* new: loads of audit messgs
@ 2010-03-17 1:04 ` Justin Mattock
0 siblings, 0 replies; 11+ messages in thread
From: Justin Mattock @ 2010-03-17 1:04 UTC (permalink / raw)
To: tresys, SE-Linux
this is new:
(log message is showing loads of these,but I don't see this getting in
the way of anything).
type=1107 audit(1268786484.482:3): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.482858] type=1107 audit(1268786484.482:4): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.514268] type=1107 audit(1268786484.514:5): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.514803] type=1107 audit(1268786484.514:6): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.515396] type=1107 audit(1268786484.515:7): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.515891] type=1107 audit(1268786484.515:8): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
I'll have a look tomorrow to see if this is kernel, and/or policy
only change I did was update libc,kernel(add ima integrity)
and add fcron/logrotate with pam support.
any ideas?
--
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] new: loads of audit messgs
@ 2010-03-17 1:04 ` Justin Mattock
0 siblings, 0 replies; 11+ messages in thread
From: Justin Mattock @ 2010-03-17 1:04 UTC (permalink / raw)
To: refpolicy
this is new:
(log message is showing loads of these,but I don't see this getting in
the way of anything).
type=1107 audit(1268786484.482:3): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.482858] type=1107 audit(1268786484.482:4): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.514268] type=1107 audit(1268786484.514:5): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.514803] type=1107 audit(1268786484.514:6): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.515396] type=1107 audit(1268786484.515:7): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.515891] type=1107 audit(1268786484.515:8): user pid=1277 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
I'll have a look tomorrow to see if this is kernel, and/or policy
only change I did was update libc,kernel(add ima integrity)
and add fcron/logrotate with pam support.
any ideas?
--
Justin P. Mattock
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: new: loads of audit messgs
2010-03-17 1:04 ` [refpolicy] " Justin Mattock
@ 2010-03-17 20:14 ` Eric Paris
-1 siblings, 0 replies; 11+ messages in thread
From: Eric Paris @ 2010-03-17 20:14 UTC (permalink / raw)
To: Justin Mattock; +Cc: tresys, SE-Linux
#define AUDIT_USER_AVC 1107 /* We filter this differently */
So some userspace object manager is denying something ?dbus?
not sure what to tell you since you only get part of the message....
-Eric
On Tue, Mar 16, 2010 at 9:04 PM, Justin Mattock <justinmattock@gmail.com> wrote:
> this is new:
> (log message is showing loads of these,but I don't see this getting in
> the way of anything).
>
> type=1107 audit(1268786484.482:3): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ 8.482858] type=1107 audit(1268786484.482:4): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ 8.514268] type=1107 audit(1268786484.514:5): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ 8.514803] type=1107 audit(1268786484.514:6): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ 8.515396] type=1107 audit(1268786484.515:7): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ 8.515891] type=1107 audit(1268786484.515:8): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
>
> I'll have a look tomorrow to see if this is kernel, and/or policy
> only change I did was update libc,kernel(add ima integrity)
> and add fcron/logrotate with pam support.
>
> any ideas?
>
> --
> Justin P. Mattock
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] new: loads of audit messgs
@ 2010-03-17 20:14 ` Eric Paris
0 siblings, 0 replies; 11+ messages in thread
From: Eric Paris @ 2010-03-17 20:14 UTC (permalink / raw)
To: refpolicy
#define AUDIT_USER_AVC 1107 /* We filter this differently */
So some userspace object manager is denying something ?dbus?
not sure what to tell you since you only get part of the message....
-Eric
On Tue, Mar 16, 2010 at 9:04 PM, Justin Mattock <justinmattock@gmail.com> wrote:
> this is new:
> (log message is showing loads of these,but I don't see this getting in
> the way of anything).
>
> ?type=1107 audit(1268786484.482:3): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ ? ?8.482858] type=1107 audit(1268786484.482:4): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ ? ?8.514268] type=1107 audit(1268786484.514:5): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ ? ?8.514803] type=1107 audit(1268786484.514:6): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ ? ?8.515396] type=1107 audit(1268786484.515:7): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
> [ ? ?8.515891] type=1107 audit(1268786484.515:8): user pid=1277 uid=0
> auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
> msg=''
>
> I'll have a look tomorrow to see if this is kernel, and/or policy
> only change I did was update libc,kernel(add ima integrity)
> and add fcron/logrotate with pam support.
>
> any ideas?
>
> --
> Justin P. Mattock
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo at tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: new: loads of audit messgs
2010-03-17 20:14 ` [refpolicy] " Eric Paris
@ 2010-03-17 21:16 ` Justin P. Mattock
-1 siblings, 0 replies; 11+ messages in thread
From: Justin P. Mattock @ 2010-03-17 21:16 UTC (permalink / raw)
To: Eric Paris; +Cc: tresys, SE-Linux
On 03/17/2010 01:14 PM, Eric Paris wrote:
> #define AUDIT_USER_AVC 1107 /* We filter this differently */
>
> So some userspace object manager is denying something ?dbus?
>
> not sure what to tell you since you only get part of the message....
>
> -Eric
>
>
o.k. these are from nscd
if I reboot without nscd these go away.
weird thing is I cant find the avc's i.g.
Xorg.0.log shows nothing, messages, dmesg etc..
maybe my configs are wrong and/or maybe I need to
bisect glibc.
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] new: loads of audit messgs
@ 2010-03-17 21:16 ` Justin P. Mattock
0 siblings, 0 replies; 11+ messages in thread
From: Justin P. Mattock @ 2010-03-17 21:16 UTC (permalink / raw)
To: refpolicy
On 03/17/2010 01:14 PM, Eric Paris wrote:
> #define AUDIT_USER_AVC 1107 /* We filter this differently */
>
> So some userspace object manager is denying something ?dbus?
>
> not sure what to tell you since you only get part of the message....
>
> -Eric
>
>
o.k. these are from nscd
if I reboot without nscd these go away.
weird thing is I cant find the avc's i.g.
Xorg.0.log shows nothing, messages, dmesg etc..
maybe my configs are wrong and/or maybe I need to
bisect glibc.
Justin P. Mattock
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: new: loads of audit messgs
2010-03-17 20:14 ` [refpolicy] " Eric Paris
@ 2010-03-17 21:52 ` Justin P. Mattock
-1 siblings, 0 replies; 11+ messages in thread
From: Justin P. Mattock @ 2010-03-17 21:52 UTC (permalink / raw)
To: Eric Paris; +Cc: tresys, SE-Linux
weird.. I load up:
vmlinuz-2.6.32-rc7-00030-g4dea955
I can see the avc's denials in dmesg,
I load the latest I just see some audit thing.
I'll bisect this, and check my configs
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] new: loads of audit messgs
@ 2010-03-17 21:52 ` Justin P. Mattock
0 siblings, 0 replies; 11+ messages in thread
From: Justin P. Mattock @ 2010-03-17 21:52 UTC (permalink / raw)
To: refpolicy
weird.. I load up:
vmlinuz-2.6.32-rc7-00030-g4dea955
I can see the avc's denials in dmesg,
I load the latest I just see some audit thing.
I'll bisect this, and check my configs
Justin P. Mattock
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: new: loads of audit messgs
2010-03-17 21:52 ` [refpolicy] " Justin P. Mattock
(?)
@ 2010-03-18 6:42 ` Justin Mattock
-1 siblings, 0 replies; 11+ messages in thread
From: Justin Mattock @ 2010-03-18 6:42 UTC (permalink / raw)
To: Eric Paris
Cc: tresys, SE-Linux, Joe Perches, libc-help,
Linux Kernel Mailing List
o.k. here's the bisect result of why/what is happening with nscd and
the avc's that seem to be missing or partly there:
ef0658f3de484bf9b173639cd47544584e01efa5 is the first bad commit
with the latest HEAD if I do a git revert ef0658f then the audit
messages are showing themselves for nscd.
I can attach dmesg of the good/bad if needed(might be too big in size to send)
here's what I see with a good boot and a bad boot:
bad:
[ 7.284796] generic-usb 0003:05AC:820A.0005: input: USB HID v1.11
Keyboard [HID 05ac:820a] on usb-0000:00:06.0-1.2/input0
[ 7.352310] usb 4-1.3: new full speed USB device using ohci_hcd and address 5
[ 7.465655] input: HID 05ac:820b as
/devices/pci0000:00/0000:00:06.0/usb4/4-1/4-1.3/4-1.3:1.0/input/input9
[ 7.495826] generic-usb 0003:05AC:820B.0006: input: USB HID v1.11
Mouse [HID 05ac:820b] on usb-0000:00:06.0-1.3/input0
[ 8.174301] type=1107 audit(1268891709.174:3): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.190628] type=1107 audit(1268891709.190:4): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.191284] type=1107 audit(1268891709.191:5): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.419552] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 8.444388] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 8.444784] CONFIG_NF_CT_ACCT is deprecated and will be removed
soon. Please use
[ 8.444787] nf_conntrack.acct=1 kernel parameter, acct=1
nf_conntrack module option or
[ 8.444789] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[ 8.651874] type=1107 audit(1268891709.651:6): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.652623] type=1107 audit(1268891709.652:7): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 9.627717] type=1107 audit(1268891710.627:8): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 9.628468] type=1107 audit(1268891710.628:9): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 14.367538] type=1107 audit(1268891715.367:10): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.533134] type=1107 audit(1268891718.533:11): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.544443] type=1100 audit(1268891718.544:12): user pid=1349 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 msg=''
[ 17.547677] type=1101 audit(1268891718.547:13): user pid=1349 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 msg=''
[ 17.573083] type=1006 audit(1268891718.572:14): login pid=1349
uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=1
[ 17.626760] type=2300 audit(1268891718.626:15): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.639043] type=1107 audit(1268891718.638:16): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.756669] type=1105 audit(1268891718.756:17): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.757523] type=1107 audit(1268891718.757:18): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.778843] type=1103 audit(1268891718.778:19): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.778988] type=1112 audit(1268891718.778:20): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.784500] type=1107 audit(1268891718.784:21): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.905611] type=1107 audit(1268891718.905:22): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
good:
[ 7.413356] input: HID 05ac:820b as
/devices/pci0000:00/0000:00:06.0/usb4/4-1/4-1.3/4-1.3:1.0/input/input9
[ 7.413467] generic-usb 0003:05AC:820B.0006: input: USB HID v1.11
Mouse [HID 05ac:820b] on usb-0000:00:06.0-1.3/input0
[ 7.703644] type=1107 audit(1268893782.703:3): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemhost } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass
[ 7.703649] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.719890] type=1107 audit(1268893782.719:4): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 7.719895] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.720580] type=1107 audit(1268893782.720:5): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 7.720585] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.940048] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 7.957023] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 7.957423] CONFIG_NF_CT_ACCT is deprecated and will be removed
soon. Please use
[ 7.957426] nf_conntrack.acct=1 kernel parameter, acct=1
nf_conntrack module option or
[ 7.957429] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[ 8.181014] type=1107 audit(1268893783.180:6): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 8.181019] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 8.181709] type=1107 audit(1268893783.181:7): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 8.181714] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 9.210425] type=1107 audit(1268893784.210:8): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:crond_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 9.210430] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 9.211152] type=1107 audit(1268893784.210:9): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:crond_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 9.211158] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 12.564898] type=1107 audit(1268893787.564:10): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 12.564903] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 15.853971] type=1107 audit(1268893790.853:11): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 15.853976] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 15.865393] type=1100 audit(1268893790.865:12): user pid=1378 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:authentication acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 15.868672] type=1101 audit(1268893790.868:13): user pid=1378 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:accounting acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 15.893990] type=1006 audit(1268893790.893:14): login pid=1378
uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=1
[ 15.955961] type=2300 audit(1268893790.955:15): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='pam: default-context=justin:staff_r:staff_t:s0
selected-context=justin:staff_r:staff_t:s0: exe="/bin/login"
hostname=? addr=? terminal=tty1 res=success'
[ 15.968319] type=1107 audit(1268893790.968:16): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { getpwd } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 15.968324] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.085919] type=1105 audit(1268893791.085:17): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:session_open acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 16.086793] type=1107 audit(1268893791.086:18): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.086798] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.108104] type=1103 audit(1268893791.108:19): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:setcred acct="justin" exe="/bin/login" hostname=? addr=?
terminal=/dev/tty1 res=success'
[ 16.108250] type=1112 audit(1268893791.108:20): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=login acct="justin" exe="/bin/login" hostname=? addr=?
terminal=/dev/tty1 res=success'
[ 16.113829] type=1107 audit(1268893791.113:21): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=justin:staff_r:staff_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.113834] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.234781] type=1107 audit(1268893791.234:22): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=justin:staff_r:staff_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.234786] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 18.651428] type=1107 audit(1268893793.651:23): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemhost } for
scontext=justin:staff_r:xauth_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 18.651430] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
maybe I need to adjust something in /etc/sysctl.conf for the print or
something.
added come CC's
--
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: new: loads of audit messgs
@ 2010-03-18 6:42 ` Justin Mattock
0 siblings, 0 replies; 11+ messages in thread
From: Justin Mattock @ 2010-03-18 6:42 UTC (permalink / raw)
To: Eric Paris
Cc: tresys, SE-Linux, Joe Perches, libc-help,
Linux Kernel Mailing List
o.k. here's the bisect result of why/what is happening with nscd and
the avc's that seem to be missing or partly there:
ef0658f3de484bf9b173639cd47544584e01efa5 is the first bad commit
with the latest HEAD if I do a git revert ef0658f then the audit
messages are showing themselves for nscd.
I can attach dmesg of the good/bad if needed(might be too big in size to send)
here's what I see with a good boot and a bad boot:
bad:
[ 7.284796] generic-usb 0003:05AC:820A.0005: input: USB HID v1.11
Keyboard [HID 05ac:820a] on usb-0000:00:06.0-1.2/input0
[ 7.352310] usb 4-1.3: new full speed USB device using ohci_hcd and address 5
[ 7.465655] input: HID 05ac:820b as
/devices/pci0000:00/0000:00:06.0/usb4/4-1/4-1.3/4-1.3:1.0/input/input9
[ 7.495826] generic-usb 0003:05AC:820B.0006: input: USB HID v1.11
Mouse [HID 05ac:820b] on usb-0000:00:06.0-1.3/input0
[ 8.174301] type=1107 audit(1268891709.174:3): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.190628] type=1107 audit(1268891709.190:4): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.191284] type=1107 audit(1268891709.191:5): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.419552] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 8.444388] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 8.444784] CONFIG_NF_CT_ACCT is deprecated and will be removed
soon. Please use
[ 8.444787] nf_conntrack.acct=1 kernel parameter, acct=1
nf_conntrack module option or
[ 8.444789] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[ 8.651874] type=1107 audit(1268891709.651:6): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.652623] type=1107 audit(1268891709.652:7): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 9.627717] type=1107 audit(1268891710.627:8): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 9.628468] type=1107 audit(1268891710.628:9): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 14.367538] type=1107 audit(1268891715.367:10): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.533134] type=1107 audit(1268891718.533:11): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.544443] type=1100 audit(1268891718.544:12): user pid=1349 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 msg=''
[ 17.547677] type=1101 audit(1268891718.547:13): user pid=1349 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 msg=''
[ 17.573083] type=1006 audit(1268891718.572:14): login pid=1349
uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=1
[ 17.626760] type=2300 audit(1268891718.626:15): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.639043] type=1107 audit(1268891718.638:16): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.756669] type=1105 audit(1268891718.756:17): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.757523] type=1107 audit(1268891718.757:18): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.778843] type=1103 audit(1268891718.778:19): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.778988] type=1112 audit(1268891718.778:20): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.784500] type=1107 audit(1268891718.784:21): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.905611] type=1107 audit(1268891718.905:22): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
good:
[ 7.413356] input: HID 05ac:820b as
/devices/pci0000:00/0000:00:06.0/usb4/4-1/4-1.3/4-1.3:1.0/input/input9
[ 7.413467] generic-usb 0003:05AC:820B.0006: input: USB HID v1.11
Mouse [HID 05ac:820b] on usb-0000:00:06.0-1.3/input0
[ 7.703644] type=1107 audit(1268893782.703:3): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemhost } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass
[ 7.703649] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.719890] type=1107 audit(1268893782.719:4): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 7.719895] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.720580] type=1107 audit(1268893782.720:5): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 7.720585] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.940048] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 7.957023] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 7.957423] CONFIG_NF_CT_ACCT is deprecated and will be removed
soon. Please use
[ 7.957426] nf_conntrack.acct=1 kernel parameter, acct=1
nf_conntrack module option or
[ 7.957429] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[ 8.181014] type=1107 audit(1268893783.180:6): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 8.181019] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 8.181709] type=1107 audit(1268893783.181:7): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 8.181714] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 9.210425] type=1107 audit(1268893784.210:8): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:crond_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 9.210430] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 9.211152] type=1107 audit(1268893784.210:9): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:crond_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 9.211158] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 12.564898] type=1107 audit(1268893787.564:10): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 12.564903] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 15.853971] type=1107 audit(1268893790.853:11): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 15.853976] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 15.865393] type=1100 audit(1268893790.865:12): user pid=1378 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:authentication acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 15.868672] type=1101 audit(1268893790.868:13): user pid=1378 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:accounting acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 15.893990] type=1006 audit(1268893790.893:14): login pid=1378
uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=1
[ 15.955961] type=2300 audit(1268893790.955:15): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='pam: default-context=justin:staff_r:staff_t:s0
selected-context=justin:staff_r:staff_t:s0: exe="/bin/login"
hostname=? addr=? terminal=tty1 res=success'
[ 15.968319] type=1107 audit(1268893790.968:16): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { getpwd } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 15.968324] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.085919] type=1105 audit(1268893791.085:17): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:session_open acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 16.086793] type=1107 audit(1268893791.086:18): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.086798] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.108104] type=1103 audit(1268893791.108:19): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:setcred acct="justin" exe="/bin/login" hostname=? addr=?
terminal=/dev/tty1 res=success'
[ 16.108250] type=1112 audit(1268893791.108:20): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=login acct="justin" exe="/bin/login" hostname=? addr=?
terminal=/dev/tty1 res=success'
[ 16.113829] type=1107 audit(1268893791.113:21): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=justin:staff_r:staff_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.113834] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.234781] type=1107 audit(1268893791.234:22): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=justin:staff_r:staff_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.234786] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 18.651428] type=1107 audit(1268893793.651:23): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemhost } for
scontext=justin:staff_r:xauth_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 18.651430] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
maybe I need to adjust something in /etc/sysctl.conf for the print or
something.
added come CC's
--
Justin P. Mattock
^ permalink raw reply [flat|nested] 11+ messages in thread* [refpolicy] new: loads of audit messgs
@ 2010-03-18 6:42 ` Justin Mattock
0 siblings, 0 replies; 11+ messages in thread
From: Justin Mattock @ 2010-03-18 6:42 UTC (permalink / raw)
To: refpolicy
o.k. here's the bisect result of why/what is happening with nscd and
the avc's that seem to be missing or partly there:
ef0658f3de484bf9b173639cd47544584e01efa5 is the first bad commit
with the latest HEAD if I do a git revert ef0658f then the audit
messages are showing themselves for nscd.
I can attach dmesg of the good/bad if needed(might be too big in size to send)
here's what I see with a good boot and a bad boot:
bad:
[ 7.284796] generic-usb 0003:05AC:820A.0005: input: USB HID v1.11
Keyboard [HID 05ac:820a] on usb-0000:00:06.0-1.2/input0
[ 7.352310] usb 4-1.3: new full speed USB device using ohci_hcd and address 5
[ 7.465655] input: HID 05ac:820b as
/devices/pci0000:00/0000:00:06.0/usb4/4-1/4-1.3/4-1.3:1.0/input/input9
[ 7.495826] generic-usb 0003:05AC:820B.0006: input: USB HID v1.11
Mouse [HID 05ac:820b] on usb-0000:00:06.0-1.3/input0
[ 8.174301] type=1107 audit(1268891709.174:3): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.190628] type=1107 audit(1268891709.190:4): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.191284] type=1107 audit(1268891709.191:5): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.419552] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 8.444388] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 8.444784] CONFIG_NF_CT_ACCT is deprecated and will be removed
soon. Please use
[ 8.444787] nf_conntrack.acct=1 kernel parameter, acct=1
nf_conntrack module option or
[ 8.444789] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[ 8.651874] type=1107 audit(1268891709.651:6): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 8.652623] type=1107 audit(1268891709.652:7): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 9.627717] type=1107 audit(1268891710.627:8): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 9.628468] type=1107 audit(1268891710.628:9): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 14.367538] type=1107 audit(1268891715.367:10): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.533134] type=1107 audit(1268891718.533:11): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.544443] type=1100 audit(1268891718.544:12): user pid=1349 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 msg=''
[ 17.547677] type=1101 audit(1268891718.547:13): user pid=1349 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 msg=''
[ 17.573083] type=1006 audit(1268891718.572:14): login pid=1349
uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=1
[ 17.626760] type=2300 audit(1268891718.626:15): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.639043] type=1107 audit(1268891718.638:16): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.756669] type=1105 audit(1268891718.756:17): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.757523] type=1107 audit(1268891718.757:18): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.778843] type=1103 audit(1268891718.778:19): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.778988] type=1112 audit(1268891718.778:20): user pid=1349 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg=''
[ 17.784500] type=1107 audit(1268891718.784:21): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
[ 17.905611] type=1107 audit(1268891718.905:22): user pid=1270 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg=''
good:
[ 7.413356] input: HID 05ac:820b as
/devices/pci0000:00/0000:00:06.0/usb4/4-1/4-1.3/4-1.3:1.0/input/input9
[ 7.413467] generic-usb 0003:05AC:820B.0006: input: USB HID v1.11
Mouse [HID 05ac:820b] on usb-0000:00:06.0-1.3/input0
[ 7.703644] type=1107 audit(1268893782.703:3): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemhost } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass
[ 7.703649] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.719890] type=1107 audit(1268893782.719:4): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 7.719895] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.720580] type=1107 audit(1268893782.720:5): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:syslogd_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 7.720585] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 7.940048] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 7.957023] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 7.957423] CONFIG_NF_CT_ACCT is deprecated and will be removed
soon. Please use
[ 7.957426] nf_conntrack.acct=1 kernel parameter, acct=1
nf_conntrack module option or
[ 7.957429] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[ 8.181014] type=1107 audit(1268893783.180:6): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 8.181019] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 8.181709] type=1107 audit(1268893783.181:7): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 8.181714] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 9.210425] type=1107 audit(1268893784.210:8): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:crond_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 9.210430] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 9.211152] type=1107 audit(1268893784.210:9): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:crond_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 9.211158] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 12.564898] type=1107 audit(1268893787.564:10): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 12.564903] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 15.853971] type=1107 audit(1268893790.853:11): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=system_u:system_r:chkpwd_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 15.853976] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 15.865393] type=1100 audit(1268893790.865:12): user pid=1378 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:authentication acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 15.868672] type=1101 audit(1268893790.868:13): user pid=1378 uid=0
auid=4294967295 ses=4294967295
subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:accounting acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 15.893990] type=1006 audit(1268893790.893:14): login pid=1378
uid=0 old auid=4294967295 new auid=1000 old ses=4294967295 new ses=1
[ 15.955961] type=2300 audit(1268893790.955:15): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='pam: default-context=justin:staff_r:staff_t:s0
selected-context=justin:staff_r:staff_t:s0: exe="/bin/login"
hostname=? addr=? terminal=tty1 res=success'
[ 15.968319] type=1107 audit(1268893790.968:16): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { getpwd } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 15.968324] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.085919] type=1105 audit(1268893791.085:17): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:session_open acct="justin" exe="/bin/login" hostname=?
addr=? terminal=/dev/tty1 res=success'
[ 16.086793] type=1107 audit(1268893791.086:18): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=system_u:system_r:local_login_t:s0-s0:c0.c255
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.086798] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.108104] type=1103 audit(1268893791.108:19): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=PAM:setcred acct="justin" exe="/bin/login" hostname=? addr=?
terminal=/dev/tty1 res=success'
[ 16.108250] type=1112 audit(1268893791.108:20): user pid=1378 uid=0
auid=1000 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c255
msg='op=login acct="justin" exe="/bin/login" hostname=? addr=?
terminal=/dev/tty1 res=success'
[ 16.113829] type=1107 audit(1268893791.113:21): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmempwd } for
scontext=justin:staff_r:staff_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.113834] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 16.234781] type=1107 audit(1268893791.234:22): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemgrp } for
scontext=justin:staff_r:staff_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 16.234786] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
[ 18.651428] type=1107 audit(1268893793.651:23): user pid=1297 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0
msg='avc: denied { shmemhost } for
scontext=justin:staff_r:xauth_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=nscd
[ 18.651430] : exe="/usr/sbin/nscd" sauid=0 hostname=? addr=? terminal=?'
maybe I need to adjust something in /etc/sysctl.conf for the print or
something.
added come CC's
--
Justin P. Mattock
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2010-03-18 6:49 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-03-17 1:04 new: loads of audit messgs Justin Mattock
2010-03-17 1:04 ` [refpolicy] " Justin Mattock
2010-03-17 20:14 ` Eric Paris
2010-03-17 20:14 ` [refpolicy] " Eric Paris
2010-03-17 21:16 ` Justin P. Mattock
2010-03-17 21:16 ` [refpolicy] " Justin P. Mattock
2010-03-17 21:52 ` Justin P. Mattock
2010-03-17 21:52 ` [refpolicy] " Justin P. Mattock
2010-03-18 6:42 ` Justin Mattock
2010-03-18 6:42 ` Justin Mattock
2010-03-18 6:42 ` [refpolicy] " Justin Mattock
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.