Attachment 851816 Details for Bug 1051461 – audit.log entries used with audit2allow

audit.log entries used with audit2allow

audit_puppet_run.txt (text/plain), 11.84 KB, created by Johan De Wit on 2014-01-17 21:51:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Johan De Wit

Created: 2014-01-17 21:51:26 UTC

Size: 11.84 KB

patch

obsolete

>type=AVC msg=audit(1389993797.111:672): avc:  denied  { write } for  pid=3341 comm="httpd" name="socket" dev=dm-0 ino=271925 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:passenger_tmp_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1389993797.111:672): arch=c000003e syscall=42 success=yes exit=0 a0=e a1=7fffebff3a60 a2=6e a3=69746172656e6567 items=0 ppid=3321 pid=3341 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
>type=AVC msg=audit(1389993797.159:673): avc:  denied  { getattr } for  pid=3970 comm="ruby" path="/etc/localtime" dev=dm-0 ino=71 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993797.159:673): arch=c000003e syscall=4 success=yes exit=0 a0=7fa3f79c3dab a1=7ffff3f20780 a2=7ffff3f20780 a3=f items=0 ppid=3331 pid=3970 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993797.413:674): avc:  denied  { read } for  pid=3976 comm="hostname" name="hosts" dev=dm-0 ino=266835 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=AVC msg=audit(1389993797.413:674): avc:  denied  { open } for  pid=3976 comm="hostname" name="hosts" dev=dm-0 ino=266835 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993797.413:674): arch=c000003e syscall=2 success=yes exit=3 a0=7ffb13946676 a1=80000 a2=1b6 a3=0 items=0 ppid=3975 pid=3976 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="hostname" exe="/bin/hostname" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993797.417:675): avc:  denied  { getattr } for  pid=3976 comm="hostname" path="/etc/hosts" dev=dm-0 ino=266835 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993797.417:675): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7fffc46f3bf0 a2=7fffc46f3bf0 a3=7fffc46f3ae0 items=0 ppid=3975 pid=3976 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="hostname" exe="/bin/hostname" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993798.663:676): avc:  denied  { relabelfrom } for  pid=3970 comm="ruby" name="ca_crt.pem" dev=dm-0 ino=5657 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:puppet_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1389993798.663:676): avc:  denied  { relabelto } for  pid=3970 comm="ruby" name="ca_crt.pem" dev=dm-0 ino=5657 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993798.663:676): arch=c000003e syscall=189 success=yes exit=0 a0=3b81510 a1=7fa3f39f3319 a2=3a859e0 a3=26 items=0 ppid=3331 pid=3970 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993798.774:677): avc:  denied  { listen } for  pid=3978 comm="ruby" laddr=127.0.0.1 lport=50363 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:system_r:passenger_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1389993798.774:677): arch=c000003e syscall=50 success=yes exit=0 a0=a a1=5 a2=10 a3=7ffff3f3548c items=0 ppid=1 pid=3978 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993798.839:678): avc:  denied  { create } for  pid=3978 comm="ruby" name="node" scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1389993798.839:678): arch=c000003e syscall=83 success=yes exit=0 a0=3e3efd0 a1=1ff a2=3e3efe9 a3=7ffff3f22da0 items=0 ppid=1 pid=3978 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993798.840:679): avc:  denied  { rmdir } for  pid=3978 comm="ruby" name="puppetosmaster.koewacht.net.yaml20140117-3978-14sk8r-0.lock" dev=dm-0 ino=7351 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1389993798.840:679): arch=c000003e syscall=84 success=yes exit=0 a0=3e40770 a1=7fa3f8b8f378 a2=3e407c5 a3=7ffff3f1d9e0 items=0 ppid=1 pid=3978 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993799.025:680): avc:  denied  { search } for  pid=3982 comm="ps" name="/" dev=sysfs ino=1 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir
>type=AVC msg=audit(1389993799.025:680): avc:  denied  { read } for  pid=3982 comm="ps" name="online" dev=sysfs ino=23 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
>type=AVC msg=audit(1389993799.025:680): avc:  denied  { open } for  pid=3982 comm="ps" name="online" dev=sysfs ino=23 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993799.025:680): arch=c000003e syscall=2 success=yes exit=12 a0=7fc7e83df2b8 a1=80000 a2=ffffffffffffffff a3=7fff6bb16220 items=0 ppid=3327 pid=3982 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="ps" exe="/bin/ps" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993800.199:681): avc:  denied  { read } for  pid=4033 comm="pickup" name="hosts" dev=dm-0 ino=266835 scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=AVC msg=audit(1389993800.199:681): avc:  denied  { open } for  pid=4033 comm="pickup" name="hosts" dev=dm-0 ino=266835 scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993800.199:681): arch=c000003e syscall=2 success=yes exit=8 a0=7f376c11f676 a1=80000 a2=1b6 a3=0 items=0 ppid=1085 pid=4033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pickup" exe="/usr/libexec/postfix/pickup" subj=system_u:system_r:postfix_pickup_t:s0 key=(null)
>type=AVC msg=audit(1389993800.212:682): avc:  denied  { getattr } for  pid=4033 comm="pickup" path="/etc/hosts" dev=dm-0 ino=266835 scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993800.212:682): arch=c000003e syscall=5 success=yes exit=0 a0=8 a1=7fff6aa03550 a2=7fff6aa03550 a3=0 items=0 ppid=1085 pid=4033 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pickup" exe="/usr/libexec/postfix/pickup" subj=system_u:system_r:postfix_pickup_t:s0 key=(null)
>type=AVC msg=audit(1389993801.107:683): avc:  denied  { getattr } for  pid=3978 comm="ruby" path="/sbin/ifconfig" dev=dm-0 ino=262844 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993801.107:683): arch=c000003e syscall=4 success=yes exit=0 a0=1aa8550 a1=7ffff3efdaa0 a2=7ffff3efdaa0 a3=8 items=0 ppid=1 pid=3978 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.108:684): avc:  denied  { execute } for  pid=3978 comm="ruby" name="ifconfig" dev=dm-0 ino=262844 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993801.108:684): arch=c000003e syscall=21 success=yes exit=0 a0=1aa8550 a1=1 a2=0 a3=8 items=0 ppid=1 pid=3978 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.129:685): avc:  denied  { read open } for  pid=4114 comm="sh" name="ifconfig" dev=dm-0 ino=262844 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file
>type=AVC msg=audit(1389993801.129:685): avc:  denied  { execute_no_trans } for  pid=4114 comm="sh" path="/sbin/ifconfig" dev=dm-0 ino=262844 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993801.129:685): arch=c000003e syscall=59 success=yes exit=0 a0=828ea0 a1=827a20 a2=826080 a3=7fffc6bcf310 items=0 ppid=4113 pid=4114 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.132:686): avc:  denied  { read } for  pid=4114 comm="ifconfig" name="unix" dev=proc ino=4026532009 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993801.132:686): arch=c000003e syscall=21 success=yes exit=0 a0=40d52e a1=4 a2=0 a3=7fffc17f9df0 items=0 ppid=4113 pid=4114 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.134:687): avc:  denied  { search } for  pid=4114 comm="ifconfig" scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir
>type=SYSCALL msg=audit(1389993801.134:687): arch=c000003e syscall=21 success=no exit=-2 a0=40c5d8 a1=4 a2=2 a3=7fffc17f9df0 items=0 ppid=4113 pid=4114 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.134:688): avc:  denied  { open } for  pid=4114 comm="ifconfig" name="dev" dev=proc ino=4026531981 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993801.134:688): arch=c000003e syscall=2 success=yes exit=6 a0=40cfe3 a1=0 a2=1b6 a3=0 items=0 ppid=4113 pid=4114 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.134:689): avc:  denied  { getattr } for  pid=4114 comm="ifconfig" path="/proc/4114/net/dev" dev=proc ino=4026531981 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
>type=SYSCALL msg=audit(1389993801.134:689): arch=c000003e syscall=5 success=yes exit=0 a0=6 a1=7fffc17f9e70 a2=7fffc17f9e70 a3=78 items=0 ppid=4113 pid=4114 auid=500 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ifconfig" exe="/sbin/ifconfig" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1389993801.779:690): avc:  denied  { write } for  pid=3348 comm="httpd" name="socket" dev=dm-0 ino=271925 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:passenger_tmp_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1389993801.779:690): arch=c000003e syscall=42 success=yes exit=0 a0=e a1=7fffebff3a60 a2=6e a3=69746172656e6567 items=0 ppid=3321 pid=3348 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

Actions: View

Attachments on bug 1051461: 851804 | 851816