Attachment 293217 Details for Bug 430595 – logs: login user login

logs: login user login

login_crypt_homedir-login (text/plain), 3.04 KB, created by Kevin R. Page on 2008-01-28 22:40:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kevin R. Page

Created: 2008-01-28 22:40:16 UTC

Size: 3.04 KB

patch

obsolete

>
>audit.log:
>
>type=USER_AUTH msg=audit(1201558398.310:260): user pid=3236 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=krp exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_ACCT msg=audit(1201558398.316:261): user pid=3236 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=krp exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=LOGIN msg=audit(1201558398.319:262): login pid=3236 uid=0 old auid=4294967295 new auid=1976
>type=AVC msg=audit(1201558399.898:263): avc:  denied  { execute } for  pid=6184 comm="login" name="pmvarrun" dev=dm-2 ino=3949781 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1201558399.898:263): arch=40000003 syscall=11 success=no exit=-13 a0=8c499a8 a1=bfacb658 a2=8c4a340 a3=0 items=0 ppid=3236 pid=6184 auid=1976 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_ROLE_CHANGE msg=audit(1201558399.916:264): user pid=3236 uid=0 auid=1976 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_START msg=audit(1201558399.923:265): user pid=3236 uid=0 auid=1976 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=krp exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_ACQ msg=audit(1201558399.924:266): user pid=3236 uid=0 auid=1976 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=krp exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_LOGIN msg=audit(1201558399.925:267): user pid=3236 uid=0 auid=1976 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=1976: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>
>
>/var/log/messages:
>Jan 28 22:13:19 yaffle kernel: EXT3 FS on dm-9, internal journal
>Jan 28 22:13:19 yaffle kernel: EXT3-fs: mounted filesystem with ordered data mode.
>Jan 28 22:13:21 yaffle setroubleshoot: #012    SELinux is preventing /bin/login (local_login_t) "execute" to <Unknown> (bin_t).#012     For complete SELinux messages. run sealert -l 81941d57-964b-4049-b14b-49c5a18f6dea
>
>/var/log/secure:
>Jan 28 22:13:18 yaffle login: pam_unix(login:session): session opened for user krp by LOGIN(uid=0)
>Jan 28 22:13:18 yaffle login: pam_mount(mount.c:177) realpath of volume "/home/krp" is "/home/krp"
>Jan 28 22:13:18 yaffle login: pam_mount(pam_mount.c:478) mount of /dev/yaffle_vg0/yaffle_lv_krp_cryptmount failed
>Jan 28 22:13:18 yaffle login: pam_mount(mount.c:177) realpath of volume "/home/common" is "/home/common"
>Jan 28 22:13:19 yaffle login: pam_mount(pam_mount.c:332) error executing /usr/sbin/pmvarrun
>Jan 28 22:13:19 yaffle login: LOGIN ON tty2 BY krp
>

Actions: View

Attachments on bug 430595: 293213 | 293214 | 293215 | 293216 | 293217 | 293218 | 295953