Attachment 297782 Details for Bug 376621 – Audit log

Audit log

audit.log (text/plain), 4.97 KB, created by Martin Nagy on 2008-03-12 15:07:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Nagy

Created: 2008-03-12 15:07:49 UTC

Size: 4.97 KB

patch

obsolete

>type=MAC_STATUS msg=audit(1205333906.572:72): enforcing=0 old_enforcing=1 auid=500
>type=USER_AVC msg=audit(1205333906.572:73): user pid=2019 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1205333906.572:72): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bf984914 a2=1 a3=bf984914 items=0 ppid=4113 pid=4162 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=MAC_STATUS msg=audit(1205333906.576:74): enforcing=1 old_enforcing=0 auid=500
>type=USER_AVC msg=audit(1205333906.596:75): user pid=2019 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received setenforce notice (enforcing=1) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1205333906.576:74): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfca8c44 a2=1 a3=bfca8c44 items=0 ppid=4113 pid=4163 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=MAC_STATUS msg=audit(1205333906.608:76): enforcing=0 old_enforcing=1 auid=500
>type=USER_AVC msg=audit(1205333906.608:77): user pid=2019 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1205333906.608:76): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfa489e4 a2=1 a3=bfa489e4 items=0 ppid=4113 pid=4164 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1205333934.240:78): avc:  denied  { write } for  pid=3761 comm="pam_auth" scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:system_r:squid_t:s0 tclass=netlink_audit_socket
>type=AVC msg=audit(1205333934.240:78): avc:  denied  { nlmsg_relay } for  pid=3761 comm="pam_auth" scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:system_r:squid_t:s0 tclass=netlink_audit_socket
>type=AVC msg=audit(1205333934.240:78): avc:  denied  { audit_write } for  pid=3761 comm="pam_auth" capability=29 scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:system_r:squid_t:s0 tclass=capability
>type=USER_AUTH msg=audit(1205333934.240:79): user pid=3761 uid=23 auid=500 subj=unconfined_u:system_r:squid_t:s0 msg='op=PAM:authentication acct=mnagy exe="/usr/lib/squid/pam_auth" (hostname=?, addr=?, terminal=? res=success)'
>type=SYSCALL msg=audit(1205333934.240:78): arch=40000003 syscall=102 success=yes exit=124 a0=b a1=bfa6f140 a2=287ff4 a3=bfa75b98 items=0 ppid=3759 pid=3761 auid=500 uid=23 gid=23 euid=0 suid=0 fsuid=0 egid=23 sgid=23 fsgid=23 tty=(none) comm="pam_auth" exe="/usr/lib/squid/pam_auth" subj=unconfined_u:system_r:squid_t:s0 key=(null)
>type=AVC msg=audit(1205333934.240:80): avc:  denied  { read } for  pid=3761 comm="pam_auth" scontext=unconfined_u:system_r:squid_t:s0 tcontext=unconfined_u:system_r:squid_t:s0 tclass=netlink_audit_socket
>type=SYSCALL msg=audit(1205333934.240:80): arch=40000003 syscall=102 success=yes exit=36 a0=c a1=bfa6f0f0 a2=287ff4 a3=4 items=0 ppid=3759 pid=3761 auid=500 uid=23 gid=23 euid=0 suid=0 fsuid=0 egid=23 sgid=23 fsgid=23 tty=(none) comm="pam_auth" exe="/usr/lib/squid/pam_auth" subj=unconfined_u:system_r:squid_t:s0 key=(null)
>type=USER_ACCT msg=audit(1205333934.244:81): user pid=3761 uid=23 auid=500 subj=unconfined_u:system_r:squid_t:s0 msg='op=PAM:accounting acct=mnagy exe="/usr/lib/squid/pam_auth" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1205334061.959:82): user pid=4209 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1205334061.959:83): user pid=4209 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1205334061.959:84): login pid=4209 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1205334061.987:85): user pid=4209 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1205334061.999:86): user pid=4209 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1205334061.999:87): user pid=4209 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'

Actions: View

Attachments on bug 376621: 258061 | 297620 | 297622 | 297643 | 297782