Attachment 304128 Details for Bug 444550 – ausearch -m avc (after auditctl -a exit,always -S kill -F pid=1 )

ausearch -m avc (after auditctl -a exit,always -S kill -F pid=1 )

bz-444550_ausearch_avc_(after auditctl -a exit,always -S kill -F pid=1).txt (text/plain), 3.24 KB, created by Richard Hartley on 2008-04-29 15:19:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Richard Hartley

Created: 2008-04-29 15:19:09 UTC

Size: 3.24 KB

patch

obsolete

>----
>time->Thu Apr 24 23:42:48 2008
>type=SYSCALL msg=audit(1209076968.068:189): arch=c000003e syscall=165 success=yes exit=0 a0=7f02d5bde590 a1=7f02d5bde5b0 a2=7f02d5bde5d0 a3=ffffffffc0ed0007 items=0 ppid=5993 pid=5996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null)
>type=AVC msg=audit(1209076968.068:189): avc:  denied  { write } for  pid=5996 comm="mount" dev=bdev ino=0 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
>----
>time->Sun Apr 27 22:08:40 2008
>type=SYSCALL msg=audit(1209330520.093:25): arch=c000003e syscall=165 success=yes exit=0 a0=7f2086a42590 a1=7f2086a425b0 a2=7f2086a425d0 a3=ffffffffc0ed0007 items=0 ppid=3007 pid=3010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null)
>type=AVC msg=audit(1209330520.093:25): avc:  denied  { write } for  pid=3010 comm="mount" dev=bdev ino=0 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
>----
>time->Tue Apr 29 02:42:17 2008
>type=SYSCALL msg=audit(1209433337.954:12): arch=c000003e syscall=165 success=yes exit=0 a0=7f516fa1c590 a1=7f516fa1c5b0 a2=7f516fa1c5d0 a3=ffffffffc0ed0007 items=0 ppid=2912 pid=2915 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null)
>type=AVC msg=audit(1209433337.954:12): avc:  denied  { write } for  pid=2915 comm="mount" dev=bdev ino=0 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
>----
>time->Tue Apr 29 15:36:59 2008
>type=SYSCALL msg=audit(1209479819.809:12): arch=c000003e syscall=165 success=yes exit=0 a0=7ffd2970f590 a1=7ffd2970f5b0 a2=7ffd2970f5d0 a3=ffffffffc0ed0007 items=0 ppid=2854 pid=2857 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null)
>type=AVC msg=audit(1209479819.809:12): avc:  denied  { write } for  pid=2857 comm="mount" dev=bdev ino=0 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
>----
>time->Tue Apr 29 16:10:21 2008
>type=PATH msg=audit(1209481821.581:24): item=1 name=(null) inode=5182 dev=00:0f mode=060640 ouid=0 ogid=19 rdev=02:00 obj=system_u:object_r:removable_device_t:s0
>type=PATH msg=audit(1209481821.581:24): item=0 name="/media/MAC-2-PC" inode=240239 dev=08:02 mode=040700 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:mnt_t:s0
>type=CWD msg=audit(1209481821.581:24):  cwd="/"
>type=SYSCALL msg=audit(1209481821.581:24): arch=c000003e syscall=165 success=yes exit=0 a0=7fd1488be590 a1=7fd1488be5b0 a2=7fd1488be5d0 a3=ffffffffc0ed0007 items=2 ppid=3243 pid=3244 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null)
>type=AVC msg=audit(1209481821.581:24): avc:  denied  { write } for  pid=3244 comm="mount" dev=bdev ino=0 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
>

Actions: View

Attachments on bug 444550: 304115 | 304125 | 304128