Attachment 300257 Details for Bug 440426 – /var/log/audit/audit.log

/var/log/audit/audit.log

audit.log (text/plain), 243.90 KB, created by Matěj Cepl on 2008-04-03 14:31:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matěj Cepl

Created: 2008-04-03 14:31:44 UTC

Size: 243.90 KB

patch

obsolete

>type=DAEMON_START msg=audit(1207041457.603:5025): auditd start, ver=1.7 format=raw kernel=2.6.25-0.172.rc7.git4.fc9.i686 auid=4294967295 pid=2263 res=success
>type=CONFIG_CHANGE msg=audit(1207041457.714:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1207041487.022:5): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2766 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207041504.373:6): user pid=2633 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="ot" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_LOGIN msg=audit(1207041504.457:7): user pid=2633 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='acct=ot: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_AUTH msg=audit(1207041514.347:8): user pid=2633 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=0C exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_LOGIN msg=audit(1207041514.347:9): user pid=2633 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='acct=: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_AUTH msg=audit(1207041520.743:10): user pid=2633 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=0D exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_LOGIN msg=audit(1207041520.744:11): user pid=2633 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='acct=
: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_AUTH msg=audit(1207041534.314:12): user pid=2631 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_ACCT msg=audit(1207041534.318:13): user pid=2631 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=LOGIN msg=audit(1207041534.319:14): login pid=2631 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1207041534.365:15): user pid=2631 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_START msg=audit(1207041534.426:16): user pid=2631 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_ACQ msg=audit(1207041534.434:17): user pid=2631 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_LOGIN msg=audit(1207041534.435:18): user pid=2631 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_AVC msg=audit(1207041574.343:19): user pid=2277 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1207041572.996:20): policy loaded auid=0 ses=1
>type=SYSCALL msg=audit(1207041572.996:20): arch=40000003 syscall=4 success=yes exit=3771380 a0=4 a1=b7884008 a2=398bf4 a3=bf8d4c18 items=0 ppid=2948 pid=2957 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_ABEND msg=audit(1207041587.056:21): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=3103 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207041592.472:22): user pid=3085 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207041592.478:23): user pid=3085 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207041592.485:24): user pid=3085 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207041592.519:25): login pid=3085 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1207041592.594:26): user pid=3085 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207041596.087:27): user pid=3085 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207041596.201:28): user pid=3085 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207043586.262:29): user pid=5465 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207043586.268:30): user pid=5465 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207043586.343:31): user pid=5465 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207043586.445:32): user pid=5465 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207043586.445:33): user pid=5465 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207043586.446:34): user pid=5465 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=AVC msg=audit(1207043720.364:35): avc:  denied  { read } for  pid=5645 comm="npviewer.bin" name="mozpluggerrc" dev=dm-0 ino=2091304 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_conf_t:s0 tclass=file
>type=SYSCALL msg=audit(1207043720.364:35): arch=40000003 syscall=5 success=no exit=-13 a0=9d2300 a1=0 a2=0 a3=bff95d47 items=0 ppid=5642 pid=5645 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207043856.500:36): avc:  denied  { read } for  pid=5755 comm="npviewer.bin" name=".fonts.conf" dev=dm-6 ino=6636229 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_fonts_config_t:s0 tclass=file
>type=SYSCALL msg=audit(1207043856.500:36): arch=40000003 syscall=33 success=no exit=-13 a0=8cd1660 a1=4 a2=1cf694 a3=8cd1660 items=0 ppid=5752 pid=5755 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207044022.447:37): avc:  denied  { read } for  pid=5967 comm="npviewer.bin" name=".fonts.conf" dev=dm-6 ino=6636229 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_fonts_config_t:s0 tclass=file
>type=SYSCALL msg=audit(1207044022.447:37): arch=40000003 syscall=33 success=no exit=-13 a0=9b71548 a1=4 a2=1cf694 a3=9b71548 items=0 ppid=5628 pid=5967 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207044061.728:38): user pid=6056 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207044061.730:39): user pid=6056 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207044061.731:40): login pid=6056 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1207044061.810:41): user pid=6056 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207044061.896:42): user pid=6056 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207044061.896:43): user pid=6056 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207044204.689:44): user pid=6155 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207044204.694:45): user pid=6155 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207044204.819:46): user pid=6155 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207044204.822:47): user pid=6155 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207044204.823:48): user pid=6155 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207044204.824:49): user pid=6155 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=AVC msg=audit(1207046484.023:50): avc:  denied  { read } for  pid=8753 comm="tmpwatch" name=".esd-500" dev=dm-0 ino=6044453 scontext=system_u:system_r:tmpreaper_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207046484.023:50): arch=40000003 syscall=5 success=no exit=-13 a0=804ac62 a1=98800 a2=0 a3=0 items=0 ppid=8751 pid=8753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0 key=(null)
>type=AVC msg=audit(1207046486.043:51): avc:  denied  { read } for  pid=8758 comm="tmpwatch" name="eclipse-mylyn-2.0.0-9.fc9-root-matej" dev=dm-0 ino=1275608 scontext=system_u:system_r:tmpreaper_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207046486.043:51): arch=40000003 syscall=5 success=no exit=-13 a0=804ac62 a1=98800 a2=0 a3=0 items=0 ppid=8751 pid=8758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="tmpwatch" exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0 key=(null)
>type=USER_ACCT msg=audit(1207047661.891:52): user pid=21989 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207047661.896:53): user pid=21989 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207047661.896:54): login pid=21989 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1207047661.967:55): user pid=21989 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207047662.030:56): user pid=21989 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207047662.031:57): user pid=21989 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207047973.754:58): user pid=24879 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=USER_ACCT msg=audit(1207047973.759:59): user pid=24879 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=CRED_ACQ msg=audit(1207047973.819:60): user pid=24879 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_START msg=audit(1207047973.838:61): user pid=24879 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_END msg=audit(1207047973.839:62): user pid=24879 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_CMD msg=audit(1207047973.839:63): user pid=24879 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1207048227.704:64): user pid=27733 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_START msg=audit(1207048227.718:65): user pid=27733 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_END msg=audit(1207048227.719:66): user pid=27733 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_CMD msg=audit(1207048227.720:67): user pid=27733 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/1 res=success)'
>type=AVC msg=audit(1207048877.446:68): avc:  denied  { read } for  pid=30687 comm="npviewer.bin" name="mozpluggerrc" dev=dm-0 ino=2091304 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_conf_t:s0 tclass=file
>type=SYSCALL msg=audit(1207048877.446:68): arch=40000003 syscall=5 success=no exit=-13 a0=af1300 a1=0 a2=0 a3=bfcd4d47 items=0 ppid=30664 pid=30687 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1207049160.180:69): user pid=30936 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207049160.184:70): user pid=30936 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207049160.187:71): user pid=30936 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207049160.190:72): user pid=30936 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207049160.191:73): user pid=30936 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207049160.191:74): user pid=30936 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_AVC msg=audit(1207049295.997:75): user pid=2277 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=3) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1207049294.619:76): policy loaded auid=500 ses=2
>type=SYSCALL msg=audit(1207049294.619:76): arch=40000003 syscall=4 success=yes exit=3771392 a0=4 a1=b786d008 a2=398c00 a3=bfabdb48 items=0 ppid=31080 pid=31089 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207049594.301:77): avc:  denied  { read } for  pid=31340 comm="npviewer.bin" name="mozpluggerrc" dev=dm-0 ino=2091304 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_conf_t:s0 tclass=file
>type=SYSCALL msg=audit(1207049594.301:77): arch=40000003 syscall=5 success=no exit=-13 a0=af1300 a1=0 a2=0 a3=bfa91d47 items=0 ppid=31331 pid=31340 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USYS_CONFIG msg=audit(1207049847.501:78): user pid=31895 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_START msg=audit(1207051073.336:6866): auditd start, ver=1.7 format=raw kernel=2.6.25-0.172.rc7.git4.fc9.i686 auid=4294967295 pid=2237 res=success
>type=CONFIG_CHANGE msg=audit(1207051073.463:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1207051100.261:5): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2740 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207051104.957:6): user pid=2731 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207051104.963:7): user pid=2731 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207051104.995:8): user pid=2731 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207051105.038:9): login pid=2731 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1207051105.091:10): user pid=2731 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207051108.665:11): user pid=2731 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207051108.744:12): user pid=2731 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1207051153.532:13): avc:  denied  { read } for  pid=3342 comm="npviewer.bin" name="mozpluggerrc" dev=dm-0 ino=2091304 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_conf_t:s0 tclass=file
>type=SYSCALL msg=audit(1207051153.532:13): arch=40000003 syscall=5 success=no exit=-13 a0=af1300 a1=0 a2=0 a3=bff0ed4f items=0 ppid=3126 pid=3342 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207051261.447:14): user pid=3518 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207051261.450:15): user pid=3518 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207051261.451:16): login pid=3518 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1207051261.454:17): user pid=3518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207051261.487:18): user pid=3518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207051261.487:19): user pid=3518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207051586.310:20): user pid=2731 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207051586.693:21): user pid=2731 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=AVC msg=audit(1207051616.036:22): avc:  denied  { write } for  pid=4005 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207051616.036:22): arch=40000003 syscall=33 success=no exit=-13 a0=8710c68 a1=2 a2=630a04 a3=8710b38 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.036:23): avc:  denied  { getattr } for  pid=4005 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207051616.036:23): arch=40000003 syscall=195 success=no exit=-13 a0=8711350 a1=bfba469c a2=390ff4 a3=64 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.051:24): avc:  denied  { write } for  pid=4005 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207051616.051:24): arch=40000003 syscall=33 success=no exit=-13 a0=8710cf8 a1=2 a2=630a04 a3=8710bc8 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.052:25): avc:  denied  { getattr } for  pid=4005 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207051616.052:25): arch=40000003 syscall=195 success=no exit=-13 a0=87113e0 a1=bfba469c a2=390ff4 a3=64 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.053:26): avc:  denied  { write } for  pid=4005 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207051616.053:26): arch=40000003 syscall=33 success=no exit=-13 a0=8710cf8 a1=2 a2=630a04 a3=8710bc8 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.053:27): avc:  denied  { getattr } for  pid=4005 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207051616.053:27): arch=40000003 syscall=195 success=no exit=-13 a0=87113e0 a1=bfba469c a2=390ff4 a3=64 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.498:28): avc:  denied  { write } for  pid=4005 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207051616.498:28): arch=40000003 syscall=33 success=no exit=-13 a0=8750350 a1=2 a2=630a04 a3=8750220 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.499:29): avc:  denied  { getattr } for  pid=4005 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207051616.499:29): arch=40000003 syscall=195 success=no exit=-13 a0=88776f0 a1=bfba45ec a2=390ff4 a3=64 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.499:30): avc:  denied  { write } for  pid=4005 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207051616.499:30): arch=40000003 syscall=33 success=no exit=-13 a0=8750360 a1=2 a2=630a04 a3=8750220 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207051616.499:31): avc:  denied  { getattr } for  pid=4005 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207051616.499:31): arch=40000003 syscall=195 success=no exit=-13 a0=8877710 a1=bfba45ec a2=390ff4 a3=64 items=0 ppid=4004 pid=4005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1207051622.609:32): user pid=2604 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207051622.614:33): user pid=2604 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207051622.615:34): login pid=2604 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1207051622.768:35): user pid=2604 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207051622.893:36): user pid=2604 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207051622.894:37): user pid=2604 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207051622.919:38): user pid=2604 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207051758.619:39): user pid=2604 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207051758.633:40): user pid=2604 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=DAEMON_END msg=audit(1207051759.009:6867): auditd normal halt, sending auid=0 pid=4271 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1207051837.617:8176): auditd start, ver=1.7 format=raw kernel=2.6.25-0.172.rc7.git4.fc9.i686 auid=4294967295 pid=2211 res=success
>type=CONFIG_CHANGE msg=audit(1207051837.746:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1207051870.612:5): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2714 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207051879.509:6): user pid=2705 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207051879.515:7): user pid=2705 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207051879.547:8): user pid=2705 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207051879.596:9): login pid=2705 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1207051879.642:10): user pid=2705 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207051883.694:11): user pid=2705 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207051883.751:12): user pid=2705 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207051921.480:13): user pid=2581 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207051921.485:14): user pid=2581 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207051921.487:15): login pid=2581 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1207051921.508:16): user pid=2581 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=AVC msg=audit(1207051921.510:17): avc:  denied  { link } for  pid=2581 comm="login" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=key
>type=SYSCALL msg=audit(1207051921.510:17): arch=40000003 syscall=288 success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=1f4 items=0 ppid=1 pid=2581 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=2 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1207051921.526:18): user pid=2581 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207051921.526:19): user pid=2581 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207051921.528:20): user pid=2581 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207052108.999:21): user pid=2581 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207052109.003:22): user pid=2581 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USYS_CONFIG msg=audit(1207052129.501:23): user pid=3866 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207052540.852:24): user pid=4135 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207052547.251:25): user pid=4294 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207053387.064:26): user pid=5379 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207053387.070:27): user pid=5379 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207053387.151:28): user pid=5379 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207053387.155:29): user pid=5379 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207053387.156:30): user pid=5379 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207053387.158:31): user pid=5379 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_CHAUTHTOK msg=audit(1207053719.948:32): user pid=5784 uid=0 auid=500 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="ntp" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=pts/0 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1207053720.051:33): user pid=5785 uid=0 auid=500 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="ntp" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/0 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1207053778.622:34): user pid=5870 uid=0 auid=500 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="tcpdump" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=pts/0 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1207053778.634:35): user pid=5871 uid=0 auid=500 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="tcpdump" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/0 res=failed)'
>type=USER_AUTH msg=audit(1207054389.560:36): user pid=8376 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207054389.567:37): user pid=8376 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207054389.680:38): user pid=8376 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207054389.767:39): user pid=8376 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207054389.768:40): user pid=8376 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207054389.769:41): user pid=8376 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207054861.518:42): user pid=8896 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207054861.522:43): user pid=8896 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207054861.523:44): login pid=8896 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1207054861.576:45): user pid=8896 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207054861.654:46): user pid=8896 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207054861.655:47): user pid=8896 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1207055315.262:48): avc:  denied  { read } for  pid=9445 comm="npviewer.bin" name="mozpluggerrc" dev=dm-0 ino=2091304 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_conf_t:s0 tclass=file
>type=SYSCALL msg=audit(1207055315.262:48): arch=40000003 syscall=5 success=no exit=-13 a0=af1300 a1=0 a2=0 a3=bfdcad47 items=0 ppid=9433 pid=9445 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207055835.372:49): avc:  denied  { read } for  pid=9920 comm="npviewer.bin" name="mozpluggerrc" dev=dm-0 ino=2091304 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mozilla_conf_t:s0 tclass=file
>type=SYSCALL msg=audit(1207055835.372:49): arch=40000003 syscall=5 success=no exit=-13 a0=af1300 a1=0 a2=0 a3=bf9bdd47 items=0 ppid=9908 pid=9920 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1207056412.315:50): user pid=11811 uid=0 auid=500 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="mysql" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AVC msg=audit(1207058150.770:51): user pid=2225 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1207058148.456:52): policy loaded auid=500 ses=1
>type=SYSCALL msg=audit(1207058148.456:52): arch=40000003 syscall=4 success=yes exit=3771392 a0=4 a1=b779f008 a2=398c00 a3=bfff0b58 items=0 ppid=8376 pid=14205 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207058462.234:53): user pid=14506 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207058462.239:54): user pid=14506 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207058462.239:55): login pid=14506 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1207058462.290:56): user pid=14506 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207058462.339:57): user pid=14506 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207058462.339:58): user pid=14506 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207059727.028:59): user pid=15617 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207059727.035:60): user pid=15617 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207059727.096:61): user pid=15617 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207059727.100:62): user pid=15617 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207059727.101:63): user pid=15617 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207059727.101:64): user pid=15617 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207062061.968:65): user pid=19524 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207062061.971:66): user pid=19524 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207062061.972:67): login pid=19524 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1207062062.127:68): user pid=19524 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207062062.368:69): user pid=19524 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207062062.369:70): user pid=19524 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207062211.887:71): user pid=21360 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/2 res=success)'
>type=USER_ACCT msg=audit(1207062211.894:72): user pid=21360 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/2 res=success)'
>type=CRED_ACQ msg=audit(1207062212.015:73): user pid=21360 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_START msg=audit(1207062212.027:74): user pid=21360 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_END msg=audit(1207062212.028:75): user pid=21360 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_CMD msg=audit(1207062212.052:76): user pid=21360 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/2 res=success)'
>type=USER_AUTH msg=audit(1207063413.383:77): user pid=25690 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/2 res=success)'
>type=USER_ACCT msg=audit(1207063413.389:78): user pid=25690 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/2 res=success)'
>type=CRED_ACQ msg=audit(1207063413.453:79): user pid=25690 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_START msg=audit(1207063413.532:80): user pid=25690 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_END msg=audit(1207063413.533:81): user pid=25690 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_CMD msg=audit(1207063413.534:82): user pid=25690 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/redhat/RPMS/noarch" cmd=2F62696E2F72706D202D5576682073656C696E75782D706F6C6963792D646576656C2D332E332E312D32372E302E6D632E312E6663392E6E6F617263682E72706D2073656C696E75782D706F6C6963792D74617267657465642D332E332E312D32372E302E6D632E312E6663392E6E6F617263682E72706D2073656C696E75782D706F6C6963792D332E332E312D32372E302E6D632E312E6663392E6E6F617263682E72706D (terminal=pts/2 res=success)'
>type=MAC_POLICY_LOAD msg=audit(1207063493.463:83): policy loaded auid=500 ses=1
>type=SYSCALL msg=audit(1207063493.463:83): arch=40000003 syscall=4 success=yes exit=3771692 a0=4 a1=b78db008 a2=398d2c a3=bfc2d808 items=0 ppid=25753 pid=25766 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1207063495.808:84): user pid=2225 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=3) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=USER_ACCT msg=audit(1207065662.348:85): user pid=27841 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207065662.351:86): user pid=27841 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207065662.352:87): login pid=27841 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1207065662.499:88): user pid=27841 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207065662.581:89): user pid=27841 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207065662.582:90): user pid=27841 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=ANOM_ABEND msg=audit(1207067685.576:91): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=29399 comm="evince-thumbnai" sig=11
>type=AVC msg=audit(1207069092.780:92): avc:  denied  { getattr } for  pid=1962 comm="sh" path="/usr/bin/mplayer" dev=dm-0 ino=5004482 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mplayer_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1207069092.780:92): arch=40000003 syscall=195 success=no exit=-13 a0=a046940 a1=bfc047f0 a2=390ff4 a3=a046940 items=0 ppid=1961 pid=1962 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207069092.826:93): avc:  denied  { getattr } for  pid=1957 comm="npviewer.bin" path="/usr/bin/mplayer" dev=dm-0 ino=5004482 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mplayer_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1207069092.826:93): arch=40000003 syscall=195 success=no exit=-13 a0=18a900 a1=bf9de5e4 a2=c56ff4 a3=8705991 items=0 ppid=1938 pid=1957 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207069092.929:94): avc:  denied  { getattr } for  pid=1957 comm="npviewer.bin" path="/usr/bin/mplayer" dev=dm-0 ino=5004482 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mplayer_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1207069092.929:94): arch=40000003 syscall=195 success=no exit=-13 a0=18a900 a1=bf9de5e4 a2=c56ff4 a3=8705991 items=0 ppid=1938 pid=1957 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207069262.852:95): user pid=8827 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207069262.866:96): user pid=8827 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207069262.867:97): login pid=8827 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1207069262.990:98): user pid=8827 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207069263.117:99): user pid=8827 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207069263.117:100): user pid=8827 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207069602.588:101): user pid=9407 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207069602.595:102): user pid=9407 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207069602.665:103): user pid=9407 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207069602.685:104): user pid=9407 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207069602.685:105): user pid=9407 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207069602.686:106): user pid=9407 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C616C6C207061636B6167656B697464 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207069770.898:107): user pid=9603 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207069770.902:108): user pid=9603 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207069770.903:109): user pid=9603 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207069770.912:110): user pid=9603 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207069976.668:111): user pid=9953 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_ACQ msg=audit(1207070015.441:112): user pid=10026 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207070015.444:113): user pid=10026 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207070015.444:114): user pid=10026 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207070015.445:115): user pid=10026 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C616C6C207061636B6167656B697464 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207070017.628:116): user pid=10027 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207070017.629:117): user pid=10027 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207070017.630:118): user pid=10027 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207070017.630:119): user pid=10027 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C616C6C207061636B6167656B697464 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207070018.344:120): user pid=10028 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207070018.346:121): user pid=10028 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207070018.347:122): user pid=10028 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207070018.348:123): user pid=10028 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C616C6C207061636B6167656B697464 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207070039.300:124): user pid=10043 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207070039.301:125): user pid=10043 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207070039.301:126): user pid=10043 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207070039.302:127): user pid=10043 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C2039383036 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207070049.921:128): user pid=10053 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207070049.922:129): user pid=10053 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207070049.922:130): user pid=10053 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207070049.923:131): user pid=10053 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C202D392039383036 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207070069.684:132): user pid=10074 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207070069.686:133): user pid=10074 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207070069.687:134): user pid=10074 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207070069.688:135): user pid=10074 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F79756D206C697374202A70796465762A (terminal=pts/0 res=success)'
>type=USYS_CONFIG msg=audit(1207070427.501:136): user pid=11035 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207071025.840:137): user pid=11223 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207071030.701:138): user pid=11414 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207072145.500:139): user pid=12456 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207073580.000:140): user pid=12733 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207073649.705:141): user pid=12922 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1207076461.344:142): user pid=15153 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207076461.348:143): user pid=15153 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207076461.348:144): login pid=15153 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1207076461.351:145): user pid=15153 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207076461.433:146): user pid=15153 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207076461.433:147): user pid=15153 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207078058.054:148): user pid=16491 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207078058.060:149): user pid=16491 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207078058.063:150): user pid=16491 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207078058.066:151): user pid=16491 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207078058.067:152): user pid=16491 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207078058.067:153): user pid=16491 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F79756D20636865636B2D75706461746573 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207078061.069:154): user pid=16504 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207078061.071:155): user pid=16504 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207078061.072:156): user pid=16504 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207078061.073:157): user pid=16504 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F79756D20636865636B2D757064617465 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207078125.697:158): user pid=16575 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207078125.699:159): user pid=16575 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207078125.700:160): user pid=16575 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207078125.701:161): user pid=16575 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207079290.422:162): user pid=17681 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207079290.428:163): user pid=17681 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207079290.515:164): user pid=17681 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207079290.588:165): user pid=17681 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207079290.589:166): user pid=17681 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207079290.590:167): user pid=17681 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/tmp" cmd=2F7573722F62696E2F79756D20696E7374616C6C202F7573722F62696E2F706F6C67656E677569 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207079309.809:168): user pid=17735 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207079309.811:169): user pid=17735 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207079309.811:170): user pid=17735 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207079309.812:171): user pid=17735 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/tmp" cmd=2F7573722F62696E2F79756D2073656172636820706F6C67656E677569 (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207079462.431:172): user pid=17896 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=failed)'
>type=USER_AUTH msg=audit(1207079473.458:173): user pid=17896 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207079473.458:174): user pid=17896 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1207079473.722:175): user pid=17896 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1207079524.954:176): user pid=17896 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207080036.602:177): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=failed)'
>type=USER_AUTH msg=audit(1207080042.974:178): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207080042.980:179): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207080043.007:180): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207080043.027:181): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207080043.028:182): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207080043.028:183): user pid=18431 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/tmp" cmd=2F7362696E2F73657276696365206D7973716C642072657374617274 (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207080061.844:184): user pid=18578 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207080061.848:185): user pid=18578 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207080061.849:186): login pid=18578 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1207080061.852:187): user pid=18578 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207080061.937:188): user pid=18578 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207080061.937:189): user pid=18578 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1207083661.344:190): user pid=21990 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207083661.348:191): user pid=21990 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207083661.349:192): login pid=21990 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=USER_START msg=audit(1207083661.425:193): user pid=21990 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207083661.623:194): user pid=21990 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207083661.624:195): user pid=21990 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=ANOM_ABEND msg=audit(1207084392.645:196): auid=4294967295 uid=81 gid=81 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 pid=2225 comm="dbus-daemon" sig=11
>type=ANOM_ABEND msg=audit(1207084393.541:197): auid=4294967295 uid=68 gid=68 ses=4294967295 subj=system_u:system_r:hald_t:s0 pid=2417 comm="hald" sig=6
>type=ANOM_ABEND msg=audit(1207084401.995:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:consolekit_t:s0-s0:c0.c1023 pid=12806 comm="console-kit-dae" sig=11
>type=USER_AUTH msg=audit(1207084425.897:199): user pid=3582 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207084425.903:200): user pid=3582 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207084425.904:201): login pid=3582 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_ROLE_CHANGE msg=audit(1207084426.082:202): user pid=3582 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207084426.148:203): user pid=3582 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207084426.198:204): user pid=3582 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207084426.200:205): user pid=3582 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207084552.923:206): user pid=3582 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207084552.926:207): user pid=3582 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_AUTH msg=audit(1207084560.985:208): user pid=22608 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207084560.991:209): user pid=22608 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207084560.992:210): login pid=22608 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
>type=USER_ROLE_CHANGE msg=audit(1207084561.015:211): user pid=22608 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207084561.019:212): user pid=22608 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207084561.020:213): user pid=22608 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207084561.021:214): user pid=22608 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=AVC msg=audit(1207084593.359:215): avc:  denied  { write } for  pid=22655 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207084593.359:215): arch=40000003 syscall=33 success=no exit=-13 a0=9211c68 a1=2 a2=630a04 a3=9211b38 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084593.359:216): avc:  denied  { getattr } for  pid=22655 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207084593.359:216): arch=40000003 syscall=195 success=no exit=-13 a0=9212350 a1=bff41c7c a2=390ff4 a3=64 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084593.360:217): avc:  denied  { write } for  pid=22655 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207084593.360:217): arch=40000003 syscall=33 success=no exit=-13 a0=9211cf8 a1=2 a2=630a04 a3=9211bc8 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084593.361:218): avc:  denied  { getattr } for  pid=22655 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207084593.361:218): arch=40000003 syscall=195 success=no exit=-13 a0=92123e0 a1=bff41c7c a2=390ff4 a3=64 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084593.361:219): avc:  denied  { write } for  pid=22655 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207084593.361:219): arch=40000003 syscall=33 success=no exit=-13 a0=9211cf8 a1=2 a2=630a04 a3=9211bc8 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084593.361:220): avc:  denied  { getattr } for  pid=22655 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207084593.361:220): arch=40000003 syscall=195 success=no exit=-13 a0=92123e0 a1=bff41c7c a2=390ff4 a3=64 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084594.060:221): avc:  denied  { write } for  pid=22655 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207084594.060:221): arch=40000003 syscall=33 success=no exit=-13 a0=92d6ff8 a1=2 a2=630a04 a3=923df28 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084594.061:222): avc:  denied  { getattr } for  pid=22655 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207084594.061:222): arch=40000003 syscall=195 success=no exit=-13 a0=922aa70 a1=bff41bcc a2=390ff4 a3=64 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084594.062:223): avc:  denied  { write } for  pid=22655 comm="gdb" name="rpm" dev=dm-0 ino=1274211 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207084594.062:223): arch=40000003 syscall=33 success=no exit=-13 a0=9296918 a1=2 a2=630a04 a3=92967c8 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207084594.063:224): avc:  denied  { getattr } for  pid=22655 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0 ino=1274218 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1207084594.063:224): arch=40000003 syscall=195 success=no exit=-13 a0=923dfe0 a1=bff41bcc a2=390ff4 a3=64 items=0 ppid=22653 pid=22655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1207084607.789:225): user pid=22608 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207084607.795:226): user pid=22608 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=DAEMON_END msg=audit(1207084614.662:8177): auditd normal halt, sending auid=0 pid=22869 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1207084694.414:9067): auditd start, ver=1.7 format=raw kernel=2.6.25-0.177.rc7.git6.fc9.i686 auid=4294967295 pid=2236 res=success
>type=CONFIG_CHANGE msg=audit(1207084694.543:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1207084731.389:5): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2762 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207084736.737:6): user pid=2749 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207084736.745:7): user pid=2749 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207084736.783:8): user pid=2749 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207084736.851:9): login pid=2749 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1207084736.914:10): user pid=2749 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207084740.786:11): user pid=2749 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207084740.909:12): user pid=2749 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207086371.450:13): user pid=4389 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207086371.454:14): user pid=4389 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207086371.696:15): user pid=4389 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207086371.895:16): user pid=4389 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207086371.896:17): user pid=4389 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207086371.897:18): user pid=4389 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/redhat" cmd=2F62696E2F72706D202D5576682052504D532F693338362F656D70617468792D6465627567696E666F2D302E32332D302E67697432303038303430312E6D632E312E6663392E693338362E72706D2052504D532F693338362F656D70617468792D646576656C2D302E32332D302E67697432303038303430312E6D632E312E6663392E693338362E72706D2052504D532F693338362F656D70617468792D6C6962732D302E32332D302E67697432303038303430312E6D632E312E6663392E693338362E72706D2052504D532F693338362F656D70617468792D707974686F6E2D302E32332D302E67697432303038303430312E6D632E312E6663392E693338362E72706D2052504D532F693338362F656D70617468792D302E32332D302E67697432303038303430312E6D632E312E6663392E693338362E72706D (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207087262.071:19): user pid=5389 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207087262.075:20): user pid=5389 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207087262.076:21): login pid=5389 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1207087262.275:22): user pid=5389 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207087262.421:23): user pid=5389 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207087262.423:24): user pid=5389 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207087948.388:25): user pid=6055 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/2 res=success)'
>type=USER_ACCT msg=audit(1207087948.394:26): user pid=6055 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/2 res=success)'
>type=CRED_ACQ msg=audit(1207087948.470:27): user pid=6055 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_START msg=audit(1207087948.547:28): user pid=6055 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_END msg=audit(1207087948.547:29): user pid=6055 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
>type=USER_CMD msg=audit(1207087948.562:30): user pid=6055 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/2 res=success)'
>type=AVC msg=audit(1207088222.930:31): avc:  denied  { getattr } for  pid=6481 comm="sh" path="/usr/bin/mplayer" dev=dm-0 ino=5004482 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mplayer_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1207088222.930:31): arch=40000003 syscall=195 success=no exit=-13 a0=963b2e0 a1=bf93fb60 a2=390ff4 a3=963b2e0 items=0 ppid=6480 pid=6481 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207088222.945:32): avc:  denied  { getattr } for  pid=6476 comm="npviewer.bin" path="/usr/bin/mplayer" dev=dm-0 ino=5004482 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mplayer_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1207088222.945:32): arch=40000003 syscall=195 success=no exit=-13 a0=18a900 a1=bfe01984 a2=c56ff4 a3=9d31991 items=0 ppid=3070 pid=6476 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207088222.951:33): avc:  denied  { getattr } for  pid=6476 comm="npviewer.bin" path="/usr/bin/mplayer" dev=dm-0 ino=5004482 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mplayer_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1207088222.951:33): arch=40000003 syscall=195 success=no exit=-13 a0=18a900 a1=bfe01984 a2=c56ff4 a3=9d31991 items=0 ppid=3070 pid=6476 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1207088376.006:34): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=failed)'
>type=USER_AUTH msg=audit(1207088381.935:35): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=USER_ACCT msg=audit(1207088381.940:36): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=CRED_ACQ msg=audit(1207088382.034:37): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_START msg=audit(1207088382.146:38): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_END msg=audit(1207088382.148:39): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_CMD msg=audit(1207088382.149:40): user pid=6670 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1207089981.033:41): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=8712 comm="evolution" sig=11
>type=USYS_CONFIG msg=audit(1207090194.501:42): user pid=9267 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207117533.816:43): user pid=9541 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207117553.768:44): user pid=9688 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=ANOM_ABEND msg=audit(1207117778.998:45): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=9753 comm="telepathy-haze" sig=11
>type=USER_AUTH msg=audit(1207117943.404:46): user pid=10135 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=USER_ACCT msg=audit(1207117943.409:47): user pid=10135 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=CRED_ACQ msg=audit(1207117943.519:48): user pid=10135 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_START msg=audit(1207117943.580:49): user pid=10135 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_END msg=audit(1207117943.581:50): user pid=10135 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_CMD msg=audit(1207117943.581:51): user pid=10135 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1207119662.701:52): user pid=11677 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207119662.707:53): user pid=11677 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207119662.708:54): login pid=11677 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1207119662.757:55): user pid=11677 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207119662.898:56): user pid=11677 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207119662.898:57): user pid=11677 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207120851.936:58): user pid=12742 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1207120851.936:59): user pid=12742 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207120852.142:60): user pid=12742 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1207120854.916:61): user pid=12742 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207120894.269:62): user pid=12819 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207120894.270:63): user pid=12819 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1207120894.289:64): user pid=12819 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1207120895.492:65): user pid=12819 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207120901.473:66): user pid=12836 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207120901.473:67): user pid=12836 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1207120901.482:68): user pid=12836 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1207120946.457:69): user pid=12836 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207120976.638:70): user pid=12894 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207120976.647:71): user pid=12894 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207120976.730:72): user pid=12894 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207120976.773:73): user pid=12894 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207120976.775:74): user pid=12894 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207120976.776:75): user pid=12894 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=CRED_DISP msg=audit(1207121051.635:76): user pid=2749 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207121052.041:77): user pid=2749 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207121070.246:78): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=13145 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207121547.421:79): user pid=13139 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207121547.430:80): user pid=13139 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207121547.435:81): user pid=13139 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207121547.473:82): login pid=13139 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=4
>type=USER_ROLE_CHANGE msg=audit(1207121547.603:83): user pid=13139 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207121550.998:84): user pid=13139 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207121551.003:85): user pid=13139 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207121821.466:86): user pid=14280 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207121821.469:87): user pid=14280 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207121821.470:88): user pid=14280 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207121821.472:89): user pid=14280 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207121821.472:90): user pid=14280 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207121821.473:91): user pid=14280 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6465627567696E666F2D696E7374616C6C2065766F6C7574696F6E (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207122053.324:92): user pid=14588 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207122053.325:93): user pid=14588 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207122053.326:94): user pid=14588 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207122053.326:95): user pid=14588 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F7461696C202D66202F7661722F6C6F672F6D65737361676573 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207122105.628:96): user pid=14642 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207122105.631:97): user pid=14642 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207122105.632:98): user pid=14642 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207122105.633:99): user pid=14642 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7362696E2F73657276696365204E6574776F726B4D616E616765722072657374617274 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207122109.266:100): user pid=14684 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207122109.272:101): user pid=14684 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207122109.273:102): user pid=14684 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207122109.274:103): user pid=14684 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207122158.152:104): user pid=15015 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207122158.154:105): user pid=15015 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207122158.154:106): user pid=15015 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207122158.154:107): user pid=15015 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6465627567696E666F2D696E7374616C6C2065766F6C7574696F6E (terminal=pts/0 res=success)'
>type=SELINUX_ERR msg=audit(1207122242.076:108): security_compute_sid:  invalid context unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 for scontext=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 tcontext=system_u:object_r:useradd_exec_t:s0 tclass=process
>type=SYSCALL msg=audit(1207122242.076:108): arch=40000003 syscall=11 success=no exit=-13 a0=93954c0 a1=93947e0 a2=93932c0 a3=0 items=0 ppid=15212 pid=15213 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 key=(null)
>type=CRED_ACQ msg=audit(1207122401.159:109): user pid=15381 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207122401.201:110): user pid=15381 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207122401.202:111): user pid=15381 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207122401.203:112): user pid=15381 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6465627567696E666F2D696E7374616C6C2063797275732D7361736C2E6933383620676E75746C732E69333836206B65797574696C732E69333836206C696263726F636F2E69333836206C69626773662E69333836206C696272737667322E69333836 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207122546.265:113): user pid=15624 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207122546.267:114): user pid=15624 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207122546.267:115): user pid=15624 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207122546.268:116): user pid=15624 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6465627567696E666F2D696E7374616C6C206B65797574696C732E69333836 (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207123261.662:117): user pid=16280 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207123261.669:118): user pid=16280 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207123261.670:119): login pid=16280 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1207123261.673:120): user pid=16280 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207123261.729:121): user pid=16280 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207123261.730:122): user pid=16280 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USYS_CONFIG msg=audit(1207123304.500:123): user pid=16684 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207123505.995:124): user pid=16855 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207123527.046:125): user pid=17026 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207123991.500:126): user pid=17709 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207150509.657:127): user pid=18029 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207150523.005:128): user pid=18184 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207150538.415:129): user pid=18234 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207150538.425:130): user pid=18234 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207150538.432:131): user pid=18234 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207150538.515:132): user pid=18234 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207150538.517:133): user pid=18234 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207150538.519:134): user pid=18234 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207151146.920:135): user pid=19162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207151146.931:136): user pid=19162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207151146.936:137): user pid=19162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207151146.941:138): user pid=19162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207151146.944:139): user pid=19162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207151146.948:140): user pid=19162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6B696C6C616C6C207061636B6167656B697464 (terminal=pts/0 res=success)'
>type=USYS_CONFIG msg=audit(1207151156.500:141): user pid=19527 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USYS_CONFIG msg=audit(1207154780.506:142): user pid=19735 uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207154854.103:143): user pid=19997 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="matej" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207155520.042:144): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=failed)'
>type=USER_AUTH msg=audit(1207155524.904:145): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207155524.914:146): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207155525.044:147): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207155525.109:148): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207155525.110:149): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207155525.111:150): user pid=19859 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/redhat" cmd=2F62696E2F72706D202D557668202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F656D70617468792D6465627567696E666F2D302E32332D302E67697432303038303430322E6D632E312E6663392E693338362E72706D202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F656D70617468792D6C6962732D302E32332D302E67697432303038303430322E6D632E312E6663392E693338362E72706D202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F656D70617468792D302E32332D302E67697432303038303430322E6D632E312E6663392E693338362E72706D202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F656D70617468792D646576656C2D302E32332D302E67697432303038303430322E6D632E312E6663392E693338362E72706D202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F656D70617468792D707974686F6E2D302E32332D302E67697432303038303430322E6D632E312E6663392E693338362E72706D (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207155661.491:151): user pid=20040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207155661.496:152): user pid=20040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207155661.496:153): login pid=20040 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1207155661.570:154): user pid=20040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207155661.678:155): user pid=20040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207155661.680:156): user pid=20040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=DAEMON_END msg=audit(1207157923.050:9068): auditd normal halt, sending auid=0 pid=32482 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1207157924.407:9984): auditd start, ver=1.7 format=raw kernel=2.6.25-0.177.rc7.git6.fc9.i686 auid=4294967295 pid=32497 res=success
>type=CONFIG_CHANGE msg=audit(1207157924.508:159): audit_enabled=1 old=1 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1207157924.519:160): audit_backlog_limit=320 old=320 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1207158873.012:161): auid=500 uid=500 gid=500 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=1127 comm="evolution" sig=11
>type=CRED_DISP msg=audit(1207158918.242:162): user pid=13139 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207158918.856:163): user pid=13139 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207158935.932:164): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=1284 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207158942.680:165): user pid=1278 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="marketa" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1207158942.684:166): user pid=1278 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=504: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=failed)'
>type=USER_AUTH msg=audit(1207159007.031:167): user pid=2625 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207159007.035:168): user pid=2625 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207159007.036:169): login pid=2625 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_ROLE_CHANGE msg=audit(1207159007.148:170): user pid=2625 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207159007.304:171): user pid=2625 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207159007.304:172): user pid=2625 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207159007.305:173): user pid=2625 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207159117.895:174): user pid=2625 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207159117.898:175): user pid=2625 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_AUTH msg=audit(1207159201.592:176): user pid=1715 uid=0 auid=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=console res=success)'
>type=USER_ACCT msg=audit(1207159201.592:177): user pid=1715 uid=0 auid=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=console res=success)'
>type=DAEMON_END msg=audit(1207159202.032:9985): auditd normal halt, sending auid=0 pid=1733 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1207159359.529:5342): auditd start, ver=1.7 format=raw kernel=2.6.25-0.185.rc7.git6.fc9.i686 auid=4294967295 pid=2309 res=success
>type=CONFIG_CHANGE msg=audit(1207159359.664:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1207159390.574:5): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2879 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207159396.608:6): user pid=2872 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207159396.615:7): user pid=2872 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207159396.646:8): user pid=2872 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207159396.704:9): login pid=2872 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1207159396.785:10): user pid=2872 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207159400.739:11): user pid=2872 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207159400.873:12): user pid=2872 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207159592.280:13): user pid=3731 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207159592.285:14): user pid=3731 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207159592.344:15): user pid=3731 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207159592.369:16): user pid=3731 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207159592.372:17): user pid=3731 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207159592.374:18): user pid=3731 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207159662.618:19): user pid=3829 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1207159662.619:20): user pid=3829 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207159662.777:21): user pid=3829 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1207159669.563:22): user pid=3829 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1207159884.386:23): user pid=2872 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207159884.728:24): user pid=2872 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207159895.245:25): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=4341 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207159904.106:26): user pid=2717 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_LOGIN msg=audit(1207159904.181:27): user pid=2717 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_AUTH msg=audit(1207159918.316:28): user pid=2717 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_LOGIN msg=audit(1207159918.317:29): user pid=2717 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
>type=USER_AUTH msg=audit(1207159924.435:30): user pid=2717 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207159924.441:31): user pid=2717 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207159924.442:32): login pid=2717 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1207159924.531:33): user pid=2717 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207159924.584:34): user pid=2717 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207159924.585:35): user pid=2717 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207159924.586:36): user pid=2717 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207159958.222:37): user pid=2717 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207159958.228:38): user pid=2717 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=ANOM_ABEND msg=audit(1207159966.053:39): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=4747 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207159981.400:40): user pid=4728 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207159981.405:41): user pid=4728 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207159981.410:42): user pid=4728 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207159981.452:43): login pid=4728 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1207159981.486:44): user pid=4728 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207159982.620:45): user pid=4728 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207159982.622:46): user pid=4728 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207160120.627:47): user pid=5500 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207160120.637:48): user pid=5500 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207160120.641:49): user pid=5500 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207160120.643:50): user pid=5500 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207160120.644:51): user pid=5500 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207160120.644:52): user pid=5500 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207162861.991:53): user pid=8003 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207162861.998:54): user pid=8003 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207162861.998:55): login pid=8003 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1207162862.001:56): user pid=8003 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207162862.090:57): user pid=8003 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207162862.092:58): user pid=8003 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207163697.417:59): user pid=17143 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207163697.428:60): user pid=17143 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207163697.512:61): user pid=17143 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207163697.585:62): user pid=17143 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207163697.586:63): user pid=17143 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207163697.587:64): user pid=17143 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F62696E2F636174202F6465762F696E7075742F6576656E7433 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207163712.316:65): user pid=17264 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207163712.318:66): user pid=17264 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207163712.319:67): user pid=17264 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207163712.320:68): user pid=17264 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F7461696C202D66202F6465762F696E7075742F6576656E7433 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207163721.661:69): user pid=17330 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207163721.663:70): user pid=17330 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207163721.664:71): user pid=17330 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207163721.665:72): user pid=17330 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F7461696C202D66202F6465762F696E7075742F6576656E7432 (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207164724.144:73): user pid=20699 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207164724.155:74): user pid=20699 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207164724.205:75): user pid=20699 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207164724.236:76): user pid=20699 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207164724.237:77): user pid=20699 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207164724.239:78): user pid=20699 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=CRED_DISP msg=audit(1207165501.039:79): user pid=4728 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207165501.921:80): user pid=4728 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207165518.405:81): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=21817 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207165520.061:82): user pid=4578 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207165520.073:83): user pid=4578 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207165520.074:84): login pid=4578 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_ROLE_CHANGE msg=audit(1207165520.222:85): user pid=4578 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207165520.289:86): user pid=4578 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207165520.290:87): user pid=4578 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207165520.294:88): user pid=4578 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207165555.134:89): user pid=4578 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207165555.141:90): user pid=4578 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=ANOM_ABEND msg=audit(1207165565.207:91): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=22248 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207165575.697:92): user pid=22235 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207165575.703:93): user pid=22235 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207165575.708:94): user pid=22235 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207165575.745:95): login pid=22235 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=6
>type=USER_ROLE_CHANGE msg=audit(1207165575.777:96): user pid=22235 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207165579.121:97): user pid=22235 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207165579.126:98): user pid=22235 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207165697.563:99): user pid=23115 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207165697.564:100): user pid=23115 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_START msg=audit(1207165697.645:101): user pid=23115 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_END msg=audit(1207165704.722:102): user pid=23115 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207165716.689:103): user pid=23162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207165716.699:104): user pid=23162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207165716.700:105): user pid=23162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207165716.702:106): user pid=23162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207165716.703:107): user pid=23162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207165716.704:108): user pid=23162 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=CRED_DISP msg=audit(1207166370.517:109): user pid=22235 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207166370.623:110): user pid=22235 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207166376.793:111): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=24152 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207166387.455:112): user pid=22133 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207166387.461:113): user pid=22133 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207166387.462:114): login pid=22133 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_ROLE_CHANGE msg=audit(1207166387.512:115): user pid=22133 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207166387.528:116): user pid=22133 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207166387.529:117): user pid=22133 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207166387.531:118): user pid=22133 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_AUTH msg=audit(1207166397.549:119): user pid=2715 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_ACCT msg=audit(1207166397.557:120): user pid=2715 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=LOGIN msg=audit(1207166397.557:121): login pid=2715 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=8
>type=USER_ROLE_CHANGE msg=audit(1207166397.615:122): user pid=2715 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=AVC msg=audit(1207166397.617:123): avc:  denied  { link } for  pid=2715 comm="login" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=key
>type=SYSCALL msg=audit(1207166397.617:123): arch=40000003 syscall=288 success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=1f4 items=0 ppid=1 pid=2715 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 ses=8 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1207166397.631:124): user pid=2715 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_ACQ msg=audit(1207166397.632:125): user pid=2715 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_LOGIN msg=audit(1207166397.639:126): user pid=2715 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_DISP msg=audit(1207166413.565:127): user pid=22133 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207166413.569:128): user pid=22133 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207166415.335:129): user pid=2715 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_END msg=audit(1207166415.349:130): user pid=2715 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_AUTH msg=audit(1207166420.718:131): user pid=24146 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207166420.724:132): user pid=24146 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207166420.731:133): user pid=24146 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207166420.791:134): login pid=24146 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=9
>type=USER_ROLE_CHANGE msg=audit(1207166420.831:135): user pid=24146 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207166421.677:136): user pid=24146 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207166421.680:137): user pid=24146 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_ACCT msg=audit(1207166461.296:138): user pid=25165 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207166461.299:139): user pid=25165 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207166461.300:140): login pid=25165 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=USER_START msg=audit(1207166461.302:141): user pid=25165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207166461.360:142): user pid=25165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207166461.360:143): user pid=25165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207166468.267:144): user pid=24146 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207166468.293:145): user pid=24146 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207166473.461:146): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=25258 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207166484.834:147): user pid=24490 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1207166484.840:148): user pid=24490 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1207166484.841:149): login pid=24490 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_ROLE_CHANGE msg=audit(1207166484.860:150): user pid=24490 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1207166484.872:151): user pid=24490 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1207166484.873:152): user pid=24490 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1207166484.878:153): user pid=24490 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=ANOM_ABEND msg=audit(1207166532.051:154): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=25763 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207166536.801:155): user pid=25757 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207166536.807:156): user pid=25757 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207166536.812:157): user pid=25757 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207166536.861:158): login pid=25757 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=12
>type=USER_ROLE_CHANGE msg=audit(1207166536.894:159): user pid=25757 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207166537.245:160): user pid=25757 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207166537.247:161): user pid=25757 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1207167034.696:162): user pid=26778 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207167034.700:163): user pid=26778 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207167034.703:164): user pid=26778 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207167034.706:165): user pid=26778 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207167034.706:166): user pid=26778 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207167034.707:167): user pid=26778 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=CRED_DISP msg=audit(1207167505.432:168): user pid=25757 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207167505.458:169): user pid=25757 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207167510.831:170): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=29171 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207167528.273:171): user pid=24540 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_ACCT msg=audit(1207167528.280:172): user pid=24540 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=LOGIN msg=audit(1207167528.280:173): login pid=24540 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=13
>type=USER_ROLE_CHANGE msg=audit(1207167528.309:174): user pid=24540 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=AVC msg=audit(1207167528.311:175): avc:  denied  { link } for  pid=24540 comm="login" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=key
>type=SYSCALL msg=audit(1207167528.311:175): arch=40000003 syscall=288 success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=1f4 items=0 ppid=1 pid=24540 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 ses=13 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1207167528.335:176): user pid=24540 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_ACQ msg=audit(1207167528.336:177): user pid=24540 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_LOGIN msg=audit(1207167528.338:178): user pid=24540 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_AUTH msg=audit(1207167702.950:179): user pid=2716 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=USER_ACCT msg=audit(1207167702.958:180): user pid=2716 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=LOGIN msg=audit(1207167702.959:181): login pid=2716 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=14
>type=USER_ROLE_CHANGE msg=audit(1207167702.979:182): user pid=2716 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=AVC msg=audit(1207167702.981:183): avc:  denied  { link } for  pid=2716 comm="login" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=key
>type=SYSCALL msg=audit(1207167702.981:183): arch=40000003 syscall=288 success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=1f4 items=0 ppid=1 pid=2716 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty3 ses=14 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1207167703.005:184): user pid=2716 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=CRED_ACQ msg=audit(1207167703.005:185): user pid=2716 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=USER_LOGIN msg=audit(1207167703.007:186): user pid=2716 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=ANOM_ABEND msg=audit(1207167802.525:187): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=30870 comm="gnome-power-man" sig=6
>type=USER_AUTH msg=audit(1207167871.777:188): user pid=30853 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207167871.783:189): user pid=30853 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207167871.791:190): user pid=30853 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207167871.826:191): login pid=30853 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=15
>type=USER_ROLE_CHANGE msg=audit(1207167871.856:192): user pid=30853 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207167872.208:193): user pid=30853 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207167872.211:194): user pid=30853 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=CRED_DISP msg=audit(1207168043.006:195): user pid=24490 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1207168043.009:196): user pid=24490 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1207168048.124:197): user pid=2716 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=USER_END msg=audit(1207168048.129:198): user pid=2716 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty3 res=success)'
>type=CRED_DISP msg=audit(1207168049.010:199): user pid=24540 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_END msg=audit(1207168049.012:200): user pid=24540 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_AUTH msg=audit(1207168317.832:201): user pid=32318 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=USER_ACCT msg=audit(1207168317.837:202): user pid=32318 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=success)'
>type=CRED_ACQ msg=audit(1207168317.875:203): user pid=32318 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_START msg=audit(1207168317.877:204): user pid=32318 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_END msg=audit(1207168317.878:205): user pid=32318 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/1 res=success)'
>type=USER_CMD msg=audit(1207168317.879:206): user pid=32318 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F6765646974202F6574632F5831312F786F72672E636F6E66 (terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1207170061.616:207): user pid=8621 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207170061.620:208): user pid=8621 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207170061.620:209): login pid=8621 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16
>type=USER_START msg=audit(1207170061.634:210): user pid=8621 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207170061.706:211): user pid=8621 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207170061.707:212): user pid=8621 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207170095.107:213): user pid=8639 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1207170095.107:214): user pid=8639 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207170095.246:215): user pid=8639 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1207170095.834:216): user pid=8639 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1207170177.371:217): dev=vnet0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295
>type=SYSCALL msg=audit(1207170177.371:217): arch=40000003 syscall=54 success=yes exit=0 a0=5 a1=89a2 a2=bfda8ae8 a3=6 items=0 ppid=1 pid=2524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0 key=(null)
>type=AVC msg=audit(1207170177.484:218): avc:  denied  { getattr } for  pid=8732 comm="qemu-kvm" path="/dev/mapper/vg00-lvRHEL5" dev=tmpfs ino=370 scontext=system_u:system_r:qemu_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1207170177.484:218): arch=40000003 syscall=195 success=no exit=-13 a0=bfd4c030 a1=bfd49680 a2=390ff4 a3=b93b690 items=0 ppid=2524 pid=8732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:qemu_t:s0 key=(null)
>type=AVC msg=audit(1207170177.485:219): avc:  denied  { read } for  pid=8732 comm="qemu-kvm" name="vg00-lvRHEL5" dev=tmpfs ino=370 scontext=system_u:system_r:qemu_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
>type=SYSCALL msg=audit(1207170177.485:219): arch=40000003 syscall=5 success=no exit=-13 a0=bfd4c030 a1=8000 a2=0 a3=8000 items=0 ppid=2524 pid=8732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:qemu_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1207170177.490:220): dev=vnet0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295
>type=USER_AUTH msg=audit(1207170749.478:221): user pid=9339 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/1 res=failed)'
>type=USER_AUTH msg=audit(1207170761.788:222): user pid=9351 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207170761.797:223): user pid=9351 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207170761.920:224): user pid=9351 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207170761.942:225): user pid=9351 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207170761.943:226): user pid=9351 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207170761.944:227): user pid=9351 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1207170803.780:228): dev=vnet0 prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295
>type=SYSCALL msg=audit(1207170803.780:228): arch=40000003 syscall=54 success=yes exit=0 a0=5 a1=89a2 a2=bfda8ae8 a3=6 items=0 ppid=1 pid=2524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0 key=(null)
>type=USER_AUTH msg=audit(1207171629.756:229): user pid=10105 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207171629.760:230): user pid=10105 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207171629.873:231): user pid=10105 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207171630.151:232): user pid=10105 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207171630.152:233): user pid=10105 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207171630.152:234): user pid=10105 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207173011.411:235): user pid=12811 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207173011.419:236): user pid=12811 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207173011.467:237): user pid=12811 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207173011.592:238): user pid=12811 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207173011.593:239): user pid=12811 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207173011.594:240): user pid=12811 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/redhat" cmd=2F62696E2F72706D202D557668202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F6269746C6265652D312E316465762D312E627A723334306F74722E312E6663392E693338362E72706D202F686F6D652F6D6174656A2F7265646861742F52504D532F693338362F6269746C6265652D6465627567696E666F2D312E316465762D312E627A723334306F74722E312E6663392E693338362E72706D (terminal=pts/0 res=success)'
>type=AVC msg=audit(1207173099.414:241): avc:  denied  { getattr } for  pid=12908 comm="bitlbee" path="pipe:[554421]" dev=pipefs ino=554421 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.414:241): arch=40000003 syscall=197 success=no exit=-13 a0=6 a1=bfd935dc a2=390ff4 a3=9db5d08 items=0 ppid=2406 pid=12908 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.414:242): avc:  denied  { getattr } for  pid=12908 comm="bitlbee" path="pipe:[554422]" dev=pipefs ino=554422 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.414:242): arch=40000003 syscall=197 success=no exit=-13 a0=7 a1=bfd935dc a2=390ff4 a3=9db5e70 items=0 ppid=2406 pid=12908 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.415:243): avc:  denied  { getattr } for  pid=12910 comm="bitlbee" path="pipe:[554421]" dev=pipefs ino=554421 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.415:243): arch=40000003 syscall=197 success=no exit=-13 a0=5 a1=bfd9311c a2=390ff4 a3=9db5fd8 items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.415:244): avc:  denied  { getattr } for  pid=12910 comm="bitlbee" path="pipe:[554422]" dev=pipefs ino=554422 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=AVC msg=audit(1207173099.415:245): avc:  denied  { getattr } for  pid=12908 comm="bitlbee" path="pipe:[554422]" dev=pipefs ino=554422 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.415:244): arch=40000003 syscall=197 success=no exit=-13 a0=8 a1=bfd9311c a2=390ff4 a3=9db6140 items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.415:246): avc:  denied  { read } for  pid=12910 comm="bitlbee" path="pipe:[554421]" dev=pipefs ino=554421 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.415:245): arch=40000003 syscall=197 success=no exit=-13 a0=7 a1=bfd936ec a2=390ff4 a3=7 items=0 ppid=2406 pid=12908 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1207173099.415:246): arch=40000003 syscall=3 success=no exit=-13 a0=5 a1=b808a000 a2=2000 a3=9db5fd8 items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.415:247): avc:  denied  { read } for  pid=12910 comm="bitlbee" path="pipe:[554421]" dev=pipefs ino=554421 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.415:247): arch=40000003 syscall=3 success=no exit=-13 a0=5 a1=b808a000 a2=2000 a3=9db5fd8 items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.416:248): avc:  denied  { write } for  pid=12908 comm="bitlbee" path="pipe:[554421]" dev=pipefs ino=554421 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.416:248): arch=40000003 syscall=4 success=no exit=-13 a0=6 a1=b808e000 a2=18 a3=18 items=0 ppid=2406 pid=12908 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.416:249): avc:  denied  { write } for  pid=12910 comm="bitlbee" name="/" dev=tmpfs ino=6995 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173099.416:249): arch=40000003 syscall=5 success=no exit=-13 a0=bfd936f8 a1=c2 a2=180 a3=9b0ba items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.417:250): avc:  denied  { write } for  pid=12910 comm="bitlbee" name="/" dev=tmpfs ino=6995 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173099.417:250): arch=40000003 syscall=5 success=no exit=-13 a0=bfd936f8 a1=242 a2=1b6 a3=240 items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173099.417:251): avc:  denied  { write } for  pid=12910 comm="bitlbee" path="pipe:[554422]" dev=pipefs ino=554422 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=fifo_file
>type=SYSCALL msg=audit(1207173099.417:251): arch=40000003 syscall=4 success=no exit=-13 a0=8 a1=b8088000 a2=1f a3=1f items=0 ppid=12908 pid=12910 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=CRED_ACQ msg=audit(1207173144.407:252): user pid=12975 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207173144.437:253): user pid=12975 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207173144.438:254): user pid=12975 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207173144.439:255): user pid=12975 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=MAC_POLICY_LOAD msg=audit(1207173240.113:256): policy loaded auid=500 ses=15
>type=SYSCALL msg=audit(1207173240.113:256): arch=40000003 syscall=4 success=yes exit=3771716 a0=4 a1=b78f9008 a2=398d44 a3=bf847fd8 items=0 ppid=13085 pid=13096 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=15 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1207173242.199:257): user pid=2324 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=AVC msg=audit(1207173276.861:258): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-B84pju" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173276.861:258): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=c2 a2=180 a3=9ee85 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173276.864:259): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-B84pju" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173276.864:259): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=242 a2=1b6 a3=240 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.107:260): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-SlqNhO" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173277.107:260): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=c2 a2=180 a3=13cdfb items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.108:261): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-SlqNhO" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173277.108:261): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=242 a2=1b6 a3=240 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.109:262): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-FUurg8" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173277.109:262): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=c2 a2=180 a3=1dad72 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.110:263): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-FUurg8" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173277.110:263): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=242 a2=1b6 a3=240 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.110:264): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-SkNefs" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173277.110:264): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=c2 a2=180 a3=278ce9 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.111:265): avc:  denied  { add_name } for  pid=13129 comm="bitlbee" name="bitlbee-SkNefs" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=SYSCALL msg=audit(1207173277.111:265): arch=40000003 syscall=5 success=no exit=-13 a0=bfb7e9d8 a1=242 a2=1b6 a3=240 items=0 ppid=13128 pid=13129 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173277.111:266): avc:  denied  { signal } for  pid=13128 comm="bitlbee" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1207173277.111:266): arch=40000003 syscall=37 success=no exit=-13 a0=3349 a1=f a2=0 a3=9a99ea8 items=0 ppid=2406 pid=13128 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=CRED_ACQ msg=audit(1207173316.196:267): user pid=13168 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207173316.271:268): user pid=13168 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207173316.273:269): user pid=13168 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207173316.273:270): user pid=13168 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/redhat" cmd=2F7573722F7362696E2F736574656E666F7263652030 (terminal=pts/0 res=success)'
>type=MAC_STATUS msg=audit(1207173316.277:271): enforcing=0 old_enforcing=1 auid=500 ses=15
>type=USER_AVC msg=audit(1207173316.277:272): user pid=2324 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1207173316.277:271): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bfa75f14 a2=1 a3=bfa75f14 items=0 ppid=13160 pid=13168 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=15 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173354.078:273): avc:  denied  { add_name } for  pid=13210 comm="bitlbee" name="bitlbee-6n3fXa" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1207173354.078:273): avc:  denied  { create } for  pid=13210 comm="bitlbee" name="bitlbee-6n3fXa" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=file
>type=AVC msg=audit(1207173354.078:273): avc:  denied  { read write } for  pid=13210 comm="bitlbee" name="bitlbee-6n3fXa" dev=tmpfs ino=565202 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1207173354.078:273): arch=40000003 syscall=5 success=yes exit=9 a0=bfcf0658 a1=c2 a2=180 a3=9f8d9 items=0 ppid=13209 pid=13210 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=CRED_ACQ msg=audit(1207173385.937:274): user pid=13240 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207173385.940:275): user pid=13240 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207173385.941:276): user pid=13240 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207173385.942:277): user pid=13240 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=AVC msg=audit(1207173405.432:278): avc:  denied  { getattr } for  pid=13210 comm="bitlbee" path="/tmp/bitlbee-6n3fXa" dev=tmpfs ino=565202 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1207173405.432:278): arch=40000003 syscall=197 success=yes exit=0 a0=9 a1=bfcf0098 a2=390ff4 a3=9942140 items=0 ppid=13209 pid=13210 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173405.433:279): avc:  denied  { remove_name } for  pid=13209 comm="bitlbee" name="bitlbee-6n3fXa" dev=tmpfs ino=565202 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
>type=AVC msg=audit(1207173405.433:279): avc:  denied  { unlink } for  pid=13209 comm="bitlbee" name="bitlbee-6n3fXa" dev=tmpfs ino=565202 scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1207173405.433:279): arch=40000003 syscall=10 success=yes exit=0 a0=bfcf0d38 a1=bfcf06f8 a2=99493b8 a3=9942408 items=0 ppid=2406 pid=13209 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207173406.882:280): avc:  denied  { signal } for  pid=13209 comm="bitlbee" scontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tcontext=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1207173406.882:280): arch=40000003 syscall=37 success=yes exit=0 a0=339a a1=f a2=0 a3=9940f80 items=0 ppid=2406 pid=13209 auid=4294967295 uid=496 gid=495 euid=496 suid=496 fsuid=496 egid=495 sgid=495 fsgid=495 tty=(none) ses=4294967295 comm="bitlbee" exe="/usr/sbin/bitlbee" subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1207173424.765:281): user pid=2324 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=3) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1207173423.029:282): policy loaded auid=500 ses=15
>type=SYSCALL msg=audit(1207173423.029:282): arch=40000003 syscall=4 success=yes exit=3771692 a0=4 a1=b7857008 a2=398d2c a3=bfda6858 items=0 ppid=13301 pid=13311 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=15 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=MAC_POLICY_LOAD msg=audit(1207173501.482:283): policy loaded auid=500 ses=15
>type=SYSCALL msg=audit(1207173501.482:283): arch=40000003 syscall=4 success=yes exit=3771728 a0=4 a1=b787c008 a2=398d50 a3=bf9cad18 items=0 ppid=13362 pid=13372 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=15 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1207173503.361:284): user pid=2324 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=4) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=ANOM_ABEND msg=audit(1207173520.013:285): auid=4294967295 uid=496 gid=495 ses=4294967295 subj=system_u:system_r:bitlbee_t:s0-s0:c0.c1023 pid=13209 comm="bitlbee" sig=11
>type=MAC_STATUS msg=audit(1207173535.936:286): enforcing=1 old_enforcing=0 auid=500 ses=15
>type=USER_AVC msg=audit(1207173535.951:287): user pid=2324 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=1) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1207173535.936:286): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bff2add4 a2=1 a3=bff2add4 items=0 ppid=13240 pid=13404 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=15 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207173661.687:288): user pid=13511 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207173661.702:289): user pid=13511 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207173661.702:290): login pid=13511 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
>type=USER_START msg=audit(1207173661.770:291): user pid=13511 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207173661.862:292): user pid=13511 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207173661.863:293): user pid=13511 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207175418.137:294): user pid=15123 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1207175418.137:295): user pid=15123 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207175420.150:296): user pid=15123 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1207175453.792:297): user pid=15123 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1207175590.959:298): user pid=15320 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/3 res=success)'
>type=USER_ACCT msg=audit(1207175590.964:299): user pid=15320 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/3 res=success)'
>type=CRED_ACQ msg=audit(1207175591.643:300): user pid=15320 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/3 res=success)'
>type=USER_START msg=audit(1207175592.059:301): user pid=15320 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/3 res=success)'
>type=USER_END msg=audit(1207175592.060:302): user pid=15320 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/3 res=success)'
>type=USER_CMD msg=audit(1207175592.061:303): user pid=15320 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/3 res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1207175601.042:304): dev=vnet0 prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295
>type=AVC msg=audit(1207177033.687:305): avc:  denied  { read } for  pid=17739 comm="npviewer.bin" name=".XCompose" dev=dm-6 ino=6651396 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1207177033.687:305): arch=40000003 syscall=5 success=no exit=-13 a0=9b04518 a1=0 a2=9ab3ad8 a3=bfbe4d53 items=0 ppid=17659 pid=17739 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=15 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207177260.206:306): avc:  denied  { read } for  pid=17973 comm="npviewer.bin" name=".XCompose" dev=dm-6 ino=6651396 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1207177260.206:306): arch=40000003 syscall=5 success=no exit=-13 a0=9ed9518 a1=0 a2=9e88ad8 a3=bfb1ad53 items=0 ppid=17937 pid=17973 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=15 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207177262.261:307): user pid=17987 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207177262.265:308): user pid=17987 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207177262.265:309): login pid=17987 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18
>type=USER_START msg=audit(1207177262.342:310): user pid=17987 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207177262.404:311): user pid=17987 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207177262.405:312): user pid=17987 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207177851.358:313): user pid=30853 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1207177852.686:314): user pid=30853 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1207177875.811:315): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=18607 comm="gnome-power-man" sig=6
>type=AVC msg=audit(1207177883.009:316): avc:  denied  { execstack } for  pid=18631 comm="gnome-power-man" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1207177883.009:316): arch=40000003 syscall=125 success=no exit=-13 a0=bfcc5000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=18630 pid=18631 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="gnome-power-man" exe="/usr/bin/gnome-power-manager" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207177885.470:317): avc:  denied  { execstack } for  pid=18635 comm="gnome-power-man" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1207177885.470:317): arch=40000003 syscall=125 success=no exit=-13 a0=bf88e000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=18634 pid=18635 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="gnome-power-man" exe="/usr/bin/gnome-power-manager" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=DAEMON_END msg=audit(1207177901.176:5343): auditd normal halt, sending auid=0 pid=18722 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1207201795.447:8012): auditd start, ver=1.7 format=raw kernel=2.6.25-0.185.rc7.git6.fc9.i686 auid=4294967295 pid=2244 res=success
>type=CONFIG_CHANGE msg=audit(1207201795.593:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=AVC msg=audit(1207201826.587:5): avc:  denied  { execstack } for  pid=2775 comm="gnome-power-man" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1207201826.587:5): arch=40000003 syscall=125 success=no exit=-13 a0=bfdbb000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=2770 pid=2775 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="gnome-power-man" exe="/usr/bin/gnome-power-manager" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1207201835.909:6): user pid=2760 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1207201835.915:7): user pid=2760 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1207201835.944:8): user pid=2760 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1207201835.990:9): login pid=2760 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1207201836.064:10): user pid=2760 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1207201840.294:11): user pid=2760 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="matej" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1207201840.426:12): user pid=2760 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_ACCT msg=audit(1207202461.567:13): user pid=4207 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207202461.570:14): user pid=4207 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207202461.570:15): login pid=4207 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1207202461.572:16): user pid=4207 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207202461.602:17): user pid=4207 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207202461.603:18): user pid=4207 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1207206061.607:19): user pid=13256 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207206061.610:20): user pid=13256 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207206061.611:21): login pid=13256 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1207206061.636:22): user pid=13256 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207206061.649:23): user pid=13256 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207206061.651:24): user pid=13256 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=ANOM_ABEND msg=audit(1207207918.823:25): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=9453 comm="telepathy-idle" sig=6
>type=USER_ACCT msg=audit(1207209661.871:26): user pid=30725 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207209661.877:27): user pid=30725 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207209661.879:28): login pid=30725 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1207209661.898:29): user pid=30725 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207209661.927:30): user pid=30725 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207209661.927:31): user pid=30725 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1207213261.174:32): user pid=1305 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207213261.177:33): user pid=1305 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207213261.177:34): login pid=1305 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1207213261.211:35): user pid=1305 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207213261.238:36): user pid=1305 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207213261.239:37): user pid=1305 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1207216861.469:38): user pid=4919 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207216861.472:39): user pid=4919 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207216861.472:40): login pid=4919 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1207216861.506:41): user pid=4919 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207216861.521:42): user pid=4919 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207216861.521:43): user pid=4919 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1207220461.605:44): user pid=7851 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207220461.607:45): user pid=7851 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207220461.608:46): login pid=7851 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1207220461.610:47): user pid=7851 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207220461.619:48): user pid=7851 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207220461.620:49): user pid=7851 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=ANOM_ABEND msg=audit(1207222135.861:50): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=1297 comm="hotwire" sig=11
>type=USER_AUTH msg=audit(1207223841.636:51): user pid=10925 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207223841.641:52): user pid=10925 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207223841.781:53): user pid=10925 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207223841.959:54): user pid=10925 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207223841.959:55): user pid=10925 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207223841.960:56): user pid=10925 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F79756D646F776E6C6F61646572202D2D736F75726365206379636C65 (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207223873.507:57): user pid=10985 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207223873.510:58): user pid=10985 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207223873.511:59): user pid=10985 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207223873.533:60): user pid=10985 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd="/root" (terminal=pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207223901.249:61): user pid=11045 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207223901.250:62): user pid=11045 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207223901.251:63): user pid=11045 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207223901.251:64): user pid=11045 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F7573722F62696E2F79756D646F776E6C6F61646572202D2D736F75726365206379636C65 (terminal=pts/0 res=success)'
>type=USER_ACCT msg=audit(1207224061.965:65): user pid=11308 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207224061.967:66): user pid=11308 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207224061.967:67): login pid=11308 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1207224061.974:68): user pid=11308 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207224062.057:69): user pid=11308 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207224062.057:70): user pid=11308 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1207227661.652:71): user pid=14783 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207227661.658:72): user pid=14783 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207227661.658:73): login pid=14783 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1207227661.745:74): user pid=14783 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207227661.876:75): user pid=14783 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207227661.876:76): user pid=14783 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_CHAUTHTOK msg=audit(1207229569.411:77): user pid=16867 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="smolt" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1207229569.857:78): user pid=16868 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="smolt" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1207229679.604:79): user pid=16993 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="gdm" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1207229680.105:80): user pid=16994 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=changing user shell acct="gdm" exe="/usr/sbin/usermod" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1207230018.127:81): avc:  denied  { read } for  pid=17430 comm="plugin-config" path="/home/matej/.mozilla/firefox/e8zuqhrq.default/prefs.js" dev=dm-6 ino=196644 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_mozilla_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1207230018.127:81): arch=40000003 syscall=11 success=yes exit=0 a0=8fe7bb0 a1=8fea4c8 a2=8fea5a8 a3=0 items=0 ppid=17428 pid=17430 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207230024.224:82): avc:  denied  { read } for  pid=17453 comm="plugin-config" path="/home/matej/.mozilla/firefox/e8zuqhrq.default/prefs.js" dev=dm-6 ino=196644 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_mozilla_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1207230024.224:82): arch=40000003 syscall=11 success=yes exit=0 a0=9495bb0 a1=94984c8 a2=94985a8 a3=0 items=0 ppid=17451 pid=17453 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1207230024.507:83): avc:  denied  { read } for  pid=17472 comm="plugin-config" path="/home/matej/.mozilla/firefox/e8zuqhrq.default/prefs.js" dev=dm-6 ino=196644 scontext=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_mozilla_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1207230024.507:83): arch=40000003 syscall=11 success=yes exit=0 a0=8e74bb0 a1=8e774c8 a2=8e775a8 a3=0 items=0 ppid=17470 pid=17472 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="plugin-config" exe="/usr/lib/nspluginwrapper/plugin-config" subj=unconfined_u:unconfined_r:nsplugin_config_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1207231262.362:84): user pid=18699 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1207231262.365:85): user pid=18699 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1207231262.365:86): login pid=18699 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=USER_START msg=audit(1207231262.433:87): user pid=18699 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1207231262.660:88): user pid=18699 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1207231262.660:89): user pid=18699 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1207232368.341:90): user pid=19635 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207232368.345:91): user pid=19635 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207232368.471:92): user pid=19635 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207232368.513:93): user pid=19635 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207232368.515:94): user pid=19635 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207232368.516:95): user pid=19635 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej/archiv/programky/eclipse/cycle" cmd=2F7573722F62696E2F79756D20636865636B2D757064617465 (terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1207232948.886:96): user pid=20095 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=USER_ACCT msg=audit(1207232948.898:97): user pid=20095 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=/dev/pts/0 res=success)'
>type=CRED_ACQ msg=audit(1207232948.954:98): user pid=20095 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1207232948.995:99): user pid=20095 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1207232948.996:100): user pid=20095 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=viklef.ceplovi.cz, addr=127.0.0.1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1207232948.996:101): user pid=20095 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/matej" cmd=2F62696E2F6370202F7661722F6C6F672F61756469742F61756469742E6C6F67202E (terminal=pts/0 res=success)'

Actions: View

Attachments on bug 440426: 300257