Attachment 260821 Details for Bug 381811 – audit.log for root logging in, selinux enforcing

audit.log for root logging in, selinux enforcing

audit-root-enf.log (text/plain), 3.77 KB, created by Tomasz Kepczynski on 2007-11-16 07:35:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomasz Kepczynski

Created: 2007-11-16 07:35:07 UTC

Size: 3.77 KB

patch

obsolete

>type=DAEMON_START msg=audit(1195198121.303:1077): auditd start, ver=1.6.2, format=raw, auid=0 pid=3460 res=success, auditd pid=3460
>type=CONFIG_CHANGE msg=audit(1195198121.402:283): audit_enabled=1 old=1 by auid=0 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1195198121.402:284): audit_enabled=1 old=1 by auid=0 res=1
>type=CONFIG_CHANGE msg=audit(1195198121.406:285): audit_backlog_limit=320 old=320 by auid=0 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1195198121.406:286): audit_backlog_limit=320 old=320 by auid=0 res=1
>type=AVC msg=audit(1195198125.726:287): avc:  denied  { read } for  pid=3352 comm="login" name="id_dsa" dev=dm-0 ino=229898 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_ssh_t:s0 tclass=file
>type=SYSCALL msg=audit(1195198125.726:287): arch=c000003e syscall=2 success=no exit=-13 a0=619100 a1=0 a2=7fff33bf9108 a3=303f5529f0 items=0 ppid=1 pid=3352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1195198125.726:288): avc:  denied  { read } for  pid=3352 comm="login" name="id_dsa" dev=dm-0 ino=229898 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_ssh_t:s0 tclass=file
>type=SYSCALL msg=audit(1195198125.726:288): arch=c000003e syscall=2 success=no exit=-13 a0=619100 a1=0 a2=7fff33bf9108 a3=303f5529f0 items=0 ppid=1 pid=3352 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1195198125.727:289): user pid=3352 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_ACCT msg=audit(1195198125.730:290): user pid=3352 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=AVC msg=audit(1195198125.735:291): avc:  denied  { execute } for  pid=3473 comm="login" name="ssh-agent" dev=dm-0 ino=1266862 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ssh_agent_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1195198125.735:291): arch=c000003e syscall=59 success=no exit=-13 a0=2aaaab347b9a a1=7fff33bf70b0 a2=7fff33bf7110 a3=2aaaaaadf1c0 items=0 ppid=3352 pid=3473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=LOGIN msg=audit(1195198125.736:292): login pid=3352 uid=0 old auid=4294967295 new auid=0
>type=USER_ROLE_CHANGE msg=audit(1195198125.745:293): user pid=3352 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=system_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=system_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_START msg=audit(1195198125.755:294): user pid=3352 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_ACQ msg=audit(1195198125.755:295): user pid=3352 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=root exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_LOGIN msg=audit(1195198125.756:296): user pid=3352 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'

Actions: View

Attachments on bug 381811: 259561 | 259571 | 259581 | 259591 | 260821 | 260831 | 263441 | 263451 | 266701 | 266711 | 266721 | 266731