Attachment 302129 Details for Bug 442054 – ausearch avc

ausearch avc

ausearch.avc (text/plain), 4.28 KB, created by LC Bruzenak on 2008-04-11 14:40:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: LC Bruzenak

Created: 2008-04-11 14:40:15 UTC

Size: 4.28 KB

patch

obsolete

>----
>time->Fri Apr 11 09:30:13 2008
>node=sun.jcdx.org type=PATH msg=audit(1207924213.612:969): item=0 name="/etc/audit/auditd.conf" inode=55426 dev=fd:00 mode=0100640 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditd_etc_t:s15:c0.c1023 
>node=sun.jcdx.org type=CWD msg=audit(1207924213.612:969):  cwd="/root" 
>node=sun.jcdx.org type=SYSCALL msg=audit(1207924213.612:969): arch=40000003 syscall=5 success=yes exit=3 a0=80572c7 a1=20000 a2=47feaa00 a3=7 items=1 ppid=3135 pid=3293 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="ausearch" exe="/sbin/ausearch" subj=root:staff_r:staff_t:s0 key=(null) 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.612:969): avc:  denied  { read } for  pid=3293 comm="ausearch" name="auditd.conf" dev=dm-0 ino=55426 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_etc_t:s15:c0.c1023 tclass=file 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.612:969): avc:  denied  { search } for  pid=3293 comm="ausearch" name="audit" dev=dm-0 ino=55421 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_etc_t:s15:c0.c1023 tclass=dir 
>----
>time->Fri Apr 11 09:30:13 2008
>node=sun.jcdx.org type=SYSCALL msg=audit(1207924213.613:970): arch=40000003 syscall=197 success=yes exit=0 a0=3 a1=bfa14e94 a2=2d06ff4 a3=7 items=0 ppid=3135 pid=3293 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="ausearch" exe="/sbin/ausearch" subj=root:staff_r:staff_t:s0 key=(null) 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.613:970): avc:  denied  { getattr } for  pid=3293 comm="ausearch" path="/etc/audit/auditd.conf" dev=dm-0 ino=55426 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_etc_t:s15:c0.c1023 tclass=file 
>----
>time->Fri Apr 11 09:30:13 2008
>node=sun.jcdx.org type=PATH msg=audit(1207924213.613:971): item=0 name="/var/log/audit" inode=56913 dev=fd:00 mode=040750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditd_log_t:s15:c0.c1023 
>node=sun.jcdx.org type=CWD msg=audit(1207924213.613:971):  cwd="/root" 
>node=sun.jcdx.org type=SYSCALL msg=audit(1207924213.613:971): arch=40000003 syscall=5 success=yes exit=4 a0=85cb8f8 a1=98800 a2=0 a3=85cb8f8 items=1 ppid=3135 pid=3293 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="ausearch" exe="/sbin/ausearch" subj=root:staff_r:staff_t:s0 key=(null) 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.613:971): avc:  denied  { read } for  pid=3293 comm="ausearch" name="audit" dev=dm-0 ino=56913 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_log_t:s15:c0.c1023 tclass=dir 
>----
>time->Fri Apr 11 09:30:13 2008
>node=sun.jcdx.org type=PATH msg=audit(1207924213.613:972): item=0 name="/var/log/audit/audit.log" inode=54458 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditd_log_t:s15:c0.c1023 
>node=sun.jcdx.org type=CWD msg=audit(1207924213.613:972):  cwd="/root" 
>node=sun.jcdx.org type=SYSCALL msg=audit(1207924213.613:972): arch=40000003 syscall=5 success=yes exit=4 a0=bfa14fa3 a1=0 a2=bfa14fa3 a3=85cb8f8 items=1 ppid=3135 pid=3293 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="ausearch" exe="/sbin/ausearch" subj=root:staff_r:staff_t:s0 key=(null) 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.613:972): avc:  denied  { read } for  pid=3293 comm="ausearch" name="audit.log" dev=dm-0 ino=54458 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_log_t:s15:c0.c1023 tclass=file 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.613:972): avc:  denied  { search } for  pid=3293 comm="ausearch" name="audit" dev=dm-0 ino=56913 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_log_t:s15:c0.c1023 tclass=dir 
>----
>time->Fri Apr 11 09:30:13 2008
>node=sun.jcdx.org type=SYSCALL msg=audit(1207924213.613:973): arch=40000003 syscall=197 success=yes exit=0 a0=4 a1=bfa14e04 a2=2d06ff4 a3=85cb8f8 items=0 ppid=3135 pid=3293 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="ausearch" exe="/sbin/ausearch" subj=root:staff_r:staff_t:s0 key=(null) 
>node=sun.jcdx.org type=AVC msg=audit(1207924213.613:973): avc:  denied  { getattr } for  pid=3293 comm="ausearch" path="/var/log/audit/audit.log" dev=dm-0 ino=54458 scontext=root:staff_r:staff_t:s0 tcontext=system_u:object_r:auditd_log_t:s15:c0.c1023 tclass=file

Actions: View

Attachments on bug 442054: 302128 | 302129 | 302130