Attachment 248511 Details for Bug 367191 – SElinux audit log

SElinux audit log

audit.log (text/plain), 12.67 KB, created by Mike A. Harris on 2007-11-05 18:23:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mike A. Harris

Created: 2007-11-05 18:23:00 UTC

Size: 12.67 KB

patch

obsolete

>type=DAEMON_START msg=audit(1194219768.294:8698): auditd start, ver=1.6.2, format=raw, auid=4294967295 pid=1642 res=success, auditd pid=1642
>type=CONFIG_CHANGE msg=audit(1194219768.394:19): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1194219768.394:20): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1194219768.419:21): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1194219768.419:22): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=USYS_CONFIG msg=audit(1194216312.500:23): user pid=2490 uid=0 auid=4294967295 subj=system_u:system_r:firstboot_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1194216429.666:24): user pid=2578 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=mharris exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1194216429.690:25): user pid=2578 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=mharris exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1194216429.702:26): user pid=2578 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mharris exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1194216429.706:27): login pid=2578 uid=0 old auid=4294967295 new auid=500
>type=USER_ROLE_CHANGE msg=audit(1194216429.722:28): user pid=2578 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0 selected-context=unconfined_u:system_r:unconfined_t:s0: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1194216429.762:29): user pid=2578 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=mharris exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1194216432.879:30): user pid=2578 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=hammer, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1194216519.770:31): user pid=2836 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:authentication acct=root exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1194216519.811:32): user pid=2836 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:accounting acct=root exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1194216519.983:33): user pid=2836 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_open acct=root exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1194216520.031:34): user pid=2836 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:setcred acct=root exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1194217261.843:35): user pid=2993 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194220861.484:36): user pid=3177 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194224461.435:37): user pid=4091 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194228062.260:38): user pid=26046 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194231662.016:39): user pid=31801 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194235261.446:40): user pid=31921 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194238862.070:41): user pid=32030 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194242461.361:42): user pid=32210 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194246061.762:43): user pid=32320 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194249662.096:44): user pid=32431 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194253261.556:45): user pid=32538 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194253321.809:46): user pid=32546 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194256862.031:47): user pid=28168 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194260462.047:48): user pid=28000 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194264061.397:49): user pid=28116 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194267661.780:50): user pid=28227 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194271261.213:51): user pid=28340 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194274861.574:52): user pid=28451 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194278461.956:53): user pid=28604 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1194282061.374:54): user pid=28716 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=SELINUX_ERR msg=audit(1194284922.113:55): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194284922.113:55): arch=c000003e syscall=59 success=no exit=-13 a0=8fa170 a1=906d80 a2=8dc5a0 a3=8 items=0 ppid=28902 pid=28916 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194284926.319:56): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194284926.319:56): arch=c000003e syscall=59 success=no exit=-13 a0=8fa170 a1=901e70 a2=8dc5a0 a3=8 items=0 ppid=28925 pid=28936 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194284992.319:57): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194284992.319:57): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=28951 pid=28960 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194285550.217:58): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194285550.217:58): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=29030 pid=29039 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194285606.839:59): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194285606.839:59): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=29053 pid=29062 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=USER_ACCT msg=audit(1194285661.889:60): user pid=29066 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=SELINUX_ERR msg=audit(1194285791.951:61): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194285791.951:61): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=29091 pid=29100 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194285793.447:62): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194285793.447:62): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=29109 pid=29118 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194286430.303:63): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194286430.303:63): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=29147 pid=29156 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
>type=SELINUX_ERR msg=audit(1194286706.628:64): security_compute_sid:  invalid context unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 for scontext=unconfined_u:system_r:initrc_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1194286706.628:64): arch=c000003e syscall=59 success=no exit=-13 a0=8ffb30 a1=901030 a2=8dc5a0 a3=8 items=0 ppid=29183 pid=29192 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 comm="sshd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key=(null)

Actions: View

Attachments on bug 367191: 248511