search for: ogid

...:s0 key="access" audispd: node=myhost.somewhere type=CWD msg=audit(1404144473.421:46298): cwd="/var/run/dovecot" audispd: node=myhost.somewhere type=PATH msg=audit(1404144473.421:46298): item=0 name="./sqlite_ZPh8vGq4ia1CCsJ" inode=8192027 dev=fb:02 mode=040755 ouid=0 ogid=97 rdev=00:00 obj=system_u:object_r:dovecot_var_run_t:s0 audispd: node=myhost.somewhere type=EOE msg=audit(1404144473.421:46298):? audispd: node=myhost.somewhere type=SYSCALL msg=audit(1404144473.422:46299): arch=c000003e syscall=2 success=no exit=-13 a0=7fff97f77ce0 a1=c2 a2=1a4 a3=0 items=1 ppid=...

Is it possible to audit the Linux User Shell? I am trying to gather what commands a user is running no our systems. Can auditd handle this? TIA -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20070903/3d4d491d/attachment.html>

...56661756C74732D746F727263002F7573722F73686172652F746F722F6465666175 6C74732D746F727263002D66002F6574632F746F722F746F727263002D2D76657269667 92D636F6E666967 type=PATH msg=audit(1539540150.692:60570): item=0 name="/var/lib/tor/hidden_service/" inode=201616393 dev=fd:02 mode=040700 ouid=494 ogid=490 rdev=00:00 obj=system_u:object_r:tor_var_lib_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 type=CWD msg=audit(1539540150.692:60570): cwd="/" type=SYSCALL msg=audit(1539540150.692:60570): arch=c000003e syscall=2 success=no exit=-13 a0=562d37...

https://bugs.freedesktop.org/show_bug.cgi?id=93629 Bug ID: 93629 Summary: [NVE6] complete system freeze, PGRAPH engine fault on channel 2, SCHED_ERROR [ CTXSW_TIMEOUT ] Product: xorg Version: unspecified Hardware: x86-64 (AMD64) OS: Linux (All) Status: NEW Severity: normal

...172652F746F722F64656661 > 75 > 6C74732D746F727263002D66002F6574632F746F722F746F727263002D2D766572696 > 67 > 92D636F6E666967 > > type=PATH msg=audit(1539540150.692:60570): item=0 > name="/var/lib/tor/hidden_service/" inode=201616393 dev=fd:02 > mode=040700 ouid=494 ogid=490 rdev=00:00 > obj=system_u:object_r:tor_var_lib_t:s0 objtype=NORMAL > cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 > > type=CWD msg=audit(1539540150.692:60570): cwd="/" > > type=SYSCALL msg=audit(1539540150.692:60570): arch=c000003e syscall=2...

...r pid=1989 comm="dovecot" name=dovecot.pem dev=md2 ino=3646976 scontext=system_u:system_r:dovecot_t tcontext=system_u:object_r:cert_t tclass=file type=PATH msg=audit(1141499436.214:3266533): item=0 name="/etc/pki/dovecot/dovecot.pem" inode=3646976 dev=09:02 mode=0100600 ouid=0 ogid=0 rdev=00:00 I put SELinux into permissive mode and Dovecot works OK. Looks like dovecot does not assume the correct security context when it initializes and reads the cert file. My question for the list is what changes should I make to the SELinux policy to safely permit dovecot to read the fil...

...they are relevant. ========== time->Fri Jul 22 09:45:06 2016 type=PROCTITLE msg=audit(1469195106.880:3563): proctitle="/usr/sbin/winbindd" type=PATH msg=audit(1469195106.880:3563): item=0 name="/var/lib/samba/private/msg.sock/1207" inode=2502647 dev=fd:00 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:samba_var_t:s0 nametype=NORMAL type=CWD msg=audit(1469195106.880:3563):  cwd="/" type=SOCKADDR msg=audit(1469195106.880:3563): saddr=01002F7661722F6C69622F73616D62612F707269766174652F6D73672E736F636B2F31323037000000000000000000000000000000000000000000000...

...; 75 >> 6C74732D746F727263002D66002F6574632F746F722F746F727263002D2D766572696 >> 67 >> 92D636F6E666967 >> >> type=PATH msg=audit(1539540150.692:60570): item=0 >> name="/var/lib/tor/hidden_service/" inode=201616393 dev=fd:02 >> mode=040700 ouid=494 ogid=490 rdev=00:00 >> obj=system_u:object_r:tor_var_lib_t:s0 objtype=NORMAL >> cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0 >> >> type=CWD msg=audit(1539540150.692:60570): cwd="/" >> >> type=SYSCALL msg=audit(1539540150.692:60570): a...