Attachment 259561 Details for Bug 381811 – audit.log for root logging in, selinux enforcing

audit.log for root logging in, selinux enforcing

audit-root-enf.log (text/plain), 4.38 KB, created by Tomasz Kepczynski on 2007-11-15 07:38:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomasz Kepczynski

Created: 2007-11-15 07:38:58 UTC

Size: 4.38 KB

patch

obsolete

>type=DAEMON_START msg=audit(1195111762.565:4957): auditd start, ver=1.6.2, format=raw, auid=43270 pid=31508 res=success, auditd pid=31508
>type=CONFIG_CHANGE msg=audit(1195111762.664:1363): audit_enabled=1 old=1 by auid=43270 subj=unconfined_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1195111762.664:1364): audit_enabled=1 old=1 by auid=43270 res=1
>type=CONFIG_CHANGE msg=audit(1195111762.668:1365): audit_backlog_limit=320 old=320 by auid=43270 subj=unconfined_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1195111762.668:1366): audit_backlog_limit=320 old=320 by auid=43270 res=1
>type=AVC msg=audit(1195111773.499:1367): avc:  denied  { read } for  pid=31474 comm="login" name="id_dsa" dev=dm-0 ino=229898 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_ssh_t:s0 tclass=file
>type=SYSCALL msg=audit(1195111773.499:1367): arch=c000003e syscall=2 success=no exit=-13 a0=6198b0 a1=0 a2=7fffb2017528 a3=303f5529f0 items=0 ppid=1 pid=31474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1195111773.500:1368): avc:  denied  { read } for  pid=31474 comm="login" name="id_dsa" dev=dm-0 ino=229898 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_ssh_t:s0 tclass=file
>type=SYSCALL msg=audit(1195111773.500:1368): arch=c000003e syscall=2 success=no exit=-13 a0=6198b0 a1=0 a2=7fffb2017528 a3=303f5529f0 items=0 ppid=1 pid=31474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1195111773.500:1369): user pid=31474 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1195111773.504:1370): user pid=31474 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=AVC msg=audit(1195111773.507:1371): avc:  denied  { read } for  pid=31474 comm="login" name="root-pts_3" dev=dm-0 ino=754591 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
>type=SYSCALL msg=audit(1195111773.507:1371): arch=c000003e syscall=2 success=no exit=-13 a0=61c750 a1=0 a2=1b6 a3=0 items=0 ppid=1 pid=31474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1195111773.509:1372): avc:  denied  { execute } for  pid=31524 comm="login" name="ssh-agent" dev=dm-0 ino=1266862 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ssh_agent_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1195111773.509:1372): arch=c000003e syscall=59 success=no exit=-13 a0=2aaaab347b9a a1=7fffb20154d0 a2=7fffb2015530 a3=2aaaaaadf1c0 items=0 ppid=31474 pid=31524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=LOGIN msg=audit(1195111773.510:1373): login pid=31474 uid=0 old auid=4294967295 new auid=0
>type=USER_ROLE_CHANGE msg=audit(1195111773.521:1374): user pid=31474 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=system_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=system_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1195111773.529:1375): user pid=31474 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1195111773.530:1376): user pid=31474 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1195111773.533:1377): user pid=31474 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'

Actions: View

Attachments on bug 381811: 259561 | 259571 | 259581 | 259591 | 260821 | 260831 | 263441 | 263451 | 266701 | 266711 | 266721 | 266731