Attachment 298458 Details for Bug 429281 – Audit log file

Audit log file

audit.log (text/plain), 7.90 KB, created by JM on 2008-03-18 22:32:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: JM

Created: 2008-03-18 22:32:38 UTC

Size: 7.90 KB

patch

obsolete

>type=DAEMON_ROTATE msg=audit(1205878869.695:2352): auditd sending auid=0 pid=2502 subj=root:system_r:initrc_t:s0
>type=AVC msg=audit(1205878888.074:174): avc:  denied  { getattr } for  pid=1609 comm="gam_server" name="mtab" dev=dm-0 ino=1665630 scontext=root:system_r:fail2ban_t:s0 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.074:174): arch=c000003e syscall=4 success=yes exit=0 a0=413940 a1=7fffadefd2a0 a2=7fffadefd2a0 a3=c items=0 ppid=1 pid=1609 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="gam_server" exe="/usr/libexec/gam_server" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.074:174):  path="/etc/mtab"
>type=AVC msg=audit(1205878888.074:175): avc:  denied  { read write } for  pid=2521 comm="iptables" name="[10920]" dev=sockfs ino=10920 scontext=root:system_r:iptables_t:s0 tcontext=root:system_r:fail2ban_t:s0 tclass=unix_stream_socket
>type=SYSCALL msg=audit(1205878888.074:175): arch=c000003e syscall=59 success=yes exit=0 a0=8ca130 a1=8ca870 a2=8c88a0 a3=32925529f0 items=0 ppid=2520 pid=2521 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="iptables" exe="/sbin/iptables" subj=root:system_r:iptables_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.074:175):  path="socket:[10920]"
>type=AVC msg=audit(1205878888.098:176): avc:  denied  { setgid } for  pid=2525 comm="mail" capability=6 scontext=root:system_r:fail2ban_t:s0 tcontext=root:system_r:fail2ban_t:s0 tclass=capability
>type=SYSCALL msg=audit(1205878888.098:176): arch=c000003e syscall=106 success=yes exit=0 a0=0 a1=7fffbc2b6ac8 a2=7fffbc2b6af0 a3=2 items=0 ppid=2523 pid=2525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mail" exe="/bin/mail" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC msg=audit(1205878888.100:177): avc:  denied  { write } for  pid=2525 comm="mail" name="tmp" dev=dm-0 ino=878689 scontext=root:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205878888.100:177): avc:  denied  { add_name } for  pid=2525 comm="mail" name="RsRp0QrJ" scontext=root:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205878888.100:177): avc:  denied  { create } for  pid=2525 comm="mail" name="RsRp0QrJ" scontext=root:system_r:fail2ban_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.100:177): arch=c000003e syscall=2 success=yes exit=7 a0=8140a0 a1=c2 a2=1b6 a3=8 items=0 ppid=2523 pid=2525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mail" exe="/bin/mail" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC msg=audit(1205878888.101:178): avc:  denied  { getattr } for  pid=2525 comm="mail" name="RsRp0QrJ" dev=dm-0 ino=878692 scontext=root:system_r:fail2ban_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.101:178): arch=c000003e syscall=5 success=yes exit=0 a0=7 a1=7fffbc2b44f0 a2=7fffbc2b44f0 a3=8 items=0 ppid=2523 pid=2525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mail" exe="/bin/mail" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.101:178):  path="/tmp/RsRp0QrJ"
>type=AVC msg=audit(1205878888.101:179): avc:  denied  { remove_name } for  pid=2525 comm="mail" name="RsRp0QrJ" dev=dm-0 ino=878692 scontext=root:system_r:fail2ban_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1205878888.101:179): avc:  denied  { unlink } for  pid=2525 comm="mail" name="RsRp0QrJ" dev=dm-0 ino=878692 scontext=root:system_r:fail2ban_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.101:179): arch=c000003e syscall=87 success=yes exit=0 a0=8140a0 a1=2 a2=1 a3=22 items=0 ppid=2523 pid=2525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mail" exe="/bin/mail" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC msg=audit(1205878888.101:180): avc:  denied  { write } for  pid=2525 comm="mail" name="RsRp0QrJ" dev=dm-0 ino=878692 scontext=root:system_r:fail2ban_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.101:180): arch=c000003e syscall=1 success=yes exit=56 a0=7 a1=2aaaaaaac000 a2=38 a3=2aaaaaaad02b items=0 ppid=2523 pid=2525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mail" exe="/bin/mail" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.101:180):  path=2F746D702F527352703051724A202864656C6574656429
>type=AVC msg=audit(1205878888.102:181): avc:  denied  { read } for  pid=2525 comm="mail" name="RsRp0QrJ" dev=dm-0 ino=878693 scontext=root:system_r:fail2ban_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.102:181): arch=c000003e syscall=2 success=yes exit=9 a0=8140a0 a1=0 a2=1b6 a3=32925529f0 items=0 ppid=2523 pid=2525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mail" exe="/bin/mail" subj=root:system_r:fail2ban_t:s0 key=(null)
>type=AVC msg=audit(1205878888.103:182): avc:  denied  { read } for  pid=2526 comm="sendmail" name="RsRp0QrJ" dev=dm-0 ino=878693 scontext=root:system_r:system_mail_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=AVC msg=audit(1205878888.103:182): avc:  denied  { read write } for  pid=2526 comm="sendmail" name="[10920]" dev=sockfs ino=10920 scontext=root:system_r:system_mail_t:s0 tcontext=root:system_r:fail2ban_t:s0 tclass=unix_stream_socket
>type=SYSCALL msg=audit(1205878888.103:182): arch=c000003e syscall=59 success=yes exit=0 a0=4108cb a1=8143d8 a2=7fffbc2b6af0 a3=8 items=0 ppid=2525 pid=2526 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=root:system_r:system_mail_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.103:182):  path="socket:[10920]"
>type=AVC_PATH msg=audit(1205878888.103:182):  path=2F746D702F527352703051724A202864656C6574656429
>type=AVC msg=audit(1205878888.115:183): avc:  denied  { getattr } for  pid=2526 comm="sendmail" name="RsRp0QrJ" dev=dm-0 ino=878693 scontext=root:system_r:system_mail_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.115:183): arch=c000003e syscall=5 success=yes exit=0 a0=0 a1=7ffff74fdef0 a2=7ffff74fdef0 a3=0 items=0 ppid=2525 pid=2526 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=root:system_r:system_mail_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.115:183):  path=2F746D702F527352703051724A202864656C6574656429
>type=AVC msg=audit(1205878888.142:184): avc:  denied  { ioctl } for  pid=2526 comm="sendmail" name="RsRp0QrJ" dev=dm-0 ino=878693 scontext=root:system_r:system_mail_t:s0 tcontext=root:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1205878888.142:184): arch=c000003e syscall=16 success=no exit=-25 a0=0 a1=5401 a2=7ffff74fdd10 a3=0 items=0 ppid=1 pid=2526 auid=0 uid=51 gid=51 euid=51 suid=51 fsuid=51 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=root:system_r:system_mail_t:s0 key=(null)
>type=AVC_PATH msg=audit(1205878888.142:184):  path=2F746D702F527352703051724A202864656C6574656429
>type=AVC msg=audit(1205878889.557:185): avc:  denied  { connectto } for  pid=2562 comm="fail2ban-server" path=002F746D702F66616D2D726F6F742D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:fail2ban_t:s0 tcontext=root:system_r:fail2ban_t:s0 tclass=unix_stream_socket
>type=SYSCALL msg=audit(1205878889.557:185): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=413febc0 a2=6e a3=2aaab0a21aaa items=0 ppid=1 pid=2562 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="fail2ban-server" exe="/usr/bin/python" subj=root:system_r:fail2ban_t:s0 key=(null)

Actions: View

Attachments on bug 429281: 293664 | 293665 | 293666 | 298458 | 298461