Attachment 302688 Details for Bug 442823 – audit.log

audit.log

audit.log (text/plain), 133.14 KB, created by Flóki Pálsson on 2008-04-17 01:38:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Flóki Pálsson

Created: 2008-04-17 01:38:42 UTC

Size: 133.14 KB

patch

obsolete

>type=DAEMON_START msg=audit(1208302082.307:6259): auditd start, ver=1.6.9 format=raw kernel=2.6.25-0.121.rc5.git4.fc9 auid=4294967295 pid=1843 res=success
>type=CONFIG_CHANGE msg=audit(1208302082.429:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=AVC msg=audit(1208302093.491:5): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.522:6): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.523:7): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.524:8): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.527:9): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.527:10): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.528:11): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.529:12): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.529:13): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.530:14): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.534:15): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.535:16): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.535:17): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.536:18): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.536:19): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.537:20): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.538:21): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.542:22): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302093.544:23): avc:  denied  { read } for  pid=1332 comm="rhgb" name="keyboard" dev=dm-0 ino=9191444 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file
>type=AVC msg=audit(1208302145.698:24): avc:  denied  { getcap } for  pid=2389 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302145.698:24): arch=c000003e syscall=125 success=no exit=-13 a0=213e3b4 a1=0 a2=30 a3=8101010101010100 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302145.702:25): avc:  denied  { setcap } for  pid=2389 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302145.702:25): arch=c000003e syscall=126 success=no exit=-13 a0=213e3b4 a1=213e3bc a2=800000 a3=7fffcf4f8eb8 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302145.702:26): avc:  denied  { getcap } for  pid=2389 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302145.702:26): arch=c000003e syscall=125 success=no exit=-13 a0=213e3b4 a1=0 a2=30 a3=7fe4c6d2e790 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302145.728:27): avc:  denied  { getcap } for  pid=2389 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302145.728:27): arch=c000003e syscall=125 success=no exit=-13 a0=213fcd4 a1=0 a2=213fcf0 a3=7fe4c74e29f0 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302145.728:28): avc:  denied  { setcap } for  pid=2389 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302145.728:28): arch=c000003e syscall=126 success=no exit=-13 a0=213fcd4 a1=213fcdc a2=0 a3=0 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302145.977:29): avc:  denied  { read } for  pid=2389 comm="pulseaudio" name="default.conf" dev=dm-0 ino=9191644 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:alsa_etc_rw_t:s0 tclass=file
>type=SYSCALL msg=audit(1208302145.977:29): arch=c000003e syscall=2 success=no exit=-13 a0=2160740 a1=0 a2=1b6 a3=7fe4c6d2e790 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302146.105:30): avc:  denied  { write } for  pid=2389 comm="pulseaudio" path="anon_inode:[eventfd]" dev=anon_inodefs ino=135 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
>type=SYSCALL msg=audit(1208302146.105:30): arch=c000003e syscall=1 success=no exit=-13 a0=c a1=7fffcf4f8730 a2=8 a3=216e850 items=0 ppid=1 pid=2389 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_ABEND msg=audit(1208302146.118:31): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2389 comm="pulseaudio" sig=6
>type=USER_AUTH msg=audit(1208302163.753:32): user pid=2364 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208302163.785:33): user pid=2364 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208302163.803:34): user pid=2364 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208302163.975:35): login pid=2364 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208302164.110:36): user pid=2364 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208302164.800:37): user pid=2364 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208302164.804:38): user pid=2364 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=DAEMON_END msg=audit(1208302228.802:6260): auditd normal halt, sending auid=0 pid=2755 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208302300.901:3181): auditd start, ver=1.6.9 format=raw kernel=2.6.25-0.121.rc5.git4.fc9 auid=4294967295 pid=1837 res=success
>type=CONFIG_CHANGE msg=audit(1208302301.022:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=AVC msg=audit(1208302315.838:5): avc:  denied  { getcap } for  pid=2361 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302315.838:5): arch=c000003e syscall=125 success=no exit=-13 a0=a9d3b4 a1=0 a2=30 a3=8101010101010100 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302315.845:6): avc:  denied  { setcap } for  pid=2361 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302315.845:6): arch=c000003e syscall=126 success=no exit=-13 a0=a9d3b4 a1=a9d3bc a2=800000 a3=7fff700ebab8 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=0 suid=0 fsuid=0 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302315.846:7): avc:  denied  { getcap } for  pid=2361 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302315.846:7): arch=c000003e syscall=125 success=no exit=-13 a0=a9d3b4 a1=0 a2=30 a3=7f5b66115790 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302315.908:8): avc:  denied  { getcap } for  pid=2361 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302315.908:8): arch=c000003e syscall=125 success=no exit=-13 a0=a9ecd4 a1=0 a2=a9ecf0 a3=7f5b668c99f0 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302315.909:9): avc:  denied  { setcap } for  pid=2361 comm="pulseaudio" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1208302315.909:9): arch=c000003e syscall=126 success=no exit=-13 a0=a9ecd4 a1=a9ecdc a2=0 a3=0 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302316.191:10): avc:  denied  { read } for  pid=2361 comm="pulseaudio" name="default.conf" dev=dm-0 ino=9191644 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:alsa_etc_rw_t:s0 tclass=file
>type=SYSCALL msg=audit(1208302316.191:10): arch=c000003e syscall=2 success=no exit=-13 a0=abf740 a1=0 a2=1b6 a3=7f5b66115790 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208302316.233:11): avc:  denied  { write } for  pid=2361 comm="pulseaudio" path="anon_inode:[eventfd]" dev=anon_inodefs ino=135 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file
>type=SYSCALL msg=audit(1208302316.233:11): arch=c000003e syscall=1 success=no exit=-13 a0=c a1=7fff700eb330 a2=8 a3=acd850 items=0 ppid=1 pid=2361 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_ABEND msg=audit(1208302316.236:12): auid=4294967295 uid=42 gid=42 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 pid=2361 comm="pulseaudio" sig=6
>type=USER_AUTH msg=audit(1208302332.401:13): user pid=2345 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208302332.424:14): user pid=2345 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208302332.465:15): user pid=2345 uid=500 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208302332.635:16): login pid=2345 uid=500 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208302332.750:17): user pid=2345 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208302333.549:18): user pid=2345 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208302333.563:19): user pid=2345 uid=500 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1208302470.798:20): user pid=2706 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/polkit-grant-helper-pam" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208302470.806:21): user pid=2706 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/libexec/polkit-grant-helper-pam" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1208303860.273:22): user pid=3167 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="gnokii" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208303947.741:23): user pid=3264 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="mailnull" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208303947.742:24): user pid=3264 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="mailnull" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208303947.760:25): user pid=3265 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="smmsp" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208303947.761:26): user pid=3265 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="smmsp" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_ACCT msg=audit(1208304061.564:27): user pid=3371 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208304061.566:28): user pid=3371 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208304061.567:29): login pid=3371 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1208304061.586:30): user pid=3371 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208304061.772:31): user pid=3371 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208304061.773:32): user pid=3371 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_CHAUTHTOK msg=audit(1208304067.028:33): user pid=3388 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="nscd" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304067.029:34): user pid=3388 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="nscd" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304094.703:35): user pid=3423 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="smolt" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304094.711:36): user pid=3424 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="smolt" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304094.712:37): user pid=3424 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="smolt" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304097.319:38): user pid=3435 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="dbus" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304097.320:39): user pid=3435 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="dbus" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304115.906:40): user pid=3450 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="polkituser" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304115.907:41): user pid=3450 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="polkituser" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304148.151:42): user pid=3473 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="pulse" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304148.162:43): user pid=3474 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="pulse" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304148.163:44): user pid=3474 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="pulse" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304148.172:45): user pid=3475 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="pulse-rt" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304148.178:46): user pid=3476 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="pulse-access" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304258.535:47): user pid=3575 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304258.536:48): user pid=3575 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1208304298.891:49): user pid=3669 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="floki" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1208304347.187:50): user pid=3729 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="wbpriv" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304457.635:51): user pid=3931 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="sshd" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304457.636:52): user pid=3931 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="sshd" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AVC msg=audit(1208304515.164:53): user pid=1852 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1208304512.904:54): policy loaded auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1208304512.904:54): arch=c000003e syscall=1 success=yes exit=3785280 a0=4 a1=7f8940071010 a2=39c240 a3=7fff487bafe0 items=0 ppid=3973 pid=3974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1208304555.605:55): user pid=4108 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="torrent" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304555.606:56): user pid=4108 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="torrent" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304555.684:57): user pid=4109 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=changing home directory acct="torrent" exe="/usr/sbin/usermod" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1208304689.364:58): user pid=8067 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="haldaemon" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304689.366:59): user pid=8067 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="haldaemon" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304899.525:60): user pid=9192 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="gdm" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304899.525:61): user pid=9192 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="gdm" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304916.989:62): user pid=9216 uid=0 auid=4294967295 subj=system_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group acct="ntp" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304916.998:63): user pid=9217 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="ntp" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1208304916.999:64): user pid=9217 uid=0 auid=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="ntp" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1208305284.498:65): user pid=11081 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="floki" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1208305590.565:3182): auditd normal halt, sending auid=0 pid=11860 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208305590.793:6842): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.121.rc5.git4.fc9 auid=4294967295 pid=11874 res=success
>type=CONFIG_CHANGE msg=audit(1208305590.904:68): audit_enabled=1 old=1 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1208305590.911:69): audit_backlog_limit=320 old=320 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208307497.729:70): user pid=22962 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="floki" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1208307565.277:6843): auditd normal halt, sending auid=0 pid=23138 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208307655.730:35): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1831 res=success
>type=CONFIG_CHANGE msg=audit(1208307655.856:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208307681.549:5): user pid=2340 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208307681.566:6): user pid=2340 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208307681.571:7): user pid=2340 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208307681.645:8): login pid=2340 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208307681.712:9): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208307682.119:10): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208307682.137:11): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=CRED_DISP msg=audit(1208307709.517:12): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208307709.540:13): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208307722.530:14): user pid=2725 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208307722.534:15): user pid=2725 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208307722.546:16): user pid=2725 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208307722.622:17): login pid=2725 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1208307722.662:18): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208307723.046:19): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208307723.048:20): user pid=2725 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1208307749.608:21): user pid=2987 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208307749.609:22): user pid=2987 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208307749.659:23): user pid=2987 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1208307753.492:24): user pid=2987 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1208307787.584:25): user pid=3025 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208307787.585:26): user pid=3025 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208307787.592:27): user pid=3025 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1208307800.766:28): user pid=3025 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1208307874.715:36): auditd normal halt, sending auid=0 pid=3208 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208330179.280:7295): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1832 res=success
>type=CONFIG_CHANGE msg=audit(1208330179.405:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208330508.824:5): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208330508.828:6): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208330508.861:7): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208330508.932:8): login pid=2342 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208330508.986:9): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208330509.382:10): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208330509.410:11): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1208330623.375:12): user pid=2715 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208330623.376:13): user pid=2715 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208330623.453:14): user pid=2715 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1208330662.689:15): user pid=2715 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1208330678.173:16): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208330678.199:17): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_START msg=audit(1208330795.452:6309): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1855 res=success
>type=CONFIG_CHANGE msg=audit(1208330795.578:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208330979.567:5): user pid=2392 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208330979.571:6): user pid=2392 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208330979.585:7): user pid=2392 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208330979.656:8): login pid=2392 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208330979.715:9): user pid=2392 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208330980.121:10): user pid=2392 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208330980.132:11): user pid=2392 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_AUTH msg=audit(1208332482.811:12): user pid=3105 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="floki" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1208332705.899:13): user pid=3240 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/polkit-grant-helper-pam" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208332705.903:14): user pid=3240 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/libexec/polkit-grant-helper-pam" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208332705.968:15): avc:  denied  { getattr } for  pid=3251 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208332705.968:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=16a42a0 a2=fff a3=0 items=0 ppid=2051 pid=3251 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208332805.642:16): avc:  denied  { getattr } for  pid=3289 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208332805.642:16): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=14bb2a0 a2=fff a3=0 items=0 ppid=2051 pid=3289 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_ACCT msg=audit(1208332861.760:17): user pid=3313 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208332861.762:18): user pid=3313 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208332861.763:19): login pid=3313 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1208332861.767:20): user pid=3313 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208332861.860:21): user pid=3313 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208332861.860:22): user pid=3313 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1208332941.835:23): user pid=3366 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1208332941.838:24): user pid=3366 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1208332941.874:25): user pid=3366 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1208332941.875:26): user pid=3366 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1208332944.041:27): user pid=3366 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1208332944.041:28): user pid=3366 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1208332947.828:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 pid=2272 comm="Xorg" sig=6
>type=DAEMON_END msg=audit(1208332952.055:6310): auditd normal halt, sending auid=0 pid=3565 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208333016.305:7978): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1832 res=success
>type=CONFIG_CHANGE msg=audit(1208333016.439:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208333049.561:5): user pid=2369 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208333049.565:6): user pid=2369 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208333049.578:7): user pid=2369 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208333049.648:8): login pid=2369 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208333049.718:9): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208333050.166:10): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208333050.184:11): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208333058.346:12): avc:  denied  { getattr } for  pid=2629 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208333058.346:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=10c32a0 a2=fff a3=0 items=0 ppid=2028 pid=2629 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208333058.368:13): avc:  denied  { getattr } for  pid=2630 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208333058.368:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=21f42a0 a2=fff a3=0 items=0 ppid=2028 pid=2630 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208333058.387:14): avc:  denied  { getattr } for  pid=2631 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208333058.387:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=1b5b2a0 a2=fff a3=0 items=0 ppid=2028 pid=2631 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_AUTH msg=audit(1208333095.945:15): user pid=2674 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1208333095.948:16): user pid=2674 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1208333096.012:17): user pid=2674 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1208333096.012:18): user pid=2674 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=AVC msg=audit(1208333169.820:19): avc:  denied  { getattr } for  pid=2818 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208333169.820:19): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=6e02a0 a2=fff a3=0 items=0 ppid=2028 pid=2818 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208333172.114:20): avc:  denied  { getattr } for  pid=2825 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208333172.114:20): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=11682a0 a2=fff a3=0 items=0 ppid=2028 pid=2825 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208333175.496:21): avc:  denied  { getattr } for  pid=2837 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208333175.496:21): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=19c12a0 a2=fff a3=0 items=0 ppid=2028 pid=2837 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=CRED_DISP msg=audit(1208333194.144:22): user pid=2674 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1208333194.146:23): user pid=2674 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=DAEMON_END msg=audit(1208333205.043:7979): auditd normal halt, sending auid=0 pid=3001 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208368677.422:2813): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1831 res=success
>type=CONFIG_CHANGE msg=audit(1208368677.547:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208368841.838:5): user pid=2369 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208368841.842:6): user pid=2369 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208368841.855:7): user pid=2369 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208368841.924:8): login pid=2369 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208368841.999:9): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208368842.428:10): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208368842.441:11): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208368851.853:12): avc:  denied  { getattr } for  pid=2634 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208368851.853:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=62c2a0 a2=fff a3=0 items=0 ppid=2027 pid=2634 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208368851.876:13): avc:  denied  { getattr } for  pid=2635 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208368851.876:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=1e912a0 a2=fff a3=0 items=0 ppid=2027 pid=2635 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208368851.896:14): avc:  denied  { getattr } for  pid=2636 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208368851.896:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=9e02a0 a2=fff a3=0 items=0 ppid=2027 pid=2636 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_ACCT msg=audit(1208368861.889:15): user pid=2657 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208368861.890:16): user pid=2657 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208368861.891:17): login pid=2657 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1208368861.895:18): user pid=2657 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208368862.006:19): user pid=2657 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208368862.006:20): user pid=2657 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1208369474.268:21): avc:  denied  { getattr } for  pid=2950 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208369474.268:21): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=15592a0 a2=fff a3=0 items=0 ppid=2027 pid=2950 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208369482.378:22): avc:  denied  { getattr } for  pid=2968 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208369482.378:22): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=9b62a0 a2=fff a3=0 items=0 ppid=2027 pid=2968 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208369484.346:23): avc:  denied  { getattr } for  pid=2973 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208369484.346:23): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=1f612a0 a2=fff a3=0 items=0 ppid=2027 pid=2973 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=CRED_DISP msg=audit(1208369498.437:24): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208369498.487:25): user pid=2369 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1208369569.258:2814): auditd normal halt, sending auid=0 pid=3137 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208369633.796:4747): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1832 res=success
>type=CONFIG_CHANGE msg=audit(1208369633.922:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208369664.301:5): user pid=2370 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208369664.305:6): user pid=2370 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208369664.313:7): user pid=2370 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208369664.385:8): login pid=2370 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208369664.443:9): user pid=2370 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208369664.855:10): user pid=2370 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208369664.868:11): user pid=2370 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208369668.777:12): avc:  denied  { read } for  pid=2250 comm="Xorg" name="fonts.dir" dev=dm-0 ino=10412073 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208369668.777:12): arch=c000003e syscall=2 success=no exit=-13 a0=7fff3f882550 a1=0 a2=1b6 a3=7f9d3786c780 items=0 ppid=2249 pid=2250 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 ses=4294967295 comm="Xorg" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1208369706.617:13): user pid=2370 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208369706.656:14): user pid=2370 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208369726.155:15): user pid=2849 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208369726.160:16): user pid=2849 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208369726.171:17): user pid=2849 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208369726.247:18): login pid=2849 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1208369726.304:19): user pid=2849 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208369726.697:20): user pid=2849 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208369726.698:21): user pid=2849 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=CRED_DISP msg=audit(1208369742.298:22): user pid=2849 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208369742.316:23): user pid=2849 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1208369742.457:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 pid=2771 comm="Xorg" sig=6
>type=USER_AUTH msg=audit(1208369755.821:25): user pid=3185 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208369755.826:26): user pid=3185 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208369755.837:27): user pid=3185 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208369755.914:28): login pid=3185 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1208369755.949:29): user pid=3185 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208369756.325:30): user pid=3185 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208369756.326:31): user pid=3185 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=CRED_DISP msg=audit(1208371504.317:32): user pid=3185 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208371504.635:33): user pid=3185 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208371525.334:34): user pid=3885 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208371525.338:35): user pid=3885 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208371525.349:36): user pid=3885 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208371525.429:37): login pid=3885 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=4
>type=USER_ROLE_CHANGE msg=audit(1208371525.508:38): user pid=3885 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208371525.849:39): user pid=3885 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208371525.850:40): user pid=3885 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_ACCT msg=audit(1208372461.512:41): user pid=4567 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208372461.514:42): user pid=4567 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208372461.515:43): login pid=4567 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1208372461.550:44): user pid=4567 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208372461.857:45): user pid=4567 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208372461.857:46): user pid=4567 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208372488.135:47): user pid=3885 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208372488.349:48): user pid=3885 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208372506.103:49): user pid=4690 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208372506.108:50): user pid=4690 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208372506.121:51): user pid=4690 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208372506.198:52): login pid=4690 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=6
>type=USER_ROLE_CHANGE msg=audit(1208372506.252:53): user pid=4690 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208372506.610:54): user pid=4690 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208372506.635:55): user pid=4690 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_ACCT msg=audit(1208376061.895:56): user pid=15214 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208376061.896:57): user pid=15214 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208376061.897:58): login pid=15214 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1208376061.901:59): user pid=15214 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208376061.919:60): user pid=15214 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208376061.920:61): user pid=15214 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1208376186.057:62): user pid=15236 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="floki" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208379661.936:63): user pid=15498 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208379661.937:64): user pid=15498 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208379661.938:65): login pid=15498 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1208379661.942:66): user pid=15498 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208379661.959:67): user pid=15498 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208379661.960:68): user pid=15498 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=DAEMON_END msg=audit(1208382055.615:4748): auditd normal halt, sending auid=0 pid=15779 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208384250.322:7606): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1834 res=success
>type=CONFIG_CHANGE msg=audit(1208384250.456:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208384275.090:5): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208384275.094:6): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208384275.108:7): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208384275.183:8): login pid=2342 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208384275.264:9): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208384275.688:10): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208384275.712:11): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208384283.492:12): avc:  denied  { getattr } for  pid=2633 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208384283.492:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=184e2a0 a2=fff a3=0 items=0 ppid=2030 pid=2633 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208384283.514:13): avc:  denied  { getattr } for  pid=2634 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208384283.514:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=b702a0 a2=fff a3=0 items=0 ppid=2030 pid=2634 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208384283.542:14): avc:  denied  { getattr } for  pid=2635 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208384283.542:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=11122a0 a2=fff a3=0 items=0 ppid=2030 pid=2635 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208384435.568:15): avc:  denied  { getattr } for  pid=2726 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208384435.568:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=1e992a0 a2=fff a3=0 items=0 ppid=2030 pid=2726 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208384442.527:16): avc:  denied  { getattr } for  pid=2734 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208384442.527:16): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=25cd2a0 a2=fff a3=0 items=0 ppid=2030 pid=2734 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=CRED_DISP msg=audit(1208384735.030:17): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208384735.073:18): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208384748.981:19): user pid=2855 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208384748.986:20): user pid=2855 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208384748.994:21): user pid=2855 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208384749.074:22): login pid=2855 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1208384749.107:23): user pid=2855 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208384749.511:24): user pid=2855 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208384749.513:25): user pid=2855 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208384751.513:26): avc:  denied  { read } for  pid=2780 comm="Xorg" name="fonts.dir" dev=dm-0 ino=10412073 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208384751.513:26): arch=c000003e syscall=2 success=no exit=-13 a0=7fff1d6df3b0 a1=0 a2=1b6 a3=7fb4156c9780 items=0 ppid=2779 pid=2780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 ses=4294967295 comm="Xorg" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1208384780.915:27): user pid=2855 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208384780.919:28): user pid=2855 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1208384781.095:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 pid=2780 comm="Xorg" sig=6
>type=USER_AUTH msg=audit(1208384794.230:30): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208384794.234:31): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208384794.247:32): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208384794.326:33): login pid=3312 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1208384794.363:34): user pid=3312 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208384794.711:35): user pid=3312 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208384794.712:36): user pid=3312 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=USER_ACCT msg=audit(1208386861.527:37): user pid=3766 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208386861.529:38): user pid=3766 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208386861.530:39): login pid=3766 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1208386861.534:40): user pid=3766 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208386861.644:41): user pid=3766 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208386861.645:42): user pid=3766 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1208387589.089:43): user pid=3800 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_chkpwd_t:s0-s0:c0.c1023 msg='op=PAM:unix_chkpwd acct="floki" exe="/sbin/unix_chkpwd" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1208388568.489:7607): auditd normal halt, sending auid=0 pid=4061 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208388631.355:4687): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1832 res=success
>type=CONFIG_CHANGE msg=audit(1208388631.480:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208388846.176:5): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208388846.180:6): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208388846.193:7): user pid=2342 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208388846.262:8): login pid=2342 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208388846.332:9): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208388846.796:10): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208388846.814:11): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208388851.969:12): avc:  denied  { getattr } for  pid=2619 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208388851.969:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=18942a0 a2=fff a3=0 items=0 ppid=2030 pid=2619 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208388851.991:13): avc:  denied  { getattr } for  pid=2620 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208388851.991:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=1c592a0 a2=fff a3=0 items=0 ppid=2030 pid=2620 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208388852.028:14): avc:  denied  { getattr } for  pid=2621 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208388852.028:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=12e32a0 a2=fff a3=0 items=0 ppid=2030 pid=2621 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208389012.183:15): avc:  denied  { getattr } for  pid=2713 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389012.183:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=20182a0 a2=fff a3=0 items=0 ppid=2030 pid=2713 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208389253.591:16): avc:  denied  { getattr } for  pid=2739 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389253.591:16): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=19b12a0 a2=fff a3=0 items=0 ppid=2030 pid=2739 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=CRED_DISP msg=audit(1208389434.750:17): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208389434.785:18): user pid=2342 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208389447.477:19): user pid=2869 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208389447.481:20): user pid=2869 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208389447.490:21): user pid=2869 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208389447.561:22): login pid=2869 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1208389447.590:23): user pid=2869 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208389448.007:24): user pid=2869 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208389448.009:25): user pid=2869 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208389450.224:26): avc:  denied  { read } for  pid=2796 comm="Xorg" name="fonts.dir" dev=dm-0 ino=10412073 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208389450.224:26): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd3c5def0 a1=0 a2=1b6 a3=7f25cbc49780 items=0 ppid=2795 pid=2796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 ses=4294967295 comm="Xorg" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1208389542.460:27): user pid=2869 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208389542.483:28): user pid=2869 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1208389591.138:4688): auditd normal halt, sending auid=0 pid=3413 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208389657.504:5757): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1833 res=success
>type=CONFIG_CHANGE msg=audit(1208389657.638:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208389682.742:5): user pid=2341 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208389682.746:6): user pid=2341 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208389682.760:7): user pid=2341 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208389682.828:8): login pid=2341 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208389682.894:9): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208389683.343:10): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208389683.361:11): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208389688.067:12): avc:  denied  { getattr } for  pid=2615 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389688.067:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=bc12a0 a2=fff a3=0 items=0 ppid=2029 pid=2615 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208389688.094:13): avc:  denied  { getattr } for  pid=2616 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389688.094:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=1e172a0 a2=fff a3=0 items=0 ppid=2029 pid=2616 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208389688.148:14): avc:  denied  { getattr } for  pid=2618 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389688.148:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=17a52a0 a2=fff a3=0 items=0 ppid=2029 pid=2618 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208389709.222:15): avc:  denied  { getattr } for  pid=2667 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389709.222:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=16322a0 a2=fff a3=0 items=0 ppid=2029 pid=2667 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208389756.864:16): avc:  denied  { getattr } for  pid=2688 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208389756.864:16): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=d962a0 a2=fff a3=0 items=0 ppid=2029 pid=2688 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_AUTH msg=audit(1208390200.879:17): user pid=2835 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208390200.879:18): user pid=2835 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208390200.963:19): user pid=2835 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208390206.919:20): avc:  denied  { append } for  pid=2847 comm="semodule" path="/home/floki/.xsession-errors" dev=dm-0 ino=7741455 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390206.919:20): arch=c000003e syscall=59 success=yes exit=0 a0=1a74490 a1=1a74830 a2=1a73660 a3=386f567a70 items=0 ppid=2843 pid=2847 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
>type=MAC_STATUS msg=audit(1208390225.947:21): enforcing=0 old_enforcing=1 auid=500 ses=1
>type=USER_AVC msg=audit(1208390225.948:22): user pid=1848 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1208390225.947:21): arch=c000003e syscall=1 success=yes exit=1 a0=e a1=7fff4f1bc830 a2=1 a3=8101010101010100 items=0 ppid=2835 pid=2843 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="/usr/share/syst" exe="/usr/bin/python" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1208390244.677:23): user pid=2835 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208390254.938:24): avc:  denied  { getattr } for  pid=2873 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208390254.938:24): arch=c000003e syscall=0 success=yes exit=28 a0=4 a1=9052a0 a2=fff a3=0 items=0 ppid=2029 pid=2873 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_ACCT msg=audit(1208390461.769:25): user pid=2973 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1208390461.775:26): user pid=2973 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1208390461.776:27): login pid=2973 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1208390461.780:28): user pid=2973 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208390461.873:29): user pid=2973 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1208390461.873:30): user pid=2973 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1208390542.786:31): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208390542.857:32): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1208390559.345:33): user pid=3137 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208390559.350:34): user pid=3137 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208390559.358:35): user pid=3137 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208390559.429:36): login pid=3137 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1208390559.459:37): user pid=3137 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208390559.832:38): user pid=3137 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208390559.833:39): user pid=3137 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208390559.835:40): avc:  denied  { add_name } for  pid=3223 comm="gdm-session-wor" name=".xsession-errors" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
>type=AVC msg=audit(1208390559.835:40): avc:  denied  { create } for  pid=3223 comm="gdm-session-wor" name=".xsession-errors" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=AVC msg=audit(1208390559.835:40): avc:  denied  { append } for  pid=3223 comm="gdm-session-wor" name=".xsession-errors" dev=dm-0 ino=10412163 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390559.835:40): arch=c000003e syscall=2 success=yes exit=8 a0=dffbc0 a1=442 a2=180 a3=a0 items=0 ppid=3137 pid=3223 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390559.835:41): avc:  denied  { write } for  pid=3223 comm="gdm-session-wor" name=".xsession-errors" dev=dm-0 ino=10412163 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390559.835:41): arch=c000003e syscall=77 success=yes exit=0 a0=8 a1=0 a2=0 a3=a0 items=0 ppid=3137 pid=3223 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390559.835:42): avc:  denied  { setattr } for  pid=3223 comm="gdm-session-wor" name=".xsession-errors" dev=dm-0 ino=10412163 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390559.835:42): arch=c000003e syscall=91 success=yes exit=0 a0=8 a1=180 a2=0 a3=a0 items=0 ppid=3137 pid=3223 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390561.890:43): avc:  denied  { read } for  pid=3063 comm="Xorg" name="fonts.dir" dev=dm-0 ino=10412073 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390561.890:43): arch=c000003e syscall=2 success=yes exit=23 a0=7fffb44ca1a0 a1=0 a2=1b6 a3=7fbeac4b6780 items=0 ppid=3062 pid=3063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 ses=4294967295 comm="Xorg" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390561.890:44): avc:  denied  { getattr } for  pid=3063 comm="Xorg" path="/root/.gnome2/share/cursor-fonts/fonts.dir" dev=dm-0 ino=10412073 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390561.890:44): arch=c000003e syscall=5 success=yes exit=0 a0=17 a1=7fffb44c8cf0 a2=7fffb44c8cf0 a3=7fbeac4b6780 items=0 ppid=3062 pid=3063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 ses=4294967295 comm="Xorg" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390563.008:45): avc:  denied  { read append } for  pid=3376 comm="pam_timestamp_c" path="/root/.xsession-errors" dev=dm-0 ino=10412163 scontext=unconfined_u:unconfined_r:pam_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390563.008:45): arch=c000003e syscall=59 success=yes exit=0 a0=406131 a1=608800 a2=7fff32801168 a3=0 items=0 ppid=3370 pid=3376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="pam_timestamp_c" exe="/sbin/pam_timestamp_check" subj=unconfined_u:unconfined_r:pam_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390563.010:46): avc:  denied  { getattr } for  pid=3376 comm="pam_timestamp_c" path="/root/.xsession-errors" dev=dm-0 ino=10412163 scontext=unconfined_u:unconfined_r:pam_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390563.010:46): arch=c000003e syscall=5 success=yes exit=0 a0=2 a1=7ffffdd952f0 a2=7ffffdd952f0 a3=7ffffdd94f90 items=0 ppid=3370 pid=3376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="pam_timestamp_c" exe="/sbin/pam_timestamp_check" subj=unconfined_u:unconfined_r:pam_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1208390563.010:47): avc:  denied  { ioctl } for  pid=3376 comm="pam_timestamp_c" path="/root/.xsession-errors" dev=dm-0 ino=10412163 scontext=unconfined_u:unconfined_r:pam_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390563.010:47): arch=c000003e syscall=16 success=no exit=-25 a0=2 a1=5401 a2=7ffffdd95010 a3=7ffffdd94f90 items=0 ppid=3370 pid=3376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="pam_timestamp_c" exe="/sbin/pam_timestamp_check" subj=unconfined_u:unconfined_r:pam_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1208390584.215:48): user pid=3467 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208390584.216:49): user pid=3467 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208390584.224:50): user pid=3467 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1208390592.017:51): user pid=3467 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1208390888.209:52): user pid=3556 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208390888.211:53): user pid=3556 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208390888.219:54): user pid=3556 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208390893.424:55): avc:  denied  { append } for  pid=3561 comm="semodule" path="/root/.xsession-errors" dev=dm-0 ino=10412163 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208390893.424:55): arch=c000003e syscall=59 success=yes exit=0 a0=1b22490 a1=1b22830 a2=1b21660 a3=386f567a70 items=0 ppid=3560 pid=3561 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
>type=MAC_STATUS msg=audit(1208390901.220:56): enforcing=1 old_enforcing=0 auid=0 ses=3
>type=USER_AVC msg=audit(1208390901.226:57): user pid=1848 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=1) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1208390901.220:56): arch=c000003e syscall=1 success=yes exit=1 a0=e a1=7fffb848cb00 a2=1 a3=8101010101010100 items=0 ppid=3556 pid=3560 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="/usr/share/syst" exe="/usr/bin/python" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1208390904.967:58): user pid=3556 uid=0 auid=0 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1208390910.454:59): user pid=3137 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208390910.486:60): user pid=3137 uid=0 auid=0 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1208390910.625:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 pid=3063 comm="Xorg" sig=6
>type=USER_AUTH msg=audit(1208390921.351:62): user pid=3674 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208390921.355:63): user pid=3674 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208390921.367:64): user pid=3674 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208390921.440:65): login pid=3674 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=4
>type=USER_ROLE_CHANGE msg=audit(1208390921.476:66): user pid=3674 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208390921.823:67): user pid=3674 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208390921.825:68): user pid=3674 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=DAEMON_END msg=audit(1208390990.058:5758): auditd normal halt, sending auid=0 pid=4094 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208391055.422:5916): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1831 res=success
>type=CONFIG_CHANGE msg=audit(1208391055.556:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208391222.641:5): user pid=2341 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208391222.645:6): user pid=2341 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208391222.658:7): user pid=2341 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208391222.727:8): login pid=2341 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208391222.791:9): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208391223.256:10): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208391223.274:11): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208391227.829:12): avc:  denied  { getattr } for  pid=2615 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208391227.829:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=25ac2a0 a2=fff a3=0 items=0 ppid=2029 pid=2615 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208391227.850:13): avc:  denied  { getattr } for  pid=2616 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208391227.850:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=e172a0 a2=fff a3=0 items=0 ppid=2029 pid=2616 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208391227.868:14): avc:  denied  { getattr } for  pid=2617 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208391227.868:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=22452a0 a2=fff a3=0 items=0 ppid=2029 pid=2617 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208391242.223:15): avc:  denied  { getattr } for  pid=2661 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208391242.223:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=17ed2a0 a2=fff a3=0 items=0 ppid=2029 pid=2661 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_AUTH msg=audit(1208391823.722:16): user pid=2783 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208391823.722:17): user pid=2783 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208391823.797:18): user pid=2783 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208391829.925:19): avc:  denied  { append } for  pid=2792 comm="semodule" path="/home/floki/.xsession-errors" dev=dm-0 ino=7741455 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208391829.925:19): arch=c000003e syscall=59 success=yes exit=0 a0=d21490 a1=d21830 a2=d20660 a3=386f567a70 items=0 ppid=2788 pid=2792 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
>type=MAC_STATUS msg=audit(1208391838.029:20): enforcing=0 old_enforcing=1 auid=500 ses=1
>type=SYSCALL msg=audit(1208391838.029:20): arch=c000003e syscall=1 success=yes exit=1 a0=e a1=7fff4ed503c0 a2=1 a3=8101010101010100 items=0 ppid=2783 pid=2788 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="/usr/share/syst" exe="/usr/bin/python" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1208391838.032:21): user pid=1846 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=0) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=USER_END msg=audit(1208391840.434:22): user pid=2783 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208391848.421:23): avc:  denied  { getattr } for  pid=2806 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208391848.421:23): arch=c000003e syscall=0 success=yes exit=28 a0=4 a1=25ff2a0 a2=fff a3=0 items=0 ppid=2029 pid=2806 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_AUTH msg=audit(1208391886.448:24): user pid=2831 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1208391886.449:25): user pid=2831 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208391886.456:26): user pid=2831 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1208391892.037:27): avc:  denied  { append } for  pid=2838 comm="semodule" path="/home/floki/.xsession-errors" dev=dm-0 ino=7741455 scontext=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_t:s0 tclass=file
>type=SYSCALL msg=audit(1208391892.037:27): arch=c000003e syscall=59 success=yes exit=0 a0=1555490 a1=1555830 a2=1554660 a3=386f567a70 items=0 ppid=2834 pid=2838 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1208391925.028:28): user pid=2865 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1208391925.031:29): user pid=2865 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1208391925.066:30): user pid=2865 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1208391925.066:31): user pid=2865 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=MAC_STATUS msg=audit(1208391950.765:32): enforcing=1 old_enforcing=0 auid=500 ses=1
>type=USER_AVC msg=audit(1208391950.771:33): user pid=1846 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received setenforce notice (enforcing=1) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=SYSCALL msg=audit(1208391950.765:32): arch=c000003e syscall=1 success=yes exit=1 a0=e a1=7fff6eb2f1a0 a2=1 a3=8101010101010100 items=0 ppid=2831 pid=2834 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="/usr/share/syst" exe="/usr/bin/python" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1208391989.504:34): user pid=2865 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1208391989.507:35): user pid=2865 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1208391989.616:36): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208391989.646:37): user pid=2341 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1208391989.847:38): user pid=2831 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1208391999.787:39): user pid=3018 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208391999.791:40): user pid=3018 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208391999.802:41): user pid=3018 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208391999.875:42): login pid=3018 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1208391999.914:43): user pid=3018 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208392000.290:44): user pid=3018 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208392000.292:45): user pid=3018 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208392002.721:46): avc:  denied  { getattr } for  pid=3247 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392002.721:46): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=13412a0 a2=fff a3=0 items=0 ppid=2029 pid=3247 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208392002.804:47): avc:  denied  { getattr } for  pid=3249 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392002.804:47): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=22472a0 a2=fff a3=0 items=0 ppid=2029 pid=3249 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=DAEMON_END msg=audit(1208392050.326:5917): auditd normal halt, sending auid=0 pid=3458 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1208392112.570:3171): auditd start, ver=1.7.1 format=raw kernel=2.6.25-0.218.rc8.git7.fc9.x86_64 auid=4294967295 pid=1832 res=success
>type=CONFIG_CHANGE msg=audit(1208392112.695:4): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1208392281.677:5): user pid=2340 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1208392281.693:6): user pid=2340 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1208392281.697:7): user pid=2340 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1208392281.766:8): login pid=2340 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1208392281.838:9): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1208392282.278:10): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="floki" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1208392282.296:11): user pid=2340 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty7 res=success)'
>type=AVC msg=audit(1208392289.184:12): avc:  denied  { getattr } for  pid=2630 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392289.184:12): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=18982a0 a2=fff a3=0 items=0 ppid=2028 pid=2630 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208392289.226:13): avc:  denied  { getattr } for  pid=2632 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392289.226:13): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=7b62a0 a2=fff a3=0 items=0 ppid=2028 pid=2632 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208392289.271:14): avc:  denied  { getattr } for  pid=2634 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392289.271:14): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=c072a0 a2=fff a3=0 items=0 ppid=2028 pid=2634 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208392384.188:15): avc:  denied  { getattr } for  pid=2764 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392384.188:15): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=18442a0 a2=fff a3=0 items=0 ppid=2028 pid=2764 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=USER_AUTH msg=audit(1208392592.122:16): user pid=2805 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1208392592.125:17): user pid=2805 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1208392592.189:18): user pid=2805 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1208392592.190:19): user pid=2805 uid=500 auid=500 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=AVC msg=audit(1208392737.799:20): avc:  denied  { getattr } for  pid=2853 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392737.799:20): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=119f2a0 a2=fff a3=0 items=0 ppid=2028 pid=2853 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)
>type=AVC msg=audit(1208392823.568:21): avc:  denied  { getattr } for  pid=2865 comm="polkit-resolve-" scontext=system_u:system_r:hald_t:s0 tcontext=system_u:system_r:hald_t:s0 tclass=process
>type=SYSCALL msg=audit(1208392823.568:21): arch=c000003e syscall=0 success=no exit=-13 a0=4 a1=c282a0 a2=fff a3=0 items=0 ppid=2028 pid=2865 auid=4294967295 uid=0 gid=68 euid=0 suid=0 fsuid=0 egid=68 sgid=68 fsgid=68 tty=(none) ses=4294967295 comm="polkit-resolve-" exe="/usr/libexec/polkit-resolve-exe-helper" subj=system_u:system_r:hald_t:s0 key=(null)

Actions: View

Attachments on bug 442823: 302687 | 302688