Attachment 313489 Details for Bug 457981 – Series of avc alerts from targeted policy

Series of avc alerts from targeted policy

ntp-avc.txt (text/plain), 7.56 KB, created by Rich Johnson on 2008-08-05 21:49:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rich Johnson

Created: 2008-08-05 21:49:45 UTC

Size: 7.56 KB

patch

obsolete

>----
>time->Tue Aug  5 14:43:06 2008
>type=SYSCALL msg=audit(1217961786.760:155): arch=c000003e syscall=2 success=yes exit=4 a0=2b832a26b850 a1=241 a2=1b6 a3=241 items=0 ppid=1 pid=15167 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217961786.760:155): avc:  denied  { create } for  pid=15167 comm="ntpd" name="drift.TEMP" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217961786.760:155): avc:  denied  { add_name } for  pid=15167 comm="ntpd" name="drift.TEMP" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>type=AVC msg=audit(1217961786.760:155): avc:  denied  { write } for  pid=15167 comm="ntpd" name="ntp" dev=md2 ino=4982434 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>----
>time->Tue Aug  5 14:43:06 2008
>type=SYSCALL msg=audit(1217961786.760:156): arch=c000003e syscall=1 success=yes exit=6 a0=4 a1=2b830b970000 a2=6 a3=22 items=0 ppid=1 pid=15167 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217961786.760:156): avc:  denied  { write } for  pid=15167 comm="ntpd" path="/etc/ntp/drift.TEMP" dev=md2 ino=4982098 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>----
>time->Tue Aug  5 14:43:06 2008
>type=SYSCALL msg=audit(1217961786.760:157): arch=c000003e syscall=82 success=yes exit=0 a0=2b832a26b850 a1=2b832a26b830 a2=2b830c8dea00 a3=0 items=0 ppid=1 pid=15167 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217961786.760:157): avc:  denied  { unlink } for  pid=15167 comm="ntpd" name="drift" dev=md2 ino=4981345 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217961786.760:157): avc:  denied  { rename } for  pid=15167 comm="ntpd" name="drift.TEMP" dev=md2 ino=4982098 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217961786.760:157): avc:  denied  { remove_name } for  pid=15167 comm="ntpd" name="drift.TEMP" dev=md2 ino=4982098 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>----
>time->Tue Aug  5 15:46:44 2008
>type=SYSCALL msg=audit(1217965604.896:147): arch=c000003e syscall=2 success=yes exit=4 a0=2adc5bd97850 a1=241 a2=1b6 a3=241 items=0 ppid=1 pid=13414 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217965604.896:147): avc:  denied  { create } for  pid=13414 comm="ntpd" name="drift.TEMP" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217965604.896:147): avc:  denied  { add_name } for  pid=13414 comm="ntpd" name="drift.TEMP" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>type=AVC msg=audit(1217965604.896:147): avc:  denied  { write } for  pid=13414 comm="ntpd" name="ntp" dev=md2 ino=4982434 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>----
>time->Tue Aug  5 15:46:44 2008
>type=SYSCALL msg=audit(1217965604.896:148): arch=c000003e syscall=1 success=yes exit=6 a0=4 a1=2adc4596b000 a2=6 a3=22 items=0 ppid=1 pid=13414 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217965604.896:148): avc:  denied  { write } for  pid=13414 comm="ntpd" path="/etc/ntp/drift.TEMP" dev=md2 ino=4982100 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>----
>time->Tue Aug  5 15:46:44 2008
>type=SYSCALL msg=audit(1217965604.896:149): arch=c000003e syscall=82 success=yes exit=0 a0=2adc5bd97850 a1=2adc5bd97830 a2=2adc468d9a00 a3=0 items=0 ppid=1 pid=13414 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217965604.896:149): avc:  denied  { unlink } for  pid=13414 comm="ntpd" name="drift" dev=md2 ino=4982098 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217965604.896:149): avc:  denied  { rename } for  pid=13414 comm="ntpd" name="drift.TEMP" dev=md2 ino=4982100 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217965604.896:149): avc:  denied  { remove_name } for  pid=13414 comm="ntpd" name="drift.TEMP" dev=md2 ino=4982100 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>----
>time->Tue Aug  5 16:11:32 2008
>type=SYSCALL msg=audit(1217967092.042:251): arch=c000003e syscall=2 success=yes exit=4 a0=2adc5bd97850 a1=241 a2=1b6 a3=241 items=0 ppid=1 pid=13414 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217967092.042:251): avc:  denied  { create } for  pid=13414 comm="ntpd" name="drift.TEMP" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217967092.042:251): avc:  denied  { add_name } for  pid=13414 comm="ntpd" name="drift.TEMP" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>type=AVC msg=audit(1217967092.042:251): avc:  denied  { write } for  pid=13414 comm="ntpd" name="ntp" dev=md2 ino=4982434 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir
>----
>time->Tue Aug  5 16:11:32 2008
>type=SYSCALL msg=audit(1217967092.043:252): arch=c000003e syscall=1 success=yes exit=6 a0=4 a1=2adc4596b000 a2=6 a3=22 items=0 ppid=1 pid=13414 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217967092.043:252): avc:  denied  { write } for  pid=13414 comm="ntpd" path="/etc/ntp/drift.TEMP" dev=md2 ino=4982089 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>----
>time->Tue Aug  5 16:11:32 2008
>type=SYSCALL msg=audit(1217967092.043:253): arch=c000003e syscall=82 success=yes exit=0 a0=2adc5bd97850 a1=2adc5bd97830 a2=2adc468d9a00 a3=22 items=0 ppid=1 pid=13414 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
>type=AVC msg=audit(1217967092.043:253): avc:  denied  { unlink } for  pid=13414 comm="ntpd" name="drift" dev=md2 ino=4982100 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217967092.043:253): avc:  denied  { rename } for  pid=13414 comm="ntpd" name="drift.TEMP" dev=md2 ino=4982089 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file
>type=AVC msg=audit(1217967092.043:253): avc:  denied  { remove_name } for  pid=13414 comm="ntpd" name="drift.TEMP" dev=md2 ino=4982089 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir

Actions: View

Attachments on bug 457981: 313489