Attachment 304683 Details for Bug 445043 – Audit log from bootup to 1st login

Audit log from bootup to 1st login

audit.log (text/plain), 2.88 KB, created by IBM Bug Proxy on 2008-05-06 20:24:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: IBM Bug Proxy

Created: 2008-05-06 20:24:43 UTC

Size: 2.88 KB

patch

obsolete

>type=DAEMON_END msg=audit(1209761272.548:2152): auditd normal halt, sending auid=4294967295 pid=2840 subj=system_u:system_r:initrc_t:s0-s15:c0.c1023 res=success, auditd pid=2403
>type=DAEMON_START msg=audit(1209761578.408:2773): auditd start, ver=1.5.5, format=raw, auid=4294967295 pid=2700 res=success, auditd pid=2700
>type=CONFIG_CHANGE msg=audit(1209761578.508:146): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s15:c0.c1023 res=1
>type=CONFIG_CHANGE msg=audit(1209761578.508:147): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=AVC msg=audit(1209761579.512:148): avc:  denied  { sys_nice } for  pid=2771 comm="modprobe" capability=23 scontext=system_u:system_r:insmod_t:s0-s15:c0.c1023 tcontext=system_u:system_r:insmod_t:s0-s15:c0.c1023 tclass=capability
>type=SYSCALL msg=audit(1209761579.512:148): arch=c000003e syscall=175 success=yes exit=0 a0=6222c0 a1=a3a0 a2=61bd10 a3=61bd10 items=0 ppid=2764 pid=2771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0-s15:c0.c1023 key=(null)
>type=LABEL_LEVEL_CHANGE msg=audit(1209761582.375:149): user pid=2814 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s15:c0.c1023 msg='[Config] Classification=mls: exe="/usr/sbin/cupsd" (hostname=bracer2.ltc.austin.ibm.com, addr=9.3.192.193, terminal=? res=success)'
>type=USER_AUTH msg=audit(1209761757.508:150): user pid=2964 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: authentication acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS1 res=success)'
>type=USER_ACCT msg=audit(1209761757.512:151): user pid=2964 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: accounting acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS1 res=success)'
>type=LOGIN msg=audit(1209761757.524:152): login pid=2964 uid=0 old auid=4294967295 new auid=0
>type=USER_ROLE_CHANGE msg=audit(1209761758.939:153): user pid=2964 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='pam: default-context=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 selected-context=root:sysadm_r:sysadm_t:s0-s15:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=ttyS1 res=success)'
>type=USER_START msg=audit(1209761758.944:154): user pid=2964 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: session open acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS1 res=success)'
>type=CRED_ACQ msg=audit(1209761758.951:155): user pid=2964 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: setcred acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS1 res=success)'
>type=USER_LOGIN msg=audit(1209761758.952:156): user pid=2964 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=ttyS1 res=success)'

Actions: View

Attachments on bug 445043: 304683 | 304684 | 304703 | 304704