Attachment 291481 Details for Bug 427347 – Audit log deleted before reboot

Audit log deleted before reboot

audit.log (text/plain), 64.81 KB, created by David on 2008-01-12 23:56:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David

Created: 2008-01-12 23:56:00 UTC

Size: 64.81 KB

patch

obsolete

>type=DAEMON_START msg=audit(1200181622.702:1452): auditd start, ver=1.5.6, format=raw, auid=4294967295 pid=2393 res=success, auditd pid=2393
>type=CONFIG_CHANGE msg=audit(1200181622.802:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1200181622.802:5): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1200181622.834:6): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1200181622.834:7): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=AVC msg=audit(1200181641.076:8): avc:  denied  { append } for  pid=3405 comm="spamd" name="razor-agent.log" dev=dm-0 ino=58098012 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181641.076:8): arch=40000003 syscall=5 success=yes exit=8 a0=b335830 a1=8441 a2=1b6 a3=8441 items=0 ppid=1 pid=3405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181641.082:9): avc:  denied  { ioctl } for  pid=3405 comm="spamd" path="/var/qmail/.razor/razor-agent.log" dev=dm-0 ino=58098012 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181641.082:9): arch=40000003 syscall=54 success=no exit=-25 a0=8 a1=5401 a2=bfc8dbb8 a3=bfc8dbf8 items=0 ppid=1 pid=3405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181641.082:10): avc:  denied  { getattr } for  pid=3405 comm="spamd" path="/var/qmail/.razor/razor-agent.log" dev=dm-0 ino=58098012 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181641.082:10): arch=40000003 syscall=197 success=yes exit=0 a0=8 a1=8e72068 a2=3cfff4 a3=8e884f0 items=0 ppid=1 pid=3405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181641.097:11): avc:  denied  { read } for  pid=3405 comm="spamd" name="servers.discovery.lst" dev=dm-0 ino=58097899 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181641.097:11): arch=40000003 syscall=5 success=yes exit=9 a0=b33db98 a1=8000 a2=0 a3=8000 items=0 ppid=1 pid=3405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181642.700:12): avc:  denied  { getattr } for  pid=3406 comm="pyzor" path="/var/qmail/.pyzor/servers" dev=dm-0 ino=58097990 scontext=system_u:system_r:pyzor_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181642.700:12): arch=40000003 syscall=195 success=yes exit=0 a0=9dfdd20 a1=bfd05718 a2=3cfff4 a3=9d831b0 items=0 ppid=3405 pid=3406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pyzor" exe="/usr/bin/python" subj=system_u:system_r:pyzor_t:s0 key=(null)
>type=AVC msg=audit(1200181642.700:13): avc:  denied  { read } for  pid=3406 comm="pyzor" name="servers" dev=dm-0 ino=58097990 scontext=system_u:system_r:pyzor_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181642.700:13): arch=40000003 syscall=5 success=yes exit=3 a0=9dfdd20 a1=8000 a2=1b6 a3=9e26fd0 items=0 ppid=3405 pid=3406 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="pyzor" exe="/usr/bin/python" subj=system_u:system_r:pyzor_t:s0 key=(null)
>type=AVC msg=audit(1200181643.039:14): avc:  denied  { read } for  pid=3407 comm="dccproc" path="/tmp/.spamassassin3405P5llejtmp" dev=dm-0 ino=45547548 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181643.039:14): arch=40000003 syscall=11 success=yes exit=0 a0=9126c70 a1=a1e0890 a2=b247898 a3=bfc8de5c items=0 ppid=3405 pid=3407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181643.063:15): avc:  denied  { getattr } for  pid=3407 comm="dccproc" path="/tmp/.spamassassin3405P5llejtmp" dev=dm-0 ino=45547548 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181643.063:15): arch=40000003 syscall=197 success=yes exit=0 a0=0 a1=bf9245a0 a2=3cfff4 a3=420ca0 items=0 ppid=3405 pid=3407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181643.071:16): avc:  denied  { setgid } for  pid=3407 comm="dccproc" capability=6 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=capability
>type=SYSCALL msg=audit(1200181643.071:16): arch=40000003 syscall=210 success=yes exit=0 a0=ffffffff a1=0 a2=ffffffff a3=420ca0 items=0 ppid=3405 pid=3407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181643.106:17): avc:  denied  { node_bind } for  pid=3407 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:inaddr_any_node_t:s0 tclass=udp_socket
>type=SYSCALL msg=audit(1200181643.106:17): arch=40000003 syscall=102 success=yes exit=0 a0=2 a1=bf923d70 a2=bf923df4 a3=bf923dfc items=0 ppid=3405 pid=3407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181644.716:18): user pid=3408 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181644.717:19): user pid=3408 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181644.807:20): login pid=3408 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181644.807:21): user pid=3408 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181644.858:22): user pid=3408 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181644.894:23): avc:  denied  { search } for  pid=3408 comm="in.proftpd" name="www" dev=dm-0 ino=58064969 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181644.894:23): arch=40000003 syscall=196 success=yes exit=0 a0=bfaea39b a1=bfaf0458 a2=260ff4 a3=bfaea39b items=0 ppid=3180 pid=3408 auid=10001 uid=0 gid=0 euid=10001 suid=0 fsuid=10001 egid=2524 sgid=0 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181644.930:24): avc:  denied  { append } for  pid=3408 comm="in.proftpd" name="xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181644.930:24): arch=40000003 syscall=5 success=yes exit=11 a0=8d7142c a1=28441 a2=1a4 a3=28441 items=0 ppid=3180 pid=3408 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181644.945:25): avc:  denied  { getattr } for  pid=3408 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181644.945:25): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfaf146c a2=260ff4 a3=8d7142c items=0 ppid=3180 pid=3408 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181648.151:26): avc:  denied  { write } for  pid=3408 comm="in.proftpd" name="webcam_front.jpg" dev=dm-0 ino=59867446 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181648.151:26): arch=40000003 syscall=5 success=yes exit=13 a0=8d76d5c a1=8241 a2=1b6 a3=8241 items=0 ppid=3180 pid=3408 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181648.167:27): avc:  denied  { setattr } for  pid=3408 comm="in.proftpd" name="webcam_front.jpg" dev=dm-0 ino=59867446 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181648.167:27): arch=40000003 syscall=212 success=yes exit=0 a0=8d76d5c a1=ffffffff a2=9dc a3=8d76d5c items=0 ppid=3180 pid=3408 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181649.287:28): avc:  denied  { read } for  pid=3408 comm="in.proftpd" name="passwd" dev=dm-0 ino=59867395 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181649.287:28): arch=40000003 syscall=5 success=yes exit=0 a0=26d353 a1=0 a2=1b6 a3=8d77988 items=0 ppid=3180 pid=3408 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181658.216:29): user pid=3646 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181658.216:30): user pid=3646 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181658.219:31): login pid=3646 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181658.219:32): user pid=3646 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181658.219:33): user pid=3646 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181658.220:34): avc:  denied  { search } for  pid=3646 comm="in.proftpd" name="www" dev=dm-0 ino=58064969 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181658.220:34): arch=40000003 syscall=196 success=yes exit=0 a0=bfe0064b a1=bfe06708 a2=260ff4 a3=bfe0064b items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=0 euid=10001 suid=0 fsuid=10001 egid=2524 sgid=0 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181658.220:35): avc:  denied  { append } for  pid=3646 comm="in.proftpd" name="xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181658.220:35): arch=40000003 syscall=5 success=yes exit=11 a0=883b42c a1=28441 a2=1a4 a3=28441 items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181658.220:36): avc:  denied  { getattr } for  pid=3646 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181658.220:36): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfe0771c a2=260ff4 a3=883b42c items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181658.721:37): avc:  denied  { search } for  pid=3646 comm="in.proftpd" name="aus-city.com" dev=dm-0 ino=59867137 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181658.721:37): arch=40000003 syscall=196 success=yes exit=0 a0=bfe0085b a1=bfe06918 a2=260ff4 a3=bfe0085b items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181661.403:38): avc:  denied  { search } for  pid=3646 comm="in.proftpd" name="aus-city.com" dev=dm-0 ino=59867137 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181661.403:38): arch=40000003 syscall=195 success=yes exit=0 a0=bfe068eb a1=bfe079cc a2=260ff4 a3=bfe068eb items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181661.408:39): avc:  denied  { write } for  pid=3646 comm="in.proftpd" name="webcam_back.jpg" dev=dm-0 ino=59867474 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181661.408:39): arch=40000003 syscall=5 success=yes exit=13 a0=8840d4c a1=8241 a2=1b6 a3=8241 items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181661.408:40): avc:  denied  { setattr } for  pid=3646 comm="in.proftpd" name="webcam_back.jpg" dev=dm-0 ino=59867474 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181661.408:40): arch=40000003 syscall=212 success=yes exit=0 a0=8840d4c a1=ffffffff a2=9dc a3=8840d4c items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181661.998:41): avc:  denied  { append } for  pid=3646 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181661.998:41): arch=40000003 syscall=4 success=yes exit=130 a0=b a1=bfe071e8 a2=82 a3=30 items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181663.814:42): avc:  denied  { read } for  pid=3448 comm="httpd" name="resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181663.814:42): arch=40000003 syscall=5 success=yes exit=94 a0=bbb79ae0 a1=8000 a2=1a0 a3=8000 items=0 ppid=3430 pid=3448 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181663.920:43): avc:  denied  { lock } for  pid=3448 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181663.920:43): arch=40000003 syscall=221 success=yes exit=0 a0=5e a1=7 a2=bfe5deac a3=bfe5deac items=0 ppid=3430 pid=3448 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181663.920:44): avc:  denied  { getattr } for  pid=3448 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181663.920:44): arch=40000003 syscall=197 success=yes exit=0 a0=5e a1=bfe5de5c a2=506ff4 a3=bbb79b20 items=0 ppid=3430 pid=3448 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181664.016:45): avc:  denied  { read } for  pid=3646 comm="in.proftpd" name="passwd" dev=dm-0 ino=59867395 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181664.016:45): arch=40000003 syscall=5 success=yes exit=0 a0=26d353 a1=0 a2=1b6 a3=8841988 items=0 ppid=3180 pid=3646 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181669.995:46): user pid=3801 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181669.996:47): user pid=3801 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181670.004:48): login pid=3801 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181670.004:49): user pid=3801 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181670.004:50): user pid=3801 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181670.006:51): avc:  denied  { getattr } for  pid=3801 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181670.006:51): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bf9ebfcc a2=260ff4 a3=92bb42c items=0 ppid=3180 pid=3801 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181672.010:52): avc:  denied  { search } for  pid=3801 comm="in.proftpd" name="aus-city.com" dev=dm-0 ino=59867137 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181672.010:52): arch=40000003 syscall=195 success=yes exit=0 a0=bf9eb1ab a1=bf9ec28c a2=260ff4 a3=bf9eb1ab items=0 ppid=3180 pid=3801 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=USER_ERR msg=audit(1200181672.651:53): user pid=3831 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
>type=AVC msg=audit(1200181673.070:54): avc:  denied  { write } for  pid=3801 comm="in.proftpd" name="webcam_car.jpg" dev=dm-0 ino=59867470 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181673.070:54): arch=40000003 syscall=5 success=yes exit=13 a0=92c0d4c a1=8241 a2=1b6 a3=8241 items=0 ppid=3180 pid=3801 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181673.070:55): avc:  denied  { setattr } for  pid=3801 comm="in.proftpd" name="webcam_car.jpg" dev=dm-0 ino=59867470 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181673.070:55): arch=40000003 syscall=212 success=yes exit=0 a0=92c0d4c a1=ffffffff a2=9dc a3=92c0d4c items=0 ppid=3180 pid=3801 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181673.393:56): avc:  denied  { read } for  pid=3450 comm="httpd" name="resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181673.393:56): arch=40000003 syscall=5 success=yes exit=93 a0=bbb51ae0 a1=8000 a2=1a0 a3=8000 items=0 ppid=3430 pid=3450 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181673.393:57): avc:  denied  { lock } for  pid=3450 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181673.393:57): arch=40000003 syscall=221 success=yes exit=0 a0=5d a1=7 a2=bfe5e29c a3=bfe5e29c items=0 ppid=3430 pid=3450 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181673.393:58): avc:  denied  { getattr } for  pid=3450 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181673.393:58): arch=40000003 syscall=197 success=yes exit=0 a0=5d a1=bfe5e24c a2=506ff4 a3=bbb51b20 items=0 ppid=3430 pid=3450 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181673.802:59): avc:  denied  { append } for  pid=3801 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181673.802:59): arch=40000003 syscall=4 success=yes exit=129 a0=b a1=bf9eba98 a2=81 a3=30 items=0 ppid=3180 pid=3801 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181674.301:60): avc:  denied  { read } for  pid=3801 comm="in.proftpd" name="passwd" dev=dm-0 ino=59867395 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181674.301:60): arch=40000003 syscall=5 success=yes exit=0 a0=26d353 a1=0 a2=1b6 a3=92c1988 items=0 ppid=3180 pid=3801 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=USER_ACCT msg=audit(1200181681.799:61): user pid=3942 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1200181686.372:62): avc:  denied  { read } for  pid=3452 comm="httpd" name="resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181686.372:62): arch=40000003 syscall=5 success=yes exit=94 a0=bbb79768 a1=8000 a2=1a0 a3=8000 items=0 ppid=3430 pid=3452 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181686.372:63): avc:  denied  { lock } for  pid=3452 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181686.372:63): arch=40000003 syscall=221 success=yes exit=0 a0=5e a1=7 a2=bfe5deac a3=bfe5deac items=0 ppid=3430 pid=3452 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181686.372:64): avc:  denied  { getattr } for  pid=3452 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181686.372:64): arch=40000003 syscall=197 success=yes exit=0 a0=5e a1=bfe5de5c a2=506ff4 a3=bbb797a8 items=0 ppid=3430 pid=3452 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181709.605:65): user pid=3949 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181709.605:66): user pid=3949 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181709.609:67): login pid=3949 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181709.609:68): user pid=3949 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181709.609:69): user pid=3949 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181709.610:70): avc:  denied  { append } for  pid=3949 comm="in.proftpd" name="xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181709.610:70): arch=40000003 syscall=5 success=yes exit=11 a0=92f442c a1=28441 a2=1a4 a3=28441 items=0 ppid=3180 pid=3949 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181709.610:71): avc:  denied  { getattr } for  pid=3949 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181709.610:71): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfeedccc a2=260ff4 a3=92f442c items=0 ppid=3180 pid=3949 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181712.617:72): avc:  denied  { write } for  pid=3949 comm="in.proftpd" name="webcam_front.jpg" dev=dm-0 ino=59867446 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181712.617:72): arch=40000003 syscall=5 success=yes exit=13 a0=92f9d5c a1=8241 a2=1b6 a3=8241 items=0 ppid=3180 pid=3949 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181712.617:73): avc:  denied  { setattr } for  pid=3949 comm="in.proftpd" name="webcam_front.jpg" dev=dm-0 ino=59867446 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181712.617:73): arch=40000003 syscall=212 success=yes exit=0 a0=92f9d5c a1=ffffffff a2=9dc a3=92f9d5c items=0 ppid=3180 pid=3949 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181713.652:74): avc:  denied  { search } for  pid=3409 comm="spamd" name="mailnames" dev=dm-0 ino=58163223 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181713.652:74): arch=40000003 syscall=195 success=yes exit=0 a0=9cae510 a1=8e720c8 a2=3cfff4 a3=9cae510 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181713.680:75): avc:  denied  { read } for  pid=3409 comm="spamd" name="user_prefs" dev=dm-0 ino=60296773 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181713.680:75): arch=40000003 syscall=5 success=yes exit=9 a0=a36c428 a1=8000 a2=0 a3=8000 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181713.680:76): avc:  denied  { ioctl } for  pid=3409 comm="spamd" path="/var/qmail/mailnames/idb.com.au/acottle/.spamassassin/user_prefs" dev=dm-0 ino=60296773 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181713.680:76): arch=40000003 syscall=54 success=no exit=-25 a0=9 a1=5401 a2=bfc8dbb8 a3=bfc8dbf8 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181713.745:77): avc:  denied  { read } for  pid=3949 comm="in.proftpd" name="passwd" dev=dm-0 ino=59867395 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181713.745:77): arch=40000003 syscall=5 success=yes exit=0 a0=26d353 a1=0 a2=1b6 a3=92fa988 items=0 ppid=3180 pid=3949 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181714.047:78): avc:  denied  { append } for  pid=3409 comm="spamd" name="bayes_journal" dev=dm-0 ino=60296827 scontext=system_u:system_r:spamd_t:s0 tcontext=root:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181714.047:78): arch=40000003 syscall=5 success=yes exit=12 a0=b78d158 a1=8441 a2=1b6 a3=8441 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181714.047:79): avc:  denied  { ioctl } for  pid=3409 comm="spamd" path="/var/qmail/mailnames/idb.com.au/acottle/.spamassassin/bayes_journal" dev=dm-0 ino=60296827 scontext=system_u:system_r:spamd_t:s0 tcontext=root:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181714.047:79): arch=40000003 syscall=54 success=no exit=-25 a0=c a1=5401 a2=bfc8dbb8 a3=bfc8dbf8 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181714.135:80): avc:  denied  { read } for  pid=3409 comm="spamd" name="servers.discovery.lst" dev=dm-0 ino=58097899 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181714.135:80): arch=40000003 syscall=5 success=yes exit=10 a0=b817138 a1=8000 a2=0 a3=8000 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181714.135:81): avc:  denied  { ioctl } for  pid=3409 comm="spamd" path="/var/qmail/.razor/servers.discovery.lst" dev=dm-0 ino=58097899 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181714.135:81): arch=40000003 syscall=54 success=no exit=-25 a0=a a1=5401 a2=bfc8dbb8 a3=bfc8dbf8 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181714.135:82): avc:  denied  { getattr } for  pid=3409 comm="spamd" path="/var/qmail/.razor/servers.discovery.lst" dev=dm-0 ino=58097899 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181714.135:82): arch=40000003 syscall=197 success=yes exit=0 a0=a a1=8e72068 a2=3cfff4 a3=8e88504 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181715.189:83): avc:  denied  { getattr } for  pid=3979 comm="pyzor" path="/var/qmail/.pyzor/servers" dev=dm-0 ino=58097990 scontext=system_u:system_r:pyzor_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181715.189:83): arch=40000003 syscall=195 success=yes exit=0 a0=80d6d20 a1=bfd46f58 a2=3cfff4 a3=805c1b0 items=0 ppid=3409 pid=3979 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="pyzor" exe="/usr/bin/python" subj=system_u:system_r:pyzor_t:s0 key=(null)
>type=AVC msg=audit(1200181715.189:84): avc:  denied  { read } for  pid=3979 comm="pyzor" name="servers" dev=dm-0 ino=58097990 scontext=system_u:system_r:pyzor_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181715.189:84): arch=40000003 syscall=5 success=yes exit=3 a0=80d6d20 a1=8000 a2=1b6 a3=80fffd0 items=0 ppid=3409 pid=3979 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="pyzor" exe="/usr/bin/python" subj=system_u:system_r:pyzor_t:s0 key=(null)
>type=AVC msg=audit(1200181715.526:85): avc:  denied  { read } for  pid=3981 comm="dccproc" path="/tmp/.spamassassin3409fwxI29tmp" dev=dm-0 ino=45547563 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181715.526:85): arch=40000003 syscall=11 success=yes exit=0 a0=b337278 a1=b2478a8 a2=b6a2ed0 a3=bfc8de5c items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=0 suid=0 fsuid=0 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.527:86): avc:  denied  { getattr } for  pid=3981 comm="dccproc" path="/tmp/.spamassassin3409fwxI29tmp" dev=dm-0 ino=45547563 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181715.527:86): arch=40000003 syscall=197 success=yes exit=0 a0=0 a1=bf9ac540 a2=3cfff4 a3=420ca0 items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=0 suid=0 fsuid=0 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.528:87): avc:  denied  { create } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1200181715.528:87): arch=40000003 syscall=102 success=yes exit=3 a0=1 a1=bf9ac484 a2=3cfff4 a3=0 items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=110 suid=0 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.528:88): avc:  denied  { bind } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1200181715.528:88): arch=40000003 syscall=102 success=yes exit=0 a0=2 a1=bf9ac484 a2=3cfff4 a3=3 items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=110 suid=0 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.528:89): avc:  denied  { getattr } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1200181715.528:89): arch=40000003 syscall=102 success=yes exit=0 a0=6 a1=bf9ac484 a2=3cfff4 a3=3 items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=110 suid=0 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.528:90): avc:  denied  { write } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=netlink_route_socket
>type=AVC msg=audit(1200181715.528:90): avc:  denied  { nlmsg_read } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1200181715.528:90): arch=40000003 syscall=102 success=yes exit=20 a0=b a1=bf9ab3c0 a2=3cfff4 a3=ffffffc8 items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=110 suid=0 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.528:91): avc:  denied  { read } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:system_r:dcc_client_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1200181715.528:91): arch=40000003 syscall=102 success=yes exit=2208 a0=11 a1=bf9ab3c0 a2=3cfff4 a3=ffffffc8 items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=110 suid=0 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=AVC msg=audit(1200181715.528:92): avc:  denied  { node_bind } for  pid=3981 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:inaddr_any_node_t:s0 tclass=udp_socket
>type=SYSCALL msg=audit(1200181715.528:92): arch=40000003 syscall=102 success=yes exit=0 a0=2 a1=bf9abd10 a2=bf9abd94 a3=bf9abd9c items=0 ppid=3409 pid=3981 auid=4294967295 uid=110 gid=31 euid=110 suid=0 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="dccproc" exe="/usr/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181723.218:93): user pid=3983 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181723.218:94): user pid=3983 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181723.223:95): login pid=3983 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181723.223:96): user pid=3983 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181723.223:97): user pid=3983 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181723.224:98): avc:  denied  { write } for  pid=3409 comm="spamd" name=".spamassassin" dev=dm-0 ino=60296768 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=dir
>type=AVC msg=audit(1200181723.224:98): avc:  denied  { add_name } for  pid=3409 comm="spamd" name="auto-whitelist.lock.server.engineering.idb.3409" scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181723.224:98): arch=40000003 syscall=5 success=yes exit=9 a0=a0e3718 a1=8241 a2=1b6 a3=8241 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181723.224:99): avc:  denied  { write } for  pid=3409 comm="spamd" path="/var/qmail/mailnames/idb.com.au/acottle/.spamassassin/auto-whitelist.lock.server.engineering.idb.3409" dev=dm-0 ino=60296831 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181723.224:99): arch=40000003 syscall=4 success=yes exit=28 a0=9 a1=b815178 a2=1c a3=b815178 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181723.236:100): avc:  denied  { link } for  pid=3409 comm="spamd" name="auto-whitelist.lock.server.engineering.idb.3409" dev=dm-0 ino=60296831 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181723.236:100): arch=40000003 syscall=9 success=yes exit=0 a0=a1fae00 a1=9f61188 a2=6065cc a3=8e72008 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=AVC msg=audit(1200181723.236:101): avc:  denied  { remove_name } for  pid=3409 comm="spamd" name="auto-whitelist.lock.server.engineering.idb.3409" dev=dm-0 ino=60296831 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=dir
>type=AVC msg=audit(1200181723.236:101): avc:  denied  { unlink } for  pid=3409 comm="spamd" name="auto-whitelist.lock.server.engineering.idb.3409" dev=dm-0 ino=60296831 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181723.236:101): arch=40000003 syscall=10 success=yes exit=0 a0=a1fae00 a1=9968a38 a2=6065cc a3=a1fae00 items=0 ppid=3405 pid=3409 auid=4294967295 uid=110 gid=31 euid=110 suid=110 fsuid=110 egid=31 sgid=31 fsgid=31 tty=(none) comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181735.005:102): user pid=3998 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181735.005:103): user pid=3998 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181735.009:104): login pid=3998 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181735.009:105): user pid=3998 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181735.009:106): user pid=3998 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181771.616:107): user pid=4002 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181771.616:108): user pid=4002 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181771.619:109): login pid=4002 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181771.619:110): user pid=4002 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181771.619:111): user pid=4002 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181788.337:112): user pid=4011 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181788.337:113): user pid=4011 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181788.340:114): login pid=4011 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181788.340:115): user pid=4011 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181788.340:116): user pid=4011 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181798.018:117): user pid=4016 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181798.018:118): user pid=4016 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181798.024:119): login pid=4016 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181798.024:120): user pid=4016 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181798.024:121): user pid=4016 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181801.925:122): user pid=4019 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1200181838.358:123): avc:  denied  { read } for  pid=3454 comm="httpd" name="resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181838.358:123): arch=40000003 syscall=5 success=yes exit=92 a0=bbb31f40 a1=8000 a2=1a0 a3=8000 items=0 ppid=3430 pid=3454 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181838.358:124): avc:  denied  { lock } for  pid=3454 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181838.358:124): arch=40000003 syscall=221 success=yes exit=0 a0=5c a1=7 a2=bfe5e1bc a3=bfe5e1bc items=0 ppid=3430 pid=3454 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181838.358:125): avc:  denied  { getattr } for  pid=3454 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181838.358:125): arch=40000003 syscall=197 success=yes exit=0 a0=5c a1=bfe5e16c a2=506ff4 a3=bbb31f80 items=0 ppid=3430 pid=3454 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181839.527:126): user pid=4033 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181839.528:127): user pid=4033 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181839.533:128): login pid=4033 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181839.533:129): user pid=4033 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181839.533:130): user pid=4033 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181839.534:131): avc:  denied  { append } for  pid=4033 comm="in.proftpd" name="xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181839.534:131): arch=40000003 syscall=5 success=yes exit=11 a0=999b42c a1=28441 a2=1a4 a3=28441 items=0 ppid=3180 pid=4033 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181839.534:132): avc:  denied  { getattr } for  pid=4033 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181839.534:132): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfa5f83c a2=260ff4 a3=999b42c items=0 ppid=3180 pid=4033 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1200181845.581:133): user pid=4035 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=203.14.171.15, addr=203.14.171.15, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181845.581:134): user pid=4035 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=203.14.171.15, addr=203.14.171.15, terminal=? res=success)'
>type=LOGIN msg=audit(1200181845.585:135): login pid=4035 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181845.585:136): user pid=4035 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=203.14.171.15, addr=203.14.171.15, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181845.585:137): user pid=4035 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=203.14.171.15, addr=203.14.171.15, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181853.171:138): user pid=4037 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181853.172:139): user pid=4037 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181853.176:140): login pid=4037 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181853.176:141): user pid=4037 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181853.176:142): user pid=4037 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181860.929:143): user pid=4038 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181860.929:144): user pid=4038 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181860.938:145): login pid=4038 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181860.938:146): user pid=4038 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181860.938:147): user pid=4038 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181901.531:148): user pid=4065 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181901.531:149): user pid=4065 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181901.535:150): login pid=4065 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181901.535:151): user pid=4065 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181901.535:152): user pid=4065 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181915.155:153): user pid=4067 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181915.155:154): user pid=4067 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181915.160:155): login pid=4067 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181915.160:156): user pid=4067 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181915.160:157): user pid=4067 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181922.940:158): user pid=4069 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181922.940:159): user pid=4069 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181922.949:160): login pid=4069 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181922.949:161): user pid=4069 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181922.949:162): user pid=4069 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1200181941.716:163): user pid=4075 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1200181941.716:164): user pid=4075 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1200181941.798:165): user pid=4075 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=ssh res=success)'
>type=LOGIN msg=audit(1200181941.800:166): login pid=4075 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1200181941.801:167): user pid=4075 uid=0 auid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1200181941.836:168): user pid=4077 uid=0 auid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=ssh res=success)'
>type=USER_AUTH msg=audit(1200181962.618:169): user pid=4103 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: authentication acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=USER_ACCT msg=audit(1200181962.618:170): user pid=4103 uid=0 auid=4294967295 subj=system_u:system_r:ftpd_t:s0 msg='PAM: accounting acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=LOGIN msg=audit(1200181962.626:171): login pid=4103 uid=0 old auid=4294967295 new auid=10001
>type=USER_START msg=audit(1200181962.626:172): user pid=4103 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: session open acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1200181962.626:173): user pid=4103 uid=0 auid=10001 subj=system_u:system_r:ftpd_t:s0 msg='PAM: setcred acct=aus-city : exe="/usr/sbin/proftpd" (hostname=10.0.0.1, addr=10.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1200181962.627:174): avc:  denied  { search } for  pid=4103 comm="in.proftpd" name="www" dev=dm-0 ino=58064969 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
>type=SYSCALL msg=audit(1200181962.627:174): arch=40000003 syscall=196 success=yes exit=0 a0=bfe19b2b a1=bfe1fbe8 a2=260ff4 a3=bfe19b2b items=0 ppid=3180 pid=4103 auid=10001 uid=0 gid=0 euid=10001 suid=0 fsuid=10001 egid=2524 sgid=0 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181962.627:175): avc:  denied  { append } for  pid=4103 comm="in.proftpd" name="xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181962.627:175): arch=40000003 syscall=5 success=yes exit=11 a0=9b9b42c a1=28441 a2=1a4 a3=28441 items=0 ppid=3180 pid=4103 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181962.627:176): avc:  denied  { getattr } for  pid=4103 comm="in.proftpd" path="/usr/local/psa/var/log/xferlog" dev=dm-0 ino=10618733 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181962.627:176): arch=40000003 syscall=197 success=yes exit=0 a0=b a1=bfe20bfc a2=260ff4 a3=9b9b42c items=0 ppid=3180 pid=4103 auid=10001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181965.779:177): avc:  denied  { write } for  pid=4103 comm="in.proftpd" name="webcam_front.jpg" dev=dm-0 ino=59867446 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181965.779:177): arch=40000003 syscall=5 success=yes exit=13 a0=9ba0d5c a1=8241 a2=1b6 a3=8241 items=0 ppid=3180 pid=4103 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181965.779:178): avc:  denied  { setattr } for  pid=4103 comm="in.proftpd" name="webcam_front.jpg" dev=dm-0 ino=59867446 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181965.779:178): arch=40000003 syscall=212 success=yes exit=0 a0=9ba0d5c a1=ffffffff a2=9dc a3=9ba0d5c items=0 ppid=3180 pid=4103 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181966.905:179): avc:  denied  { read } for  pid=4103 comm="in.proftpd" name="passwd" dev=dm-0 ino=59867395 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181966.905:179): arch=40000003 syscall=5 success=yes exit=0 a0=26d353 a1=0 a2=1b6 a3=9ba1988 items=0 ppid=3180 pid=4103 auid=10001 uid=0 gid=2524 euid=10001 suid=10001 fsuid=10001 egid=2524 sgid=2524 fsgid=2524 tty=(none) comm="in.proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)
>type=AVC msg=audit(1200181970.444:180): avc:  denied  { read } for  pid=3452 comm="httpd" name="resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181970.444:180): arch=40000003 syscall=5 success=yes exit=94 a0=bbd007c0 a1=8000 a2=1a0 a3=8000 items=0 ppid=3430 pid=3452 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181970.444:181): avc:  denied  { lock } for  pid=3452 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181970.444:181): arch=40000003 syscall=221 success=yes exit=0 a0=5e a1=7 a2=bfe5deac a3=bfe5deac items=0 ppid=3430 pid=3452 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1200181970.444:182): avc:  denied  { getattr } for  pid=3452 comm="httpd" path="/var/asl/data/msa/resource.dir" dev=dm-0 ino=61210721 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
>type=SYSCALL msg=audit(1200181970.444:182): arch=40000003 syscall=197 success=yes exit=0 a0=5e a1=bfe5de5c a2=506ff4 a3=bbd00800 items=0 ppid=3430 pid=3452 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

Actions: View

Attachments on bug 427347: 290791 | 290795 | 290872 | 291481