Attachment 573371 Details for Bug 795966 – audit logs for above avc messages

audit logs for above avc messages

audit.log (text/plain), 23.36 KB, created by Ade Lee on 2012-03-28 15:17:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ade Lee

Created: 2012-03-28 15:17:12 UTC

Size: 23.36 KB

patch

obsolete

>type=MAC_POLICY_LOAD msg=audit(1332946394.211:2098): policy loaded auid=0 ses=50
>type=SYSCALL msg=audit(1332946394.211:2098): arch=c000003e syscall=1 success=yes exit=4453890 a0=4 a1=7ff7a34a2010 a2=43f602 a3=7fff12bc6cf0 items=0 ppid=10411 pid=10412 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=50 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1332946420.680:2099): avc:  denied  { chown } for  pid=10441 comm="chown" capability=0  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946420.680:2099): arch=c000003e syscall=260 success=yes exit=0 a0=ffffffffffffff9c a1=16b4870 a2=11 a3=11 items=0 ppid=10439 pid=10441 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chown" exe="/usr/bin/chown" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946420.701:2100): avc:  denied  { dac_override } for  pid=10442 comm="touch" capability=1  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946420.701:2100): arch=c000003e syscall=2 success=yes exit=3 a0=7fffcfbdac17 a1=941 a2=1b6 a3=7fffcfbd88c0 items=0 ppid=10439 pid=10442 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="touch" exe="/usr/bin/touch" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946420.843:2101): avc:  denied  { search } for  pid=10448 comm="runuser" name="kernel" dev=proc ino=8762 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir
>type=AVC msg=audit(1332946420.843:2101): avc:  denied  { read } for  pid=10448 comm="runuser" name="ngroups_max" dev=proc ino=13993 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file
>type=AVC msg=audit(1332946420.843:2101): avc:  denied  { open } for  pid=10448 comm="runuser" name="ngroups_max" dev=proc ino=13993 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file
>type=SYSCALL msg=audit(1332946420.843:2101): arch=c000003e syscall=2 success=yes exit=3 a0=7f0051532545 a1=0 a2=0 a3=7fff0b0477a0 items=0 ppid=10439 pid=10448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946420.846:2102): avc:  denied  { setgid } for  pid=10448 comm="runuser" capability=6  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946420.846:2102): arch=c000003e syscall=116 success=yes exit=0 a0=1 a1=794100 a2=2 a3=7f005176b7b8 items=0 ppid=10439 pid=10448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946420.847:2103): avc:  denied  { create } for  pid=10448 comm="runuser" scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=netlink_audit_socket
>type=SYSCALL msg=audit(1332946420.847:2103): arch=c000003e syscall=41 success=yes exit=3 a0=10 a1=3 a2=9 a3=7fff0b047730 items=0 ppid=10439 pid=10448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946420.849:2104): avc:  denied  { nlmsg_relay } for  pid=10448 comm="runuser" scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=netlink_audit_socket
>type=AVC msg=audit(1332946420.849:2104): avc:  denied  { audit_write } for  pid=10448 comm="runuser" capability=29  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=CRED_ACQ msg=audit(1332946420.850:2105): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:setcred acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=SYSCALL msg=audit(1332946420.849:2104): arch=c000003e syscall=44 success=yes exit=112 a0=3 a1=7fff0b03cae0 a2=70 a3=0 items=0 ppid=10439 pid=10448 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946420.851:2106): avc:  denied  { setuid } for  pid=10448 comm="runuser" capability=7  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946420.851:2106): arch=c000003e syscall=113 success=yes exit=0 a0=11 a1=ffffffff a2=11 a3=1f items=0 ppid=10439 pid=10448 auid=4294967295 uid=17 gid=17 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=USER_START msg=audit(1332946420.872:2107): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:session_open acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1332946421.065:2108): avc:  denied  { execute } for  pid=10453 comm="sh" name="hostname" dev=dm-0 ino=791622 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=AVC msg=audit(1332946421.065:2108): avc:  denied  { read open } for  pid=10453 comm="sh" name="hostname" dev=dm-0 ino=791622 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=AVC msg=audit(1332946421.065:2108): avc:  denied  { execute_no_trans } for  pid=10453 comm="sh" path="/usr/bin/hostname" dev=dm-0 ino=791622 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1332946421.065:2108): arch=c000003e syscall=59 success=yes exit=0 a0=10af200 a1=10affa0 a2=10b1a70 a3=7fff526d0eb0 items=0 ppid=10452 pid=10453 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="hostname" exe="/usr/bin/hostname" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946421.112:2109): avc:  denied  { execute } for  pid=10455 comm="sh" name="consoletype" dev=dm-0 ino=804079 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
>type=AVC msg=audit(1332946421.112:2109): avc:  denied  { read open } for  pid=10455 comm="sh" name="consoletype" dev=dm-0 ino=804079 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
>type=AVC msg=audit(1332946421.112:2109): avc:  denied  { execute_no_trans } for  pid=10455 comm="sh" path="/usr/sbin/consoletype" dev=dm-0 ino=804079 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:consoletype_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1332946421.112:2109): arch=c000003e syscall=59 success=yes exit=0 a0=10bdfa0 a1=10bdd10 a2=10be130 a3=7fff526d0080 items=0 ppid=10454 pid=10455 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="consoletype" exe="/usr/sbin/consoletype" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946421.302:2110): avc:  denied  { execute_no_trans } for  pid=10465 comm="build-classpath" path="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.1.x86_64/jre/bin/java" dev=dm-0 ino=793805 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1332946421.302:2110): arch=c000003e syscall=59 success=yes exit=0 a0=2330fc0 a1=2331010 a2=23470e0 a3=7fffca754160 items=0 ppid=10464 pid=10465 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.1.x86_64/jre/bin/java" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=USER_END msg=audit(1332946421.785:2111): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:session_close acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1332946421.794:2112): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:setcred acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1332946421.984:2113): avc:  denied  { read } for  pid=10479 comm="java" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev=hugetlbfs ino=441643 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1332946421.984:2113): arch=c000003e syscall=9 success=no exit=-12 a0=0 a1=200000 a2=3 a3=40022 items=0 ppid=1 pid=10479 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.1.x86_64/jre/bin/java" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946424.670:2114): avc:  denied  { name_bind } for  pid=10479 comm="java" src=9580 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1332946424.670:2114): arch=c000003e syscall=49 success=yes exit=0 a0=27 a1=7fad46813bc0 a2=1c a3=7fad46813940 items=0 ppid=1 pid=10479 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.1.x86_64/jre/bin/java" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=SERVICE_START msg=audit(1332946426.204:2115): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="pki-cad@pki-subca" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1332946871.264:2116): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1332946871.284:2117): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1332946873.017:2118): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1332946873.018:2119): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1332946873.670:2120): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="pki-cad@pki-subca" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=AVC msg=audit(1332946874.148:2121): avc:  denied  { dac_override } for  pid=10722 comm="touch" capability=1  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946874.148:2121): arch=c000003e syscall=2 success=yes exit=3 a0=7fffdeda3c24 a1=941 a2=1b6 a3=7fffdeda2e10 items=0 ppid=10721 pid=10722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="touch" exe="/usr/bin/touch" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946874.149:2122): avc:  denied  { fowner } for  pid=10722 comm="touch" capability=3  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946874.149:2122): arch=c000003e syscall=280 success=yes exit=0 a0=0 a1=0 a2=0 a3=0 items=0 ppid=10721 pid=10722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="touch" exe="/usr/bin/touch" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946874.172:2123): avc:  denied  { chown } for  pid=10723 comm="chown" capability=0  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946874.172:2123): arch=c000003e syscall=260 success=yes exit=0 a0=ffffffffffffff9c a1=1452870 a2=11 a3=11 items=0 ppid=10721 pid=10723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chown" exe="/usr/bin/chown" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946874.323:2124): avc:  denied  { setgid } for  pid=10730 comm="runuser" capability=6  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946874.323:2124): arch=c000003e syscall=116 success=yes exit=0 a0=1 a1=b9b100 a2=2 a3=7faed7f8a7b8 items=0 ppid=10721 pid=10730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946874.324:2125): avc:  denied  { create } for  pid=10730 comm="runuser" scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=netlink_audit_socket
>type=SYSCALL msg=audit(1332946874.324:2125): arch=c000003e syscall=41 success=yes exit=3 a0=10 a1=3 a2=9 a3=7fff6ea531e0 items=0 ppid=10721 pid=10730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946874.326:2126): avc:  denied  { nlmsg_relay } for  pid=10730 comm="runuser" scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=netlink_audit_socket
>type=AVC msg=audit(1332946874.326:2126): avc:  denied  { audit_write } for  pid=10730 comm="runuser" capability=29  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=CRED_ACQ msg=audit(1332946874.327:2127): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:setcred acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=SYSCALL msg=audit(1332946874.326:2126): arch=c000003e syscall=44 success=yes exit=112 a0=3 a1=7fff6ea48590 a2=70 a3=0 items=0 ppid=10721 pid=10730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=AVC msg=audit(1332946874.328:2128): avc:  denied  { setuid } for  pid=10730 comm="runuser" capability=7  scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:system_r:pki_ca_t:s0 tclass=capability
>type=SYSCALL msg=audit(1332946874.328:2128): arch=c000003e syscall=113 success=yes exit=0 a0=11 a1=ffffffff a2=11 a3=1f items=0 ppid=10721 pid=10730 auid=4294967295 uid=17 gid=17 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="runuser" exe="/usr/sbin/runuser" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=USER_START msg=audit(1332946874.343:2129): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:session_open acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1332946874.422:2130): avc:  denied  { execute } for  pid=10735 comm="sh" name="hostname" dev=dm-0 ino=791622 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=AVC msg=audit(1332946874.422:2130): avc:  denied  { read open } for  pid=10735 comm="sh" name="hostname" dev=dm-0 ino=791622 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=AVC msg=audit(1332946874.422:2130): avc:  denied  { execute_no_trans } for  pid=10735 comm="sh" path="/usr/bin/hostname" dev=dm-0 ino=791622 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1332946874.422:2130): arch=c000003e syscall=59 success=yes exit=0 a0=c6a200 a1=c6afa0 a2=c6ca70 a3=7fffa36344d0 items=0 ppid=10734 pid=10735 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 tty=(none) ses=4294967295 comm="hostname" exe="/usr/bin/hostname" subj=system_u:system_r:pki_ca_t:s0 key=(null)
>type=USER_END msg=audit(1332946874.928:2131): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:session_close acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1332946874.929:2132): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:pki_ca_t:s0 msg='op=PAM:setcred acct="pkiuser" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1332946875.440:2133): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="pki-cad@pki-subca" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1332947087.731:2134): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_sandbox_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=83:99:da:05:e5:d7:29:9c:aa:d4:37:4b:7a:0f:09:a5 direction=? spid=11000 suid=0 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1332947087.733:2135): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_sandbox_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:fc:43:45:f2:14:cd:d1:bb:47:dd:b0:bc:48:7c:5d direction=? spid=11000 suid=0 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1332947087.780:2136): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=11000 suid=74 rport=35129 laddr=10.16.78.66 lport=22 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1332947087.782:2137): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=11000 suid=74 rport=35129 laddr=10.16.78.66 lport=22 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=USER_AUTH msg=audit(1332947088.936:2138): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1332947089.006:2139): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1332947089.073:2140): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1332947089.134:2141): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1332947089.214:2142): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1332947089.291:2143): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=35129 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=USER_AUTH msg=audit(1332947089.291:2144): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a0:f3:33:ad:04:0d:94:34:49:22:38:7a:30:a8:6e:bc rport=35129 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=USER_ACCT msg=audit(1332947089.418:2145): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-10-212.rdu.redhat.com addr=10.11.10.212 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1332947089.433:2146): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=11000 suid=74 rport=35129 laddr=10.16.78.66 lport=22 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=USER_AUTH msg=audit(1332947089.462:2147): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1332947089.467:2148): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-10-212.rdu.redhat.com addr=10.11.10.212 terminal=ssh res=success'
>type=LOGIN msg=audit(1332947089.469:2149): login pid=10999 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=51
>type=USER_ROLE_CHANGE msg=audit(1332947089.646:2150): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1332947089.694:2151): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-10-212.rdu.redhat.com addr=10.11.10.212 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1332947089.761:2152): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-10-212.rdu.redhat.com addr=10.11.10.212 terminal=ssh res=success'
>type=USER_START msg=audit(1332947089.764:2153): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-10-212.rdu.redhat.com addr=10.11.10.212 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1332947089.793:2154): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=83:99:da:05:e5:d7:29:9c:aa:d4:37:4b:7a:0f:09:a5 direction=? spid=11002 suid=0 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1332947089.794:2155): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:fc:43:45:f2:14:cd:d1:bb:47:dd:b0:bc:48:7c:5d direction=? spid=11002 suid=0 : exe="/usr/sbin/sshd" hostname=? addr=10.11.10.212 terminal=? res=success'
>type=CRED_REFR msg=audit(1332947089.802:2156): user pid=0 uid=0 auid=0 ses=51 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-10-212.rdu.redhat.com addr=10.11.10.212 terminal=ssh res=success'

Actions: View

Attachments on bug 795966: 564786 | 564788 | 573371