Attachment 315626 Details for Bug 460873 – audit

audit

audit2.log (text/plain), 6.74 KB, created by Marcela Mašláňová on 2008-09-03 09:11:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcela Mašláňová

Created: 2008-09-03 09:11:53 UTC

Size: 6.74 KB

patch

obsolete

>type=USER_ACCT msg=audit(1220430654.393:587): user pid=3671 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_crontab_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="marca" exe="/usr/bin/at" (hostname=?, addr=?, terminal=atd res=success)'                                                                                                                     
>type=LOGIN msg=audit(1220430654.394:588): login pid=3671 uid=0 old auid=500 new auid=500 old ses=36 new ses=79                                                                      
>type=USER_START msg=audit(1220430654.397:589): user pid=3671 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_crontab_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="marca" exe="/usr/bin/at" (hostname=?, addr=?, terminal=atd res=success)'                                                                                                                  
>type=CRED_ACQ msg=audit(1220430654.397:590): user pid=3671 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_crontab_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="marca" exe="/usr/bin/at" (hostname=?, addr=?, terminal=atd res=success)'
>type=CRED_DISP msg=audit(1220430654.397:591): user pid=3671 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_crontab_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="marca" exe="/usr/bin/at" (hostname=?, addr=?, terminal=atd res=success)'
>type=USER_END msg=audit(1220430654.398:592): user pid=3671 uid=0 auid=500 subj=unconfined_u:unconfined_r:unconfined_crontab_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="marca"exe="/usr/bin/at" (hostname=?, addr=?, terminal=atd res=success)'
>type=USER_ACCT msg=audit(1220430658.961:593): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=LOGIN msg=audit(1220430658.961:594): login pid=3677 uid=0 old auid=500 new auid=500 old ses=36 new ses=80
>type=USER_START msg=audit(1220430658.964:595): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=CRED_ACQ msg=audit(1220430658.964:596): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=CRED_DISP msg=audit(1220430658.994:597): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=USER_END msg=audit(1220430658.994:598): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=USER_ACCT msg=audit(1220430658.998:599): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=LOGIN msg=audit(1220430658.998:600): login pid=3677 uid=0 old auid=500 new auid=500 old ses=80 new ses=81
>type=USER_START msg=audit(1220430658.999:601): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=CRED_ACQ msg=audit(1220430658.999:602): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=AVC msg=audit(1220430659.001:603): avc:  denied  { read } for  pid=3682 comm="sendmail" path=2F7661722F73706F6F6C2F61742F73706F6F6C2F6130303030613031333635663165202864656C6574656429 dev=dm-1 ino=778763 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:cron_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1220430659.001:603): arch=40000003 syscall=11 success=yes exit=0 a0=804c0b0 a1=bf82b2cc a2=bf82c6fc a3=2 items=0 ppid=3677 pid=3682 auid=500 uid=500 gid=500euid=500 suid=500 fsuid=500 egid=51 sgid=51 fsgid=51 tty=(none) ses=81 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1220430659.005:604): avc:  denied  { getattr } for  pid=3682 comm="sendmail" path=2F7661722F73706F6F6C2F61742F73706F6F6C2F6130303030613031333635663165202864656C6574656429 dev=dm-1 ino=778763 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:cron_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1220430659.005:604): arch=40000003 syscall=197 success=yes exit=0 a0=0 a1=bf867e84 a2=64dff4 a3=0 items=0 ppid=3677 pid=3682 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=51 sgid=51 fsgid=51 tty=(none) ses=81 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1220430659.008:605): avc:  denied  { ioctl } for  pid=3682 comm="sendmail" path=2F7661722F73706F6F6C2F61742F73706F6F6C2F6130303030613031333635663165202864656C6574656429 dev=dm-1 ino=778763 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:cron_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1220430659.008:605): arch=40000003 syscall=54 success=no exit=-25 a0=0 a1=5401 a2=bf867cf8 a3=bf867d38 items=0 ppid=3677 pid=3682 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=51 sgid=51 fsgid=51 tty=(none) ses=81 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1220430659.011:606): avc:  denied  { read } for  pid=3682 comm="sendmail" path=2F7661722F73706F6F6C2F61742F73706F6F6C2F6130303030613031333635663165202864656C6574656429 dev=dm-1 ino=778763 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:cron_spool_t:s0 tclass=file
>type=SYSCALL msg=audit(1220430659.011:606): arch=40000003 syscall=3 success=yes exit=55 a0=0 a1=b9d90990 a2=1000 a3=b806dd80 items=0 ppid=3677 pid=3682 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=51 sgid=51 fsgid=51 tty=(none) ses=81 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1220430659.524:607): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>type=USER_END msg=audit(1220430659.524:608): user pid=3677 uid=0 auid=500 subj=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="marca" exe="/usr/sbin/atd" (hostname=?, addr=?, terminal=atd res=success)'
>

Actions: View

Attachments on bug 460873: 315625 | 315626 | 316674 | 316856