Attachment 631346 Details for Bug 868839 – audit.log

audit.log

audit.log (text/plain), 10.46 KB, created by Jan Stodola on 2012-10-22 09:22:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Stodola

Created: 2012-10-22 09:22:26 UTC

Size: 10.46 KB

patch

obsolete

>type=CRYPTO_KEY_USER msg=audit(1350896784.944:490): pid=1068 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a5:cd:61:50:1a:9b:98:c9:2e:72:2e:7c:17:85:3e:a5 direction=? spid=1068 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1350896784.944:491): pid=1068 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=09:99:20:b8:f8:76:32:34:f0:64:b8:51:13:50:d6:b2 direction=? spid=1068 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1350896785.044:492): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1068 suid=74 rport=53100 laddr=10.16.105.198 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1350896785.044:493): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1068 suid=74 rport=53100 laddr=10.16.105.198 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=? res=success'
>type=USER_AUTH msg=audit(1350896786.664:494): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1350896789.274:495): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1350896789.284:496): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1350896789.284:497): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1068 suid=74 rport=53100 laddr=10.16.105.198 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=? res=success'
>type=USER_AUTH msg=audit(1350896789.284:498): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1350896789.284:499): pid=1067 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=ssh res=success'
>type=USER_ROLE_CHANGE msg=audit(1350896789.354:500): pid=1067 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1350896789.464:501): avc:  denied  { execmod } for  pid=1071 comm="systemd-logind" path="/usr/lib/systemd/systemd-logind" dev="dasda1" ino=13933 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_logind_exec_t:s0 tclass=file
>type=SERVICE_START msg=audit(1350896789.514:502): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1350896789.514:503): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1350896789.514:504): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1350896789.594:505): avc:  denied  { execmod } for  pid=1074 comm="systemd-logind" path="/usr/lib/systemd/systemd-logind" dev="dasda1" ino=13933 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_logind_exec_t:s0 tclass=file
>type=SERVICE_START msg=audit(1350896789.644:506): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1350896789.644:507): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1350896789.644:508): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1350896789.714:509): avc:  denied  { execmod } for  pid=1078 comm="systemd-logind" path="/usr/lib/systemd/systemd-logind" dev="dasda1" ino=13933 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_logind_exec_t:s0 tclass=file
>type=SERVICE_START msg=audit(1350896789.744:510): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1350896789.744:511): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1350896789.744:512): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1350896789.824:513): avc:  denied  { execmod } for  pid=1080 comm="systemd-logind" path="/usr/lib/systemd/systemd-logind" dev="dasda1" ino=13933 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_logind_exec_t:s0 tclass=file
>type=SERVICE_START msg=audit(1350896789.874:514): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1350896789.874:515): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1350896789.874:516): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1350896789.954:517): avc:  denied  { execmod } for  pid=1083 comm="systemd-logind" path="/usr/lib/systemd/systemd-logind" dev="dasda1" ino=13933 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_logind_exec_t:s0 tclass=file
>type=SERVICE_START msg=audit(1350896789.994:518): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1350896789.994:519): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1350896789.994:520): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1350896790.074:521): avc:  denied  { execmod } for  pid=1085 comm="systemd-logind" path="/usr/lib/systemd/systemd-logind" dev="dasda1" ino=13933 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_logind_exec_t:s0 tclass=file
>type=SERVICE_START msg=audit(1350896790.114:522): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1350896790.114:523): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1350896790.114:524): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-logind" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1350896814.384:525): pid=1067 uid=0 auid=0 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1350896814.524:526): pid=1087 uid=0 auid=0 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=/dev/pts/2 res=success'
>type=USER_START msg=audit(1350896814.524:527): pid=1087 uid=0 auid=0 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=/dev/pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1350896814.524:528): pid=1087 uid=0 auid=0 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a5:cd:61:50:1a:9b:98:c9:2e:72:2e:7c:17:85:3e:a5 direction=? spid=1087 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1350896814.524:529): pid=1087 uid=0 auid=0 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=09:99:20:b8:f8:76:32:34:f0:64:b8:51:13:50:d6:b2 direction=? spid=1087 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.117 terminal=pts/2 res=success'
>type=CRED_REFR msg=audit(1350896814.524:530): pid=1087 uid=0 auid=0 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=unused-4-117.brq.redhat.com addr=10.34.4.117 terminal=ssh res=success'

Actions: View

Attachments on bug 868839: 631346 | 631347 | 640642 | 640646