Attachment 709068 Details for Bug 920738 – audit log (permissive mode)

audit log (permissive mode)

audit.log.permissive (text/plain), 8.65 KB, created by Eric Harney on 2013-03-12 16:26:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eric Harney

Created: 2013-03-12 16:26:38 UTC

Size: 8.65 KB

patch

obsolete

>type=DAEMON_START msg=audit(1363105507.749:9781): auditd start, ver=2.2 format=raw kernel=2.6.32-343.el6.x86_64 auid=0 pid=11679 subj=unconfined_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1363105507.856:2254): audit_backlog_limit=320 old=320 auid=0 ses=2 subj=unconfined_u:system_r:auditctl_t:s0 res=1
>type=USER_CMD msg=audit(1363105515.287:2255): user pid=11701 uid=165 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E662073746174202F7661722F6C69622F63696E6465722F6D6E742F39343038303133383234333036303034323337 terminal=? res=success'
>type=CRED_ACQ msg=audit(1363105515.287:2256): user pid=11701 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1363105515.289:2257): user pid=11701 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1363105515.350:2258): user pid=11701 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1363105515.351:2259): user pid=11701 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1363105515.357:2260): user pid=11704 uid=165 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E66206D6F756E74202D7420676C7573746572667320676C75737465722E6C6F63616C3A2F74657374766F6C202F7661722F6C69622F63696E6465722F6D6E742F39343038303133383234333036303034323337 terminal=? res=success'
>type=CRED_ACQ msg=audit(1363105515.357:2261): user pid=11704 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1363105515.358:2262): user pid=11704 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1363105515.479:2263): avc:  denied  { execute } for  pid=11778 comm="mount.glusterfs" name="glusterfsd" dev=vda3 ino=19781 scontext=unconfined_u:system_r:mount_t:s0 tcontext=system_u:object_r:glusterd_exec_t:s0 tclass=file
>type=AVC msg=audit(1363105515.479:2263): avc:  denied  { execute_no_trans } for  pid=11778 comm="mount.glusterfs" path="/usr/sbin/glusterfsd" dev=vda3 ino=19781 scontext=unconfined_u:system_r:mount_t:s0 tcontext=system_u:object_r:glusterd_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1363105515.479:2263): arch=c000003e syscall=59 success=yes exit=0 a0=1dfa970 a1=1df1370 a2=1df9020 a3=7fff016b1920 items=0 ppid=11707 pid=11778 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="glusterfs" exe="/usr/sbin/glusterfsd" subj=unconfined_u:system_r:mount_t:s0 key=(null)
>type=USER_END msg=audit(1363105518.543:2264): user pid=11704 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1363105518.543:2265): user pid=11704 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1363105518.558:2266): user pid=11794 uid=165 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E66206466202D2D706F72746162696C697479202D2D626C6F636B2D73697A652031202F7661722F6C69622F63696E6465722F6D6E742F39343038303133383234333036303034323337 terminal=? res=success'
>type=CRED_ACQ msg=audit(1363105518.561:2267): user pid=11794 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1363105518.562:2268): user pid=11794 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1363105518.621:2269): avc:  denied  { read } for  pid=11792 comm="glusterfs" name="status" dev=proc ino=110748 scontext=unconfined_u:system_r:mount_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=file
>type=AVC msg=audit(1363105518.621:2269): avc:  denied  { open } for  pid=11792 comm="glusterfs" name="status" dev=proc ino=110748 scontext=unconfined_u:system_r:mount_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=file
>type=SYSCALL msg=audit(1363105518.621:2269): arch=c000003e syscall=2 success=yes exit=11 a0=7f9ca9436c30 a1=0 a2=1b6 a3=0 items=0 ppid=1 pid=11792 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="glusterfs" exe="/usr/sbin/glusterfsd" subj=unconfined_u:system_r:mount_t:s0 key=(null)
>type=AVC msg=audit(1363105518.625:2270): avc:  denied  { getattr } for  pid=11792 comm="glusterfs" path="/proc/11796/status" dev=proc ino=110748 scontext=unconfined_u:system_r:mount_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=file
>type=SYSCALL msg=audit(1363105518.625:2270): arch=c000003e syscall=5 success=yes exit=0 a0=b a1=7f9ca9435aa0 a2=7f9ca9435aa0 a3=0 items=0 ppid=1 pid=11792 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="glusterfs" exe="/usr/sbin/glusterfsd" subj=unconfined_u:system_r:mount_t:s0 key=(null)
>type=USER_END msg=audit(1363105518.630:2271): user pid=11794 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1363105518.630:2272): user pid=11794 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1363105518.638:2273): user pid=11797 uid=165 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E66207472756E63617465202D73203147202F7661722F6C69622F63696E6465722F6D6E742F393430383031333832343330363030343233372F766F6C756D652D32343739393762392D323566622D343430352D613061342D613837333561313530333339 terminal=? res=success'
>type=CRED_ACQ msg=audit(1363105518.638:2274): user pid=11797 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1363105518.638:2275): user pid=11797 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1363105518.704:2276): user pid=11797 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1363105518.704:2277): user pid=11797 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1363105518.710:2278): user pid=11800 uid=165 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E662063686D6F642075676F2B7277202F7661722F6C69622F63696E6465722F6D6E742F393430383031333832343330363030343233372F766F6C756D652D32343739393762392D323566622D343430352D613061342D613837333561313530333339 terminal=? res=success'
>type=CRED_ACQ msg=audit(1363105518.711:2279): user pid=11800 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1363105518.711:2280): user pid=11800 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1363105518.776:2281): user pid=11800 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1363105518.776:2282): user pid=11800 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'

Actions: View

Attachments on bug 920738: 709068 | 709069