Re: mknod still not working after suggested fix

[Antonio Olivares <olivares14031@xxxxxxxxx>]

----- Original Message ----
From: Daniel J Walsh <dwalsh@xxxxxxxxxx>
To: Antonio Olivares <olivares14031@xxxxxxxxx>
Cc: fedora-selinux-list@xxxxxxxxxx
Sent: Tuesday, June 5, 2007 8:22:32 AM
Subject: Re: mknod still not working after suggested fix

Antonio Olivares wrote:
> selinux is still not allowing mknod to do its job.  
>
> I have to manually create the device node every boot 
>
> [root@localhost ~]# mknod -m 600 /dev/slamr0 c 242 0
> [1]+  Done                    gedit /boot/grub/grub.conf
> [root@localhost ~]# modprobe ungrab-winmodem
> [root@localhost ~]# modprobe slamr
> [root@localhost ~]# slmodemd -c USA /dev/slamr0 &
> [1] 2709
> [root@localhost ~]# SmartLink Soft Modem: version 2.9.11 Jun  4 2007 00:14:21
> symbolic link `/dev/ttySL0' -> `/dev/pts/1' created.
> modem `slamr0' created. TTY is `/dev/pts/1'
> Use `/dev/ttySL0' as modem device, Ctrl+C for termination.
>
>
>
> audit(1181023411.825:4): avc:  denied  { mknod } for  pid=673 comm="mknod" capability=27 scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability
>
>
> [root@localhost ~]# grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod
> ******************** IMPORTANT ***********************
> To make this policy package active, execute:
>
> semodule -i myinsmod.pp
>
> [root@localhost ~]# semodule -i myinsmod.pp
>
> What should I try now?  
>
> Regards,
>
> Antonio
>
>
>   
Are you seeing other avc messages?  Please attach the myinsmod.te and 
your audit.log
>
>        
> ____________________________________________________________________________________
> Get the Yahoo! toolbar and be alerted to new email wherever you're surfing.
> http://new.toolbar.yahoo.com/toolbar/features/mail/index.php
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   

[root@localhost ~]# cat myinsmod.te 

module myinsmod 1.0;

require {
        type insmod_t;
        type device_t;
        class dir write;
}

#============= insmod_t ==============
allow insmod_t device_t:dir write;
[root@localhost ~]# 

Attachment was neglected by yahoo mail, sent it to text file and attached as auditlog.txt

[root@localhost audit]# cat audit.log | more
type=DAEMON_START msg=audit(1180930151.012:6690) auditd start, ver=1.5.3, format
=raw, auid=4294967295 pid=1558 res=success, auditd pid=1558
type=CONFIG_CHANGE msg=audit(1180930150.723:15): audit_enabled=1 old=0 by auid=4
294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180930150.723:16): audit_enabled=1 old=0 by auid=4
294967295 res=1
type=CONFIG_CHANGE msg=audit(1180930150.723:17): audit_backlog_limit=320 old=64 
by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180930150.723:18): audit_backlog_limit=320 old=64 
by auid=4294967295 res=1
type=USER_AUTH msg=audit(1180930198.716:19): user pid=2385 uid=0 auid=4294967295
 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication ac
ct=? : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
type=USER_LOGIN msg=audit(1180930199.216:20): user pid=2385 uid=0 auid=429496729
5 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='acct=olivares: exe="/
bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
type=USER_AUTH msg=audit(1180930208.714:21): user pid=2385 uid=0 auid=4294967295
 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication ac
ct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180930208.714:22): user pid=2385 uid=0 auid=4294967295
 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=r
oot : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=LOGIN msg=audit(1180930209.214:23): login pid=2385 uid=0 old auid=429496729
....


Thank you very much for your patience and your kindness with this issue. ,

Antonio 







 
____________________________________________________________________________________
We won't tell. Get more on shows you hate to love 
(and love to hate): Yahoo! TV's Guilty Pleasures list.
http://tv.yahoo.com/collections/265

type=DAEMON_START msg=audit(1180930151.012:6690) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1558 res=success, auditd pid=1558
type=CONFIG_CHANGE msg=audit(1180930150.723:15): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180930150.723:16): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180930150.723:17): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180930150.723:18): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_AUTH msg=audit(1180930198.716:19): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=? : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
type=USER_LOGIN msg=audit(1180930199.216:20): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='acct=olivares: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)'
type=USER_AUTH msg=audit(1180930208.714:21): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180930208.714:22): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=LOGIN msg=audit(1180930209.214:23): login pid=2385 uid=0 old auid=4294967295 new auid=0
type=USER_ROLE_CHANGE msg=audit(1180930209.214:24): user pid=2385 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=root:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180930209.214:25): user pid=2385 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180930209.214:26): user pid=2385 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_LOGIN msg=audit(1180930209.214:27): user pid=2385 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=AVC msg=audit(1180930216.713:28): avc:  denied  { search } for  pid=2512 comm="ck-get-x11-serv" name="root" dev=dm-0 ino=6193153 scontext=system_u:system_r:consolekit_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir
type=SYSCALL msg=audit(1180930216.713:28): arch=40000003 syscall=33 success=no exit=-13 a0=bffc4fbc a1=4 a2=8c59b8 a3=bffc4fbc items=0 ppid=2511 pid=2512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ck-get-x11-serv" exe="/usr/libexec/ck-get-x11-server-pid" subj=system_u:system_r:consolekit_t:s0 key=(null)
type=USER_AUTH msg=audit(1180930283.203:29): user pid=2706 uid=0 auid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180930283.203:30): user pid=2706 uid=0 auid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180930283.203:31): user pid=2706 uid=0 auid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180930306.200:32): user pid=2706 uid=0 auid=0 subj=root:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=CRED_DISP msg=audit(1180930315.698:33): user pid=2385 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180930315.698:34): user pid=2385 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180930320.697:35): user pid=2726 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180930320.697:36): user pid=2726 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=LOGIN msg=audit(1180930320.697:37): login pid=2726 uid=0 old auid=4294967295 new auid=500
type=USER_ROLE_CHANGE msg=audit(1180930320.697:38): user pid=2726 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=user_u:system_r:unconfined_t:s0 selected-context=user_u:system_r:unconfined_t:s0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180930320.697:39): user pid=2726 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180930320.697:40): user pid=2726 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_LOGIN msg=audit(1180930320.697:41): user pid=2726 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180930727.635:42): user pid=3603 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180930727.635:43): user pid=3603 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180930727.635:44): user pid=3603 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180930727.635:45): user pid=3603 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_DISP msg=audit(1180930794.625:46): user pid=3603 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180930794.625:47): user pid=3603 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180930802.124:48): user pid=4054 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180930802.124:49): user pid=4054 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180930802.124:50): user pid=4054 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180930802.124:51): user pid=4054 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180930944.102:52): user pid=4168 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_ACCT msg=audit(1180930944.102:53): user pid=4168 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_START msg=audit(1180930944.102:54): user pid=4168 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_ACQ msg=audit(1180930944.102:55): user pid=4168 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_AUTH msg=audit(1180931033.089:56): user pid=4257 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180931033.089:57): user pid=4257 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1180931033.089:58): user pid=4257 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1180931033.089:59): user pid=4257 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_DISP msg=audit(1180932055.933:60): user pid=4257 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_END msg=audit(1180932055.933:61): user pid=4257 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_AUTH msg=audit(1180932189.412:62): user pid=4690 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180932189.412:63): user pid=4690 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180932189.412:64): user pid=4690 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180932245.904:65): user pid=4690 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=CRED_DISP msg=audit(1180932415.378:66): user pid=4168 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_END msg=audit(1180932415.378:67): user pid=4168 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_DISP msg=audit(1180932437.874:68): user pid=4054 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180932437.874:69): user pid=4054 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180932463.370:70): user pid=4812 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180932463.370:71): user pid=4812 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180932463.870:72): user pid=2726 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180932463.870:73): user pid=2726 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=DAEMON_END msg=audit(1180932472.160:6691) auditd normal halt, sending auid=4294967295 pid=5278 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1558
type=DAEMON_START msg=audit(1180932581.561:2652) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1563 res=success, auditd pid=1563
type=CONFIG_CHANGE msg=audit(1180932581.589:16): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180932581.589:17): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180932581.589:18): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180932581.589:19): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_AUTH msg=audit(1180932613.584:20): user pid=2432 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180932613.584:21): user pid=2432 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=LOGIN msg=audit(1180932613.584:22): login pid=2432 uid=0 old auid=4294967295 new auid=500
type=USER_ROLE_CHANGE msg=audit(1180932613.584:23): user pid=2432 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=user_u:system_r:unconfined_t:s0 selected-context=user_u:system_r:unconfined_t:s0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180932613.584:24): user pid=2432 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180932613.584:25): user pid=2432 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_LOGIN msg=audit(1180932613.584:26): user pid=2432 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180932700.571:27): user pid=2783 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180932700.571:28): user pid=2783 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180932700.571:29): user pid=2783 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180932700.571:30): user pid=2783 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180932718.068:31): user pid=2839 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180932718.068:32): user pid=2839 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180932718.068:33): user pid=2839 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=AVC msg=audit(1180932721.567:34): avc:  denied  { write } for  pid=2893 comm="mknod" name="/" dev=tmpfs ino=752 scontext=system_u:system_r:insmod_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir
type=SYSCALL msg=audit(1180932721.567:34): arch=40000003 syscall=14 success=no exit=-13 a0=bfd3ef63 a1=21b0 a2=f200 a3=21b0 items=0 ppid=2892 pid=2893 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mknod" exe="/bin/mknod" subj=system_u:system_r:insmod_t:s0 key=(null)
type=USER_END msg=audit(1180932783.058:35): user pid=2839 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=CRED_DISP msg=audit(1180933182.497:36): user pid=2432 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180933182.497:37): user pid=2432 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180933182.497:38): user pid=2783 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180933182.497:39): user pid=2783 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=DAEMON_END msg=audit(1180933189.871:2653) auditd normal halt, sending auid=4294967295 pid=3440 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1563
type=DAEMON_START msg=audit(1180933570.604:3972) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1400 res=success, auditd pid=1400
type=CONFIG_CHANGE msg=audit(1180933570.547:66): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180933570.547:67): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180933570.547:68): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180933570.547:69): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_AUTH msg=audit(1180933616.540:70): user pid=2222 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180933616.540:71): user pid=2222 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=LOGIN msg=audit(1180933616.540:72): login pid=2222 uid=0 old auid=4294967295 new auid=500
type=USER_ROLE_CHANGE msg=audit(1180933616.540:73): user pid=2222 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=user_u:system_r:unconfined_t:s0 selected-context=user_u:system_r:unconfined_t:s0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180933616.540:74): user pid=2222 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180933616.540:75): user pid=2222 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_LOGIN msg=audit(1180933616.540:76): user pid=2222 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180933623.539:77): user pid=2303 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180933623.539:78): user pid=2303 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180933623.539:79): user pid=2303 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180933623.539:80): user pid=2303 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180933713.025:81): user pid=2303 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180933713.025:82): user pid=2303 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180933749.020:83): user pid=2636 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180933749.020:84): user pid=2636 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180933749.020:85): user pid=2636 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180933749.020:86): user pid=2636 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=AVC msg=audit(1180933804.511:87): avc:  denied  { write } for  pid=2766 comm="mknod" name="/" dev=tmpfs ino=752 scontext=user_u:system_r:insmod_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir
type=SYSCALL msg=audit(1180933804.511:87): arch=40000003 syscall=14 success=no exit=-13 a0=bfa53f6d a1=21b0 a2=f200 a3=21b0 items=0 ppid=2765 pid=2766 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="mknod" exe="/bin/mknod" subj=user_u:system_r:insmod_t:s0 key=(null)
type=USER_AUTH msg=audit(1180933876.500:88): user pid=2779 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180933876.500:89): user pid=2779 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180933876.500:90): user pid=2779 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180933907.495:91): user pid=2636 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180933907.495:92): user pid=2636 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180933919.494:93): user pid=2808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180933919.494:94): user pid=2808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180933919.494:95): user pid=2808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180933919.494:96): user pid=2808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180933959.987:97): user pid=2853 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180933959.987:98): user pid=2853 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180933959.987:99): user pid=2853 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180934024.478:100): user pid=2853 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=CRED_DISP msg=audit(1180934039.975:101): user pid=2808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180934039.975:102): user pid=2808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180934077.470:103): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180934077.470:104): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180934077.470:105): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180934077.470:106): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_DISP msg=audit(1180934089.968:107): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180934089.968:108): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180934097.966:109): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180934097.966:110): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180934097.966:111): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180934097.966:112): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180934143.459:113): user pid=3483 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180934143.459:114): user pid=3483 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180934143.459:115): user pid=3483 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180934150.958:116): user pid=3483 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1180934158.957:117): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_ACCT msg=audit(1180934158.957:118): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_START msg=audit(1180934158.957:119): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_ACQ msg=audit(1180934158.957:120): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_AUTH msg=audit(1180934544.398:121): user pid=3760 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180934544.398:122): user pid=3760 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1180934544.398:123): user pid=3760 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1180934544.398:124): user pid=3760 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_DISP msg=audit(1180936055.168:125): user pid=3760 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_END msg=audit(1180936055.168:126): user pid=3760 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_DISP msg=audit(1180936288.632:127): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_END msg=audit(1180936288.632:128): user pid=3527 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_DISP msg=audit(1180936292.132:129): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180936292.132:130): user pid=3437 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180936304.630:131): user pid=3942 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180936304.630:132): user pid=3942 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180936305.130:133): user pid=2222 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180936305.130:134): user pid=2222 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=DAEMON_END msg=audit(1180936313.700:3973) auditd normal halt, sending auid=4294967295 pid=4410 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1400
type=DAEMON_START msg=audit(1180938259.064:4191) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1379 res=success, auditd pid=1379
type=CONFIG_CHANGE msg=audit(1180938258.772:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180938258.772:7): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180938258.772:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180938258.772:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=AVC msg=audit(1180938269.270:10): avc:  denied  { write } for  pid=1974 comm="mknod" name="/" dev=tmpfs ino=752 scontext=system_u:system_r:insmod_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir
type=SYSCALL msg=audit(1180938269.270:10): arch=40000003 syscall=14 success=no exit=-13 a0=bf93aef8 a1=21b0 a2=f200 a3=21b0 items=0 ppid=1973 pid=1974 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mknod" exe="/bin/mknod" subj=system_u:system_r:insmod_t:s0 key=(null)
type=USER_ERR msg=audit(1180938282.268:11): user pid=2228 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
type=USER_AUTH msg=audit(1180938299.266:12): user pid=2296 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_ACCT msg=audit(1180938299.266:13): user pid=2296 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_ACQ msg=audit(1180938299.266:14): user pid=2296 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=LOGIN msg=audit(1180938299.266:15): login pid=2296 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1180938299.266:16): user pid=2296 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_LOGIN msg=audit(1180938299.266:17): user pid=2296 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
type=USER_AUTH msg=audit(1180938332.761:18): user pid=2611 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180938332.761:19): user pid=2611 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180938332.761:20): user pid=2611 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180938332.761:21): user pid=2611 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180938456.742:22): user pid=2738 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_ACCT msg=audit(1180938456.742:23): user pid=2738 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_START msg=audit(1180938456.742:24): user pid=2738 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=CRED_ACQ msg=audit(1180938456.742:25): user pid=2738 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_AUTH msg=audit(1180938686.707:26): user pid=2899 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180938686.707:27): user pid=2899 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1180938686.707:28): user pid=2899 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1180938686.707:29): user pid=2899 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_AUTH msg=audit(1180938810.688:30): user pid=2967 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180938810.688:31): user pid=2967 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180938810.688:32): user pid=2967 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1180939757.043:33): user pid=2967 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1180940051.498:34): user pid=3397 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180940051.498:35): user pid=3397 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180940051.498:36): user pid=3397 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1180940192.477:37): user pid=3397 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1180940216.973:38): user pid=3476 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180940216.973:39): user pid=3476 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180940216.973:40): user pid=3476 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180940461.936:41): user pid=3712 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1180940461.936:42): user pid=3712 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1180940461.936:43): login pid=3712 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1180940461.936:44): user pid=3712 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1180940461.936:45): user pid=3712 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1180940461.936:46): user pid=3712 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1180940496.930:47): user pid=3476 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=CRED_DISP msg=audit(1180940709.898:48): user pid=2899 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_END msg=audit(1180940709.898:49): user pid=2899 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_AUTH msg=audit(1180941546.770:50): user pid=3888 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180941546.770:51): user pid=3888 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180941546.770:52): user pid=3888 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1180941670.251:53): user pid=3888 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=CRED_DISP msg=audit(1180941712.245:54): user pid=2738 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_END msg=audit(1180941712.245:55): user pid=2738 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=CRED_DISP msg=audit(1180941740.741:56): user pid=2611 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180941740.741:57): user pid=2611 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180941865.222:58): user pid=4041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180941865.222:59): user pid=4041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180941865.222:60): user pid=4041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180941865.222:61): user pid=4041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_DISP msg=audit(1180941901.216:62): user pid=4041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180941901.216:63): user pid=4041 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180941901.216:64): user pid=2296 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_DISP msg=audit(1180941901.216:65): user pid=2296 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=DAEMON_END msg=audit(1180941908.981:4192) auditd normal halt, sending auid=4294967295 pid=4549 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1379
type=DAEMON_START msg=audit(1180944824.661:3622) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1408 res=success, auditd pid=1408
type=CONFIG_CHANGE msg=audit(1180944824.737:57): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180944824.737:58): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180944824.737:59): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180944824.737:60): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=AVC msg=audit(1180944833.236:61): avc:  denied  { write } for  pid=2005 comm="mknod" name="/" dev=tmpfs ino=752 scontext=system_u:system_r:insmod_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir
type=SYSCALL msg=audit(1180944833.236:61): arch=40000003 syscall=14 success=no exit=-13 a0=bff39ef8 a1=21b0 a2=f200 a3=21b0 items=0 ppid=2004 pid=2005 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mknod" exe="/bin/mknod" subj=system_u:system_r:insmod_t:s0 key=(null)
type=USER_ERR msg=audit(1180944842.235:62): user pid=2260 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
type=USER_AUTH msg=audit(1180944857.732:63): user pid=2328 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_ACCT msg=audit(1180944857.732:64): user pid=2328 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_ACQ msg=audit(1180944857.732:65): user pid=2328 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=LOGIN msg=audit(1180944857.732:66): login pid=2328 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1180944857.732:67): user pid=2328 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_LOGIN msg=audit(1180944857.732:68): user pid=2328 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
type=USER_AUTH msg=audit(1180944918.223:69): user pid=2648 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180944918.223:70): user pid=2648 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180944918.223:71): user pid=2648 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180944918.223:72): user pid=2648 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180945001.710:73): user pid=2727 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_ACCT msg=audit(1180945001.710:74): user pid=2727 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_START msg=audit(1180945001.710:75): user pid=2727 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=CRED_ACQ msg=audit(1180945001.710:76): user pid=2727 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_AUTH msg=audit(1180945104.195:77): user pid=2824 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180945104.195:78): user pid=2824 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1180945104.195:79): user pid=2824 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1180945104.195:80): user pid=2824 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180947661.305:81): user pid=3123 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1180947661.305:82): user pid=3123 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1180947661.305:83): login pid=3123 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1180947661.305:84): user pid=3123 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1180947661.305:85): user pid=3123 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1180947661.305:86): user pid=3123 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1180947721.295:87): user pid=3126 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1180947721.295:88): user pid=3126 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1180947721.295:89): login pid=3126 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1180947721.295:90): user pid=3126 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=DAEMON_START msg=audit(1180952212.455:1536) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1416 res=success, auditd pid=1416
type=CONFIG_CHANGE msg=audit(1180952212.100:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180952212.100:7): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180952212.600:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180952212.600:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_ERR msg=audit(1180952235.097:10): user pid=2243 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
type=USER_AUTH msg=audit(1180952254.094:11): user pid=2311 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_ACCT msg=audit(1180952254.094:12): user pid=2311 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_ACQ msg=audit(1180952254.094:13): user pid=2311 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=LOGIN msg=audit(1180952254.094:14): login pid=2311 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1180952254.094:15): user pid=2311 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_LOGIN msg=audit(1180952254.094:16): user pid=2311 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
type=USER_AUTH msg=audit(1180952294.088:17): user pid=2622 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180952294.088:18): user pid=2622 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180952294.088:19): user pid=2622 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1180952326.583:20): user pid=2622 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1180952336.081:21): user pid=2651 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180952336.081:22): user pid=2651 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180952336.081:23): user pid=2651 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180952336.081:24): user pid=2651 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180952447.065:25): user pid=2770 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_ACCT msg=audit(1180952447.065:26): user pid=2770 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_START msg=audit(1180952447.065:27): user pid=2770 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_ACQ msg=audit(1180952447.065:28): user pid=2770 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_AUTH msg=audit(1180953920.340:29): user pid=3001 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180953920.340:30): user pid=3001 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1180953920.340:31): user pid=3001 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1180953920.340:32): user pid=3001 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_AUTH msg=audit(1180953985.330:33): user pid=3101 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_ACCT msg=audit(1180953985.330:34): user pid=3101 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_START msg=audit(1180953985.330:35): user pid=3101 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=CRED_ACQ msg=audit(1180953985.330:36): user pid=3101 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=CRED_DISP msg=audit(1180954020.824:37): user pid=3101 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_END msg=audit(1180954020.824:38): user pid=3101 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_ACCT msg=audit(1180954861.196:39): user pid=3212 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1180954861.196:40): user pid=3212 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1180954861.196:41): login pid=3212 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1180954861.196:42): user pid=3212 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1180954861.196:43): user pid=3212 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1180954861.196:44): user pid=3212 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_AUTH msg=audit(1180954939.184:45): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/7 res=success)'
type=USER_ACCT msg=audit(1180954939.184:46): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/7 res=success)'
type=USER_START msg=audit(1180954939.184:47): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/7 res=success)'
type=CRED_ACQ msg=audit(1180954939.184:48): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/7 res=success)'
type=CRED_DISP msg=audit(1180955006.674:49): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/7 res=success)'
type=USER_END msg=audit(1180955006.674:50): user pid=3250 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/7 res=success)'
type=CRED_DISP msg=audit(1180955389.116:51): user pid=3001 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_END msg=audit(1180955389.116:52): user pid=3001 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_DISP msg=audit(1180955429.110:53): user pid=2770 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_END msg=audit(1180955429.110:54): user pid=2770 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_DISP msg=audit(1180955491.100:55): user pid=2651 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180955491.100:56): user pid=2651 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180955538.093:57): user pid=3418 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180955538.093:58): user pid=3418 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180955538.093:59): user pid=3418 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180955538.093:60): user pid=3418 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_DISP msg=audit(1180955547.592:61): user pid=3418 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180955547.592:62): user pid=3418 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180955555.590:63): user pid=2311 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_DISP msg=audit(1180955555.590:64): user pid=2311 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=DAEMON_END msg=audit(1180955564.299:1537) auditd normal halt, sending auid=4294967295 pid=3970 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1416
type=DAEMON_START msg=audit(1180959408.139:1638) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1390 res=success, auditd pid=1390
type=CONFIG_CHANGE msg=audit(1180959407.830:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180959407.830:7): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180959407.830:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180959407.830:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_AUTH msg=audit(1180959444.825:10): user pid=2199 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180959444.825:11): user pid=2199 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=LOGIN msg=audit(1180959444.825:12): login pid=2199 uid=0 old auid=4294967295 new auid=500
type=USER_ROLE_CHANGE msg=audit(1180959444.825:13): user pid=2199 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=user_u:system_r:unconfined_t:s0 selected-context=user_u:system_r:unconfined_t:s0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180959444.825:14): user pid=2199 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180959444.825:15): user pid=2199 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_LOGIN msg=audit(1180959444.825:16): user pid=2199 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180959450.824:17): user pid=2280 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180959450.824:18): user pid=2280 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_START msg=audit(1180959450.824:19): user pid=2280 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1180959450.824:20): user pid=2280 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180959514.314:21): user pid=2280 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180959514.314:22): user pid=2280 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_AUTH msg=audit(1180959621.798:23): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180959621.798:24): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180959621.798:25): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180959621.798:26): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_DISP msg=audit(1180959628.297:27): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180959628.297:28): user pid=3035 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180959631.296:29): user pid=3240 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180959631.296:30): user pid=3240 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180959653.793:31): user pid=3244 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180959653.793:32): user pid=3244 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180959654.293:33): user pid=3244 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USYS_CONFIG msg=audit(1180995656.226:34): user pid=3283 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1180995656.226:35): user pid=3244 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1180995677.723:36): user pid=3305 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1180995677.723:37): user pid=3305 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1180995677.723:38): user pid=3305 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USYS_CONFIG msg=audit(1180977679.210:39): user pid=3343 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1180977679.210:40): user pid=3305 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1180977727.703:41): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_ACCT msg=audit(1180977727.703:42): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_START msg=audit(1180977727.703:43): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_ACQ msg=audit(1180977727.703:44): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_AUTH msg=audit(1180977784.194:45): user pid=3482 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/4 res=success)'
type=USER_ACCT msg=audit(1180977784.194:46): user pid=3482 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/4 res=success)'
type=USER_START msg=audit(1180977784.194:47): user pid=3482 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/4 res=success)'
type=CRED_ACQ msg=audit(1180977784.194:48): user pid=3482 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/4 res=success)'
type=USER_AUTH msg=audit(1180978033.156:49): user pid=3641 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_ACCT msg=audit(1180978033.156:50): user pid=3641 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_START msg=audit(1180978033.156:51): user pid=3641 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=CRED_ACQ msg=audit(1180978033.156:52): user pid=3641 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=CRED_DISP msg=audit(1180978810.538:53): user pid=3641 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=USER_END msg=audit(1180978810.538:54): user pid=3641 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/5 res=success)'
type=CRED_DISP msg=audit(1180979022.006:55): user pid=3482 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/4 res=success)'
type=USER_END msg=audit(1180979022.006:56): user pid=3482 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/4 res=success)'
type=CRED_DISP msg=audit(1180979026.005:57): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_END msg=audit(1180979026.005:58): user pid=3384 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_AUTH msg=audit(1180979048.002:59): user pid=3773 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1180979048.002:60): user pid=3773 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=tty1 res=success)'
type=CRED_DISP msg=audit(1180979048.002:61): user pid=2199 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=USER_END msg=audit(1180979048.002:62): user pid=2199 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=DAEMON_END msg=audit(1180979055.057:1639) auditd normal halt, sending auid=4294967295 pid=4225 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1390
type=DAEMON_START msg=audit(1180984222.436:1862) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1387 res=success, auditd pid=1387
type=CONFIG_CHANGE msg=audit(1180984222.328:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180984222.328:7): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1180984222.328:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1180984222.328:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_ERR msg=audit(1180984245.824:10): user pid=2201 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
type=USER_AUTH msg=audit(1180984251.823:11): user pid=2269 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_ACCT msg=audit(1180984251.823:12): user pid=2269 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_ACQ msg=audit(1180984251.823:13): user pid=2269 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=LOGIN msg=audit(1180984251.823:14): login pid=2269 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1180984251.823:15): user pid=2269 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_AUTH msg=audit(1180984295.817:16): user pid=2579 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180984295.817:17): user pid=2579 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180984305.815:18): user pid=2580 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1180984305.815:19): user pid=2580 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1180984305.815:20): user pid=2580 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1180984305.815:21): user pid=2580 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1180985327.659:22): user pid=2832 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_ACCT msg=audit(1180985327.659:23): user pid=2832 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_START msg=audit(1180985327.659:24): user pid=2832 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=CRED_ACQ msg=audit(1180985327.659:25): user pid=2832 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_AUTH msg=audit(1180986401.995:26): user pid=2953 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1180986401.995:27): user pid=2953 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1180986401.995:28): user pid=2953 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1180986401.995:29): user pid=2953 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_AVC msg=audit(1180986452.988:30): user pid=1605 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
type=MAC_POLICY_LOAD msg=audit(1180986452.988:31): policy loaded auid=500
type=SYSCALL msg=audit(1180986452.988:31): arch=40000003 syscall=4 success=yes exit=1523106 a0=4 a1=b7da0000 a2=173da2 a3=bf8d7e38 items=0 ppid=3002 pid=3003 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 comm="load_policy" exe="/usr/sbin/load_policy" subj=user_u:system_r:load_policy_t:s0 key=(null)
type=USER_ACCT msg=audit(1180987261.864:32): user pid=3054 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1180987261.864:33): user pid=3054 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1180987261.864:34): login pid=3054 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1180987261.864:35): user pid=3054 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1180987261.864:36): user pid=3054 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1180987261.864:37): user pid=3054 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1180987354.350:38): user pid=2953 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_END msg=audit(1180987354.350:39): user pid=2953 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_DISP msg=audit(1180987592.814:40): user pid=2832 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=USER_END msg=audit(1180987592.814:41): user pid=2832 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
type=CRED_DISP msg=audit(1180987768.787:42): user pid=2580 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180987768.787:43): user pid=2580 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1180987773.786:44): user pid=2269 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_DISP msg=audit(1180987773.786:45): user pid=2269 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=DAEMON_END msg=audit(1180987783.962:1863) auditd normal halt, sending auid=4294967295 pid=3598 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1387
type=DAEMON_START msg=audit(1181023422.436:4945) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1391 res=success, auditd pid=1391
type=CONFIG_CHANGE msg=audit(1181023422.324:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1181023422.324:7): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1181023422.324:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1181023422.324:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_ERR msg=audit(1181023446.320:10): user pid=2219 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
type=USER_AUTH msg=audit(1181023452.819:11): user pid=2287 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_ACCT msg=audit(1181023452.819:12): user pid=2287 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_ACQ msg=audit(1181023452.819:13): user pid=2287 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=LOGIN msg=audit(1181023452.819:14): login pid=2287 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1181023452.819:15): user pid=2287 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_AUTH msg=audit(1181023459.318:16): user pid=2506 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1181023459.318:17): user pid=2506 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1181023479.815:18): user pid=2593 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1181023479.815:19): user pid=2593 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1181023479.815:20): user pid=2593 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1181023479.815:21): user pid=2593 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_DISP msg=audit(1181024291.691:22): user pid=2593 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1181024291.691:23): user pid=2593 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_END msg=audit(1181024296.690:24): user pid=2287 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_DISP msg=audit(1181024296.690:25): user pid=2287 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=DAEMON_END msg=audit(1181024305.768:4946) auditd normal halt, sending auid=4294967295 pid=3380 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1391
type=DAEMON_START msg=audit(1181063067.203:1857) auditd start, ver=1.5.3, format=raw, auid=4294967295 pid=1388 res=success, auditd pid=1388
type=CONFIG_CHANGE msg=audit(1181063067.026:6): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1181063067.026:7): audit_enabled=1 old=0 by auid=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1181063067.026:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1181063067.026:9): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
type=USER_ERR msg=audit(1181063090.522:10): user pid=2216 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct=? : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=failed)'
type=USER_AUTH msg=audit(1181063097.022:11): user pid=2284 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_ACCT msg=audit(1181063097.022:12): user pid=2284 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=CRED_ACQ msg=audit(1181063097.022:13): user pid=2284 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=LOGIN msg=audit(1181063097.022:14): login pid=2284 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1181063097.022:15): user pid=2284 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct=olivares : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
type=USER_AUTH msg=audit(1181063103.521:16): user pid=2503 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1181063103.521:17): user pid=2503 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=olivares : exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1181063135.016:18): user pid=2588 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_ACCT msg=audit(1181063135.016:19): user pid=2588 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_START msg=audit(1181063135.016:20): user pid=2588 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=CRED_ACQ msg=audit(1181063135.016:21): user pid=2588 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)'
type=USER_AUTH msg=audit(1181063860.405:22): user pid=2795 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_ACCT msg=audit(1181063860.405:23): user pid=2795 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_START msg=audit(1181063860.405:24): user pid=2795 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_ACQ msg=audit(1181063860.405:25): user pid=2795 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'

--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list