Attachment 297525 Details for Bug 436882 – /var/log/audit/audit.log with "qemu-kvm -smb" troubles

/var/log/audit/audit.log with "qemu-kvm -smb" troubles

audit-smb.txt (text/plain), 29.23 KB, created by Tom London on 2008-03-10 21:55:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tom London

Created: 2008-03-10 21:55:49 UTC

Size: 29.23 KB

patch

obsolete

>type=DAEMON_START msg=audit(1205167407.180:5854): auditd start, ver=1.6.9 format=raw kernel=2.6.25-0.101.rc4.git3.fc9 auid=4294967295 pid=2337 res=success
>type=CONFIG_CHANGE msg=audit(1205167407.709:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1205167429.721:6): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Cups-PDF uri=cups-pdf:/ banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167429.854:7): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=HP5MP uri=hp:/par/HP_LaserJet_5MP?device=/dev/parport0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167430.039:8): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=hp_laserjet_1300 uri=hp:/usb/hp_LaserJet_1300?serial=00CNCB954325 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167430.084:9): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=hp_LaserJet_1300_USB_1 uri=usb://HP/LaserJet%201300 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167430.154:10): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Kyocera_FS-C5030N_on_dc1 uri=socket://10.10.3.49:9100 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167430.266:11): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=SavinColor uri=ipp://10.10.3.47/ipp/ banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167430.566:12): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Innopath uri=file:/dev/null banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1205167430.567:13): user pid=2598 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Local uri=file:/dev/null banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1205167523.964:14): user pid=2971 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1205167523.970:15): user pid=2971 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1205167524.054:16): user pid=2971 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1205167524.251:17): login pid=2971 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1205167524.668:18): user pid=2971 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0 selected-context=unconfined_u:unconfined_r:unconfined_t:s0: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1205167526.610:19): user pid=2971 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1205167526.613:20): user pid=2971 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1205167588.486:21): user pid=3550 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1205167588.490:22): user pid=3550 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1205167588.620:23): user pid=3550 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1205167588.620:24): user pid=3550 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=AVC msg=audit(1205168022.170:25): avc:  denied  { read append } for  pid=4036 comm="qemu-kvm" path="/home/tbl/.xsession-errors" dev=dm-0 ino=131081 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file
>type=AVC msg=audit(1205168022.170:25): avc:  denied  { read append } for  pid=4036 comm="qemu-kvm" path="/home/tbl/.xsession-errors" dev=dm-0 ino=131081 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file
>type=AVC msg=audit(1205168022.170:25): avc:  denied  { read } for  pid=4036 comm="qemu-kvm" path="inotify" dev=inotifyfs ino=1 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
>type=SYSCALL msg=audit(1205168022.170:25): arch=40000003 syscall=11 success=yes exit=0 a0=89d0e30 a1=89d16c8 a2=89cf568 a3=0 items=0 ppid=1 pid=4036 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205168022.301:26): avc:  denied  { write } for  pid=4036 comm="qemu-kvm" name="tmp" dev=dm-0 ino=2686977 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1205168022.301:26): arch=40000003 syscall=39 success=no exit=-13 a0=82cd160 a1=1c0 a2=8179344 a3=bfd43b49 items=0 ppid=1 pid=4036 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=USER_ACCT msg=audit(1205168461.349:27): user pid=4370 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1205168461.355:28): user pid=4370 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1205168461.355:29): login pid=4370 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1205168461.360:30): user pid=4370 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1205168461.436:31): user pid=4370 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1205168461.438:32): user pid=4370 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=MAC_STATUS msg=audit(1205171041.285:33): enforcing=0 old_enforcing=1 auid=500 ses=1
>type=SYSCALL msg=audit(1205171041.285:33): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfb89b04 a2=1 a3=bfb89b04 items=0 ppid=3563 pid=10460 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null)
>type=USER_AVC msg=audit(1205171041.286:34): user pid=2353 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_STATUS msg=audit(1205171060.017:35): enforcing=1 old_enforcing=0 auid=500 ses=1
>type=SYSCALL msg=audit(1205171060.017:35): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfb98314 a2=1 a3=bfb98314 items=0 ppid=3563 pid=10475 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null)
>type=USER_AVC msg=audit(1205171060.027:36): user pid=2353 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=1) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=USER_ACCT msg=audit(1205172061.588:37): user pid=17118 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1205172061.592:38): user pid=17118 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1205172061.592:39): login pid=17118 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1205172061.613:40): user pid=17118 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1205172061.654:41): user pid=17118 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1205172061.654:42): user pid=17118 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1205175662.091:43): user pid=28275 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1205175662.095:44): user pid=28275 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1205175662.096:45): login pid=28275 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1205175662.169:46): user pid=28275 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1205175662.244:47): user pid=28275 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1205175662.245:48): user pid=28275 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1205179262.119:49): user pid=30863 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1205179262.123:50): user pid=30863 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1205179262.124:51): login pid=30863 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1205179262.236:52): user pid=30863 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1205179262.400:53): user pid=30863 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1205179262.401:54): user pid=30863 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1205182861.481:55): user pid=983 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1205182861.486:56): user pid=983 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1205182861.486:57): login pid=983 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1205182861.548:58): user pid=983 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1205182861.661:59): user pid=983 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1205182861.662:60): user pid=983 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1205184320.206:61): avc:  denied  { write } for  pid=2207 comm="qemu-kvm" name="tmp" dev=dm-0 ino=2686977 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1205184320.206:61): arch=40000003 syscall=39 success=no exit=-13 a0=82cd160 a1=1c0 a2=8179344 a3=bf9b16e3 items=0 ppid=2206 pid=2207 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=MAC_STATUS msg=audit(1205184352.150:62): enforcing=0 old_enforcing=1 auid=500 ses=1
>type=SYSCALL msg=audit(1205184352.150:62): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfe7b5d4 a2=1 a3=bfe7b5d4 items=0 ppid=3563 pid=2238 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null)
>type=USER_AVC msg=audit(1205184352.151:63): user pid=2353 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=AVC msg=audit(1205184364.927:64): avc:  denied  { write } for  pid=2249 comm="qemu-kvm" name="tmp" dev=dm-0 ino=2686977 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205184364.927:64): avc:  denied  { add_name } for  pid=2249 comm="qemu-kvm" name="qemu-smb.2249" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205184364.927:64): avc:  denied  { create } for  pid=2249 comm="qemu-kvm" name="qemu-smb.2249" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1205184364.927:64): arch=40000003 syscall=39 success=yes exit=0 a0=82cd160 a1=1c0 a2=8179344 a3=bfbd66e3 items=0 ppid=2248 pid=2249 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184364.927:65): avc:  denied  { write } for  pid=2249 comm="qemu-kvm" name="qemu-smb.2249" dev=dm-0 ino=2687201 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205184364.927:65): avc:  denied  { add_name } for  pid=2249 comm="qemu-kvm" name="smb.conf" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205184364.927:65): avc:  denied  { create } for  pid=2249 comm="qemu-kvm" name="smb.conf" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=AVC msg=audit(1205184364.927:65): avc:  denied  { write } for  pid=2249 comm="qemu-kvm" name="smb.conf" dev=dm-0 ino=2687202 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184364.927:65): arch=40000003 syscall=5 success=yes exit=3 a0=bfbd1990 a1=8241 a2=1b6 a3=240 items=0 ppid=2248 pid=2249 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184364.929:66): avc:  denied  { getattr } for  pid=2249 comm="qemu-kvm" path="/tmp/qemu-smb.2249/smb.conf" dev=dm-0 ino=2687202 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184364.929:66): arch=40000003 syscall=197 success=yes exit=0 a0=3 a1=bfbd07e4 a2=ad8ff4 a3=b1d1d60 items=0 ppid=2248 pid=2249 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184609.754:67): avc:  denied  { execute } for  pid=2480 comm="qemu-kvm" name="smbd" dev=dm-0 ino=5485329 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:smbd_exec_t:s0 tclass=file
>type=AVC msg=audit(1205184609.754:67): avc:  denied  { read } for  pid=2480 comm="qemu-kvm" name="smbd" dev=dm-0 ino=5485329 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:smbd_exec_t:s0 tclass=file
>type=AVC msg=audit(1205184609.754:67): avc:  denied  { execute_no_trans } for  pid=2480 comm="qemu-kvm" path="/usr/sbin/smbd" dev=dm-0 ino=5485329 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:smbd_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184609.754:67): arch=40000003 syscall=11 success=yes exit=0 a0=b237e48 a1=bfbce820 a2=bfbd490c a3=0 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184614.956:68): avc:  denied  { read } for  pid=2480 comm="smbd" name="urandom" dev=tmpfs ino=3373 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1205184614.956:68): arch=40000003 syscall=5 success=yes exit=3 a0=b7f86ba8 a1=8000 a2=0 a3=8000 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184615.252:69): avc:  denied  { read } for  pid=2480 comm="smbd" name="smb.conf" dev=dm-0 ino=2687202 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184615.252:69): arch=40000003 syscall=5 success=yes exit=4 a0=b90b9690 a1=8000 a2=0 a3=8000 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184615.599:70): avc:  denied  { getattr } for  pid=2480 comm="smbd" path="/var/run/cups/cups.sock" dev=dm-0 ino=66315 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:cupsd_var_run_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1205184615.599:70): arch=40000003 syscall=195 success=yes exit=0 a0=2a9e39 a1=bf84a6d0 a2=51bff4 a3=b910c300 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184615.990:71): avc:  denied  { read } for  pid=2480 comm="smbd" name="random" dev=tmpfs ino=3352 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1205184615.990:71): arch=40000003 syscall=33 success=yes exit=0 a0=7efcf9 a1=4 a2=80c8b8 a3=1 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184616.167:72): avc:  denied  { write } for  pid=2480 comm="smbd" name="cups.sock" dev=dm-0 ino=66315 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:cupsd_var_run_t:s0 tclass=sock_file
>type=AVC msg=audit(1205184616.167:72): avc:  denied  { connectto } for  pid=2480 comm="smbd" path="/var/run/cups/cups.sock" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tclass=unix_stream_socket
>type=SYSCALL msg=audit(1205184616.167:72): arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bf84a990 a2=2b2748 a3=b912afbc items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184617.817:73): avc:  denied  { append } for  pid=2480 comm="smbd" name="log.smbd" dev=dm-0 ino=2687203 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184617.817:73): arch=40000003 syscall=5 success=yes exit=5 a0=b90b85c8 a1=8441 a2=1a4 a3=8441 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184617.876:74): avc:  denied  { create } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:unconfined_r:qemu_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1205184617.876:74): arch=40000003 syscall=102 success=yes exit=5 a0=1 a1=bf83dce4 a2=51bff4 a3=bf83ddf8 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184617.876:75): avc:  denied  { bind } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:unconfined_r:qemu_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1205184617.876:75): arch=40000003 syscall=102 success=yes exit=0 a0=2 a1=bf83dce4 a2=51bff4 a3=bf83ddf8 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184617.877:76): avc:  denied  { getattr } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:unconfined_r:qemu_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1205184617.877:76): arch=40000003 syscall=102 success=yes exit=0 a0=6 a1=bf83dce4 a2=51bff4 a3=bf83ddf8 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184617.878:77): avc:  denied  { write } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:unconfined_r:qemu_t:s0 tclass=netlink_route_socket
>type=AVC msg=audit(1205184617.878:77): avc:  denied  { nlmsg_read } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:unconfined_r:qemu_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1205184617.878:77): arch=40000003 syscall=102 success=yes exit=20 a0=b a1=bf83cc60 a2=51bff4 a3=bf83dcdc items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184617.878:78): avc:  denied  { read } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:unconfined_r:qemu_t:s0 tclass=netlink_route_socket
>type=SYSCALL msg=audit(1205184617.878:78): arch=40000003 syscall=102 success=yes exit=1688 a0=11 a1=bf83cc60 a2=51bff4 a3=0 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184618.101:79): avc:  denied  { lock } for  pid=2480 comm="smbd" path="/tmp/qemu-smb.2249/secrets.tdb" dev=dm-0 ino=2687204 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184618.101:79): arch=40000003 syscall=221 success=yes exit=0 a0=5 a1=e a2=bf84abc4 a3=bf84abc4 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184619.678:80): avc:  denied  { setattr } for  pid=2480 comm="smbd" name="smbpasswd" dev=dm-0 ino=11141191 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184619.678:80): arch=40000003 syscall=94 success=yes exit=0 a0=e a1=180 a2=b8055860 a3=b912fd18 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184628.739:81): avc:  denied  { search } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir
>type=AVC msg=audit(1205184628.739:81): avc:  denied  { read } for  pid=2480 comm="smbd" scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184628.739:81): arch=40000003 syscall=5 success=yes exit=18 a0=4ecb92 a1=0 a2=1 a3=63 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184869.159:82): avc:  denied  { append } for  pid=2480 comm="smbd" name="log.smbd" dev=dm-0 ino=2687203 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184869.159:82): arch=40000003 syscall=5 success=yes exit=21 a0=b90b85c8 a1=8441 a2=1a4 a3=8441 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1205184869.159:83): avc:  denied  { getattr } for  pid=2480 comm="smbd" path="/tmp/qemu-smb.2249/smb.conf" dev=dm-0 ino=2687202 scontext=unconfined_u:unconfined_r:qemu_t:s0 tcontext=unconfined_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205184869.159:83): arch=40000003 syscall=195 success=yes exit=0 a0=b912e348 a1=bf84aaf4 a2=51bff4 a3=bf84aaf4 items=0 ppid=2249 pid=2480 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 ses=1 comm="smbd" exe="/usr/sbin/smbd" subj=unconfined_u:unconfined_r:qemu_t:s0 key=(null)
>type=CRED_DISP msg=audit(1205184932.022:84): user pid=3550 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1205184932.448:85): user pid=3550 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=ANOM_ABEND msg=audit(1205184940.608:86): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:mono_t:s0 pid=3443 comm="tomboy" sig=11
>type=DAEMON_END msg=audit(1205184950.886:5855): auditd normal halt, sending auid=0 pid=3190 subj=system_u:system_r:initrc_t:s0 res=success

Actions: View

Attachments on bug 436882: 297525