Attachment 259591 Details for Bug 381811 – audit.log for normal user (home on nfs) logging in, selinux permissive

audit.log for normal user (home on nfs) logging in, selinux permissive

audit-user-perm.log (text/plain), 6.05 KB, created by Tomasz Kepczynski on 2007-11-15 07:40:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomasz Kepczynski

Created: 2007-11-15 07:40:26 UTC

Size: 6.05 KB

patch

obsolete

>type=DAEMON_START msg=audit(1195111934.944:4015): auditd start, ver=1.6.2, format=raw, auid=43270 pid=31790 res=success, auditd pid=31790
>type=CONFIG_CHANGE msg=audit(1195111935.044:1404): audit_enabled=1 old=1 by auid=43270 subj=unconfined_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1195111935.044:1405): audit_enabled=1 old=1 by auid=43270 res=1
>type=CONFIG_CHANGE msg=audit(1195111935.048:1406): audit_backlog_limit=320 old=320 by auid=43270 subj=unconfined_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1195111935.048:1407): audit_backlog_limit=320 old=320 by auid=43270 res=1
>type=USER_AUTH msg=audit(1195111942.632:1408): user pid=31760 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=tkepczyn exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1195111942.633:1409): user pid=31760 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=tkepczyn exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=AVC msg=audit(1195111942.685:1410): avc:  denied  { read } for  pid=31760 comm="login" name="tkepczyn-:0" dev=dm-0 ino=754580 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file
>type=SYSCALL msg=audit(1195111942.685:1410): arch=c000003e syscall=2 success=yes exit=4 a0=61c2b0 a1=0 a2=1b6 a3=0 items=0 ppid=1 pid=31760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1195111942.710:1411): avc:  denied  { write } for  pid=31760 comm="login" name="pam_ssh" dev=dm-0 ino=754255 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
>type=AVC msg=audit(1195111942.710:1411): avc:  denied  { add_name } for  pid=31760 comm="login" name="tkepczyn" dev=dm-0 ino=754580 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
>type=AVC msg=audit(1195111942.710:1411): avc:  denied  { link } for  pid=31760 comm="login" name="tkepczyn" dev=dm-0 ino=754580 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file
>type=SYSCALL msg=audit(1195111942.710:1411): arch=c000003e syscall=86 success=yes exit=0 a0=61c2b0 a1=61cac0 a2=2 a3=303f5529f0 items=0 ppid=1 pid=31760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=LOGIN msg=audit(1195111942.711:1412): login pid=31760 uid=0 old auid=4294967295 new auid=43270
>type=USER_ROLE_CHANGE msg=audit(1195111942.723:1413): user pid=31760 uid=0 auid=43270 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0 selected-context=unconfined_u:system_r:unconfined_t:s0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1195111942.824:1414): user pid=31760 uid=0 auid=43270 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=tkepczyn exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1195111942.825:1415): user pid=31760 uid=0 auid=43270 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=tkepczyn exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1195111942.827:1416): user pid=31760 uid=0 auid=43270 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=43270: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1195112101.326:1417): user pid=31889 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1195112105.189:1418): user pid=31760 uid=0 auid=43270 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=tkepczyn exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=AVC msg=audit(1195112105.215:1419): avc:  denied  { write } for  pid=31760 comm="login" name="pam_ssh" dev=dm-0 ino=754255 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
>type=AVC msg=audit(1195112105.215:1419): avc:  denied  { remove_name } for  pid=31760 comm="login" name="tkepczyn-tty1" dev=dm-0 ino=754580 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
>type=AVC msg=audit(1195112105.215:1419): avc:  denied  { unlink } for  pid=31760 comm="login" name="tkepczyn-tty1" dev=dm-0 ino=754580 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file
>type=SYSCALL msg=audit(1195112105.215:1419): arch=c000003e syscall=87 success=yes exit=0 a0=61cac0 a1=620ec0 a2=303f5529d8 a3=7fffc3edac23 items=0 ppid=1 pid=31760 auid=43270 uid=0 gid=32602 euid=0 suid=43270 fsuid=0 egid=32602 sgid=32602 fsgid=32602 tty=(none) comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1195112105.241:1420): avc:  denied  { getattr } for  pid=31760 comm="login" path="/var/run/pam_ssh/tkepczyn" dev=dm-0 ino=754580 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file
>type=SYSCALL msg=audit(1195112105.241:1420): arch=c000003e syscall=4 success=yes exit=0 a0=61c2b0 a1=7fffc3edb930 a2=7fffc3edb930 a3=7fffc3edac23 items=0 ppid=1 pid=31760 auid=43270 uid=0 gid=32602 euid=43270 suid=43270 fsuid=43270 egid=32602 sgid=32602 fsgid=32602 tty=(none) comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1195112105.242:1421): user pid=31760 uid=0 auid=43270 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=tkepczyn exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'

Actions: View

Attachments on bug 381811: 259561 | 259571 | 259581 | 259591 | 260821 | 260831 | 263441 | 263451 | 266701 | 266711 | 266721 | 266731