Attachment 849471 Details for Bug 1052317 – /var/log/audit/audit.log

/var/log/audit/audit.log

audit.log (text/plain), 14.55 KB, created by Dan Mossor [danofsatx] on 2014-01-13 16:02:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dan Mossor [danofsatx]

Created: 2014-01-13 16:02:12 UTC

Size: 14.55 KB

patch

obsolete

>type=LOGIN msg=audit(1389625261.225:940): login pid=2502 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1389625261.244:941): pid=2502 uid=0 auid=0 ses=9  subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1389625261.244:942): pid=2502 uid=0 auid=0 ses=9  subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1389625261.253:943): pid=2504 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=PAM:accounting acct="root" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1389625261.255:944): pid=2504 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1389625261.267:945): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="user@0" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1389625261.272:946): pid=2502 uid=0 auid=0 ses=9  subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1389625261.274:947): pid=2502 uid=0 auid=0 ses=9  subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=SERVICE_START msg=audit(1389627202.668:948): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="dnf-makecache" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1389627202.668:949): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="dnf-makecache" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.251:950): pid=2606 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=server fp=89:65:d1:97:e7:32:71:33:08:d0:c9:a7:ca:c9:20:d5 direction=? spid=2606 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.251:951): pid=2606 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=server fp=2a:26:5e:c5:34:43:69:af:1b:d7:c2:5f:54:df:61:d0 direction=? spid=2606 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=AVC msg=audit(1389628147.252:952): avc:  denied  { dyntransition } for  pid=2606 comm="sshd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:sshd_net_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628147.252:952): arch=c000003e syscall=1 success=no exit=-13 a0=6 a1=7f2c8aa2c930 a2=20 a3=7fff232ae9c0 items=0 ppid=2605 pid=2606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:init_t:s0 key=(null)
>type=CRYPTO_SESSION msg=audit(1389628147.253:953): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=2606 suid=74 rport=56847 laddr=172 exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1389628147.253:954): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=2606 suid=74 rport=56847 laddr=172 exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=USER_AUTH msg=audit(1389628147.373:955): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=pubkey_auth rport=56847 acct="dan" exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=USER_AUTH msg=audit(1389628147.373:956): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=key algo=ssh-rsa size=2048 fp=03:09:fd:a4:2b:4e:13:d7:ee:c7:1c:8f:5b:e2:eb:cc rport=56847 acct="dan" exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=USER_ACCT msg=audit(1389628147.376:957): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=PAM:accounting acct="dan" exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.376:958): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=session fp=? direction=both spid=2606 suid=74 rport=56847 laddr=172.16.4.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=USER_AUTH msg=audit(1389628147.376:959): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=success acct="dan" exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1389628147.377:960): pid=2605 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="dan" exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=LOGIN msg=audit(1389628147.377:961): login pid=2605 uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=10
>type=USER_ROLE_CHANGE msg=audit(1389628147.472:962): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0 selected-context=unconfined_u:unconfined_r:unconfined_t:s0 exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=USER_START msg=audit(1389628147.485:963): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="dan" exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.486:964): pid=2614 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=server fp=89:65:d1:97:e7:32:71:33:08:d0:c9:a7:ca:c9:20:d5 direction=? spid=2614 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.486:965): pid=2614 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=server fp=2a:26:5e:c5:34:43:69:af:1b:d7:c2:5f:54:df:61:d0 direction=? spid=2614 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=CRED_ACQ msg=audit(1389628147.486:966): pid=2614 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="dan" exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.486:967): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=session fp=? direction=both spid=2605 suid=0 rport=56847 laddr=172.16.4.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=AVC msg=audit(1389628147.486:968): avc:  denied  { dyntransition } for  pid=2614 comm="sshd" scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628147.486:968): arch=c000003e syscall=1 success=no exit=-13 a0=7 a1=7f2c8aa4b4b0 a2=2a a3=666e6f636e753a72 items=0 ppid=2605 pid=2614 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=10 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:init_t:s0 key=(null)
>type=USER_LOGIN msg=audit(1389628147.488:969): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1389628147.488:970): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=/dev/pts/0 res=success'
>type=AVC msg=audit(1389628147.489:971): avc:  denied  { transition } for  pid=2615 comm="sshd" path="/usr/bin/bash" dev="dm-0" ino=2493160 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628147.489:971): arch=c000003e syscall=59 success=no exit=-13 a0=7f2c8aa37040 a1=7fff232ae4e0 a2=7f2c8aa2a340 a3=8 items=0 ppid=2614 pid=2615 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=10 tty=pts0 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:init_t:s0 key=(null)
>type=USER_END msg=audit(1389628147.491:972): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_LOGOUT msg=audit(1389628147.491:973): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.491:974): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=session fp=? direction=both spid=2614 suid=1000 rport=56847 laddr=172.16.4.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=USER_END msg=audit(1389628147.493:975): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="dan" exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1389628147.493:976): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="dan" exe="/usr/sbin/sshd" hostname=172.16.4.15 addr=172.16.4.15 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.494:977): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=server fp=89:65:d1:97:e7:32:71:33:08:d0:c9:a7:ca:c9:20:d5 direction=? spid=2605 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1389628147.494:978): pid=2605 uid=0 auid=1000 ses=10  subj=system_u:system_r:init_t:s0 msg='op=destroy kind=server fp=2a:26:5e:c5:34:43:69:af:1b:d7:c2:5f:54:df:61:d0 direction=? spid=2605 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.4.15 terminal=? res=success'
>type=AVC msg=audit(1389628158.233:979): avc:  denied  { transition } for  pid=2639 comm="sddm" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=2495219 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628158.233:979): arch=c000003e syscall=59 success=no exit=-13 a0=7f0addf9738d a1=7fff0772a7a0 a2=7f0ade19e3c0 a3=7f0aec873330 items=0 ppid=989 pid=2639 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm="sddm" exe="/usr/bin/sddm" subj=system_u:system_r:init_t:s0 key=(null)
>type=AVC msg=audit(1389628158.235:980): avc:  denied  { transition } for  pid=2640 comm="sddm" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=2495219 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628158.235:980): arch=c000003e syscall=59 success=no exit=-13 a0=7f0addf9738d a1=7fff0772a740 a2=7f0ade19e3c0 a3=7f0aec873330 items=0 ppid=989 pid=2640 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm="sddm" exe="/usr/bin/sddm" subj=system_u:system_r:init_t:s0 key=(null)
>type=USER_AUTH msg=audit(1389628160.639:981): pid=989 uid=0 auid=1000 ses=1  subj=system_u:system_r:init_t:s0 msg='op=PAM:authentication acct="dan" exe="/usr/bin/sddm" hostname=? addr=? terminal=? res=failed'
>type=AVC msg=audit(1389628160.643:982): avc:  denied  { transition } for  pid=2653 comm="sddm" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=2495219 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628160.643:982): arch=c000003e syscall=59 success=no exit=-13 a0=7f0addf9738d a1=7fff0772a7a0 a2=7f0ade19e3c0 a3=7f0aec873330 items=0 ppid=989 pid=2653 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm="sddm" exe="/usr/bin/sddm" subj=system_u:system_r:init_t:s0 key=(null)
>type=AVC msg=audit(1389628160.644:983): avc:  denied  { transition } for  pid=2654 comm="sddm" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=2495219 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628160.644:983): arch=c000003e syscall=59 success=no exit=-13 a0=7f0addf9738d a1=7fff0772a740 a2=7f0ade19e3c0 a3=7f0aec873330 items=0 ppid=989 pid=2654 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm="sddm" exe="/usr/bin/sddm" subj=system_u:system_r:init_t:s0 key=(null)
>type=USER_AUTH msg=audit(1389628162.987:984): pid=989 uid=0 auid=1000 ses=1  subj=system_u:system_r:init_t:s0 msg='op=PAM:authentication acct="dan" exe="/usr/bin/sddm" hostname=? addr=? terminal=? res=failed'
>type=AVC msg=audit(1389628170.770:985): avc:  denied  { transition } for  pid=2667 comm="sddm" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=2495219 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628170.770:985): arch=c000003e syscall=59 success=no exit=-13 a0=7f0addf9738d a1=7fff0772a7a0 a2=7f0ade19e3c0 a3=7f0aec873330 items=0 ppid=989 pid=2667 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm="sddm" exe="/usr/bin/sddm" subj=system_u:system_r:init_t:s0 key=(null)
>type=AVC msg=audit(1389628170.771:986): avc:  denied  { transition } for  pid=2668 comm="sddm" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=2495219 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
>type=SYSCALL msg=audit(1389628170.771:986): arch=c000003e syscall=59 success=no exit=-13 a0=7f0addf9738d a1=7fff0772a740 a2=7f0ade19e3c0 a3=7f0aec873330 items=0 ppid=989 pid=2668 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm="sddm" exe="/usr/bin/sddm" subj=system_u:system_r:init_t:s0 key=(null)
>type=USER_AUTH msg=audit(1389628173.154:987): pid=989 uid=0 auid=1000 ses=1  subj=system_u:system_r:init_t:s0 msg='op=PAM:authentication acct="dan" exe="/usr/bin/sddm" hostname=? addr=? terminal=? res=failed'

Actions: View

Attachments on bug 1052317: 849467 | 849468 | 849469 | 849470 | 849471