Attachment 899508 Details for Bug 1098244 – audit.log

audit.log

audit.log (text/plain), 9.57 KB, created by Mike Burns on 2014-05-27 13:47:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mike Burns

Created: 2014-05-27 13:47:14 UTC

Size: 9.57 KB

patch

obsolete

>type=DAEMON_START msg=audit(1401196872.446:1343): auditd start, ver=2.2 format=raw kernel=2.6.32-431.17.1.el6.x86_64 auid=0 pid=13045 subj=unconfined_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1401196872.550:2527): audit_backlog_limit=320 old=320 auid=0 ses=368 subj=unconfined_u:system_r:auditctl_t:s0 res=1
>type=MAC_STATUS msg=audit(1401196905.769:2528): enforcing=0 old_enforcing=1 auid=0 ses=368
>type=SYSCALL msg=audit(1401196905.769:2528): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fffb37c5ca0 a2=1 a3=7fffb37c4a20 items=0 ppid=6896 pid=13424 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=368 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_START msg=audit(1401196923.315:2529): user pid=13461 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1401196923.315:2530): user pid=13461 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1401196926.142:2531): user pid=13461 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1401196926.142:2532): user pid=13461 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1401197003.752:2533): user pid=14624 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1401197003.753:2534): user pid=14624 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1401197004.034:2535): user pid=14656 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1401197004.034:2536): user pid=14656 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1401197016.402:2537): user pid=14656 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1401197016.403:2538): user pid=14656 uid=0 auid=0 ses=368 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_AUTH msg=audit(1401197028.164:2539): user pid=15026 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1401197028.164:2540): user pid=15026 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_START msg=audit(1401197028.168:2541): user pid=15026 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1401197028.168:2542): user pid=15026 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1401197047.613:2543): user pid=15026 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1401197047.616:2544): user pid=15026 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1401197164.670:2545): user pid=16422 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1401197164.670:2546): user pid=16422 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
>type=USER_AUTH msg=audit(1401197176.671:2547): user pid=16748 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1401197176.671:2548): user pid=16748 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_START msg=audit(1401197176.675:2549): user pid=16748 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1401197176.676:2550): user pid=16748 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1401197195.921:2551): user pid=16748 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1401197195.923:2552): user pid=16748 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_AUTH msg=audit(1401197250.552:2553): user pid=17221 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1401197250.552:2554): user pid=17221 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_START msg=audit(1401197250.559:2555): user pid=17221 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1401197250.559:2556): user pid=17221 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1401197266.705:2557): user pid=17221 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1401197266.706:2558): user pid=17221 uid=0 auid=0 ses=368 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1401197401.645:2559): user pid=17420 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1401197401.645:2560): user pid=17420 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1401197401.650:2561): pid=17420 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=498 old ses=4294967295 new ses=373
>type=USER_START msg=audit(1401197401.671:2562): user pid=17420 uid=0 auid=498 ses=373 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1401197409.056:2563): user pid=17420 uid=498 auid=498 ses=373 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1401197409.057:2564): user pid=17420 uid=498 auid=498 ses=373 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=AVC msg=audit(1401197569.085:2565): avc:  denied  { name_bind } for  pid=9349 comm="ruby" src=17659 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
>type=SYSCALL msg=audit(1401197569.085:2565): arch=c000003e syscall=49 success=yes exit=0 a0=7 a1=7f63887a3740 a2=10 a3=7f6392b73b68 items=0 ppid=1 pid=9349 auid=0 uid=498 gid=498 euid=498 suid=498 fsuid=498 egid=498 sgid=498 fsgid=498 tty=(none) ses=54 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)

Actions: View

Attachments on bug 1098244: 895963 | 896468 | 896469 | 898390 | 899508 | 899509