Attachment 650338 Details for Bug 879516 – SELinux audit log

SELinux audit log

audit.log (text/plain), 25.58 KB, created by Martin Kosek on 2012-11-23 11:37:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Kosek

Created: 2012-11-23 11:37:24 UTC

Size: 25.58 KB

patch

obsolete

>type=MAC_STATUS msg=audit(1353670283.475:184): enforcing=0 old_enforcing=1 auid=525 ses=1
>type=SYSCALL msg=audit(1353670283.475:184): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff4001db30 a2=1 a3=7fff4001d8c0 items=0 ppid=911 pid=4146 auid=525 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1353670349.944:185): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=0)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=SERVICE_START msg=audit(1353670350.148:186): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="ntpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670354.044:187): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670355.325:188): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670355.325:189): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670355.433:190): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670357.897:191): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670358.083:192): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670370.214:193): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670371.590:194): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670371.590:195): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670371.711:196): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670373.984:197): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670373.984:198): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670374.105:199): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670384.325:200): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670384.325:201): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670384.455:202): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1353670387.517:203): avc:  denied  { getattr } for  pid=4878 comm="java" path="/var/lib/tomcat" dev="dm-0" ino=14111 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:tomcat_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1353670387.517:203): arch=c000003e syscall=6 success=yes exit=0 a0=7fcb7110eab0 a1=7fcb7110d970 a2=7fcb7110d970 a3=61636d6f742f6572 items=0 ppid=1 pid=4878 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1353670390.645:204): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1353670411.051:205): avc:  denied  { name_connect } for  pid=4977 comm="java" dest=7389 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1353670411.051:205): arch=c000003e syscall=42 success=yes exit=0 a0=55 a1=7fcb46b362a0 a2=1c a3=24a items=0 ppid=1 pid=4977 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1353670420.789:206): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670420.789:207): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670420.843:208): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670424.732:209): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1353670425.835:210): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670425.835:211): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670426.031:212): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670427.690:213): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1353670427.861:214): avc:  denied  { getattr } for  pid=5416 comm="java" path="/var/lib/tomcat" dev="dm-0" ino=14111 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:tomcat_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1353670427.861:214): arch=c000003e syscall=6 success=yes exit=0 a0=7f6146f27ab0 a1=7f6146f26970 a2=7f6146f26970 a3=61636d6f742f6572 items=0 ppid=1 pid=5416 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1353670435.779:215): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=SERVICE_START msg=audit(1353670436.575:216): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670448.632:217): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="krb5kdc" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670449.560:218): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="kadmin" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670450.645:219): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="ipa_memcached" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670453.311:220): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670453.311:221): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1353670453.695:222): avc:  denied  { getattr } for  pid=5675 comm="java" path="/var/lib/tomcat" dev="dm-0" ino=14111 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:tomcat_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1353670453.695:222): arch=c000003e syscall=6 success=yes exit=0 a0=7fd8dc45f7b0 a1=7fd8dc45e670 a2=7fd8dc45e670 a3=61636d6f742f6572 items=0 ppid=1 pid=5675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="java" exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/bin/java" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1353670475.633:223): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="certmonger" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=MAC_CONFIG_CHANGE msg=audit(1353670492.763:224): bool=httpd_manage_ipa val=1 old_val=0 auid=525 ses=1
>type=MAC_CONFIG_CHANGE msg=audit(1353670492.763:224): bool=httpd_can_network_connect val=1 old_val=0 auid=525 ses=1
>type=SYSCALL msg=audit(1353670492.763:224): arch=c000003e syscall=1 success=yes exit=2 a0=4 a1=7fff9e7cd7a0 a2=2 a3=f items=0 ppid=4197 pid=5855 auid=525 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="setsebool" exe="/usr/sbin/setsebool" subj=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 key=(null)
>type=MAC_POLICY_LOAD msg=audit(1353670492.844:225): policy loaded auid=525 ses=1
>type=SYSCALL msg=audit(1353670492.844:225): arch=c000003e syscall=1 success=yes exit=5157711 a0=4 a1=7f86b44ef000 a2=4eb34f a3=7fff40bbdc90 items=0 ppid=5855 pid=5857 auid=525 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1353670494.402:226): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=7)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=USER_AVC msg=audit(1353670494.402:227): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=8)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=SERVICE_START msg=audit(1353670496.018:228): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670500.541:229): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670500.541:230): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670502.014:231): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670537.536:232): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670537.536:233): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670537.745:234): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@IDM-LAB-BOS-REDHAT-COM" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1353670538.682:235): avc:  denied  { block_suspend } for  pid=5698 comm="krb5kdc" capability=36  scontext=system_u:system_r:krb5kdc_t:s0 tcontext=system_u:system_r:krb5kdc_t:s0 tclass=capability2
>type=SYSCALL msg=audit(1353670538.682:235): arch=c000003e syscall=233 success=yes exit=0 a0=5 a1=2 a2=6 a3=7fff0c8d4460 items=0 ppid=1 pid=5698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="krb5kdc" exe="/usr/sbin/krb5kdc" subj=system_u:system_r:krb5kdc_t:s0 key=(null)
>type=SERVICE_START msg=audit(1353670538.694:236): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="krb5kdc" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670538.694:237): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="krb5kdc" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670538.760:238): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="krb5kdc" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=ANOM_ABEND msg=audit(1353670539.002:239): auid=4294967295 uid=48 gid=48 ses=4294967295 subj=system_u:system_r:httpd_t:s0 pid=5908 comm="httpd" reason="memory violation" sig=6
>type=ANOM_ABEND msg=audit(1353670539.005:240): auid=4294967295 uid=48 gid=48 ses=4294967295 subj=system_u:system_r:httpd_t:s0 pid=5913 comm="httpd" reason="memory violation" sig=6
>type=ANOM_ABEND msg=audit(1353670539.006:241): auid=4294967295 uid=48 gid=48 ses=4294967295 subj=system_u:system_r:httpd_t:s0 pid=5910 comm="httpd" reason="memory violation" sig=6
>type=ANOM_ABEND msg=audit(1353670539.013:242): auid=4294967295 uid=48 gid=48 ses=4294967295 subj=system_u:system_r:httpd_t:s0 pid=5912 comm="httpd" reason="memory violation" sig=6
>type=SERVICE_STOP msg=audit(1353670539.438:243): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670541.017:244): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670547.890:245): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="sssd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670548.185:246): pid=3034 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=49:db:a6:a1:14:62:83:92:9c:64:3a:7b:11:d0:c7:79 direction=? spid=3034 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670548.189:247): pid=3034 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=05:f2:b1:62:61:6d:82:d1:a0:1c:56:f5:f7:1b:27:2b direction=? spid=3034 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670548.197:248): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="sshd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1353670548.197:249): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="sshd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670548.274:250): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="sshd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1353670551.380:251): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="ipa" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670599.310:252): pid=6153 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=49:db:a6:a1:14:62:83:92:9c:64:3a:7b:11:d0:c7:79 direction=? spid=6153 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670599.311:253): pid=6153 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=05:f2:b1:62:61:6d:82:d1:a0:1c:56:f5:f7:1b:27:2b direction=? spid=6153 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1353670599.417:254): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6153 suid=74 rport=51384 laddr=10.16.78.24 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1353670599.417:255): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6153 suid=74 rport=51384 laddr=10.16.78.24 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670601.836:256): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6153 suid=74 rport=51384 laddr=10.16.78.24 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=USER_ERR msg=audit(1353670601.866:257): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1353670601.867:258): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=49:db:a6:a1:14:62:83:92:9c:64:3a:7b:11:d0:c7:79 direction=? spid=6152 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670601.868:259): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=05:f2:b1:62:61:6d:82:d1:a0:1c:56:f5:f7:1b:27:2b direction=? spid=6152 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=USER_LOGIN msg=audit(1353670601.868:260): pid=6152 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mkosek" exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1353670604.576:261): pid=6155 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=49:db:a6:a1:14:62:83:92:9c:64:3a:7b:11:d0:c7:79 direction=? spid=6155 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670604.577:262): pid=6155 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=05:f2:b1:62:61:6d:82:d1:a0:1c:56:f5:f7:1b:27:2b direction=? spid=6155 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1353670604.713:263): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6155 suid=74 rport=51385 laddr=10.16.78.24 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1353670604.714:264): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6155 suid=74 rport=51385 laddr=10.16.78.24 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=USER_AUTH msg=audit(1353670606.219:265): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51385 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=USER_AUTH msg=audit(1353670606.219:266): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=4096 fp=c8:cd:4a:9d:ba:4e:f2:1d:88:7a:9c:5a:75:8a:56:cd rport=51385 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=USER_ACCT msg=audit(1353670606.229:267): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670606.232:268): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6155 suid=74 rport=51385 laddr=10.16.78.24 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=USER_AUTH msg=audit(1353670606.236:269): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1353670606.238:270): pid=6154 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'
>type=LOGIN msg=audit(1353670606.238:271): login pid=6154 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_ROLE_CHANGE msg=audit(1353670606.294:272): pid=6154 uid=0 auid=0 ses=7 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'
>type=USER_START msg=audit(1353670606.309:273): pid=6154 uid=0 auid=0 ses=7 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1353670606.465:274): pid=6154 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'
>type=USER_START msg=audit(1353670606.466:275): pid=6154 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670606.470:276): pid=6161 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=49:db:a6:a1:14:62:83:92:9c:64:3a:7b:11:d0:c7:79 direction=? spid=6161 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1353670606.470:277): pid=6161 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=05:f2:b1:62:61:6d:82:d1:a0:1c:56:f5:f7:1b:27:2b direction=? spid=6161 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.4.72 terminal=? res=success'
>type=CRED_REFR msg=audit(1353670606.475:278): pid=6161 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=balmora.brq.redhat.com addr=10.34.4.72 terminal=ssh res=success'

Actions: View

Attachments on bug 879516: 650338