Attachment 950728 Details for Bug 1151814 – audit.log resulting in kernel0000.te file for comment 9, point 2.

audit.log resulting in kernel0000.te file for comment 9, point 2.

audit.log.kernel0000 (text/plain), 4.40 KB, created by Peter H. Jones on 2014-10-26 00:39:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Peter H. Jones

Created: 2014-10-26 00:39:18 UTC

Size: 4.40 KB

patch

obsolete

>type=DAEMON_ROTATE msg=audit(1414280724.093:1679): auditd sending auid=0 pid=1818 subj=unconfined_u:unconfined_r:unconfined_t:s0
>type=MAC_POLICY_LOAD msg=audit(1414280792.660:425): policy loaded auid=0 ses=2
>type=USER_AUTH msg=audit(1414280811.749:426): pid=2279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:authentication grantor=pam_unix acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=USER_ACCT msg=audit(1414280811.752:427): pid=2279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:accounting grantor=pam_unix,pam_localuser acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=CRED_ACQ msg=audit(1414280811.753:428): pid=2279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:setcred grantor=pam_unix acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=LOGIN msg=audit(1414280811.753:429): pid=2279 uid=0 subj=system_u:system_r:kernel_t:s0 old-auid=4294967295 auid=1000 old-ses=4294967295 ses=4 res=1
>type=USER_ROLE_CHANGE msg=audit(1414280811.862:430): pid=2279 uid=0 auid=1000 ses=4 subj=system_u:system_r:kernel_t:s0 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0 selected-context=unconfined_u:unconfined_r:unconfined_t:s0 exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=USER_AVC msg=audit(1414280811.887:431): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='avc:  received policyload notice (seqno=3)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=USER_AVC msg=audit(1414280811.888:432): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg='avc:  received policyload notice (seqno=4)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=USER_START msg=audit(1414280811.945:433): pid=2279 uid=0 auid=1000 ses=4 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:session_open grantor=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=CRED_REFR msg=audit(1414280811.945:434): pid=2279 uid=0 auid=1000 ses=4 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:setcred grantor=pam_unix acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=USER_LOGIN msg=audit(1414280811.947:435): pid=2279 uid=0 auid=1000 ses=4 subj=system_u:system_r:kernel_t:s0 msg='op=login id=1000 exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=AVC msg=audit(1414280811.948:436): avc:  denied  { transition } for  pid=2447 comm="login" path="/usr/bin/bash" dev="dm-0" ino=144641 scontext=system_u:system_r:kernel_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0
>type=CRED_DISP msg=audit(1414280811.950:437): pid=2279 uid=0 auid=1000 ses=4 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:setcred grantor=pam_unix acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=USER_END msg=audit(1414280811.974:438): pid=2279 uid=0 auid=1000 ses=4 subj=system_u:system_r:kernel_t:s0 msg='op=PAM:session_close grantor=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="liveuser" exe="/usr/bin/login" hostname=? addr=? terminal=tty3 res=success'
>type=SERVICE_STOP msg=audit(1414280812.056:439): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg=' comm="getty@tty3" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1414280812.087:440): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg=' comm="getty@tty3" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1414280812.087:441): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg=' comm="getty@tty3" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1414280812.098:442): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 msg=' comm="getty@tty3" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=MAC_POLICY_LOAD msg=audit(1414280904.044:443): policy loaded auid=0 ses=2

Actions: View

Attachments on bug 1151814: 947309 | 950727 | 950728 | 950729