Attachment 597433 Details for Bug 839103 – ausearch for the dovecot violations

ausearch for the dovecot violations

dovecot-audit.txt (text/plain), 5.89 KB, created by Scott Shambarger on 2012-07-10 23:58:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Scott Shambarger

Created: 2012-07-10 23:58:41 UTC

Size: 5.89 KB

patch

obsolete

>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:469): item=0 name="/var/named/chroot/etc/named"
>type=CWD msg=audit(1341964065.237:469):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:469): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:469): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:470): item=0 name="/var/named/chroot/var/named"
>type=CWD msg=audit(1341964065.237:470):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:470): arch=c000003e syscall=4 success=no exit=-13 a0=b161db a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:470): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:471): item=0 name="/var/named/chroot/etc/named.conf"
>type=CWD msg=audit(1341964065.237:471):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:471): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:471): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:472): item=0 name="/var/named/chroot/etc/named.rfc1912.zones"
>type=CWD msg=audit(1341964065.237:472):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:472): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:472): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:473): item=0 name="/var/named/chroot/etc/rndc.key"
>type=CWD msg=audit(1341964065.237:473):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:473): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:473): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:474): item=0 name="/var/named/chroot/usr/lib64/bind"
>type=CWD msg=audit(1341964065.237:474):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:474): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:474): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:475): item=0 name="/var/named/chroot/etc/named.iscdlv.key"
>type=CWD msg=audit(1341964065.237:475):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:475): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:475): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
>----
>time->Tue Jul 10 16:47:45 2012
>type=PATH msg=audit(1341964065.237:476): item=0 name="/var/named/chroot/etc/named.root.key"
>type=CWD msg=audit(1341964065.237:476):  cwd="/run/dovecot"
>type=SYSCALL msg=audit(1341964065.237:476): arch=c000003e syscall=4 success=no exit=-13 a0=b161dc a1=7fff364b2a50 a2=7fff364b2a50 a3=0 items=1 ppid=1 pid=22364 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)
>type=AVC msg=audit(1341964065.237:476): avc:  denied  { search } for  pid=22364 comm="dovecot" name="named" dev="dm-2" ino=1572878 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir

Actions: View

Attachments on bug 839103: 597433