Attachment 655771 Details for Bug 882568 – "ausearch -m avc -ts recent" output

"ausearch -m avc -ts recent" output

ausearch.LOG01 (text/plain), 5.91 KB, created by D. Hugh Redelmeier on 2012-12-01 22:59:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: D. Hugh Redelmeier

Created: 2012-12-01 22:59:39 UTC

Size: 5.91 KB

patch

obsolete

>[root@redace sully]# ausearch -m avc -ts recent
>----
>time->Sat Dec  1 14:30:31 2012
>type=SYSCALL msg=audit(1354390231.712:381): arch=c000003e syscall=6 success=yes exit=0 a0=4d49130 a1=7fff9c88ed20 a2=7fff9c88ed20 a3=20 items=0 ppid=1 pid=2663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python2.7" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390231.712:381): avc:  denied  { getattr } for  pid=2663 comm="setroubleshootd" path="/var/lib/os-prober/mount" dev="sde12" ino=2 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>----
>time->Sat Dec  1 14:30:31 2012
>type=SYSCALL msg=audit(1354390231.702:380): arch=c000003e syscall=257 success=yes exit=3 a0=ffffffffffffff9c a1=1de0050 a2=90800 a3=0 items=0 ppid=7289 pid=7331 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="90linux-distro" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390231.702:380): avc:  denied  { open } for  pid=7331 comm="90linux-distro" path="/var/lib/os-prober/mount" dev="sde12" ino=2 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>type=AVC msg=audit(1354390231.702:380): avc:  denied  { read } for  pid=7331 comm="90linux-distro" name="/" dev="sde12" ino=2 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>----
>time->Sat Dec  1 14:30:31 2012
>type=SYSCALL msg=audit(1354390231.746:382): arch=c000003e syscall=4 success=yes exit=0 a0=7f681cfca200 a1=7ffff2b3b540 a2=7ffff2b3b540 a3=7ffff2b3b2c0 items=0 ppid=7289 pid=7336 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="umount" exe="/usr/bin/umount" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390231.746:382): avc:  denied  { getattr } for  pid=7336 comm="umount" path="/var/lib/os-prober/mount" dev="sde12" ino=2 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>----
>time->Sat Dec  1 14:30:32 2012
>type=SYSCALL msg=audit(1354390232.482:383): arch=c000003e syscall=4 success=yes exit=0 a0=12494f0 a1=7fffe730d670 a2=7fffe730d670 a3=8 items=0 ppid=7393 pid=7425 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="40lsb" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390232.482:383): avc:  denied  { getattr } for  pid=7425 comm="40lsb" path="/var/lib/os-prober/mount/etc/lsb-release" dev="sde6" ino=260975 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file
>----
>time->Sat Dec  1 14:30:32 2012
>type=SYSCALL msg=audit(1354390232.528:384): arch=c000003e syscall=257 success=yes exit=3 a0=ffffffffffffff9c a1=7fffbee68247 a2=0 a3=0 items=0 ppid=7427 pid=7428 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390232.528:384): avc:  denied  { open } for  pid=7428 comm="grep" path="/var/lib/os-prober/mount/etc/lsb-release" dev="sde6" ino=260975 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file
>type=AVC msg=audit(1354390232.528:384): avc:  denied  { read } for  pid=7428 comm="grep" name="lsb-release" dev="sde6" ino=260975 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file
>----
>time->Sat Dec  1 14:30:32 2012
>type=SYSCALL msg=audit(1354390232.528:385): arch=c000003e syscall=16 success=no exit=-25 a0=3 a1=5401 a2=7fffbee67180 a3=0 items=0 ppid=7427 pid=7428 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390232.528:385): avc:  denied  { ioctl } for  pid=7428 comm="grep" path="/var/lib/os-prober/mount/etc/lsb-release" dev="sde6" ino=260975 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file
>----
>time->Sat Dec  1 14:30:32 2012
>type=SYSCALL msg=audit(1354390232.620:386): arch=c000003e syscall=4 success=yes exit=0 a0=7fdacf5be200 a1=7fff797b61b0 a2=7fff797b61b0 a3=7fff797b5f30 items=0 ppid=7393 pid=7455 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="umount" exe="/usr/bin/umount" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390232.620:386): avc:  denied  { getattr } for  pid=7455 comm="umount" path="/var/lib/os-prober/mount" dev="sde6" ino=2 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>----
>time->Sat Dec  1 14:30:33 2012
>type=SYSCALL msg=audit(1354390233.232:387): arch=c000003e syscall=257 success=yes exit=3 a0=ffffffffffffff9c a1=1056050 a2=90800 a3=0 items=0 ppid=7525 pid=7572 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="90linux-distro" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1354390233.232:387): avc:  denied  { open } for  pid=7572 comm="90linux-distro" path="/var/lib/os-prober/mount" dev="sde8" ino=2 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>type=AVC msg=audit(1354390233.232:387): avc:  denied  { read } for  pid=7572 comm="90linux-distro" name="/" dev="sde8" ino=2 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
>[root@redace sully]# exit
>exit
>[Process i-shell: Done]

Actions: View

Attachments on bug 882568: 655771