097022.597:14): user pid=2672 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1190097144.706:15): user pid=2766 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1190097144.709:16): user pid=2766 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1190097144.710:17): user pid=2766 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1190097144.714:18): login pid=2766 uid=0 old auid=4294967295 new auid=500
>type=USER_START msg=audit(1190097144.727:19): user pid=2766 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=dpawson : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1190097144.728:20): user pid=2766 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=marge, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1190097367.033:21): user pid=3115 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1190097367.033:22): user pid=3115 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1190097367.125:23): user pid=3115 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1190097376.704:24): user pid=3115 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1190097437.573:25): user pid=3161 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1190097437.574:26): user pid=3161 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1190097437.587:27): user pid=3161 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1190097437.588:28): user pid=3161 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'

Actions: View

Attachments on bug 289141: 198101