Attachment 913439 Details for Bug 1110263 – /var/log/audit/audit.log permissive mode

/var/log/audit/audit.log permissive mode

audit.log_permissive (text/plain), 15.32 KB, created by yfried on 2014-06-30 14:54:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: yfried

Created: 2014-06-30 14:54:24 UTC

Size: 15.32 KB

patch

obsolete

>type=USER_END msg=audit(1404139749.152:1553): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/2 res=success'
>type=USER_LOGOUT msg=audit(1404139749.152:1554): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/2 res=success'
>type=USER_END msg=audit(1404139749.156:1555): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1404139749.157:1556): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139749.157:1557): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bd:de:8d:8a:18:6d:8c:3b:fb:c8:08:3e:2d:f7:f0:16 direction=? spid=4304 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139749.157:1558): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=62:0a:7a:63:27:e8:08:3e:25:87:7d:c3:cf:92:f4:63 direction=? spid=4304 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139749.157:1559): pid=4304 uid=0 auid=0 ses=43 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=4304 suid=0 rport=51871 laddr=172.16.0.173 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139752.991:1560): pid=4339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bd:de:8d:8a:18:6d:8c:3b:fb:c8:08:3e:2d:f7:f0:16 direction=? spid=4339 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139752.991:1561): pid=4339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=62:0a:7a:63:27:e8:08:3e:25:87:7d:c3:cf:92:f4:63 direction=? spid=4339 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1404139752.992:1562): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=4339 suid=74 rport=51879 laddr=172 exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1404139752.992:1563): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=4339 suid=74 rport=51879 laddr=172 exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=USER_AUTH msg=audit(1404139753.045:1564): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51879 acct="root" exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=USER_AUTH msg=audit(1404139753.045:1565): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=cf:2b:4d:8e:1a:27:89:6a:04:b3:3e:93:94:2a:3b:d4 rport=51879 acct="root" exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=USER_ACCT msg=audit(1404139753.049:1566): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139753.049:1567): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=4339 suid=74 rport=51879 laddr=172.16.0.173 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=USER_AUTH msg=audit(1404139753.050:1568): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1404139753.050:1569): pid=4338 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=LOGIN msg=audit(1404139753.050:1570): pid=4338 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=44 res=1
>type=USER_ROLE_CHANGE msg=audit(1404139753.105:1571): pid=4338 uid=0 auid=0 ses=44 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=USER_START msg=audit(1404139753.119:1572): pid=4338 uid=0 auid=0 ses=44 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1404139753.126:1573): pid=4341 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=/dev/pts/2 res=success'
>type=USER_START msg=audit(1404139753.126:1574): pid=4341 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=/dev/pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139753.126:1575): pid=4341 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bd:de:8d:8a:18:6d:8c:3b:fb:c8:08:3e:2d:f7:f0:16 direction=? spid=4341 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139753.126:1576): pid=4341 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=62:0a:7a:63:27:e8:08:3e:25:87:7d:c3:cf:92:f4:63 direction=? spid=4341 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=pts/2 res=success'
>type=CRED_REFR msg=audit(1404139753.127:1577): pid=4341 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=AVC msg=audit(1404139758.042:1578): avc:  denied  { name_connect } for  pid=4151 comm="neutron-metadat" dest=9696 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:neutron_port_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1404139758.042:1578): arch=c000003e syscall=42 success=no exit=-115 a0=9 a1=7fff28247bf0 a2=10 a3=ab items=0 ppid=1 pid=4151 auid=4294967295 uid=996 gid=994 euid=996 suid=996 fsuid=996 egid=994 sgid=994 fsgid=994 tty=(none) ses=4294967295 comm="neutron-metadat" exe="/usr/bin/python2.7" subj=system_u:system_r:neutron_t:s0 key=(null)
>type=AVC msg=audit(1404139758.268:1579): avc:  denied  { name_connect } for  pid=4151 comm="neutron-metadat" dest=8775 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
>type=SYSCALL msg=audit(1404139758.268:1579): arch=c000003e syscall=42 success=no exit=-115 a0=9 a1=7fff28249dd0 a2=10 a3=ab items=0 ppid=1 pid=4151 auid=4294967295 uid=996 gid=994 euid=996 suid=996 fsuid=996 egid=994 sgid=994 fsgid=994 tty=(none) ses=4294967295 comm="neutron-metadat" exe="/usr/bin/python2.7" subj=system_u:system_r:neutron_t:s0 key=(null)
>type=USER_END msg=audit(1404139758.337:1580): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/2 res=success'
>type=USER_LOGOUT msg=audit(1404139758.337:1581): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/2 res=success'
>type=USER_END msg=audit(1404139758.342:1582): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1404139758.342:1583): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=172.16.0.171 addr=172.16.0.171 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139758.343:1584): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bd:de:8d:8a:18:6d:8c:3b:fb:c8:08:3e:2d:f7:f0:16 direction=? spid=4338 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139758.343:1585): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=62:0a:7a:63:27:e8:08:3e:25:87:7d:c3:cf:92:f4:63 direction=? spid=4338 suid=0  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139758.343:1586): pid=4338 uid=0 auid=0 ses=44 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=4338 suid=0 rport=51879 laddr=172.16.0.173 lport=22  exe="/usr/sbin/sshd" hostname=? addr=172.16.0.171 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139760.426:1587): pid=4372 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bd:de:8d:8a:18:6d:8c:3b:fb:c8:08:3e:2d:f7:f0:16 direction=? spid=4372 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139760.426:1588): pid=4372 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=62:0a:7a:63:27:e8:08:3e:25:87:7d:c3:cf:92:f4:63 direction=? spid=4372 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1404139760.532:1589): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=4372 suid=74 rport=39444 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1404139760.532:1590): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=4372 suid=74 rport=39444 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=? res=success'
>type=USER_AUTH msg=audit(1404139767.445:1591): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1404139767.552:1592): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1404139769.315:1593): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1404139769.318:1594): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139769.319:1595): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=4372 suid=74 rport=39444 laddr=10.35.160.173 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=? res=success'
>type=USER_AUTH msg=audit(1404139769.320:1596): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1404139769.321:1597): pid=4371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=ssh res=success'
>type=LOGIN msg=audit(1404139769.321:1598): pid=4371 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=45 res=1
>type=USER_ROLE_CHANGE msg=audit(1404139769.377:1599): pid=4371 uid=0 auid=0 ses=45 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=ssh res=success'
>type=USER_START msg=audit(1404139769.393:1600): pid=4371 uid=0 auid=0 ses=45 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1404139769.539:1601): pid=4375 uid=0 auid=0 ses=45 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=/dev/pts/2 res=success'
>type=USER_START msg=audit(1404139769.540:1602): pid=4375 uid=0 auid=0 ses=45 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=/dev/pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139769.541:1603): pid=4375 uid=0 auid=0 ses=45 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bd:de:8d:8a:18:6d:8c:3b:fb:c8:08:3e:2d:f7:f0:16 direction=? spid=4375 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1404139769.541:1604): pid=4375 uid=0 auid=0 ses=45 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=62:0a:7a:63:27:e8:08:3e:25:87:7d:c3:cf:92:f4:63 direction=? spid=4375 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.34.131.50 terminal=pts/2 res=success'
>type=CRED_REFR msg=audit(1404139769.542:1605): pid=4375 uid=0 auid=0 ses=45 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=jl-laptop.brq.redhat.com addr=10.34.131.50 terminal=ssh res=success'

Actions: View

Attachments on bug 1110263: 909678 | 911135 | 913439