Attachment 208401 Details for Bug 301961 – audit.log extract after switching to permissive and attemting fingerprint login

audit.log extract after switching to permissive and attemting fingerprint login

fingerprint.txt (text/plain), 8.40 KB, created by Stuart Jansen on 2007-09-27 12:57:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stuart Jansen

Created: 2007-09-27 12:57:15 UTC

Size: 8.40 KB

patch

obsolete

>type=MAC_STATUS msg=audit(1190896658.333:42): enforcing=0 old_enforcing=1 auid=500
>type=SYSCALL msg=audit(1190896658.333:42): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfea10f4 a2=1 a3=bfea10f4 items=0 ppid=3404 pid=3428 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="setenforce" exe="/usr/sbin/setenforce" subj=system_u:system_r:unconfined_t:s0 key=(null)
>type=USER_AVC msg=audit(1190896658.335:43): user pid=2609 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=CRED_DISP msg=audit(1190896665.343:44): user pid=3400 uid=500 auid=500 subj=system_u:system_r:unconfined_t:s0 msg='op=PAM:setcred acct=root exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1190896665.344:45): user pid=3400 uid=500 auid=500 subj=system_u:system_r:unconfined_t:s0 msg='op=PAM:session_close acct=root exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=ANOM_ABEND msg=audit(1190896665.474:46): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:hald_acl_t:s0 pid=3432 comm="hal-acl-tool" sig=11
>type=USER_END msg=audit(1190896665.498:47): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=sjansen exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1190896665.498:48): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=sjansen exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=AVC msg=audit(1190896673.549:49): avc:  denied  { read write } for  pid=3060 comm="gdm-binary" name="002" dev=tmpfs ino=5277 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1190896673.549:49): arch=40000003 syscall=5 success=yes exit=16 a0=bfdcc6ac a1=2 a2=1 a3=bfdcc6ac items=0 ppid=2996 pid=3060 auid=500 uid=0 gid=0 euid=0 suid=500 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1190896673.550:50): avc:  denied  { ioctl } for  pid=3060 comm="gdm-binary" path="/dev/bus/usb/002/002" dev=tmpfs ino=5277 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1190896673.550:50): arch=40000003 syscall=54 success=yes exit=0 a0=10 a1=40085511 a2=bfdcc6a4 a3=bfdcc6ac items=0 ppid=2996 pid=3060 auid=500 uid=0 gid=0 euid=0 suid=500 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1190896676.554:51): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=sjansen exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1190896676.562:52): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=sjansen exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1190896676.563:53): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=sjansen exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1190896676.572:54): login pid=3060 uid=0 old auid=500 new auid=500
>type=USER_ROLE_CHANGE msg=audit(1190896676.602:55): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=system_u:system_r:unconfined_t:s0 selected-context=system_u:system_r:unconfined_t:s0: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1190896676.602:56): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=sjansen exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1190896676.603:57): user pid=3060 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=simplicity.buscaluz.org, addr=127.0.0.1, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1190896676.674:58): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:hald_acl_t:s0 pid=3499 comm="hal-acl-tool" sig=11
>type=ANOM_ABEND msg=audit(1190896676.681:59): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:hald_acl_t:s0 pid=3500 comm="hal-acl-tool" sig=11
>type=ANOM_ABEND msg=audit(1190896682.977:60): auid=4294967295 uid=0 gid=0 subj=system_u:system_r:hald_acl_t:s0 pid=3708 comm="hal-acl-tool" sig=11
>type=AVC msg=audit(1190896686.582:61): avc:  denied  { write } for  pid=2990 comm="login" name="uinput" dev=tmpfs ino=6461 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1190896686.582:61): arch=40000003 syscall=5 success=yes exit=4 a0=2e8970 a1=801 a2=45c a3=bfe1c330 items=0 ppid=1 pid=2990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1190896686.583:62): avc:  denied  { ioctl } for  pid=2990 comm="login" path="/dev/input/uinput" dev=tmpfs ino=6461 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1190896686.583:62): arch=40000003 syscall=54 success=yes exit=0 a0=4 a1=40045564 a2=1 a3=bfe1c330 items=0 ppid=1 pid=2990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1190896686.585:63): avc:  denied  { read write } for  pid=2990 comm="login" name="002" dev=tmpfs ino=5277 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1190896686.585:63): arch=40000003 syscall=5 success=yes exit=6 a0=bfe1a1bc a1=2 a2=1 a3=bfe1a1bc items=0 ppid=1 pid=2990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1190896686.585:64): avc:  denied  { ioctl } for  pid=2990 comm="login" path="/dev/bus/usb/002/002" dev=tmpfs ino=5277 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1190896686.585:64): arch=40000003 syscall=54 success=yes exit=0 a0=6 a1=40085511 a2=bfe1a1b4 a3=bfe1a1bc items=0 ppid=1 pid=2990 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1190896689.128:65): user pid=2990 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=sjansen exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1190896689.135:66): user pid=2990 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=sjansen exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1190896689.139:67): login pid=2990 uid=0 old auid=4294967295 new auid=500
>type=USER_ROLE_CHANGE msg=audit(1190896689.159:68): user pid=2990 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=system_u:system_r:unconfined_t:s0 selected-context=system_u:system_r:unconfined_t:s0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1190896689.168:69): user pid=2990 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=sjansen exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1190896689.169:70): user pid=2990 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=sjansen exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1190896689.169:71): user pid=2990 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'

Actions: View

Attachments on bug 301961: 208401