Attachment 878147 Details for Bug 1079034 – Output of ausearch command after connecting via ssh -X

Output of ausearch command after connecting via ssh -X

ausearch.log (text/x-log), 10.82 KB, created by Gabriel Redner on 2014-03-24 19:15:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Gabriel Redner

Created: 2014-03-24 19:15:55 UTC

Size: 10.82 KB

patch

obsolete

>[root@capsid ~]# ausearch -m avc,user_avc -ts recent
>----
>time->Mon Mar 24 15:09:10 2014
>type=SYSCALL msg=audit(1395688150.606:79481): arch=c000003e syscall=59 success=yes exit=0 a0=7ff2358fad18 a1=7ffff0aefb80 a2=7ff235afd350 a3=a items=0 ppid=396 pid=398 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688150.606:79481): avc:  denied  { noatsecure } for  pid=398 comm="unix_chkpwd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process
>type=AVC msg=audit(1395688150.606:79481): avc:  denied  { siginh } for  pid=398 comm="unix_chkpwd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process
>type=AVC msg=audit(1395688150.606:79481): avc:  denied  { rlimitinh } for  pid=398 comm="unix_chkpwd" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process
>----
>time->Mon Mar 24 15:09:10 2014
>type=SYSCALL msg=audit(1395688150.630:79487): arch=c000003e syscall=59 success=yes exit=0 a0=8ae7d0 a1=8ae6d0 a2=8ad010 a3=1 items=0 ppid=399 pid=400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688150.630:79487): avc:  denied  { noatsecure } for  pid=400 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process
>type=AVC msg=audit(1395688150.630:79487): avc:  denied  { siginh } for  pid=400 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process
>type=AVC msg=audit(1395688150.630:79487): avc:  denied  { rlimitinh } for  pid=400 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process
>----
>time->Mon Mar 24 15:09:10 2014
>type=SYSCALL msg=audit(1395688150.763:79494): arch=c000003e syscall=21 success=no exit=-13 a0=14ee8a0 a1=2 a2=0 a3=9 items=0 ppid=399 pid=400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688150.763:79494): avc:  denied  { write } for  pid=400 comm="setroubleshootd" name="rpm" dev=dm-0 ino=522244 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>----
>time->Mon Mar 24 15:09:10 2014
>type=SYSCALL msg=audit(1395688150.764:79495): arch=c000003e syscall=21 success=no exit=-13 a0=14ee8a0 a1=2 a2=0 a3=5 items=0 ppid=399 pid=400 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688150.764:79495): avc:  denied  { write } for  pid=400 comm="setroubleshootd" name="rpm" dev=dm-0 ino=522244 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir
>----
>time->Mon Mar 24 15:09:10 2014
>type=SYSCALL msg=audit(1395688150.839:79498): arch=c000003e syscall=4 success=no exit=-13 a0=7fffbefe4180 a1=7fffbefe3ce0 a2=7fffbefe3ce0 a3=7fffbefe3d70 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688150.839:79498): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:10 2014
>type=SYSCALL msg=audit(1395688150.839:79499): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=7fffbefe3d70 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688150.839:79499): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:12 2014
>type=SYSCALL msg=audit(1395688152.840:79500): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688152.840:79500): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:14 2014
>type=SYSCALL msg=audit(1395688154.840:79501): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688154.840:79501): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:16 2014
>type=SYSCALL msg=audit(1395688156.840:79502): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688156.840:79502): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:18 2014
>type=SYSCALL msg=audit(1395688158.840:79503): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688158.840:79503): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:20 2014
>type=SYSCALL msg=audit(1395688160.841:79504): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688160.841:79504): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:22 2014
>type=SYSCALL msg=audit(1395688162.841:79505): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688162.841:79505): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:24 2014
>type=SYSCALL msg=audit(1395688164.841:79506): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688164.841:79506): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:28 2014
>type=SYSCALL msg=audit(1395688168.841:79508): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688168.841:79508): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:09:26 2014
>type=SYSCALL msg=audit(1395688166.841:79507): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688166.841:79507): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
>----
>time->Mon Mar 24 15:10:01 2014
>type=SYSCALL msg=audit(1395688201.631:79513): arch=c000003e syscall=4 success=no exit=-13 a0=24e5f30 a1=7fffda68e3c0 a2=7fffda68e3c0 a3=3dcbd38510 items=0 ppid=486 pid=488 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1263 comm="sa1" exe="/bin/bash" subj=system_u:system_r:sysstat_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1395688201.631:79513): avc:  denied  { getattr } for  pid=488 comm="sa1" path="/root" dev=dm-0 ino=652802 scontext=system_u:system_r:sysstat_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
>

Actions: View

Attachments on bug 1079034: 877001 | 878147