auditd log

emerge-webrsync.log (text/plain), 3.35 KB, created by Matthew Thode ( prometheanfire ) on 2011-07-22 14:00:06 UTC

type=DAEMON_START msg=audit(1311341560.772:8328): auditd start, ver=1.7.4 format=raw kernel=2.6.38-hardened-r6 auid=0 pid=3593 res=success
type=CONFIG_CHANGE msg=audit(1311341560.872:586): audit_enabled=1 old=1 auid=0 ses=3 subj=system_u:system_r:auditd_t res=1
type=CONFIG_CHANGE msg=audit(1311341560.880:587): audit_backlog_limit=256 old=256 auid=0 ses=3 subj=system_u:system_r:auditctl_t res=1
type=AVC msg=audit(1311341599.593:588): avc:  denied  { search } for  pid=3708 comm="gpg" name="portage" dev=vda3 ino=5237 scontext=root:sysadm_r:gpg_t tcontext=system_u:object_r:portage_conf_t tclass=dir
type=SYSCALL msg=audit(1311341599.593:588): arch=c000003e syscall=21 success=no exit=-2 a0=7d4c7c1a990 a1=4 a2=0 a3=0 items=0 ppid=3634 pid=3708 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="gpg" exe="/usr/bin/gpg2" subj=root:sysadm_r:gpg_t key=(null)
type=AVC msg=audit(1311341599.593:589): avc:  denied  { getattr } for  pid=3708 comm="gpg" path="/etc/portage" dev=vda3 ino=5237 scontext=root:sysadm_r:gpg_t tcontext=system_u:object_r:portage_conf_t tclass=dir
type=SYSCALL msg=audit(1311341599.593:589): arch=c000003e syscall=4 success=yes exit=0 a0=7d4c7c1a9f0 a1=72a046ef51b0 a2=72a046ef51b0 a3=0 items=0 ppid=3634 pid=3708 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="gpg" exe="/usr/bin/gpg2" subj=root:sysadm_r:gpg_t key=(null)
type=AVC msg=audit(1311341599.612:590): avc:  denied  { search } for  pid=3708 comm="gpg" name="emerge-webrsync" dev=dm-3 ino=74 scontext=root:sysadm_r:gpg_t tcontext=system_u:object_r:file_t tclass=dir
type=AVC msg=audit(1311341599.612:590): avc:  denied  { read } for  pid=3708 comm="gpg" name="portage-20110721.tar.xz.gpgsig" dev=dm-3 ino=262 scontext=root:sysadm_r:gpg_t tcontext=root:object_r:file_t tclass=file
type=AVC msg=audit(1311341599.612:590): avc:  denied  { open } for  pid=3708 comm="gpg" name="portage-20110721.tar.xz.gpgsig" dev=dm-3 ino=262 scontext=root:sysadm_r:gpg_t tcontext=root:object_r:file_t tclass=file
type=SYSCALL msg=audit(1311341599.612:590): arch=c000003e syscall=2 success=yes exit=3 a0=72a046ef5b75 a1=0 a2=1b6 a3=0 items=0 ppid=3634 pid=3708 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="gpg" exe="/usr/bin/gpg2" subj=root:sysadm_r:gpg_t key=(null)
type=AVC msg=audit(1311341645.967:591): avc:  denied  { execute } for  pid=3634 comm="emerge-webrsync" name="post_sync" dev=vda3 ino=5741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:portage_conf_t tclass=file
type=SYSCALL msg=audit(1311341645.967:591): arch=c000003e syscall=21 success=yes exit=0 a0=7facebef320 a1=1 a2=0 a3=8 items=0 ppid=3604 pid=3634 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="emerge-webrsync" exe="/bin/bash" subj=root:sysadm_r:sysadm_t key=(null)
type=AVC msg=audit(1311341645.967:592): avc:  denied  { execute_no_trans } for  pid=3724 comm="emerge-webrsync" path="/etc/portage/bin/post_sync" dev=vda3 ino=5741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:portage_conf_t tclass=file
type=SYSCALL msg=audit(1311341645.967:592): arch=c000003e syscall=59 success=yes exit=0 a0=7facebeefd0 a1=7facebf0a90 a2=7facebc1e60 a3=8 items=0 ppid=3634 pid=3724 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="post_sync" exe="/bin/bash" subj=root:sysadm_r:sysadm_t key=(null)