Attachment 293218 Details for Bug 430595 – logs: login user logout

logs: login user logout

login_crypt_homedir-logout (text/plain), 2.87 KB, created by Kevin R. Page on 2008-01-28 22:40:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kevin R. Page

Created: 2008-01-28 22:40:41 UTC

Size: 2.87 KB

patch

obsolete

>
>audit.log:
>
>type=CRED_DISP msg=audit(1201558517.029:268): user pid=3236 uid=0 auid=1976 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=krp exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=AVC msg=audit(1201558517.045:269): avc:  denied  { execute } for  pid=6267 comm="login" name="pmvarrun" dev=dm-2 ino=3949781 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1201558517.045:269): arch=40000003 syscall=11 success=no exit=-13 a0=8c54048 a1=bfacb668 a2=8c55d00 a3=0 items=0 ppid=3236 pid=6267 auid=1976 uid=0 gid=1976 euid=0 suid=0 fsuid=0 egid=1976 sgid=1976 fsgid=1976 tty=(none) comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1201558517.047:270): avc:  denied  { execute } for  pid=6268 comm="login" name="umount.crypt" dev=dm-0 ino=325126 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1201558517.047:270): arch=40000003 syscall=11 success=no exit=-13 a0=8c56be8 a1=bfacb5f4 a2=8c55d00 a3=b7ef9688 items=0 ppid=3236 pid=6268 auid=1976 uid=0 gid=1976 euid=0 suid=0 fsuid=0 egid=1976 sgid=1976 fsgid=1976 tty=(none) comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1201558517.049:271): avc:  denied  { execute } for  pid=6269 comm="login" name="umount.crypt" dev=dm-0 ino=325126 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=file
>type=SYSCALL msg=audit(1201558517.049:271): arch=40000003 syscall=11 success=no exit=-13 a0=8c4c2a8 a1=bfacb5f4 a2=8c55d00 a3=b7ef9688 items=0 ppid=3236 pid=6269 auid=1976 uid=0 gid=1976 euid=0 suid=0 fsuid=0 egid=1976 sgid=1976 fsgid=1976 tty=(none) comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1201558517.050:272): user pid=3236 uid=0 auid=1976 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=krp exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>
>
>/var/log/messages:
>
>Jan 28 22:15:19 yaffle setroubleshoot: #012    SELinux is preventing /bin/login (local_login_t) "execute" to <Unknown> (bin_t).#012     For complete SELinux messages. run sealert -l 81941d57-964b-4049-b14b-49c5a18f6dea
>Jan 28 22:15:19 yaffle setroubleshoot:last message repeated 2 times
>
>
>/var/log/secure:
>Jan 28 22:15:17 yaffle login: pam_unix(login:session): session closed for user krp
>Jan 28 22:15:17 yaffle login: pam_mount(pam_mount.c:332) error executing /usr/sbin/pmvarrun
>Jan 28 22:15:17 yaffle login: pam_mount(pam_mount.c:558) unmount of /dev/yaffle_vg0/yaffle_lv_common_cryptmount failed
>Jan 28 22:15:17 yaffle login: pam_mount(pam_mount.c:558) unmount of /dev/yaffle_vg0/yaffle_lv_krp_cryptmount failed
>
>

Actions: View

Attachments on bug 430595: 293213 | 293214 | 293215 | 293216 | 293217 | 293218 | 295953