type=DAEMON_ROTATE msg=audit(1317576182.054:5809): auditd sending auid=0 pid=11323 subj=unconfined_u:system_r:initrc_t:s0 type=SYSCALL msg=audit(1317576181.924:181184): arch=c000003e syscall=59 success=yes exit=0 a0=1583a70 a1=1583810 a2=15891d0 a3=8 items=3 ppid=11329 pid=11337 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576181.924:181184): argc=2 a0="basename" a1="/sbin/service" type=DAEMON_END msg=audit(1317576182.099:5810): auditd normal halt, sending auid=? pid=? subj=? res=success type=DAEMON_START msg=audit(1317576182.448:8261): auditd start, ver=2.1.2 format=raw kernel=2.6.38.8-32.fc15.x86_64 auid=4294967295 pid=11370 subj=system_u:system_r:auditd_t:s0 res=success type=CONFIG_CHANGE msg=audit(1317576182.584:181203): audit_backlog_limit=512 old=512 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576182.585:181204): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576182.585:181205): audit_failure=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576182.585:181206): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="slash_etc_actions" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576182.586:181207): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="32bit_execs" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576182.586:181208): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="64bit_execs" list=4 res=1 type=SERVICE_START msg=audit(1317576182.594:181209): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="auditd" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=SYSCALL msg=audit(1317576182.602:181210): arch=c000003e syscall=59 success=yes exit=0 a0=266d090 a1=266d300 a2=266cbb0 a3=0 items=3 ppid=11313 pid=11385 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="head" exe="/usr/bin/head" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576182.611:181211): arch=c000003e syscall=59 success=yes exit=0 a0=266e2e0 a1=266f1c0 a2=266cbb0 a3=2 items=3 ppid=11313 pid=11384 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="ls" exe="/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576182.602:181210): argc=3 a0="head" a1="-n" a2="-10" type=CWD msg=audit(1317576182.602:181210): cwd="/root" type=PATH msg=audit(1317576182.602:181210): item=0 name="/usr/bin/head" inode=72544 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576182.602:181210): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.602:181210): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576182.605:181212): arch=c000003e syscall=59 success=yes exit=0 a0=266d150 a1=266e8e0 a2=266cbb0 a3=8 items=3 ppid=11313 pid=11386 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="xargs" exe="/usr/bin/xargs" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576182.605:181212): argc=2 a0="xargs" a1="rm" type=CWD msg=audit(1317576182.605:181212): cwd="/root" type=PATH msg=audit(1317576182.605:181212): item=0 name="/usr/bin/xargs" inode=73375 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576182.605:181212): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.605:181212): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576182.611:181211): argc=13 a0="ls" a1="-rt" a2="/var/log/audit/audit.log" a3="/var/log/audit/audit.log.1" a4="/var/log/audit/audit.log.10" a5="/var/log/audit/audit.log.2" a6="/var/log/audit/audit.log.3" a7="/var/log/audit/audit.log.4" a8="/var/log/audit/audit.log.5" a9="/var/log/audit/audit.log.6" a10="/var/log/audit/audit.log.7" a11="/var/log/audit/audit.log.8" a12="/var/log/audit/audit.log.9" type=CWD msg=audit(1317576182.611:181211): cwd="/root" type=PATH msg=audit(1317576182.611:181211): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576182.611:181211): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.611:181211): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576182.632:181213): arch=c000003e syscall=59 success=yes exit=0 a0=7fff2ddafa28 a1=c2b240 a2=7fff2ddafd10 a3=366b082260 items=3 ppid=11386 pid=11387 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576182.632:181213): argc=2 a0="rm" a1="/var/log/audit/audit.log.10" type=CWD msg=audit(1317576182.632:181213): cwd="/root" type=PATH msg=audit(1317576182.632:181213): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576182.632:181213): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.632:181213): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576182.661:181214): arch=c000003e syscall=59 success=yes exit=0 a0=266d230 a1=266e8e0 a2=266cbb0 a3=8 items=3 ppid=11313 pid=11389 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576182.661:181214): argc=2 a0="grep" a1="^my" type=CWD msg=audit(1317576182.661:181214): cwd="/root" type=PATH msg=audit(1317576182.661:181214): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576182.661:181214): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.661:181214): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576182.666:181215): arch=c000003e syscall=59 success=yes exit=0 a0=266ed20 a1=266edc0 a2=266cbb0 a3=8 items=3 ppid=11313 pid=11390 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576182.666:181215): argc=3 a0="grep" a1="-Pv" a2="^mysql\s" type=CWD msg=audit(1317576182.666:181215): cwd="/root" type=PATH msg=audit(1317576182.666:181215): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576182.666:181215): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.666:181215): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576182.664:181216): arch=c000003e syscall=59 success=yes exit=0 a0=266d1c0 a1=266e8e0 a2=266cbb0 a3=8 items=3 ppid=11313 pid=11388 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576182.664:181216): argc=2 a0="semodule" a1="-l" type=CWD msg=audit(1317576182.664:181216): cwd="/root" type=PATH msg=audit(1317576182.664:181216): item=0 name="/usr/sbin/semodule" inode=504160 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:semanage_exec_t:s0 type=PATH msg=audit(1317576182.664:181216): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576182.664:181216): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576184.102:181217): arch=c000003e syscall=59 success=yes exit=0 a0=266d0b0 a1=266e8e0 a2=266cbb0 a3=8 items=3 ppid=11313 pid=11392 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="ausearch" exe="/sbin/ausearch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576184.102:181217): argc=2 a0="ausearch" a1="-i" type=CWD msg=audit(1317576184.102:181217): cwd="/root" type=PATH msg=audit(1317576184.102:181217): item=0 name="/sbin/ausearch" inode=71831 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576184.102:181217): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576184.102:181217): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576184.106:181218): arch=c000003e syscall=59 success=yes exit=0 a0=266edc0 a1=266d1d0 a2=266cbb0 a3=0 items=3 ppid=11313 pid=11391 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=316 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576184.106:181218): argc=4 a0="grep" a1="-P" a2="(AVC|SELINUX)" a3="/var/log/audit/audit.log.1" type=CWD msg=audit(1317576184.106:181218): cwd="/root" type=PATH msg=audit(1317576184.106:181218): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576184.106:181218): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576184.106:181218): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=CRED_DISP msg=audit(1317576184.620:181219): user pid=11311 uid=0 auid=0 ses=316 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_END msg=audit(1317576184.628:181220): user pid=11311 uid=0 auid=0 ses=316 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576189.839:181221): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d9d628 a1=7fc228d982b8 a2=7fc228d982d0 a3=7fffc1bf5590 items=5 ppid=7224 pid=11398 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576189.839:181221): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576189.839:181221): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576189.839:181221): cwd="/srv/jfgi" type=PATH msg=audit(1317576189.839:181221): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576189.839:181221): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576189.839:181221): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576189.839:181221): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576189.839:181221): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576205.858:181222): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d8f4a8 a1=7fc228d8c288 a2=7fc228d8c2a0 a3=7fffc1bf5590 items=5 ppid=9011 pid=11399 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576205.858:181222): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576205.858:181222): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576205.858:181222): cwd="/srv/jfgi" type=PATH msg=audit(1317576205.858:181222): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576205.858:181222): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576205.858:181222): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576205.858:181222): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576205.858:181222): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576233.549:181223): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837c90 a2=1c98c60 a3=1c51940 items=3 ppid=9719 pid=11400 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576233.549:181223): argc=3 a0="sudo" a1="cat" a2="/etc/auditd.conf" type=BPRM_FCAPS msg=audit(1317576233.549:181223): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576233.549:181223): cwd="/home/rlpowell" type=PATH msg=audit(1317576233.549:181223): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576233.549:181223): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576233.549:181223): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576233.581:181224): user pid=11400 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=636174202F6574632F6175646974642E636F6E66 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576233.588:181225): user pid=11401 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576233.596:181226): user pid=11401 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576233.598:181227): user pid=11401 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576233.599:181228): arch=c000003e syscall=59 success=yes exit=0 a0=2b61159d7985 a1=7ffffa30dfe8 a2=2b6115c13180 a3=726379656b2f7274 items=3 ppid=11400 pid=11401 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576233.599:181228): argc=3 a0="sesh" a1="/bin/cat" a2="/etc/auditd.conf" type=CWD msg=audit(1317576233.599:181228): cwd="/home/rlpowell" type=PATH msg=audit(1317576233.599:181228): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576233.599:181228): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576233.599:181228): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576233.609:181229): arch=c000003e syscall=59 success=yes exit=0 a0=7fab787de010 a1=7fff61c94e20 a2=7fff61c94e38 a3=0 items=3 ppid=11400 pid=11401 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="cat" exe="/bin/cat" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576233.609:181229): argc=2 a0="/bin/cat" a1="/etc/auditd.conf" type=CWD msg=audit(1317576233.609:181229): cwd="/home/rlpowell" type=PATH msg=audit(1317576233.609:181229): item=0 name="/bin/cat" inode=70829 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576233.609:181229): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576233.609:181229): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576235.900:181230): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837c88 a2=1c98c60 a3=1c51940 items=3 ppid=9719 pid=11402 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576235.900:181230): argc=3 a0="sudo" a1="cat" a2="/etc/audit.conf" type=BPRM_FCAPS msg=audit(1317576235.900:181230): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576235.900:181230): cwd="/home/rlpowell" type=PATH msg=audit(1317576235.900:181230): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576235.900:181230): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576235.900:181230): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576235.915:181231): user pid=11402 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=636174202F6574632F61756469742E636F6E66 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576235.921:181232): user pid=11403 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576235.929:181233): user pid=11403 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576235.931:181234): user pid=11403 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576235.931:181235): arch=c000003e syscall=59 success=yes exit=0 a0=2b1b546f5985 a1=7fffd8ec6b58 a2=2b1b54931180 a3=726379656b2f7274 items=3 ppid=11402 pid=11403 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576235.931:181235): argc=3 a0="sesh" a1="/bin/cat" a2="/etc/audit.conf" type=CWD msg=audit(1317576235.931:181235): cwd="/home/rlpowell" type=PATH msg=audit(1317576235.931:181235): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576235.931:181235): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576235.931:181235): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576235.936:181236): arch=c000003e syscall=59 success=yes exit=0 a0=7f52f8d0e010 a1=7fffe0513dd0 a2=7fffe0513de8 a3=0 items=3 ppid=11402 pid=11403 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="cat" exe="/bin/cat" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576235.936:181236): argc=2 a0="/bin/cat" a1="/etc/audit.conf" type=CWD msg=audit(1317576235.936:181236): cwd="/home/rlpowell" type=PATH msg=audit(1317576235.936:181236): item=0 name="/bin/cat" inode=70829 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576235.936:181236): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576235.936:181236): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576239.359:181237): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837ce8 a2=1c95740 a3=1c51940 items=3 ppid=9719 pid=11404 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576239.359:181237): argc=4 a0="sudo" a1="ls" a2="-lrt" a3="/etc" type=BPRM_FCAPS msg=audit(1317576239.359:181237): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576239.359:181237): cwd="/home/rlpowell" type=PATH msg=audit(1317576239.359:181237): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576239.359:181237): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576239.359:181237): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576239.374:181238): user pid=11404 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=6C73202D6C7274202F657463 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576239.379:181239): user pid=11405 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576239.387:181240): user pid=11405 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576239.388:181241): user pid=11405 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576239.388:181242): arch=c000003e syscall=59 success=yes exit=0 a0=2b963d6fb985 a1=7fff82eadbc8 a2=2b963d937180 a3=726379656b2f7274 items=3 ppid=11404 pid=11405 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576239.388:181242): argc=4 a0="sesh" a1="/bin/ls" a2="-lrt" a3="/etc" type=CWD msg=audit(1317576239.388:181242): cwd="/home/rlpowell" type=PATH msg=audit(1317576239.388:181242): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576239.388:181242): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576239.388:181242): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576239.393:181243): arch=c000003e syscall=59 success=yes exit=0 a0=7f7684988010 a1=7fff6f2b9420 a2=7fff6f2b9440 a3=0 items=3 ppid=11404 pid=11405 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ls" exe="/bin/ls" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576239.393:181243): argc=3 a0="/bin/ls" a1="-lrt" a2="/etc" type=CWD msg=audit(1317576239.393:181243): cwd="/home/rlpowell" type=PATH msg=audit(1317576239.393:181243): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576239.393:181243): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576239.393:181243): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.656:181244): arch=c000003e syscall=59 success=yes exit=0 a0=7f8b3f124c58 a1=7fff49504bb0 a2=7f8b3f326ef0 a3=0 items=3 ppid=11406 pid=11407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.656:181244): argc=3 a0="/sbin/unix_chkpwd" a1="root" a2="chkexpiry" type=CWD msg=audit(1317576241.656:181244): cwd="/" type=PATH msg=audit(1317576241.656:181244): item=0 name="/sbin/unix_chkpwd" inode=72011 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 type=PATH msg=audit(1317576241.656:181244): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.656:181244): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_ACCT msg=audit(1317576241.667:181245): user pid=11406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_ACQ msg=audit(1317576241.668:181246): user pid=11406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=LOGIN msg=audit(1317576241.670:181247): login pid=11406 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=317 type=USER_START msg=audit(1317576241.673:181248): user pid=11406 uid=0 auid=0 ses=317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_REFR msg=audit(1317576241.674:181249): user pid=11406 uid=0 auid=0 ses=317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576241.678:181250): arch=c000003e syscall=59 success=yes exit=0 a0=208cd36 a1=7fff494c2a60 a2=208ce50 a3=8 items=3 ppid=11406 pid=11408 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.678:181250): argc=3 a0="/bin/sh" a1="-c" a2="/usr/local/sbin/auditd_rotate.sh" type=CWD msg=audit(1317576241.678:181250): cwd="/root" type=PATH msg=audit(1317576241.678:181250): item=0 name="/bin/sh" inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.678:181250): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.678:181250): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.688:181251): arch=c000003e syscall=59 success=yes exit=0 a0=1d2fb90 a1=1d2fbf0 a2=1d2ec30 a3=0 items=5 ppid=11406 pid=11408 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="auditd_rotate.s" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.688:181251): argc=2 a0="/bin/bash" a1="/usr/local/sbin/auditd_rotate.sh" type=EXECVE msg=audit(1317576241.688:181251): argc=1 a0="/bin/bash" type=CWD msg=audit(1317576241.688:181251): cwd="/root" type=PATH msg=audit(1317576241.688:181251): item=0 name="/usr/local/sbin/auditd_rotate.sh" inode=393265 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.688:181251): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.688:181251): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.688:181251): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.688:181251): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.705:181252): arch=c000003e syscall=59 success=yes exit=0 a0=223e820 a1=223cf30 a2=223cbb0 a3=0 items=5 ppid=11408 pid=11410 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576241.699:181253): arch=c000003e syscall=59 success=yes exit=0 a0=7fff494c4c00 a1=7fff494c1a00 a2=7fff49505300 a3=0 items=3 ppid=11406 pid=11409 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) ses=317 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.699:181253): argc=9 a0="/usr/sbin/sendmail" a1="-FCronDaemon" a2="-i" a3="-odi" a4="-oem" a5="-oi" a6="-t" a7="-f" a8="root" type=CWD msg=audit(1317576241.699:181253): cwd="/root" type=PATH msg=audit(1317576241.699:181253): item=0 name="/usr/sbin/sendmail" inode=504161 dev=fc:02 mode=0102755 ouid=0 ogid=51 rdev=00:00 obj=system_u:object_r:sendmail_exec_t:s0 type=PATH msg=audit(1317576241.699:181253): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.699:181253): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576241.705:181252): argc=4 a0="/bin/sh" a1="/sbin/service" a2="auditd" a3="rotate" type=EXECVE msg=audit(1317576241.705:181252): argc=3 a0="/bin/sh" a1="/sbin/service" a2="auditd" type=CWD msg=audit(1317576241.705:181252): cwd="/root" type=PATH msg=audit(1317576241.705:181252): item=0 name="/sbin/service" inode=71990 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.705:181252): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.705:181252): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.705:181252): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.705:181252): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.730:181254): arch=c000003e syscall=59 success=yes exit=0 a0=1765260 a1=175cfc0 a2=1765810 a3=0 items=3 ppid=11411 pid=11412 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.730:181254): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" type=CWD msg=audit(1317576241.730:181254): cwd="/root" type=PATH msg=audit(1317576241.730:181254): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.730:181254): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.730:181254): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.746:181255): arch=c000003e syscall=59 success=yes exit=0 a0=1765190 a1=1765780 a2=1765810 a3=8 items=3 ppid=11411 pid=11413 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.746:181255): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" type=CWD msg=audit(1317576241.746:181255): cwd="/root" type=PATH msg=audit(1317576241.746:181255): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.746:181255): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.746:181255): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.769:181256): arch=c000003e syscall=59 success=yes exit=0 a0=1764f30 a1=1768500 a2=1768360 a3=0 items=3 ppid=11414 pid=11415 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.769:181256): argc=1 a0="/sbin/consoletype" type=CWD msg=audit(1317576241.769:181256): cwd="/root" type=PATH msg=audit(1317576241.769:181256): item=0 name="/sbin/consoletype" inode=71844 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:consoletype_exec_t:s0 type=PATH msg=audit(1317576241.769:181256): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.769:181256): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.798:181257): arch=c000003e syscall=59 success=yes exit=0 a0=1763bd0 a1=178edb0 a2=179a1d0 a3=8 items=3 ppid=11410 pid=11416 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.798:181257): argc=2 a0="basename" a1="/sbin/service" type=CWD msg=audit(1317576241.798:181257): cwd="/root" type=PATH msg=audit(1317576241.798:181257): item=0 name="/bin/basename" inode=70827 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.798:181257): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.798:181257): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.808:181258): arch=c000003e syscall=59 success=yes exit=0 a0=1794a70 a1=1794810 a2=179a1d0 a3=8 items=3 ppid=11410 pid=11417 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.808:181258): argc=2 a0="basename" a1="/sbin/service" type=CWD msg=audit(1317576241.808:181258): cwd="/root" type=PATH msg=audit(1317576241.808:181258): item=0 name="/bin/basename" inode=70827 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.808:181258): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.808:181258): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.817:181259): arch=c000003e syscall=59 success=yes exit=0 a0=175caa0 a1=179d090 a2=179a1d0 a3=8 items=3 ppid=11410 pid=11418 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="env" exe="/bin/env" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.817:181259): argc=8 a0="env" a1="-i" a2="PATH=/sbin:/usr/sbin:/bin:/usr/bin" a3="TERM=dumb" a4="SYSTEMCTL_IGNORE_DEPENDENCIES=" a5="SYSTEMCTL_SKIP_REDIRECT=" a6="/etc/init.d/auditd" a7="rotate" type=CWD msg=audit(1317576241.817:181259): cwd="/" type=PATH msg=audit(1317576241.817:181259): item=0 name="/bin/env" inode=70857 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.817:181259): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.817:181259): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.822:181260): arch=c000003e syscall=59 success=yes exit=0 a0=7fff0fc32f26 a1=7fff0fc325b8 a2=e51030 a3=ffffe000 items=5 ppid=11410 pid=11418 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="auditd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key="slash_etc_actions" type=EXECVE msg=audit(1317576241.822:181260): argc=3 a0="/bin/bash" a1="/etc/init.d/auditd" a2="rotate" type=EXECVE msg=audit(1317576241.822:181260): argc=2 a0="/bin/bash" a1="/etc/init.d/auditd" type=CWD msg=audit(1317576241.822:181260): cwd="/" type=PATH msg=audit(1317576241.822:181260): item=0 name="/etc/init.d/auditd" inode=484162 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditd_initrc_exec_t:s0 type=PATH msg=audit(1317576241.822:181260): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.822:181260): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576241.822:181260): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.822:181260): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.841:181261): arch=c000003e syscall=59 success=yes exit=0 a0=2549320 a1=2548220 a2=25498d0 a3=0 items=3 ppid=11419 pid=11420 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:system_r:initrc_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576241.841:181261): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" type=CWD msg=audit(1317576241.841:181261): cwd="/" type=PATH msg=audit(1317576241.841:181261): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.841:181261): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.841:181261): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.849:181262): arch=c000003e syscall=59 success=yes exit=0 a0=2549250 a1=2542570 a2=25498d0 a3=8 items=3 ppid=11419 pid=11421 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:system_r:initrc_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576241.849:181262): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" type=CWD msg=audit(1317576241.849:181262): cwd="/" type=PATH msg=audit(1317576241.849:181262): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576241.849:181262): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.849:181262): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.863:181263): arch=c000003e syscall=59 success=yes exit=0 a0=2548fa0 a1=25409b0 a2=254b2f0 a3=0 items=3 ppid=11422 pid=11423 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:system_r:consoletype_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576241.863:181263): argc=1 a0="/sbin/consoletype" type=CWD msg=audit(1317576241.863:181263): cwd="/" type=PATH msg=audit(1317576241.863:181263): item=0 name="/sbin/consoletype" inode=71844 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:consoletype_exec_t:s0 type=PATH msg=audit(1317576241.863:181263): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576241.863:181263): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576241.891:181264): arch=c000003e syscall=59 success=yes exit=0 a0=223a540 a1=223d090 a2=223cbb0 a3=0 items=5 ppid=11408 pid=11424 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576241.891:181264): argc=4 a0="/bin/sh" a1="/sbin/service" a2="auditd" a3="restart" type=DAEMON_END msg=audit(1317576242.520:8262): auditd normal halt, sending auid=? pid=? subj=? res=success type=DAEMON_START msg=audit(1317576243.540:7424): auditd start, ver=2.1.2 format=raw kernel=2.6.38.8-32.fc15.x86_64 auid=4294967295 pid=11467 subj=system_u:system_r:auditd_t:s0 res=success type=CONFIG_CHANGE msg=audit(1317576243.665:181290): audit_backlog_limit=512 old=512 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576243.666:181291): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576243.666:181292): audit_failure=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576243.666:181293): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="slash_etc_actions" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576243.667:181294): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="32bit_execs" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576243.667:181295): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="64bit_execs" list=4 res=1 type=SERVICE_START msg=audit(1317576243.673:181296): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="auditd" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=SYSCALL msg=audit(1317576243.694:181297): arch=c000003e syscall=59 success=yes exit=0 a0=223d090 a1=223d300 a2=223cbb0 a3=0 items=3 ppid=11408 pid=11482 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="head" exe="/usr/bin/head" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576243.690:181298): arch=c000003e syscall=59 success=yes exit=0 a0=223d150 a1=223e8e0 a2=223cbb0 a3=8 items=3 ppid=11408 pid=11483 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="xargs" exe="/usr/bin/xargs" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576243.694:181297): argc=3 a0="head" a1="-n" a2="-10" type=CWD msg=audit(1317576243.694:181297): cwd="/root" type=PATH msg=audit(1317576243.694:181297): item=0 name="/usr/bin/head" inode=72544 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576243.694:181297): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.694:181297): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576243.690:181298): argc=2 a0="xargs" a1="rm" type=CWD msg=audit(1317576243.690:181298): cwd="/root" type=PATH msg=audit(1317576243.690:181298): item=0 name="/usr/bin/xargs" inode=73375 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576243.690:181298): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.690:181298): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576243.692:181299): arch=c000003e syscall=59 success=yes exit=0 a0=223e2c0 a1=223f130 a2=223cbb0 a3=1 items=3 ppid=11408 pid=11481 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="ls" exe="/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576243.692:181299): argc=12 a0="ls" a1="-rt" a2="/var/log/audit/audit.log" a3="/var/log/audit/audit.log.1" a4="/var/log/audit/audit.log.2" a5="/var/log/audit/audit.log.3" a6="/var/log/audit/audit.log.4" a7="/var/log/audit/audit.log.5" a8="/var/log/audit/audit.log.6" a9="/var/log/audit/audit.log.7" a10="/var/log/audit/audit.log.8" a11="/var/log/audit/audit.log.9" type=CWD msg=audit(1317576243.692:181299): cwd="/root" type=PATH msg=audit(1317576243.692:181299): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576243.692:181299): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.692:181299): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576243.717:181300): arch=c000003e syscall=59 success=yes exit=0 a0=7fff71450588 a1=dc3240 a2=7fff71450870 a3=366b082260 items=3 ppid=11483 pid=11484 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576243.717:181300): argc=1 a0="rm" type=CWD msg=audit(1317576243.717:181300): cwd="/root" type=PATH msg=audit(1317576243.717:181300): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576243.717:181300): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.717:181300): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576243.735:181301): arch=c000003e syscall=59 success=yes exit=0 a0=223d230 a1=223e8e0 a2=223cbb0 a3=8 items=3 ppid=11408 pid=11486 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576243.731:181302): arch=c000003e syscall=59 success=yes exit=0 a0=223ed20 a1=223edc0 a2=223cbb0 a3=8 items=3 ppid=11408 pid=11487 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576243.731:181302): argc=3 a0="grep" a1="-Pv" a2="^mysql\s" type=CWD msg=audit(1317576243.731:181302): cwd="/root" type=PATH msg=audit(1317576243.731:181302): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576243.731:181302): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.731:181302): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576243.735:181301): argc=2 a0="grep" a1="^my" type=CWD msg=audit(1317576243.735:181301): cwd="/root" type=PATH msg=audit(1317576243.735:181301): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576243.735:181301): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.735:181301): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576243.738:181303): arch=c000003e syscall=59 success=yes exit=0 a0=223d1c0 a1=223e8e0 a2=223cbb0 a3=8 items=3 ppid=11408 pid=11485 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576243.738:181303): argc=2 a0="semodule" a1="-l" type=CWD msg=audit(1317576243.738:181303): cwd="/root" type=PATH msg=audit(1317576243.738:181303): item=0 name="/usr/sbin/semodule" inode=504160 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:semanage_exec_t:s0 type=PATH msg=audit(1317576243.738:181303): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576243.738:181303): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576244.254:181304): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837f90 a2=1c95740 a3=0 items=3 ppid=9719 pid=11488 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576244.254:181304): argc=14 a0="sudo" a1="ls" a2="-lrt" a3="/etc/acpi" a4="/etc/adjtime" a5="/etc/aliases" a6="/etc/aliases.db" a7="/etc/alternatives" a8="/etc/anacrontab" a9="/etc/asound.conf" a10="/etc/at.deny" a11="/etc/audisp" a12="/etc/audit" a13="/etc/avahi" type=BPRM_FCAPS msg=audit(1317576244.254:181304): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576244.254:181304): cwd="/home/rlpowell" type=PATH msg=audit(1317576244.254:181304): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576244.254:181304): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576244.254:181304): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576244.297:181305): user pid=11488 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=6C73202D6C7274202F6574632F61637069202F6574632F61646A74696D65202F6574632F616C6961736573202F6574632F616C69617365732E6462202F6574632F616C7465726E617469766573202F6574632F616E6163726F6E746162202F6574632F61736F756E642E636F6E66202F6574632F61742E64656E79202F6574632F617564697370202F6574632F6175646974202F6574632F6176616869 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576244.313:181306): user pid=11489 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576244.329:181307): user pid=11489 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576244.334:181308): user pid=11489 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576244.335:181309): arch=c000003e syscall=59 success=yes exit=0 a0=2ac6d6fff985 a1=7fff7346f098 a2=2ac6d72447b0 a3=726379656b2f7274 items=3 ppid=11488 pid=11489 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576244.335:181309): argc=14 a0="sesh" a1="/bin/ls" a2="-lrt" a3="/etc/acpi" a4="/etc/adjtime" a5="/etc/aliases" a6="/etc/aliases.db" a7="/etc/alternatives" a8="/etc/anacrontab" a9="/etc/asound.conf" a10="/etc/at.deny" a11="/etc/audisp" a12="/etc/audit" a13="/etc/avahi" type=CWD msg=audit(1317576244.335:181309): cwd="/home/rlpowell" type=PATH msg=audit(1317576244.335:181309): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576244.335:181309): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576244.335:181309): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576244.351:181310): arch=c000003e syscall=59 success=yes exit=0 a0=7fb533e18010 a1=7fff68edd100 a2=7fff68edd170 a3=0 items=3 ppid=11488 pid=11489 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ls" exe="/bin/ls" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576244.351:181310): argc=13 a0="/bin/ls" a1="-lrt" a2="/etc/acpi" a3="/etc/adjtime" a4="/etc/aliases" a5="/etc/aliases.db" a6="/etc/alternatives" a7="/etc/anacrontab" a8="/etc/asound.conf" a9="/etc/at.deny" a10="/etc/audisp" a11="/etc/audit" a12="/etc/avahi" type=CWD msg=audit(1317576244.351:181310): cwd="/home/rlpowell" type=PATH msg=audit(1317576244.351:181310): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576244.351:181310): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576244.351:181310): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576245.325:181311): arch=c000003e syscall=59 success=yes exit=0 a0=223edc0 a1=223d1d0 a2=223cbb0 a3=0 items=3 ppid=11408 pid=11490 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576245.322:181312): arch=c000003e syscall=59 success=yes exit=0 a0=223d0b0 a1=223e8e0 a2=223cbb0 a3=8 items=3 ppid=11408 pid=11491 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=317 comm="ausearch" exe="/sbin/ausearch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576245.322:181312): argc=2 a0="ausearch" a1="-i" type=CWD msg=audit(1317576245.322:181312): cwd="/root" type=PATH msg=audit(1317576245.322:181312): item=0 name="/sbin/ausearch" inode=71831 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576245.322:181312): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576245.322:181312): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576245.325:181311): argc=4 a0="grep" a1="-P" a2="(AVC|SELINUX)" a3="/var/log/audit/audit.log.1" type=CWD msg=audit(1317576245.325:181311): cwd="/root" type=PATH msg=audit(1317576245.325:181311): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576245.325:181311): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576245.325:181311): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=CRED_DISP msg=audit(1317576245.954:181313): user pid=11406 uid=0 auid=0 ses=317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_END msg=audit(1317576245.961:181314): user pid=11406 uid=0 auid=0 ses=317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576256.366:181315): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837c90 a2=1c98c60 a3=1c51940 items=3 ppid=9719 pid=11496 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576256.366:181315): argc=3 a0="sudo" a1="cat" a2="/etc/auditd.conf" type=BPRM_FCAPS msg=audit(1317576256.366:181315): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576256.366:181315): cwd="/home/rlpowell" type=PATH msg=audit(1317576256.366:181315): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576256.366:181315): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576256.366:181315): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576256.383:181316): user pid=11496 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=636174202F6574632F6175646974642E636F6E66 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576256.389:181317): user pid=11497 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576256.397:181318): user pid=11497 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576256.399:181319): user pid=11497 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576256.399:181320): arch=c000003e syscall=59 success=yes exit=0 a0=2b26b0240985 a1=7fff0101a568 a2=2b26b047c180 a3=726379656b2f7274 items=3 ppid=11496 pid=11497 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576256.399:181320): argc=3 a0="sesh" a1="/bin/cat" a2="/etc/auditd.conf" type=CWD msg=audit(1317576256.399:181320): cwd="/home/rlpowell" type=PATH msg=audit(1317576256.399:181320): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576256.399:181320): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576256.399:181320): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576256.404:181321): arch=c000003e syscall=59 success=yes exit=0 a0=7ff9c0a38010 a1=7fff66edb450 a2=7fff66edb468 a3=0 items=3 ppid=11496 pid=11497 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="cat" exe="/bin/cat" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576256.404:181321): argc=2 a0="/bin/cat" a1="/etc/auditd.conf" type=CWD msg=audit(1317576256.404:181321): cwd="/home/rlpowell" type=PATH msg=audit(1317576256.404:181321): item=0 name="/bin/cat" inode=70829 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576256.404:181321): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576256.404:181321): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576261.896:181322): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837c98 a2=1c98c60 a3=1c51940 items=3 ppid=9719 pid=11498 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576261.896:181322): argc=3 a0="sudo" a1="cat" a2="/etc/audit/auditd.conf" type=BPRM_FCAPS msg=audit(1317576261.896:181322): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576261.896:181322): cwd="/home/rlpowell" type=PATH msg=audit(1317576261.896:181322): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576261.896:181322): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576261.896:181322): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576261.913:181323): user pid=11498 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=636174202F6574632F61756469742F6175646974642E636F6E66 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576261.919:181324): user pid=11499 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576261.927:181325): user pid=11499 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576261.928:181326): user pid=11499 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576261.928:181327): arch=c000003e syscall=59 success=yes exit=0 a0=2b1a5764e985 a1=7fff4e0fc428 a2=2b1a5788a180 a3=726379656b2f7274 items=3 ppid=11498 pid=11499 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576261.928:181327): argc=3 a0="sesh" a1="/bin/cat" a2="/etc/audit/auditd.conf" type=CWD msg=audit(1317576261.928:181327): cwd="/home/rlpowell" type=PATH msg=audit(1317576261.928:181327): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576261.928:181327): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576261.928:181327): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576261.933:181328): arch=c000003e syscall=59 success=yes exit=0 a0=7f859b2d6010 a1=7fff9ea11770 a2=7fff9ea11788 a3=0 items=3 ppid=11498 pid=11499 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="cat" exe="/bin/cat" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576261.933:181328): argc=2 a0="/bin/cat" a1="/etc/audit/auditd.conf" type=CWD msg=audit(1317576261.933:181328): cwd="/home/rlpowell" type=PATH msg=audit(1317576261.933:181328): item=0 name="/bin/cat" inode=70829 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576261.933:181328): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576261.933:181328): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576295.921:181329): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d8f4a8 a1=7fc228d9c3f8 a2=7fc228d9c410 a3=7fffc1bf5590 items=5 ppid=7316 pid=11500 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576295.921:181329): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576295.921:181329): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576295.921:181329): cwd="/srv/jfgi" type=PATH msg=audit(1317576295.921:181329): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576295.921:181329): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576295.921:181329): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576295.921:181329): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576295.921:181329): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576300.305:181330): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=1c51940 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.305:181330): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.305:181330): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.305:181331): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=1 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.305:181331): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.305:181331): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.306:181332): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.306:181332): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.306:181332): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.307:181333): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.307:181333): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.307:181333): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.307:181334): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.307:181334): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.307:181334): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.308:181335): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.308:181335): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.308:181335): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.323:181336): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.323:181336): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.323:181336): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.323:181337): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.323:181337): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.323:181337): item=0 name="----" type=SYSCALL msg=audit(1317576300.323:181338): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=6a6222 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.323:181338): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.323:181338): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.323:181339): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98c60 a3=0 items=1 ppid=9719 pid=11501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.323:181339): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.323:181339): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.430:181340): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=1c51940 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.430:181340): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.430:181340): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.430:181341): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=1 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.430:181341): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.430:181341): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.430:181342): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.430:181342): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.430:181342): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.430:181343): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.430:181343): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.430:181343): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.430:181344): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.430:181344): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.430:181344): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.430:181345): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.430:181345): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.430:181345): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.431:181346): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.431:181346): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.431:181346): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.431:181347): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.431:181347): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.431:181347): item=0 name="----" type=SYSCALL msg=audit(1317576300.431:181348): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=6a6222 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.431:181348): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.431:181348): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.431:181349): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c989e0 a3=0 items=1 ppid=9719 pid=11502 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.431:181349): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.431:181349): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.442:181350): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=1c51940 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181350): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181350): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.442:181351): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=1 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181351): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181351): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.442:181352): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=1 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181352): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181352): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.442:181353): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181353): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181353): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.442:181354): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181354): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181354): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.442:181355): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181355): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181355): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.442:181356): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181356): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181356): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.442:181357): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181357): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181357): item=0 name="----" type=SYSCALL msg=audit(1317576300.442:181358): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=6a6222 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181358): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181358): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.442:181359): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11503 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.442:181359): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.442:181359): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.460:181360): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=1c51940 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.460:181360): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.460:181360): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.461:181361): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=1 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181361): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181361): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.461:181362): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181362): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181362): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.461:181363): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181363): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181363): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.461:181364): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181364): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181364): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.461:181365): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181365): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181365): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.461:181366): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181366): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181366): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.461:181367): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181367): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181367): item=0 name="----" type=SYSCALL msg=audit(1317576300.461:181368): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=6a6222 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181368): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181368): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.461:181369): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c99620 a3=0 items=1 ppid=9719 pid=11504 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.461:181369): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.461:181369): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.472:181370): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=1c51940 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.472:181370): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.472:181370): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.472:181371): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=1 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.472:181371): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.472:181371): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.473:181372): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181372): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181372): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.473:181373): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181373): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181373): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.473:181374): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181374): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181374): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.473:181375): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181375): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181375): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.473:181376): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181376): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181376): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.473:181377): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181377): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181377): item=0 name="----" type=SYSCALL msg=audit(1317576300.473:181378): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=6a6222 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181378): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181378): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.473:181379): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c977d0 a3=0 items=1 ppid=9719 pid=11505 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.473:181379): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.473:181379): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.486:181380): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=1c51940 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181380): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181380): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.486:181381): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=1 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181381): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181381): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.486:181382): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181382): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181382): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.486:181383): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181383): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181383): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.486:181384): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181384): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181384): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.486:181385): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181385): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181385): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.486:181386): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.486:181386): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.486:181386): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.487:181387): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.487:181387): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.487:181387): item=0 name="----" type=SYSCALL msg=audit(1317576300.487:181388): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=6a6222 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.487:181388): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.487:181388): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.487:181389): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c978a0 a3=0 items=1 ppid=9719 pid=11506 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.487:181389): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.487:181389): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.500:181390): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=1c51940 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181390): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181390): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.500:181391): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=1 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181391): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181391): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.500:181392): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181392): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181392): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.500:181393): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181393): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181393): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.500:181394): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181394): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181394): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.500:181395): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181395): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181395): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.500:181396): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181396): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181396): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.500:181397): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.500:181397): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.500:181397): item=0 name="----" type=SYSCALL msg=audit(1317576300.501:181398): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=6a6222 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.501:181398): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.501:181398): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.501:181399): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c97a50 a3=0 items=1 ppid=9719 pid=11507 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.501:181399): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.501:181399): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.512:181400): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1c51940 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181400): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181400): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.512:181401): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181401): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181401): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.512:181402): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181402): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181402): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.512:181403): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181403): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181403): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.512:181404): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181404): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181404): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.512:181405): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181405): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181405): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.512:181406): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181406): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181406): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.512:181407): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.512:181407): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.512:181407): item=0 name="----" type=SYSCALL msg=audit(1317576300.513:181408): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=6a6222 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.513:181408): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.513:181408): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.513:181409): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11508 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.513:181409): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.513:181409): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.522:181410): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1c51940 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.522:181410): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.522:181410): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.522:181411): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=6a6201 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.522:181411): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.522:181411): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.522:181412): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.522:181412): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.522:181412): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.523:181413): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181413): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181413): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.523:181414): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181414): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181414): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.523:181415): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181415): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181415): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.523:181416): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181416): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181416): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.523:181417): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181417): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181417): item=0 name="----" type=SYSCALL msg=audit(1317576300.523:181418): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=6a6222 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181418): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181418): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.523:181419): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11509 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.523:181419): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.523:181419): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.533:181420): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=1c51940 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.533:181420): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.533:181420): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.533:181421): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=1 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.533:181421): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.533:181421): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.533:181422): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.533:181422): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.533:181422): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.534:181423): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181423): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181423): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.534:181424): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181424): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181424): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.534:181425): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181425): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181425): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.534:181426): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181426): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181426): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.534:181427): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181427): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181427): item=0 name="----" type=SYSCALL msg=audit(1317576300.534:181428): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=6a6222 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181428): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181428): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.534:181429): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990a0 a3=0 items=1 ppid=9719 pid=11510 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.534:181429): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.534:181429): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.554:181430): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1c51940 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.554:181430): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.554:181430): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.554:181431): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.554:181431): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.554:181431): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.554:181432): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.554:181432): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.554:181432): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.554:181433): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.554:181433): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.554:181433): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.555:181434): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.555:181434): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.555:181434): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.555:181435): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.555:181435): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.555:181435): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.555:181436): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.555:181436): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.555:181436): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.555:181437): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.555:181437): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.555:181437): item=0 name="----" type=SYSCALL msg=audit(1317576300.555:181438): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=6a6222 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.555:181438): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.555:181438): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.555:181439): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11511 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.555:181439): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.555:181439): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.566:181440): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=1c51940 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181440): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181440): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.566:181441): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=1 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181441): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181441): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.566:181442): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181442): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181442): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.566:181443): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181443): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181443): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.566:181444): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181444): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181444): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.566:181445): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181445): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181445): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.566:181446): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181446): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181446): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.566:181447): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181447): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181447): item=0 name="----" type=SYSCALL msg=audit(1317576300.566:181448): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=6a6222 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181448): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181448): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.566:181449): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c990c0 a3=0 items=1 ppid=9719 pid=11512 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.566:181449): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.566:181449): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576300.576:181450): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1c51940 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181450): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181450): item=0 name="/bin/----" type=SYSCALL msg=audit(1317576300.576:181451): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=1 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181451): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181451): item=0 name="/usr/bin/----" type=SYSCALL msg=audit(1317576300.576:181452): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181452): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181452): item=0 name="/sbin/----" type=SYSCALL msg=audit(1317576300.576:181453): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181453): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181453): item=0 name="/usr/sbin/----" type=SYSCALL msg=audit(1317576300.576:181454): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181454): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181454): item=0 name="/usr/local/bin/----" type=SYSCALL msg=audit(1317576300.576:181455): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181455): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181455): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.576:181456): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181456): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181456): item=0 name="/var/lib/gems/1.8/bin//----" type=SYSCALL msg=audit(1317576300.576:181457): arch=c000003e syscall=59 success=no exit=-2 a0=7f2e2b837b98 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181457): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181457): item=0 name="----" type=SYSCALL msg=audit(1317576300.576:181458): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=6a6222 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181458): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181458): item=0 name="/home/rlpowell/bin/----" type=SYSCALL msg=audit(1317576300.576:181459): arch=c000003e syscall=59 success=no exit=-2 a0=7fffc5ff60a0 a1=7f2e2b837bb0 a2=1c98fd0 a3=0 items=1 ppid=9719 pid=11513 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="zsh" exe="/bin/zsh" subj=staff_u:staff_r:staff_t:s0 key="64bit_execs" type=CWD msg=audit(1317576300.576:181459): cwd="/home/rlpowell" type=PATH msg=audit(1317576300.576:181459): item=0 name="/usr/local/sbin/----" type=SYSCALL msg=audit(1317576301.989:181460): arch=c000003e syscall=59 success=yes exit=0 a0=7f8b3f124c58 a1=7fff49504bb0 a2=7f8b3f326ef0 a3=0 items=3 ppid=11515 pid=11516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576301.989:181460): argc=3 a0="/sbin/unix_chkpwd" a1="nobody" a2="chkexpiry" type=CWD msg=audit(1317576301.989:181460): cwd="/" type=PATH msg=audit(1317576301.989:181460): item=0 name="/sbin/unix_chkpwd" inode=72011 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 type=PATH msg=audit(1317576301.989:181460): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576301.989:181460): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576301.993:181461): arch=c000003e syscall=59 success=yes exit=0 a0=7f8b3f124c58 a1=7fff49504bb0 a2=7f8b3f326ef0 a3=0 items=3 ppid=11514 pid=11517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576301.993:181461): argc=3 a0="/sbin/unix_chkpwd" a1="root" a2="chkexpiry" type=CWD msg=audit(1317576301.993:181461): cwd="/" type=PATH msg=audit(1317576301.993:181461): item=0 name="/sbin/unix_chkpwd" inode=72011 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 type=PATH msg=audit(1317576301.993:181461): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576301.993:181461): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_ACCT msg=audit(1317576302.013:181462): user pid=11514 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_ACQ msg=audit(1317576302.013:181463): user pid=11514 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=LOGIN msg=audit(1317576302.016:181464): login pid=11514 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=318 type=USER_ACCT msg=audit(1317576302.018:181465): user pid=11515 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="nobody" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_ACQ msg=audit(1317576302.018:181466): user pid=11515 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nobody" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_START msg=audit(1317576302.025:181467): user pid=11514 uid=0 auid=0 ses=318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_REFR msg=audit(1317576302.026:181468): user pid=11514 uid=0 auid=0 ses=318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576302.030:181469): arch=c000003e syscall=59 success=yes exit=0 a0=208cd36 a1=7fff494c2a60 a2=208ce50 a3=8 items=3 ppid=11514 pid=11518 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.030:181469): argc=3 a0="/bin/sh" a1="-c" a2="/usr/local/sbin/auditd_rotate.sh" type=CWD msg=audit(1317576302.030:181469): cwd="/root" type=PATH msg=audit(1317576302.030:181469): item=0 name="/bin/sh" inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.030:181469): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.030:181469): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.043:181470): arch=c000003e syscall=59 success=yes exit=0 a0=1086b90 a1=1086bf0 a2=1085c30 a3=0 items=5 ppid=11514 pid=11518 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="auditd_rotate.s" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.043:181470): argc=2 a0="/bin/bash" a1="/usr/local/sbin/auditd_rotate.sh" type=EXECVE msg=audit(1317576302.043:181470): argc=1 a0="/bin/bash" type=CWD msg=audit(1317576302.043:181470): cwd="/root" type=PATH msg=audit(1317576302.043:181470): item=0 name="/usr/local/sbin/auditd_rotate.sh" inode=393265 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.043:181470): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.043:181470): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.043:181470): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.043:181470): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.054:181471): arch=c000003e syscall=59 success=yes exit=0 a0=7fff494c4c00 a1=7fff494c1a00 a2=7fff49505300 a3=0 items=3 ppid=11514 pid=11519 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) ses=318 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.054:181471): argc=9 a0="/usr/sbin/sendmail" a1="-FCronDaemon" a2="-i" a3="-odi" a4="-oem" a5="-oi" a6="-t" a7="-f" a8="root" type=CWD msg=audit(1317576302.054:181471): cwd="/root" type=PATH msg=audit(1317576302.054:181471): item=0 name="/usr/sbin/sendmail" inode=504161 dev=fc:02 mode=0102755 ouid=0 ogid=51 rdev=00:00 obj=system_u:object_r:sendmail_exec_t:s0 type=PATH msg=audit(1317576302.054:181471): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.054:181471): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.060:181472): arch=c000003e syscall=59 success=yes exit=0 a0=1cd8820 a1=1cd6f30 a2=1cd6bb0 a3=0 items=5 ppid=11518 pid=11520 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.060:181472): argc=4 a0="/bin/sh" a1="/sbin/service" a2="auditd" a3="rotate" type=EXECVE msg=audit(1317576302.060:181472): argc=3 a0="/bin/sh" a1="/sbin/service" a2="auditd" type=CWD msg=audit(1317576302.060:181472): cwd="/root" type=PATH msg=audit(1317576302.060:181472): item=0 name="/sbin/service" inode=71990 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.060:181472): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.060:181472): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.060:181472): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.060:181472): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.082:181473): arch=c000003e syscall=59 success=yes exit=0 a0=2703260 a1=26fafc0 a2=2703810 a3=0 items=3 ppid=11521 pid=11522 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.082:181473): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" type=CWD msg=audit(1317576302.082:181473): cwd="/root" type=PATH msg=audit(1317576302.082:181473): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.082:181473): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.082:181473): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.097:181474): arch=c000003e syscall=59 success=yes exit=0 a0=2703190 a1=2703780 a2=2703810 a3=8 items=3 ppid=11521 pid=11523 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.097:181474): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" type=CWD msg=audit(1317576302.097:181474): cwd="/root" type=PATH msg=audit(1317576302.097:181474): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.097:181474): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.097:181474): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.124:181475): arch=c000003e syscall=59 success=yes exit=0 a0=2702f30 a1=2706500 a2=2706360 a3=0 items=3 ppid=11524 pid=11525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.124:181475): argc=1 a0="/sbin/consoletype" type=CWD msg=audit(1317576302.124:181475): cwd="/root" type=PATH msg=audit(1317576302.124:181475): item=0 name="/sbin/consoletype" inode=71844 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:consoletype_exec_t:s0 type=PATH msg=audit(1317576302.124:181475): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.124:181475): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.141:181476): arch=c000003e syscall=59 success=yes exit=0 a0=2701bd0 a1=272cdb0 a2=27381d0 a3=8 items=3 ppid=11520 pid=11526 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.141:181476): argc=2 a0="basename" a1="/sbin/service" type=CWD msg=audit(1317576302.141:181476): cwd="/root" type=PATH msg=audit(1317576302.141:181476): item=0 name="/bin/basename" inode=70827 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.141:181476): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.141:181476): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.150:181477): arch=c000003e syscall=59 success=yes exit=0 a0=2732a70 a1=2732810 a2=27381d0 a3=8 items=3 ppid=11520 pid=11527 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.150:181477): argc=2 a0="basename" a1="/sbin/service" type=CWD msg=audit(1317576302.150:181477): cwd="/root" type=PATH msg=audit(1317576302.150:181477): item=0 name="/bin/basename" inode=70827 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.150:181477): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.150:181477): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.160:181478): arch=c000003e syscall=59 success=yes exit=0 a0=26faaa0 a1=273b090 a2=27381d0 a3=8 items=3 ppid=11520 pid=11528 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="env" exe="/bin/env" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.160:181478): argc=8 a0="env" a1="-i" a2="PATH=/sbin:/usr/sbin:/bin:/usr/bin" a3="TERM=dumb" a4="SYSTEMCTL_IGNORE_DEPENDENCIES=" a5="SYSTEMCTL_SKIP_REDIRECT=" a6="/etc/init.d/auditd" a7="rotate" type=CWD msg=audit(1317576302.160:181478): cwd="/" type=PATH msg=audit(1317576302.160:181478): item=0 name="/bin/env" inode=70857 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.160:181478): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.160:181478): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.164:181479): arch=c000003e syscall=59 success=yes exit=0 a0=7fff16e40f26 a1=7fff16e406a8 a2=216d030 a3=ffffe000 items=5 ppid=11520 pid=11528 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="auditd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key="slash_etc_actions" type=EXECVE msg=audit(1317576302.164:181479): argc=3 a0="/bin/bash" a1="/etc/init.d/auditd" a2="rotate" type=EXECVE msg=audit(1317576302.164:181479): argc=2 a0="/bin/bash" a1="/etc/init.d/auditd" type=CWD msg=audit(1317576302.164:181479): cwd="/" type=PATH msg=audit(1317576302.164:181479): item=0 name="/etc/init.d/auditd" inode=484162 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditd_initrc_exec_t:s0 type=PATH msg=audit(1317576302.164:181479): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.164:181479): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.164:181479): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.164:181479): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.183:181480): arch=c000003e syscall=59 success=yes exit=0 a0=218a320 a1=2189220 a2=218a8d0 a3=0 items=3 ppid=11529 pid=11530 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:system_r:initrc_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576302.183:181480): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" type=CWD msg=audit(1317576302.183:181480): cwd="/" type=PATH msg=audit(1317576302.183:181480): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.183:181480): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.183:181480): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.191:181481): arch=c000003e syscall=59 success=yes exit=0 a0=218a250 a1=2183570 a2=218a8d0 a3=8 items=3 ppid=11529 pid=11531 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:system_r:initrc_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576302.191:181481): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" type=CWD msg=audit(1317576302.191:181481): cwd="/" type=PATH msg=audit(1317576302.191:181481): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.191:181481): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.191:181481): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.206:181482): arch=c000003e syscall=59 success=yes exit=0 a0=2189fa0 a1=21819b0 a2=218c2f0 a3=0 items=3 ppid=11532 pid=11533 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:system_r:consoletype_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576302.206:181482): argc=1 a0="/sbin/consoletype" type=CWD msg=audit(1317576302.206:181482): cwd="/" type=PATH msg=audit(1317576302.206:181482): item=0 name="/sbin/consoletype" inode=71844 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:consoletype_exec_t:s0 type=PATH msg=audit(1317576302.206:181482): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.206:181482): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.235:181483): arch=c000003e syscall=59 success=yes exit=0 a0=1cd4540 a1=1cd7090 a2=1cd6bb0 a3=0 items=5 ppid=11518 pid=11534 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.235:181483): argc=4 a0="/bin/sh" a1="/sbin/service" a2="auditd" a3="restart" type=EXECVE msg=audit(1317576302.235:181483): argc=3 a0="/bin/sh" a1="/sbin/service" a2="auditd" type=CWD msg=audit(1317576302.235:181483): cwd="/root" type=PATH msg=audit(1317576302.235:181483): item=0 name="/sbin/service" inode=71990 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.235:181483): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.235:181483): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576302.235:181483): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.235:181483): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.250:181484): arch=c000003e syscall=59 success=yes exit=0 a0=26a6260 a1=269dfc0 a2=26a6810 a3=0 items=3 ppid=11535 pid=11536 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.250:181484): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" type=CWD msg=audit(1317576302.250:181484): cwd="/root" type=PATH msg=audit(1317576302.250:181484): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.250:181484): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.250:181484): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.258:181485): arch=c000003e syscall=59 success=yes exit=0 a0=26a6190 a1=26a6780 a2=26a6810 a3=8 items=3 ppid=11535 pid=11537 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.258:181485): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" type=CWD msg=audit(1317576302.258:181485): cwd="/root" type=PATH msg=audit(1317576302.258:181485): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.258:181485): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.258:181485): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.274:181486): arch=c000003e syscall=59 success=yes exit=0 a0=26a5f30 a1=26a9500 a2=26a9360 a3=0 items=3 ppid=11538 pid=11539 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.274:181486): argc=1 a0="/sbin/consoletype" type=CWD msg=audit(1317576302.274:181486): cwd="/root" type=PATH msg=audit(1317576302.274:181486): item=0 name="/sbin/consoletype" inode=71844 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:consoletype_exec_t:s0 type=PATH msg=audit(1317576302.274:181486): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.274:181486): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.292:181487): arch=c000003e syscall=59 success=yes exit=0 a0=26a4bd0 a1=26cfdb0 a2=26db1d0 a3=8 items=3 ppid=11534 pid=11540 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.292:181487): argc=2 a0="basename" a1="/sbin/service" type=CWD msg=audit(1317576302.292:181487): cwd="/root" type=PATH msg=audit(1317576302.292:181487): item=0 name="/bin/basename" inode=70827 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.292:181487): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.292:181487): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.302:181488): arch=c000003e syscall=59 success=yes exit=0 a0=26d5a70 a1=26d5810 a2=26db1d0 a3=8 items=3 ppid=11534 pid=11541 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="basename" exe="/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.302:181488): argc=2 a0="basename" a1="/sbin/service" type=CWD msg=audit(1317576302.302:181488): cwd="/root" type=PATH msg=audit(1317576302.302:181488): item=0 name="/bin/basename" inode=70827 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.302:181488): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.302:181488): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.311:181489): arch=c000003e syscall=59 success=yes exit=0 a0=269daa0 a1=26de090 a2=26db1d0 a3=8 items=3 ppid=11534 pid=11542 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="env" exe="/bin/env" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576302.311:181489): argc=8 a0="env" a1="-i" a2="PATH=/sbin:/usr/sbin:/bin:/usr/bin" a3="TERM=dumb" a4="SYSTEMCTL_IGNORE_DEPENDENCIES=" a5="SYSTEMCTL_SKIP_REDIRECT=" a6="/etc/init.d/auditd" a7="restart" type=CWD msg=audit(1317576302.311:181489): cwd="/" type=PATH msg=audit(1317576302.311:181489): item=0 name="/bin/env" inode=70857 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576302.311:181489): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576302.311:181489): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576302.316:181490): arch=c000003e syscall=59 success=yes exit=0 a0=7fffdfa7bf25 a1=7fffdfa7acd8 a2=1ca6030 a3=fffff000 items=5 ppid=11534 pid=11542 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="auditd" exe="/bin/bash" subj=unconfined_u:system_r:initrc_t:s0 key="slash_etc_actions" type=EXECVE msg=audit(1317576302.316:181490): argc=3 a0="/bin/bash" a1="/etc/init.d/auditd" a2="restart" type=EXECVE msg=audit(1317576302.316:181490): argc=2 a0="/bin/bash" a1="/etc/init.d/auditd" type=DAEMON_END msg=audit(1317576302.565:7425): auditd normal halt, sending auid=? pid=? subj=? res=success type=DAEMON_START msg=audit(1317576303.690:2154): auditd start, ver=2.1.2 format=raw kernel=2.6.38.8-32.fc15.x86_64 auid=4294967295 pid=11577 subj=system_u:system_r:auditd_t:s0 res=success type=CONFIG_CHANGE msg=audit(1317576303.815:181509): audit_backlog_limit=512 old=512 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576303.815:181510): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576303.816:181511): audit_failure=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576303.816:181512): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="slash_etc_actions" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576303.816:181513): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="32bit_execs" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576303.816:181514): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="64bit_execs" list=4 res=1 type=SERVICE_START msg=audit(1317576303.820:181515): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="auditd" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=SYSCALL msg=audit(1317576303.837:181516): arch=c000003e syscall=59 success=yes exit=0 a0=1cd82c0 a1=1cd9130 a2=1cd6bb0 a3=1 items=3 ppid=11518 pid=11591 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="ls" exe="/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576303.843:181517): arch=c000003e syscall=59 success=yes exit=0 a0=1cd7090 a1=1cd7300 a2=1cd6bb0 a3=0 items=3 ppid=11518 pid=11592 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="head" exe="/usr/bin/head" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576303.840:181518): arch=c000003e syscall=59 success=yes exit=0 a0=1cd7150 a1=1cd88e0 a2=1cd6bb0 a3=8 items=3 ppid=11518 pid=11593 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="xargs" exe="/usr/bin/xargs" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576303.837:181516): argc=12 a0="ls" a1="-rt" a2="/var/log/audit/audit.log" a3="/var/log/audit/audit.log.1" a4="/var/log/audit/audit.log.2" a5="/var/log/audit/audit.log.3" a6="/var/log/audit/audit.log.4" a7="/var/log/audit/audit.log.5" a8="/var/log/audit/audit.log.6" a9="/var/log/audit/audit.log.7" a10="/var/log/audit/audit.log.8" a11="/var/log/audit/audit.log.9" type=CWD msg=audit(1317576303.837:181516): cwd="/root" type=PATH msg=audit(1317576303.837:181516): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576303.837:181516): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.837:181516): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576303.840:181518): argc=2 a0="xargs" a1="rm" type=CWD msg=audit(1317576303.840:181518): cwd="/root" type=PATH msg=audit(1317576303.840:181518): item=0 name="/usr/bin/xargs" inode=73375 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576303.840:181518): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.840:181518): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576303.843:181517): argc=3 a0="head" a1="-n" a2="-10" type=CWD msg=audit(1317576303.843:181517): cwd="/root" type=PATH msg=audit(1317576303.843:181517): item=0 name="/usr/bin/head" inode=72544 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576303.843:181517): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.843:181517): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576303.870:181519): arch=c000003e syscall=59 success=yes exit=0 a0=7fff3172cf08 a1=2312240 a2=7fff3172d1f0 a3=366b082260 items=3 ppid=11593 pid=11594 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576303.870:181519): argc=1 a0="rm" type=CWD msg=audit(1317576303.870:181519): cwd="/root" type=PATH msg=audit(1317576303.870:181519): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576303.870:181519): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.870:181519): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576303.885:181520): arch=c000003e syscall=59 success=yes exit=0 a0=1cd7230 a1=1cd88e0 a2=1cd6bb0 a3=8 items=3 ppid=11518 pid=11596 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576303.885:181520): argc=2 a0="grep" a1="^my" type=CWD msg=audit(1317576303.885:181520): cwd="/root" type=PATH msg=audit(1317576303.885:181520): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576303.885:181520): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.885:181520): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576303.891:181521): arch=c000003e syscall=59 success=yes exit=0 a0=1cd8d20 a1=1cd8dc0 a2=1cd6bb0 a3=8 items=3 ppid=11518 pid=11597 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576303.891:181521): argc=3 a0="grep" a1="-Pv" a2="^mysql\s" type=CWD msg=audit(1317576303.891:181521): cwd="/root" type=PATH msg=audit(1317576303.891:181521): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576303.891:181521): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.891:181521): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576303.888:181522): arch=c000003e syscall=59 success=yes exit=0 a0=1cd71c0 a1=1cd88e0 a2=1cd6bb0 a3=8 items=3 ppid=11518 pid=11595 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576303.888:181522): argc=2 a0="semodule" a1="-l" type=CWD msg=audit(1317576303.888:181522): cwd="/root" type=PATH msg=audit(1317576303.888:181522): item=0 name="/usr/sbin/semodule" inode=504160 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:semanage_exec_t:s0 type=PATH msg=audit(1317576303.888:181522): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576303.888:181522): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576305.386:181523): arch=c000003e syscall=59 success=yes exit=0 a0=1cd70b0 a1=1cd88e0 a2=1cd6bb0 a3=8 items=3 ppid=11518 pid=11599 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="ausearch" exe="/sbin/ausearch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576305.386:181523): argc=2 a0="ausearch" a1="-i" type=CWD msg=audit(1317576305.386:181523): cwd="/root" type=PATH msg=audit(1317576305.386:181523): item=0 name="/sbin/ausearch" inode=71831 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576305.386:181523): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576305.386:181523): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576305.389:181524): arch=c000003e syscall=59 success=yes exit=0 a0=1cd8dc0 a1=1cd71d0 a2=1cd6bb0 a3=0 items=3 ppid=11518 pid=11598 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=318 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576305.389:181524): argc=4 a0="grep" a1="-P" a2="(AVC|SELINUX)" a3="/var/log/audit/audit.log.1" type=CWD msg=audit(1317576305.389:181524): cwd="/root" type=PATH msg=audit(1317576305.389:181524): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576305.389:181524): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576305.389:181524): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=CRED_DISP msg=audit(1317576305.979:181525): user pid=11514 uid=0 auid=0 ses=318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_END msg=audit(1317576305.990:181526): user pid=11514 uid=0 auid=0 ses=318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576329.569:181527): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837cf8 a2=1c9a070 a3=1c51940 items=3 ppid=9719 pid=11606 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576329.569:181527): argc=4 a0="sudo" a1="ls" a2="-Zlrt" a3="/var/log/audit" type=BPRM_FCAPS msg=audit(1317576329.569:181527): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576329.569:181527): cwd="/home/rlpowell" type=PATH msg=audit(1317576329.569:181527): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576329.569:181527): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576329.569:181527): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576329.592:181528): user pid=11606 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=6C73202D5A6C7274202F7661722F6C6F672F6175646974 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576329.599:181529): user pid=11607 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576329.607:181530): user pid=11607 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576329.609:181531): user pid=11607 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576329.610:181532): arch=c000003e syscall=59 success=yes exit=0 a0=2b460de28985 a1=7fff654a4338 a2=2b460e064180 a3=726379656b2f7274 items=3 ppid=11606 pid=11607 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576329.610:181532): argc=4 a0="sesh" a1="/bin/ls" a2="-Zlrt" a3="/var/log/audit" type=CWD msg=audit(1317576329.610:181532): cwd="/home/rlpowell" type=PATH msg=audit(1317576329.610:181532): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576329.610:181532): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576329.610:181532): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576329.620:181533): arch=c000003e syscall=59 success=yes exit=0 a0=7fac1ae24010 a1=7fff9b2e1fb0 a2=7fff9b2e1fd0 a3=0 items=3 ppid=11606 pid=11607 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ls" exe="/bin/ls" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576329.620:181533): argc=3 a0="/bin/ls" a1="-Zlrt" a2="/var/log/audit" type=CWD msg=audit(1317576329.620:181533): cwd="/home/rlpowell" type=PATH msg=audit(1317576329.620:181533): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576329.620:181533): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576329.620:181533): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576333.656:181534): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228da06b8 a1=7fc22a093660 a2=7fc22a093678 a3=7fffc1bf5590 items=5 ppid=7301 pid=11608 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="search.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576333.656:181534): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/search.pl" type=EXECVE msg=audit(1317576333.656:181534): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576333.656:181534): cwd="/srv/jfgi" type=PATH msg=audit(1317576333.656:181534): item=0 name="/srv/jfgi/search.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576333.656:181534): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576333.656:181534): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576333.656:181534): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576333.656:181534): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576338.935:181535): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d954d8 a1=7fc2298f5188 a2=7fc2298f51a0 a3=7fffc1bf5590 items=5 ppid=7302 pid=11609 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576338.935:181535): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576338.935:181535): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576338.935:181535): cwd="/srv/jfgi" type=PATH msg=audit(1317576338.935:181535): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576338.935:181535): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576338.935:181535): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576338.935:181535): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576338.935:181535): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.014:181536): arch=c000003e syscall=59 success=yes exit=0 a0=7f8b3f124c58 a1=7fff49504bb0 a2=7f8b3f326ef0 a3=0 items=3 ppid=11610 pid=11611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.014:181536): argc=3 a0="/sbin/unix_chkpwd" a1="root" a2="chkexpiry" type=CWD msg=audit(1317576362.014:181536): cwd="/" type=PATH msg=audit(1317576362.014:181536): item=0 name="/sbin/unix_chkpwd" inode=72011 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 type=PATH msg=audit(1317576362.014:181536): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.014:181536): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_ACCT msg=audit(1317576362.025:181537): user pid=11610 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_ACQ msg=audit(1317576362.026:181538): user pid=11610 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=LOGIN msg=audit(1317576362.029:181539): login pid=11610 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=319 type=USER_START msg=audit(1317576362.033:181540): user pid=11610 uid=0 auid=0 ses=319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_REFR msg=audit(1317576362.033:181541): user pid=11610 uid=0 auid=0 ses=319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576362.038:181542): arch=c000003e syscall=59 success=yes exit=0 a0=208cd36 a1=7fff494c2a60 a2=208ce50 a3=8 items=3 ppid=11610 pid=11612 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.038:181542): argc=3 a0="/bin/sh" a1="-c" a2="/usr/local/sbin/auditd_rotate.sh" type=CWD msg=audit(1317576362.038:181542): cwd="/root" type=PATH msg=audit(1317576362.038:181542): item=0 name="/bin/sh" inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576362.038:181542): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.038:181542): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.050:181543): arch=c000003e syscall=59 success=yes exit=0 a0=178db90 a1=178dbf0 a2=178cc30 a3=0 items=5 ppid=11610 pid=11612 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="auditd_rotate.s" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.050:181543): argc=2 a0="/bin/bash" a1="/usr/local/sbin/auditd_rotate.sh" type=EXECVE msg=audit(1317576362.050:181543): argc=1 a0="/bin/bash" type=CWD msg=audit(1317576362.050:181543): cwd="/root" type=PATH msg=audit(1317576362.050:181543): item=0 name="/usr/local/sbin/auditd_rotate.sh" inode=393265 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.050:181543): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576362.050:181543): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576362.050:181543): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.050:181543): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.060:181544): arch=c000003e syscall=59 success=yes exit=0 a0=7fff494c4c00 a1=7fff494c1a00 a2=7fff49505300 a3=0 items=3 ppid=11610 pid=11613 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) ses=319 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.060:181544): argc=9 a0="/usr/sbin/sendmail" a1="-FCronDaemon" a2="-i" a3="-odi" a4="-oem" a5="-oi" a6="-t" a7="-f" a8="root" type=CWD msg=audit(1317576362.060:181544): cwd="/root" type=PATH msg=audit(1317576362.060:181544): item=0 name="/usr/sbin/sendmail" inode=504161 dev=fc:02 mode=0102755 ouid=0 ogid=51 rdev=00:00 obj=system_u:object_r:sendmail_exec_t:s0 type=PATH msg=audit(1317576362.060:181544): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.060:181544): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.068:181545): arch=c000003e syscall=59 success=yes exit=0 a0=99f820 a1=99df30 a2=99dbb0 a3=0 items=5 ppid=11612 pid=11614 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="service" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.068:181545): argc=4 a0="/bin/sh" a1="/sbin/service" a2="auditd" a3="rotate" type=EXECVE msg=audit(1317576362.068:181545): argc=3 a0="/bin/sh" a1="/sbin/service" a2="auditd" type=CWD msg=audit(1317576362.068:181545): cwd="/root" type=PATH msg=audit(1317576362.068:181545): item=0 name="/sbin/service" inode=71990 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.068:181545): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576362.068:181545): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576362.068:181545): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.068:181545): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.092:181546): arch=c000003e syscall=59 success=yes exit=0 a0=11d6260 a1=11cdfc0 a2=11d6810 a3=0 items=3 ppid=11615 pid=11616 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.092:181546): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" type=CWD msg=audit(1317576362.092:181546): cwd="/root" type=PATH msg=audit(1317576362.092:181546): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.092:181546): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.092:181546): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.107:181547): arch=c000003e syscall=59 success=yes exit=0 a0=11d6190 a1=11d6780 a2=11d6810 a3=8 items=3 ppid=11615 pid=11617 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="mountpoint" exe="/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.107:181547): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" type=CWD msg=audit(1317576362.107:181547): cwd="/root" type=PATH msg=audit(1317576362.107:181547): item=0 name="/bin/mountpoint" inode=70886 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.107:181547): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.107:181547): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.132:181548): arch=c000003e syscall=59 success=yes exit=0 a0=11d5f30 a1=11d9500 a2=11d9360 a3=0 items=3 ppid=11618 pid=11619 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.132:181548): argc=1 a0="/sbin/consoletype" type=CWD msg=audit(1317576362.132:181548): cwd="/root" type=PATH msg=audit(1317576362.132:181548): item=0 name="/sbin/consoletype" inode=71844 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:consoletype_exec_t:s0 type=PATH msg=audit(1317576362.132:181548): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.132:181548): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=DAEMON_END msg=audit(1317576362.455:2155): auditd normal halt, sending auid=? pid=? subj=? res=success type=DAEMON_START msg=audit(1317576362.718:1803): auditd start, ver=2.1.2 format=raw kernel=2.6.38.8-32.fc15.x86_64 auid=4294967295 pid=11669 subj=system_u:system_r:auditd_t:s0 res=success type=CONFIG_CHANGE msg=audit(1317576362.843:181580): audit_backlog_limit=512 old=512 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576362.843:181581): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576362.844:181582): audit_failure=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1317576362.844:181583): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="slash_etc_actions" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576362.844:181584): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="32bit_execs" list=4 res=1 type=CONFIG_CHANGE msg=audit(1317576362.844:181585): auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 op="add rule" key="64bit_execs" list=4 res=1 type=SERVICE_START msg=audit(1317576362.849:181586): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="auditd" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=SYSCALL msg=audit(1317576362.866:181587): arch=c000003e syscall=59 success=yes exit=0 a0=99e150 a1=99f8e0 a2=99dbb0 a3=8 items=3 ppid=11612 pid=11685 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="xargs" exe="/usr/bin/xargs" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=SYSCALL msg=audit(1317576362.869:181588): arch=c000003e syscall=59 success=yes exit=0 a0=99f2c0 a1=9a0130 a2=99dbb0 a3=1 items=3 ppid=11612 pid=11683 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="ls" exe="/bin/ls" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.869:181588): argc=12 a0="ls" a1="-rt" a2="/var/log/audit/audit.log" a3="/var/log/audit/audit.log.1" a4="/var/log/audit/audit.log.2" a5="/var/log/audit/audit.log.3" a6="/var/log/audit/audit.log.4" a7="/var/log/audit/audit.log.5" a8="/var/log/audit/audit.log.6" a9="/var/log/audit/audit.log.7" a10="/var/log/audit/audit.log.8" a11="/var/log/audit/audit.log.9" type=CWD msg=audit(1317576362.869:181588): cwd="/root" type=PATH msg=audit(1317576362.869:181588): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.869:181588): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.869:181588): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=EXECVE msg=audit(1317576362.866:181587): argc=2 a0="xargs" a1="rm" type=CWD msg=audit(1317576362.866:181587): cwd="/root" type=PATH msg=audit(1317576362.866:181587): item=0 name="/usr/bin/xargs" inode=73375 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.866:181587): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.866:181587): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.863:181589): arch=c000003e syscall=59 success=yes exit=0 a0=99e090 a1=99e300 a2=99dbb0 a3=0 items=3 ppid=11612 pid=11684 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="head" exe="/usr/bin/head" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.863:181589): argc=3 a0="head" a1="-n" a2="-10" type=CWD msg=audit(1317576362.863:181589): cwd="/root" type=PATH msg=audit(1317576362.863:181589): item=0 name="/usr/bin/head" inode=72544 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.863:181589): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.863:181589): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.897:181590): arch=c000003e syscall=59 success=yes exit=0 a0=7fff89596cf8 a1=14d6240 a2=7fff89596fe0 a3=366b082260 items=3 ppid=11685 pid=11686 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.897:181590): argc=1 a0="rm" type=CWD msg=audit(1317576362.897:181590): cwd="/root" type=PATH msg=audit(1317576362.897:181590): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.897:181590): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.897:181590): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.909:181591): arch=c000003e syscall=59 success=yes exit=0 a0=99fd20 a1=99fdc0 a2=99dbb0 a3=8 items=3 ppid=11612 pid=11689 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.909:181591): argc=3 a0="grep" a1="-Pv" a2="^mysql\s" type=CWD msg=audit(1317576362.909:181591): cwd="/root" type=PATH msg=audit(1317576362.909:181591): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.909:181591): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.909:181591): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.912:181592): arch=c000003e syscall=59 success=yes exit=0 a0=99e230 a1=99f8e0 a2=99dbb0 a3=8 items=3 ppid=11612 pid=11688 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.912:181592): argc=2 a0="grep" a1="^my" type=CWD msg=audit(1317576362.912:181592): cwd="/root" type=PATH msg=audit(1317576362.912:181592): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576362.912:181592): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.912:181592): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576362.916:181593): arch=c000003e syscall=59 success=yes exit=0 a0=99e1c0 a1=99f8e0 a2=99dbb0 a3=8 items=3 ppid=11612 pid=11687 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="semodule" exe="/usr/sbin/semodule" subj=unconfined_u:unconfined_r:semanage_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576362.916:181593): argc=2 a0="semodule" a1="-l" type=CWD msg=audit(1317576362.916:181593): cwd="/root" type=PATH msg=audit(1317576362.916:181593): item=0 name="/usr/sbin/semodule" inode=504160 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:semanage_exec_t:s0 type=PATH msg=audit(1317576362.916:181593): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576362.916:181593): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576364.358:181594): arch=c000003e syscall=59 success=yes exit=0 a0=99e0b0 a1=99f8e0 a2=99dbb0 a3=8 items=3 ppid=11612 pid=11691 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="ausearch" exe="/sbin/ausearch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576364.358:181594): argc=2 a0="ausearch" a1="-i" type=CWD msg=audit(1317576364.358:181594): cwd="/root" type=PATH msg=audit(1317576364.358:181594): item=0 name="/sbin/ausearch" inode=71831 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576364.358:181594): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576364.358:181594): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576364.362:181595): arch=c000003e syscall=59 success=yes exit=0 a0=99fdc0 a1=99e1d0 a2=99dbb0 a3=0 items=3 ppid=11612 pid=11690 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=319 comm="grep" exe="/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576364.362:181595): argc=4 a0="grep" a1="-P" a2="(AVC|SELINUX)" a3="/var/log/audit/audit.log.1" type=CWD msg=audit(1317576364.362:181595): cwd="/root" type=PATH msg=audit(1317576364.362:181595): item=0 name="/bin/grep" inode=70863 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576364.362:181595): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576364.362:181595): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=CRED_DISP msg=audit(1317576365.006:181596): user pid=11610 uid=0 auid=0 ses=319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_END msg=audit(1317576365.011:181597): user pid=11610 uid=0 auid=0 ses=319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576380.239:181598): arch=c000003e syscall=59 success=yes exit=0 a0=7fc2298a22e8 a1=7fc228d8e468 a2=7fc228d8e480 a3=7fffc1bf5590 items=5 ppid=7236 pid=11696 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576380.239:181598): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576380.239:181598): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576380.239:181598): cwd="/srv/jfgi" type=PATH msg=audit(1317576380.239:181598): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576380.239:181598): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576380.239:181598): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576380.239:181598): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576380.239:181598): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576384.564:181599): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837c78 a2=1c9a2d0 a3=0 items=3 ppid=9719 pid=11697 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576384.564:181599): argc=3 a0="sudo" a1="crontab" a2="-e" type=BPRM_FCAPS msg=audit(1317576384.564:181599): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576384.564:181599): cwd="/home/rlpowell" type=PATH msg=audit(1317576384.564:181599): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576384.564:181599): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576384.564:181599): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576384.585:181600): user pid=11697 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=63726F6E746162202D65 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576384.590:181601): user pid=11698 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576384.598:181602): user pid=11698 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576384.599:181603): user pid=11698 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576384.600:181604): arch=c000003e syscall=59 success=yes exit=0 a0=2b1c25f8f985 a1=7fff471316b8 a2=2b1c261cb180 a3=726379656b2f7274 items=3 ppid=11697 pid=11698 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576384.600:181604): argc=3 a0="sesh" a1="/usr/bin/crontab" a2="-e" type=CWD msg=audit(1317576384.600:181604): cwd="/home/rlpowell" type=PATH msg=audit(1317576384.600:181604): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576384.600:181604): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576384.600:181604): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576384.610:181605): arch=c000003e syscall=59 success=yes exit=0 a0=7f6ad4485010 a1=7fffe69dbdf0 a2=7fffe69dbe08 a3=0 items=3 ppid=11697 pid=11698 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="crontab" exe="/usr/bin/crontab" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576384.610:181605): argc=2 a0="/usr/bin/crontab" a1="-e" type=CWD msg=audit(1317576384.610:181605): cwd="/home/rlpowell" type=PATH msg=audit(1317576384.610:181605): item=0 name="/usr/bin/crontab" inode=72357 dev=fc:02 mode=0106755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:crontab_exec_t:s0 type=PATH msg=audit(1317576384.610:181605): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576384.610:181605): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576384.637:181606): arch=c000003e syscall=59 success=yes exit=0 a0=7f420d17cc58 a1=7fff91f32960 a2=7f420d37eef0 a3=0 items=3 ppid=11698 pid=11699 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576384.637:181606): argc=3 a0="/sbin/unix_chkpwd" a1="root" a2="chkexpiry" type=CWD msg=audit(1317576384.637:181606): cwd="/home/rlpowell" type=PATH msg=audit(1317576384.637:181606): item=0 name="/sbin/unix_chkpwd" inode=72011 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 type=PATH msg=audit(1317576384.637:181606): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576384.637:181606): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_ACCT msg=audit(1317576384.647:181607): user pid=11698 uid=0 auid=1000 ses=307 subj=staff_u:unconfined_r:unconfined_t:s0 msg='op=PAM:accounting acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success' type=CRED_ACQ msg=audit(1317576384.647:181608): user pid=11698 uid=0 auid=1000 ses=307 subj=staff_u:unconfined_r:unconfined_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576384.658:181609): arch=c000003e syscall=59 success=yes exit=0 a0=408dac a1=7fff91f0fa90 a2=7fff91f32d40 a3=0 items=3 ppid=11698 pid=11700 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sh" exe="/bin/bash" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576384.658:181609): argc=3 a0="/bin/sh" a1="-c" a2=2F62696E2F7669202F746D702F63726F6E7461622E764B6C537576 type=CWD msg=audit(1317576384.658:181609): cwd="/home/rlpowell" type=PATH msg=audit(1317576384.658:181609): item=0 name="/bin/sh" inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576384.658:181609): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576384.658:181609): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576384.671:181610): arch=c000003e syscall=59 success=yes exit=0 a0=24eb2d0 a1=24e9ca0 a2=24e9e30 a3=0 items=3 ppid=11698 pid=11700 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="vi" exe="/bin/vi" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576384.671:181610): argc=2 a0="/bin/vi" a1="/tmp/crontab.vKlSuv" type=CWD msg=audit(1317576384.671:181610): cwd="/home/rlpowell" type=PATH msg=audit(1317576384.671:181610): item=0 name="/bin/vi" inode=70946 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576384.671:181610): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576384.671:181610): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576391.463:181611): arch=c000003e syscall=59 success=yes exit=0 a0=7fc2295ed678 a1=7fc228da4288 a2=7fc228da42a0 a3=7fffc1bf5590 items=5 ppid=7171 pid=11701 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576391.463:181611): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576391.463:181611): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576391.463:181611): cwd="/srv/jfgi" type=PATH msg=audit(1317576391.463:181611): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576391.463:181611): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576391.463:181611): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576391.463:181611): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576391.463:181611): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576402.618:181612): arch=c000003e syscall=59 success=yes exit=0 a0=7fc229885068 a1=7fc229bb2728 a2=7fc229bb2740 a3=7fffc1bf5560 items=5 ppid=2976 pid=11702 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576402.618:181612): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576402.618:181612): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576402.618:181612): cwd="/srv/jfgi" type=PATH msg=audit(1317576402.618:181612): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576402.618:181612): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576402.618:181612): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576402.618:181612): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576402.618:181612): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576412.403:181613): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837c08 a2=1c9a070 a3=0 items=3 ppid=9719 pid=11703 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576412.403:181613): argc=2 a0="sudo" a1="cat" type=BPRM_FCAPS msg=audit(1317576412.403:181613): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576412.403:181613): cwd="/home/rlpowell" type=PATH msg=audit(1317576412.403:181613): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576412.403:181613): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576412.403:181613): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576412.420:181614): user pid=11703 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd="cat" terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576412.425:181615): user pid=11704 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576412.432:181616): user pid=11704 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576412.433:181617): user pid=11704 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576412.433:181618): arch=c000003e syscall=59 success=yes exit=0 a0=2b7bbea64985 a1=7fff3c5a9f38 a2=2b7bbecf2180 a3=726379656b2f7274 items=3 ppid=11703 pid=11704 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576412.433:181618): argc=2 a0="sesh" a1="/bin/cat" type=CWD msg=audit(1317576412.433:181618): cwd="/home/rlpowell" type=PATH msg=audit(1317576412.433:181618): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576412.433:181618): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576412.433:181618): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576412.437:181619): arch=c000003e syscall=59 success=yes exit=0 a0=7f58d0f30010 a1=7fff61f1d7d0 a2=7fff61f1d7e0 a3=0 items=3 ppid=11703 pid=11704 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="cat" exe="/bin/cat" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576412.437:181619): argc=1 a0="/bin/cat" type=CWD msg=audit(1317576412.437:181619): cwd="/home/rlpowell" type=PATH msg=audit(1317576412.437:181619): item=0 name="/bin/cat" inode=70829 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576412.437:181619): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576412.437:181619): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576415.887:181620): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837cd0 a2=1c9a550 a3=1c51940 items=3 ppid=9719 pid=11705 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576415.887:181620): argc=3 a0="sudo" a1="cat" a2="/usr/local/sbin/auditd_rotate.sh" type=BPRM_FCAPS msg=audit(1317576415.887:181620): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576415.887:181620): cwd="/home/rlpowell" type=PATH msg=audit(1317576415.887:181620): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576415.887:181620): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576415.887:181620): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576415.901:181621): user pid=11705 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=636174202F7573722F6C6F63616C2F7362696E2F6175646974645F726F746174652E7368 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576415.907:181622): user pid=11706 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576415.914:181623): user pid=11706 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576415.915:181624): user pid=11706 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576415.915:181625): arch=c000003e syscall=59 success=yes exit=0 a0=2ae54637b985 a1=7fff3057dbf8 a2=2ae5465b7180 a3=726379656b2f7274 items=3 ppid=11705 pid=11706 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576415.915:181625): argc=3 a0="sesh" a1="/bin/cat" a2="/usr/local/sbin/auditd_rotate.sh" type=CWD msg=audit(1317576415.915:181625): cwd="/home/rlpowell" type=PATH msg=audit(1317576415.915:181625): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576415.915:181625): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576415.915:181625): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576415.920:181626): arch=c000003e syscall=59 success=yes exit=0 a0=7f7c17564010 a1=7fff9bbe6900 a2=7fff9bbe6918 a3=0 items=3 ppid=11705 pid=11706 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="cat" exe="/bin/cat" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576415.920:181626): argc=2 a0="/bin/cat" a1="/usr/local/sbin/auditd_rotate.sh" type=CWD msg=audit(1317576415.920:181626): cwd="/home/rlpowell" type=PATH msg=audit(1317576415.920:181626): item=0 name="/bin/cat" inode=70829 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576415.920:181626): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576415.920:181626): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576428.201:181627): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228db1758 a1=7fc228d8e1a8 a2=7fc228d8e1c0 a3=7fffc1bf5590 items=5 ppid=3113 pid=11707 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576428.201:181627): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576428.201:181627): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576428.201:181627): cwd="/srv/jfgi" type=PATH msg=audit(1317576428.201:181627): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576428.201:181627): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576428.201:181627): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576428.201:181627): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576428.201:181627): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576431.847:181628): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d8d498 a1=7fc228d900f8 a2=7fc228d90110 a3=7fffc1bf5590 items=5 ppid=3618 pid=11708 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576431.847:181628): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576431.847:181628): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576431.847:181628): cwd="/srv/jfgi" type=PATH msg=audit(1317576431.847:181628): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576431.847:181628): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576431.847:181628): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576431.847:181628): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576431.847:181628): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576448.564:181629): arch=c000003e syscall=59 success=yes exit=0 a0=7fc227df9dc8 a1=7fc229883e38 a2=7fc229883e50 a3=7fffc1bf5560 items=5 ppid=2976 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576448.564:181629): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576448.564:181629): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576448.564:181629): cwd="/srv/jfgi" type=PATH msg=audit(1317576448.564:181629): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576448.564:181629): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576448.564:181629): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576448.564:181629): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576448.564:181629): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576456.558:181630): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d9ff88 a1=7fc228d982f0 a2=7fc228d98308 a3=7fffc1bf5590 items=5 ppid=7224 pid=11710 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576456.558:181630): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576456.558:181630): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576456.558:181630): cwd="/srv/jfgi" type=PATH msg=audit(1317576456.558:181630): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576456.558:181630): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576456.558:181630): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576456.558:181630): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576456.558:181630): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576459.521:181631): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d8d498 a1=7fc228dae3a0 a2=7fc228dae3b8 a3=7fffc1bf5590 items=5 ppid=3618 pid=11711 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576459.521:181631): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576459.521:181631): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576459.521:181631): cwd="/srv/jfgi" type=PATH msg=audit(1317576459.521:181631): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576459.521:181631): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576459.521:181631): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576459.521:181631): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576459.521:181631): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576473.705:181632): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228dad738 a1=7fc228d9ed68 a2=7fc228d9ed80 a3=7fffc1bf5590 items=5 ppid=9011 pid=11712 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576473.705:181632): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576473.705:181632): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576473.705:181632): cwd="/srv/jfgi" type=PATH msg=audit(1317576473.705:181632): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576473.705:181632): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576473.705:181632): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576473.705:181632): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576473.705:181632): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576475.574:181633): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d954d8 a1=7fc228d92120 a2=7fc228d92138 a3=7fffc1bf5590 items=5 ppid=7302 pid=11713 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576475.574:181633): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576475.574:181633): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576475.574:181633): cwd="/srv/jfgi" type=PATH msg=audit(1317576475.574:181633): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576475.574:181633): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576475.574:181633): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576475.574:181633): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576475.574:181633): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576484.654:181634): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d934c8 a1=7fc228d9ec90 a2=7fc228d9eca8 a3=7fffc1bf5590 items=5 ppid=3064 pid=11714 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576484.654:181634): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576484.654:181634): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576484.654:181634): cwd="/srv/jfgi" type=PATH msg=audit(1317576484.654:181634): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576484.654:181634): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576484.654:181634): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576484.654:181634): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576484.654:181634): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576490.209:181635): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837cf8 a2=1c9a200 a3=1c51940 items=3 ppid=9719 pid=11715 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576490.209:181635): argc=4 a0="sudo" a1="ls" a2="-Zlrt" a3="/var/log/audit" type=BPRM_FCAPS msg=audit(1317576490.209:181635): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576490.209:181635): cwd="/home/rlpowell" type=PATH msg=audit(1317576490.209:181635): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576490.209:181635): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576490.209:181635): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576490.235:181636): user pid=11715 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=6C73202D5A6C7274202F7661722F6C6F672F6175646974 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576490.241:181637): user pid=11716 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576490.249:181638): user pid=11716 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576490.250:181639): user pid=11716 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576490.251:181640): arch=c000003e syscall=59 success=yes exit=0 a0=2ad58117e985 a1=7fff0ad8f518 a2=2ad5813ba180 a3=726379656b2f7274 items=3 ppid=11715 pid=11716 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576490.251:181640): argc=4 a0="sesh" a1="/bin/ls" a2="-Zlrt" a3="/var/log/audit" type=CWD msg=audit(1317576490.251:181640): cwd="/home/rlpowell" type=PATH msg=audit(1317576490.251:181640): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576490.251:181640): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576490.251:181640): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576490.260:181641): arch=c000003e syscall=59 success=yes exit=0 a0=7f68169a6010 a1=7fff86406d10 a2=7fff86406d30 a3=0 items=3 ppid=11715 pid=11716 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ls" exe="/bin/ls" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576490.260:181641): argc=3 a0="/bin/ls" a1="-Zlrt" a2="/var/log/audit" type=CWD msg=audit(1317576490.260:181641): cwd="/home/rlpowell" type=PATH msg=audit(1317576490.260:181641): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576490.260:181641): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576490.260:181641): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576490.971:181642): arch=c000003e syscall=59 success=yes exit=0 a0=7fc229a28208 a1=7fc228d9ec38 a2=7fc228d9ec50 a3=7fffc1bf5590 items=5 ppid=7316 pid=11717 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576490.971:181642): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576490.971:181642): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576490.971:181642): cwd="/srv/jfgi" type=PATH msg=audit(1317576490.971:181642): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576490.971:181642): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576490.971:181642): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576490.971:181642): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576490.971:181642): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576495.791:181643): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837cc0 a2=1c9a470 a3=1c51940 items=3 ppid=9719 pid=11718 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576495.791:181643): argc=3 a0="sudo" a1="less" a2="/var/log/audit/audit.log.1" type=BPRM_FCAPS msg=audit(1317576495.791:181643): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576495.791:181643): cwd="/home/rlpowell" type=PATH msg=audit(1317576495.791:181643): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576495.791:181643): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576495.791:181643): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576495.806:181644): user pid=11718 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=6C657373202F7661722F6C6F672F61756469742F61756469742E6C6F672E31 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576495.811:181645): user pid=11719 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576495.819:181646): user pid=11719 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576495.820:181647): user pid=11719 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576495.820:181648): arch=c000003e syscall=59 success=yes exit=0 a0=2b8abbea2985 a1=7fffbbc69718 a2=2b8abc0de180 a3=726379656b2f7274 items=3 ppid=11718 pid=11719 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576495.820:181648): argc=3 a0="sesh" a1="/usr/bin/less" a2="/var/log/audit/audit.log.1" type=CWD msg=audit(1317576495.820:181648): cwd="/home/rlpowell" type=PATH msg=audit(1317576495.820:181648): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576495.820:181648): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576495.820:181648): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576495.826:181649): arch=c000003e syscall=59 success=yes exit=0 a0=7faff7cf5010 a1=7fff7af251a0 a2=7fff7af251b8 a3=0 items=3 ppid=11718 pid=11719 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="less" exe="/usr/bin/less" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576495.826:181649): argc=2 a0="/usr/bin/less" a1="/var/log/audit/audit.log.1" type=CWD msg=audit(1317576495.826:181649): cwd="/home/rlpowell" type=PATH msg=audit(1317576495.826:181649): item=0 name="/usr/bin/less" inode=72621 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576495.826:181649): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576495.826:181649): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576532.666:181650): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837cf8 a2=1c9a5c0 a3=1c51940 items=3 ppid=9719 pid=11720 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576532.666:181650): argc=4 a0="sudo" a1="ls" a2="-Zlrt" a3="/var/log/audit" type=BPRM_FCAPS msg=audit(1317576532.666:181650): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576532.666:181650): cwd="/home/rlpowell" type=PATH msg=audit(1317576532.666:181650): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576532.666:181650): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576532.666:181650): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576532.681:181651): user pid=11720 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=6C73202D5A6C7274202F7661722F6C6F672F6175646974 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576532.686:181652): user pid=11721 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576532.695:181653): user pid=11721 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576532.696:181654): user pid=11721 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576532.696:181655): arch=c000003e syscall=59 success=yes exit=0 a0=2af9c9088985 a1=7fff173b7228 a2=2af9c92c4180 a3=726379656b2f7274 items=3 ppid=11720 pid=11721 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576532.696:181655): argc=4 a0="sesh" a1="/bin/ls" a2="-Zlrt" a3="/var/log/audit" type=CWD msg=audit(1317576532.696:181655): cwd="/home/rlpowell" type=PATH msg=audit(1317576532.696:181655): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576532.696:181655): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576532.696:181655): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576532.701:181656): arch=c000003e syscall=59 success=yes exit=0 a0=7f9a31265010 a1=7fff0ea4c380 a2=7fff0ea4c3a0 a3=0 items=3 ppid=11720 pid=11721 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ls" exe="/bin/ls" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576532.701:181656): argc=3 a0="/bin/ls" a1="-Zlrt" a2="/var/log/audit" type=CWD msg=audit(1317576532.701:181656): cwd="/home/rlpowell" type=PATH msg=audit(1317576532.701:181656): item=0 name="/bin/ls" inode=70876 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576532.701:181656): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576532.701:181656): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576542.491:181657): arch=c000003e syscall=59 success=yes exit=0 a0=7fc229905ff8 a1=7fc228d94188 a2=7fc228d941a0 a3=7fffc1bf5590 items=5 ppid=7171 pid=11722 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576542.491:181657): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576542.491:181657): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576542.491:181657): cwd="/srv/jfgi" type=PATH msg=audit(1317576542.491:181657): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576542.491:181657): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576542.491:181657): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576542.491:181657): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576542.491:181657): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576551.733:181658): arch=c000003e syscall=59 success=yes exit=0 a0=7fc22a51a238 a1=7fc229c3f1c8 a2=7fc229c3f1e0 a3=7fffc1bf5590 items=5 ppid=7240 pid=11723 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576551.733:181658): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576551.733:181658): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576551.733:181658): cwd="/srv/jfgi" type=PATH msg=audit(1317576551.733:181658): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576551.733:181658): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576551.733:181658): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576551.733:181658): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576551.733:181658): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576569.004:181659): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228da54a8 a1=7fc2295ec468 a2=7fc2295ec480 a3=7fffc1bf5590 items=5 ppid=7171 pid=11724 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576569.004:181659): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576569.004:181659): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576569.004:181659): cwd="/srv/jfgi" type=PATH msg=audit(1317576569.004:181659): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576569.004:181659): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576569.004:181659): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576569.004:181659): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576569.004:181659): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576591.499:181660): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837e10 a2=1c9a5c0 a3=1c51940 items=3 ppid=9719 pid=11725 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576591.499:181660): argc=5 a0="sudo" a1="scp" a2="/var/log/audit/audit.log.1" a3="/var/log/audit/audit.log" a4="users.teddyb.org:~/www/media/public" type=BPRM_FCAPS msg=audit(1317576591.499:181660): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576591.499:181660): cwd="/home/rlpowell" type=PATH msg=audit(1317576591.499:181660): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576591.499:181660): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576591.499:181660): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576591.572:181661): user pid=11725 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=736370202F7661722F6C6F672F61756469742F61756469742E6C6F672E31202F7661722F6C6F672F61756469742F61756469742E6C6F672075736572732E7465646479622E6F72673A7E2F7777772F6D656469612F7075626C6963 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576591.575:181662): user pid=11726 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576591.583:181663): user pid=11726 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576591.584:181664): user pid=11726 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576591.584:181665): arch=c000003e syscall=59 success=yes exit=0 a0=2b59aedaf985 a1=7fffc32e9628 a2=2b59aeff47b0 a3=726379656b2f7274 items=3 ppid=11725 pid=11726 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576591.584:181665): argc=5 a0="sesh" a1="/usr/bin/scp" a2="/var/log/audit/audit.log.1" a3="/var/log/audit/audit.log" a4="users.teddyb.org:~/www/media/public" type=CWD msg=audit(1317576591.584:181665): cwd="/home/rlpowell" type=PATH msg=audit(1317576591.584:181665): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576591.584:181665): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576591.584:181665): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576591.589:181666): arch=c000003e syscall=59 success=yes exit=0 a0=7f204bdfc010 a1=7fff7860e110 a2=7fff7860e138 a3=0 items=3 ppid=11725 pid=11726 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="scp" exe="/usr/bin/scp" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576591.589:181666): argc=4 a0="/usr/bin/scp" a1="/var/log/audit/audit.log.1" a2="/var/log/audit/audit.log" a3="users.teddyb.org:~/www/media/public" type=CWD msg=audit(1317576591.589:181666): cwd="/home/rlpowell" type=PATH msg=audit(1317576591.589:181666): item=0 name="/usr/bin/scp" inode=73181 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576591.589:181666): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576591.589:181666): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576591.677:181667): arch=c000003e syscall=59 success=yes exit=0 a0=7f0b15d46834 a1=7f0b168ae1c0 a2=7fff07c08c60 a3=0 items=3 ppid=11726 pid=11727 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ssh" exe="/usr/bin/ssh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576591.677:181667): argc=8 a0="/usr/bin/ssh" a1="-x" a2=2D6F466F72776172644167656E74206E6F a3=2D6F5065726D69744C6F63616C436F6D6D616E64206E6F a4=2D6F436C656172416C6C466F7277617264696E677320796573 a5="--" a6="users.teddyb.org" a7=736370202D64202D74202D2D207E2F7777772F6D656469612F7075626C6963 type=CWD msg=audit(1317576591.677:181667): cwd="/home/rlpowell" type=PATH msg=audit(1317576591.677:181667): item=0 name="/usr/bin/ssh" inode=73244 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ssh_exec_t:s0 type=PATH msg=audit(1317576591.677:181667): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576591.677:181667): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576594.599:181668): arch=c000003e syscall=59 success=yes exit=0 a0=7fc2292769d8 a1=7fc229960d50 a2=7fc229960d68 a3=7fffc1bf5590 items=5 ppid=3615 pid=11728 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576594.599:181668): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576594.599:181668): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576594.599:181668): cwd="/srv/jfgi" type=PATH msg=audit(1317576594.599:181668): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576594.599:181668): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576594.599:181668): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576594.599:181668): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576594.599:181668): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576599.882:181669): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d9ff88 a1=7fc228d9c408 a2=7fc228d9c420 a3=7fffc1bf5590 items=5 ppid=7231 pid=11729 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576599.882:181669): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576599.882:181669): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576599.882:181669): cwd="/srv/jfgi" type=PATH msg=audit(1317576599.882:181669): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576599.882:181669): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576599.882:181669): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576599.882:181669): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576599.882:181669): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.196:181670): arch=c000003e syscall=59 success=yes exit=0 a0=7f8b3f124c58 a1=7fff49504bb0 a2=7f8b3f326ef0 a3=0 items=3 ppid=11730 pid=11731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.196:181670): argc=3 a0="/sbin/unix_chkpwd" a1="root" a2="chkexpiry" type=CWD msg=audit(1317576601.196:181670): cwd="/" type=PATH msg=audit(1317576601.196:181670): item=0 name="/sbin/unix_chkpwd" inode=72011 dev=fc:02 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 type=PATH msg=audit(1317576601.196:181670): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.196:181670): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_ACCT msg=audit(1317576601.209:181671): user pid=11730 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_ACQ msg=audit(1317576601.209:181672): user pid=11730 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=LOGIN msg=audit(1317576601.212:181673): login pid=11730 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=320 type=USER_START msg=audit(1317576601.217:181674): user pid=11730 uid=0 auid=0 ses=320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=CRED_REFR msg=audit(1317576601.217:181675): user pid=11730 uid=0 auid=0 ses=320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576601.225:181676): arch=c000003e syscall=59 success=yes exit=0 a0=208cc86 a1=7fff494c2a60 a2=208cda0 a3=8 items=3 ppid=11730 pid=11732 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.225:181676): argc=3 a0="/bin/sh" a1="-c" a2="/usr/local/bin/tiki_cleanup.sh" type=CWD msg=audit(1317576601.225:181676): cwd="/root" type=PATH msg=audit(1317576601.225:181676): item=0 name="/bin/sh" inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576601.225:181676): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.225:181676): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.258:181677): arch=c000003e syscall=59 success=yes exit=0 a0=fcfb90 a1=fcfbf0 a2=fcec30 a3=0 items=5 ppid=11730 pid=11732 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="tiki_cleanup.sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.258:181677): argc=2 a0="/bin/sh" a1="/usr/local/bin/tiki_cleanup.sh" type=EXECVE msg=audit(1317576601.258:181677): argc=1 a0="/bin/sh" type=CWD msg=audit(1317576601.258:181677): cwd="/root" type=PATH msg=audit(1317576601.258:181677): item=0 name="/usr/local/bin/tiki_cleanup.sh" inode=492556 dev=fc:02 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.258:181677): item=1 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576601.258:181677): item=2 name=(null) inode=70828 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576601.258:181677): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.258:181677): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.336:181678): arch=c000003e syscall=59 success=yes exit=0 a0=24ca5d0 a1=24cafe0 a2=24c8bb0 a3=27 items=3 ppid=11732 pid=11733 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.336:181678): argc=309 a0="/bin/rm" a1="-f" a2="/tmp/sess_004u8nb6b4erl8d8o036mh5t66" a3="/tmp/sess_05qfgh9ab9ogl7ikh9rpis1c57" a4="/tmp/sess_05uufneaplatna2sd1u13dh646" a5="/tmp/sess_078slpdnru53hl28p54ud9l2a7" a6="/tmp/sess_07b0cllam2clna0io4ipg72v13" a7="/tmp/sess_090in751efd2ca395lplphhtd2" a8="/tmp/sess_0a9jbkrhggnotsarhutk45e217" a9="/tmp/sess_0bgemvttl31dovu270hbppdji7" a10="/tmp/sess_0et9mq599kb8tmofu41t1cth95" a11="/tmp/sess_0of4rojp5kc6kqrnqqdct3bjj0" a12="/tmp/sess_0selnl4ru7avgvhhjjafsc06q5" a13="/tmp/sess_0snv5vlje4e8m1p4pmm1voheu2" a14="/tmp/sess_10fvepi7gcviqalbsvsjiubau6" a15="/tmp/sess_11839o38b17fg8mtrdhko55qi5" a16="/tmp/sess_11le6rqaotu32hhh69ha6a6ne1" a17="/tmp/sess_11qgvcd3nfemd50cqsqksfmbt6" a18="/tmp/sess_12rojsubfl93lbkplhvs3vnp27" a19="/tmp/sess_176vn7pprmuu744h83onofset3" a20="/tmp/sess_19beel086uuf1mi5lskjv5m3n3" a21="/tmp/sess_1c7odngg5dhgh3j03aekogo5m3" a22="/tmp/sess_1h7024ohjpiaisufmg932aq9o5" a23="/tmp/sess_1hsh75dhuh0enrj65mdvsokrh1" a24="/tmp/sess_1m49nvgoih9e6g3324svpf9612" a25="/tmp/sess_1pg41cqh2qdvcpb8na6cagic14" a26="/tmp/sess_1td3br2imqdapqj94i8gceibr3" a27="/tmp/sess_20cmm1sdk07o81ddsrjhg3nep2" a28="/tmp/sess_21b3rhqjrap8fkh7274std9cg5" a29="/tmp/sess_24k6236kabf83ubudqo658gpv4" a30="/tmp/sess_27v0ef58n82crspoi76ggiblb3" a31="/tmp/sess_2l7urddqdap6qkd5ldhjjaago4" a32="/tmp/sess_2l8cjeqrn0i69qn0oqm172sal6" a33="/tmp/sess_2r0f1eunpmmrcchl6pjuk2lae5" a34="/tmp/sess_30pffnoukr2mphvv0savontni7" a35="/tmp/sess_30q7guhf912vue4cpbv4kfa0l0" a36="/tmp/sess_32itbs3oko0k14maipqt38sm61" a37="/tmp/sess_34c95qn86irpjmrsph4thlbtd1" a38="/tmp/sess_368ihma13fnl8h9bgmkok5cpb0" a39="/tmp/sess_3c1b5v70dl113i094rm14m30c0" a40="/tmp/sess_3enks16bgkdocqgrpkd1regcp3" a41="/tmp/sess_3gueoe4hcg1muskl1qq87b4ma7" a42="/tmp/sess_3ipc7tnva9ro265kmb7leck8k3" a43="/tmp/sess_3kigavumrc472i3b8kmmrog2h1" a44="/tmp/sess_3me8c4rpkpfvtdn4mmi1kanuu4" a45="/tmp/sess_3onbs9pl6cqhl9lssc3tm8p3p6" a46="/tmp/sess_412sfciruqj9vc6ihtrbqesuv6" a47="/tmp/sess_42r3fv31aesnukbir58khduml2" a48="/tmp/sess_43m82j3ikj0lopbs25b1l5otd5" a49="/tmp/sess_4am59giv1v4bp81bkbv4d6v1n3" a50="/tmp/sess_4dk2god2gv960kdr03kg4g8770" a51="/tmp/sess_4g3hva7o8m862jg28lkitspd76" a52="/tmp/sess_4guieppjdbj9mqst6ce8g6iff1" a53="/tmp/sess_4h28n7ovsq3m01jmlcivrtjph5" a54="/tmp/sess_4i8inr2gtvnmjk66vt5s1b7t23" a55="/tmp/sess_4kgkfhr9438bdnkvvs2fp7htb2" a56="/tmp/sess_4ovl692o3nt2hms1rvbgkgkj43" a57="/tmp/sess_4pifsqgh3l9l8ih2n8iidppbg5" a58="/tmp/sess_4q9h1jtp20cab28je5t8rvnnq3" a59="/tmp/sess_4u3pp7ermeav34mnnojmm1gh93" a60="/tmp/sess_594ask3khsgsmac6dosav5afl2" a61="/tmp/sess_5ae69d6d9gd7kn4mj2t23lnk04" a62="/tmp/sess_5g3c2nf6q8fj7nngbsnqp483v1" a63="/tmp/sess_5hf4sk11e6lsmja5s9jn1t0hc4" a64="/tmp/sess_5l74jp2lo3nm4l6ogl3au74744" a65="/tmp/sess_5o5dj0662rqcd1l9a6h4ou60g7" a66="/tmp/sess_5p66bbm4b1kn4924kta27ssgh2" a67="/tmp/sess_5p9agh6bhqr6u3n32t9carqmc1" a68="/tmp/sess_5si7rcd1u1n6itmjp63l8ghh31" a69="/tmp/sess_646f82e927cf1c3297e55c88dedab729" a70="/tmp/sess_6bhkp2n78gk5ct44287ucc2if7" a71="/tmp/sess_6c4u9707vrmp3nobccpvva0aa3" a72="/tmp/sess_6kfhvtl0kao76mpmbob4sriil7" a73="/tmp/sess_6ki4cs60vfm9952nvq9fupvcn7" a74="/tmp/sess_6mul3ei7la29j9vd68ar080m84" a75="/tmp/sess_6u2rslbra36k4q9581nr1ttto2" a76="/tmp/sess_77v056j0edu428gpnnqv3kcf36" a77="/tmp/sess_7bc52t5vkjjg8coe7qk7ir1784" a78="/tmp/sess_7jjfbo9flegt0ib149rv5sf0b6" a79="/tmp/sess_7m2bo1v6hk692uh9uk2hecs0k0" a80="/tmp/sess_7nniimijkp322gaoaa86noi0s2" a81="/tmp/sess_7nue5eer1nlp3qiq7g4d6a2nk3" a82="/tmp/sess_7o7hbpugileip5246p04d2rf94" a83="/tmp/sess_7obj767a4de4cvmgi7unltadi4" a84="/tmp/sess_7ucjdf3oepsvelrl44u4t3nd13" a85="/tmp/sess_805oj808arj2266tnu37557n71" a86="/tmp/sess_867u0cn8mo8tpk583e12ebibj4" a87="/tmp/sess_86q1v1jv203vqge1b0s6a66hf3" a88="/tmp/sess_87ea73op1274hu74mjbalvofr6" a89="/tmp/sess_8esqojpgrg11157edk7t0h5q12" a90="/tmp/sess_8f4jpmcun76h65uilme07me0h0" a91="/tmp/sess_8feeb6b59ptrsm2d3m3ep9l0u0" a92="/tmp/sess_8fuostddgpsnqhfo25if041c25" a93="/tmp/sess_8mf4hk56rdnloun83kqhe3s6h7" a94="/tmp/sess_8t0cr4m2v8honahq9skft5mlt5" a95="/tmp/sess_8u3h9pc6cia196jp2sk976j6q4" a96="/tmp/sess_96rv25jviqucga949l75mr21m1" a97="/tmp/sess_9bf5l0sh3id5gavah4o68gj2h4" a98="/tmp/sess_9i6v1dj1qv0sotr4vjd0eblju0" a99="/tmp/sess_9kck5ieppursjaisbe6vtq6566" a100="/tmp/sess_9ofd3509aido1390rhsdddbke1" a101="/tmp/sess_9otiolfvepcv93m231ofhoh605" a102="/tmp/sess_9r8h8l8c4ad75oat9or5c5d064" a103="/tmp/sess_9trda2gcr1jq6398heplvrrgk6" a104="/tmp/sess_a3uugjhcbdpnv417qaljb5jev7" a105="/tmp/sess_a4bgf5q5pl7o10tiv64mqk02o6" a106="/tmp/sess_ai9vifsr2kmdkkugoskm8tb3g1" a107="/tmp/sess_ako8it0aq2orm89dqq2kl5c8v6" a108="/tmp/sess_b1nt9f8bopg6qo7ucr8s2l2022" a109="/tmp/sess_bagdm75d0qe5j25mp7i0gcpo17" a110="/tmp/sess_bfm11gt1ua5oj36kna53fpivu7" a111="/tmp/sess_bilmiul159bfih2eucco3d6m86" a112="/tmp/sess_bo7sgsana5j1gllhisvqta54b0" a113="/tmp/sess_bp7s28b5m019hd11a67srasvb0" a114="/tmp/sess_c154e439afoteneke1pqalp8r5" a115="/tmp/sess_c1qrq7p4gbte3e0prbli196h52" a116="/tmp/sess_c21rsiu126jva1p1173nlv0d47" a117="/tmp/sess_c40h1dhhdh9mitifmlvmnevd85" a118="/tmp/sess_cbbu6oiv6rimu6co4n4br4tuk1" a119="/tmp/sess_cbmct453grdjthclqmb85chpr5" a120="/tmp/sess_ccbvls8somd1i20s77mn2e6rf5" a121="/tmp/sess_ce3iddknhua98op7m6v3vc3gc7" a122="/tmp/sess_cj9765ovtdsksrnfdbtal7hi63" a123="/tmp/sess_ck6ekbob70dmaomlb9h20qlve1" a124="/tmp/sess_cr79nqnhft4pstdmsrrvuquva5" a125="/tmp/sess_d0o149li41h0puhi693plgesj4" a126="/tmp/sess_d2lo7c6g6n6ipb54r6n7dqhpf3" a127="/tmp/sess_d6fhfkksp9pd85r13o2suir322" a128="/tmp/sess_d89fqe7tn0nuvqeri3akfe4vm2" a129="/tmp/sess_dai0bo074rr0d9esdjgplgmh52" a130="/tmp/sess_dgv5rursj4f60k4j8ojq888dn3" a131="/tmp/sess_dlrs9u8d4hredb9iidktgblvt3" a132="/tmp/sess_doh7si5kf24rq0p5dmf7o7ihg3" a133="/tmp/sess_ds2nk2qlk402dcggvv3ds55oh2" a134="/tmp/sess_e1ljhe82vifj2phqe86ja67a16" a135="/tmp/sess_e9jjdum560k1rp53j7cfen2ru6" a136="/tmp/sess_efbtonnek8s5i48t3jglrksmf5" a137="/tmp/sess_efcicpa2v25c9jmsp3v8chbsl0" a138="/tmp/sess_ehq0of31t399cpa1k8fn18o957" a139="/tmp/sess_elhtbpftnf54g1arj0ta3o3650" a140="/tmp/sess_eq01ualr3jkrktvp1ei2h447h7" a141="/tmp/sess_etq0rv0s2nmoo3qaktrmlut005" a142="/tmp/sess_f1n7v40rmaibfqtd9arhi35qf4" a143="/tmp/sess_f3gqvt1tt232na2p3i3jsmt660" a144="/tmp/sess_f8543rrtmusrv2pmeerku60b55" a145="/tmp/sess_f8meopqie0ubs8687qevphbar4" a146="/tmp/sess_fcvkqpup71vruscnl8q1ltp8u2" a147="/tmp/sess_fge5gb4lnt4v58t5g50afjvj21" a148="/tmp/sess_fhtvk6lqoj57nsudlgn435usd6" a149="/tmp/sess_fmvm5ag9q5kg8ovbvdst39mlg6" a150="/tmp/sess_fojbds0hf9eotuis1bj33fdia7" a151="/tmp/sess_fpodtleu7cn0ndbcfladqf48q0" a152="/tmp/sess_fqdjp412cffqr95j29cigevm36" a153="/tmp/sess_fqrgf61jceevtumtjcgaft15h0" a154="/tmp/sess_fujn3g8tdlcknotk401dbh1on7" a155="/tmp/sess_g8c7c9308rdqpib8ooar4u3et4" a156="/tmp/sess_g8dc3noju8lrldpgs5u6skos44" a157="/tmp/sess_gibkleoacq05q75h7jthfbklv2" a158="/tmp/sess_gopeo05miq379rjt0hbvq58c73" a159="/tmp/sess_gvgqo42gom1trfuvq8pc9juch5" a160="/tmp/sess_h04mo4smshit5apah6o0s7ucu0" a161="/tmp/sess_h1dnokmimk705df4l4bci6vsh2" a162="/tmp/sess_h1mkpe9ir41ubqpa0pu29mfs71" a163="/tmp/sess_hgdvuk4jjv32cj1hd8ecdmhi05" a164="/tmp/sess_hhcoc0o79pn49uutnooql61ce4" a165="/tmp/sess_hn3e0pbrvvd9t03mcmjfddv6s7" a166="/tmp/sess_i151ht4li8bvn5jhh9qo2uj755" a167="/tmp/sess_i2m0hj9eia5ne079c8gssv7766" a168="/tmp/sess_i5gntfvmv504mloj80tvhvn9b3" a169="/tmp/sess_i6qt22i66id1g1gmpdv0ln4k15" a170="/tmp/sess_i97t3lgo1jegtm26vuck4sp2s6" a171="/tmp/sess_iaqo10orh1c807p6ssemf5a3r1" a172="/tmp/sess_id4ntu65m4v69t9dfi1o8mbfo4" a173="/tmp/sess_idlhh28daeiv239es85gc9kmg4" type=EXECVE msg=audit(1317576601.336:181678): a174="/tmp/sess_ilgmhu9i3spk5s6729cuiqkph6" a175="/tmp/sess_jat8s293api0nfblm78bsaknk7" a176="/tmp/sess_jbmmhoopu6g9gck25v5op01h27" a177="/tmp/sess_jee9lneu6sfgdcghgtv1j5kqn7" a178="/tmp/sess_jhgqauuuq5j87va6f7hnsdpme4" a179="/tmp/sess_jqf622dpdqrmeqa54ls0unimo7" a180="/tmp/sess_jrips7i3u1t8p5c4m98j3cjkd2" a181="/tmp/sess_jsfraoi0ujoi7em3h33i26bef2" a182="/tmp/sess_juq0en7sf0ad815ros2tjhmaq5" a183="/tmp/sess_k35ur5k67523g0sm9dhjcp0827" a184="/tmp/sess_k3f7aamie4k7bd6km9sdbckql6" a185="/tmp/sess_k3qglqpao5rbpkrilq61jtlm72" a186="/tmp/sess_k4splds2os61ut7hbd6r3iimh2" a187="/tmp/sess_k5ks1tr8cq0ar4nc0tkkspqjp5" a188="/tmp/sess_kacqnh3db3qcl54nfbhs8r7a41" a189="/tmp/sess_kas092ihtqucvhv2lnf42aeon6" a190="/tmp/sess_kgpb1nvk9inj0t0dkm0p66fho5" a191="/tmp/sess_kjop8m4e1afv1sl7ci2n8esue3" a192="/tmp/sess_kk3p98jffdvjbin7p7m0g1p3k3" a193="/tmp/sess_km3i0cqeqvog5is9j9hs1umpt5" a194="/tmp/sess_kpcqkld1om7gv3tsomgde1ffa4" a195="/tmp/sess_l3lflr15u5o4qvhig6tapj5fq4" a196="/tmp/sess_l44n7j4lr3j5tg7p97quhsi3q5" a197="/tmp/sess_l4eqhv7u876smecmj7rf6a2124" a198="/tmp/sess_l4mq36fg1lkms3uc17o1kddn40" a199="/tmp/sess_l5al0anpdloom189tuvh78gfc2" a200="/tmp/sess_luvan052j3levkh9v7sno9ucq4" a201="/tmp/sess_lvdk7tlqr691061q6aaomgf8v3" a202="/tmp/sess_m1c5rqegju9sl0m2mj2q9n6n35" a203="/tmp/sess_m5kf8trjkj85to7o7kgm0udn57" a204="/tmp/sess_m7g9u2hai7juj5pudf4n6rdm91" a205="/tmp/sess_m7omtnii63iommmimpdgp6nb34" a206="/tmp/sess_mbotblhvqsn8blqka1jilorl55" a207="/tmp/sess_mdq6qb72lbf5c04aibeua2g304" a208="/tmp/sess_mfh10v81epg5d773ih916pd7q4" a209="/tmp/sess_mhrlp4nf8ln18mnc0cmepaccd3" a210="/tmp/sess_mlf87knv064mteirlv29h7t6l0" a211="/tmp/sess_mlkm4n812ecmije2asjb22psf5" a212="/tmp/sess_mq4icicbjv5o771js55oafnb00" a213="/tmp/sess_mtpqvri34tna3d90b8dfgepur0" a214="/tmp/sess_n02c7h7dlj1918dkva0p7rdel5" a215="/tmp/sess_n7p90lh89pm1bdib8sid34af80" a216="/tmp/sess_n87f8qj6eeg1pl2rlf53suovo0" a217="/tmp/sess_nadun56i553fof7hv0st8c8tg0" a218="/tmp/sess_nlavdb9a6hpp8psbi9t4p90m52" a219="/tmp/sess_nqddgftd5rha4coqk6ogj49dd2" a220="/tmp/sess_nr5ukln8m05ols0n99tn96qbp1" a221="/tmp/sess_nrl2sc1ngvv2vpkheuhfm6qpv7" a222="/tmp/sess_nuppodebv35k2d6vs5cf1g89a1" a223="/tmp/sess_o1snvqq91en332akhp66puk5p5" a224="/tmp/sess_o257j83el7tq6t9g7pk0o2qja4" a225="/tmp/sess_o7febtq4hag4c9ao3lp2a4vaj1" a226="/tmp/sess_o91flera91d0uatpod38o4enh7" a227="/tmp/sess_o99ae4k3jfl8m76vm4mjpfetl3" a228="/tmp/sess_oct2jgj862e9i3mpq7bsif3p06" a229="/tmp/sess_ocv95p7eg5blshh799t8h9g677" a230="/tmp/sess_oec2rea038b2eh6m18o08i4ga6" a231="/tmp/sess_ofoava2r34s3vs8uol9t79icf4" a232="/tmp/sess_oga2ap44sgv2bgin18lnfjc572" a233="/tmp/sess_ommhc7lgtanc8sjve39ggg2qq6" a234="/tmp/sess_op0s37krutafumddb42v0911o2" a235="/tmp/sess_or025htqcsl1cise5r12enb8h0" a236="/tmp/sess_ovtupqja5vbohs70t6t231a537" a237="/tmp/sess_p2fdeovk5usek6ep4bhsp37fn3" a238="/tmp/sess_p2u4tuvnbiv6tv5jasjj6bbii4" a239="/tmp/sess_p33d7rm8l1hhqo3gruos77h684" a240="/tmp/sess_p3537rfp1to41c7ee2rguq4e64" a241="/tmp/sess_p6186oeub2ssushh53dctm6d61" a242="/tmp/sess_p75hmhmn9u35jned97q8ldjo13" a243="/tmp/sess_paljd9tqmrepfe03eidudpfhm5" a244="/tmp/sess_pg0vraj10e148gd95ge23l84d5" a245="/tmp/sess_ph4002qh1ddr00uq16nosdefj5" a246="/tmp/sess_piq3mvvonh1rhcrt2j38oucds0" a247="/tmp/sess_pkdf06rdpmtdv79rc6c06cn4a4" a248="/tmp/sess_pqretb7380fa6olblhhhcf8v13" a249="/tmp/sess_q05dqul9g7ul6i100fg41tmqs5" a250="/tmp/sess_q2emavgj4tgoet0e0p4a8f21a0" a251="/tmp/sess_qaa5hckfmpub300ofssjqjkon7" a252="/tmp/sess_qcffsq3terpjh19flqs2ee63c2" a253="/tmp/sess_qdj9v3d7bdnqldsir3kcfsih70" a254="/tmp/sess_qi646unevp0q79cgubp5vp4bm5" a255="/tmp/sess_qjo1ll2nmf49a83u0jt1fqhi52" a256="/tmp/sess_qnt6ssfkrph9pnu39vu3b11s87" a257="/tmp/sess_qntdb3ddr1ai6bpmfd0v4hnmu1" a258="/tmp/sess_r3adc3bllsh85s5l0e6mh9oar1" a259="/tmp/sess_r75c5e3u805mhdgg865ulm3752" a260="/tmp/sess_r9saa094et1esnlc90po6lbap0" a261="/tmp/sess_rad8j3lou22i7l4lqm6ivhkea7" a262="/tmp/sess_rcbt8fdcm2ka9d5prp4n448p56" a263="/tmp/sess_reinel5ui3ja0v1tje4r5p5720" a264="/tmp/sess_rhmaijoq9tsj10umhqpr68o114" a265="/tmp/sess_rig0omr2u3hee0c5j1ctm7c8f7" a266="/tmp/sess_rlncq4sqb229te9ej7on0sbjq5" a267="/tmp/sess_rmhkk5n1kmvpnk9vifeainpjh6" a268="/tmp/sess_rndd7lljvd4s9lmhg465gs6rt4" a269="/tmp/sess_rnrpkq69s2e1mojhf2k9u3d1k7" a270="/tmp/sess_rt4do0r1l0v760qvniqi0t1es5" a271="/tmp/sess_rv02ocrqtn85f5pi076ss9gi66" a272="/tmp/sess_rvr36ffusbqhvdnmqn0d4rlp93" a273="/tmp/sess_s3u2livi5vb1qpugdh0q3jb2l2" a274="/tmp/sess_s4fml1feqj4tml3qrl3h4au6j3" a275="/tmp/sess_s4uno50s22s3uag5igdl7eule3" a276="/tmp/sess_s694k49d5qouolq7dlnlsb90h1" a277="/tmp/sess_sai8raff3kv3b2kee73688u1q6" a278="/tmp/sess_sba91g2u2l5g9dauda2agdqfo4" a279="/tmp/sess_senba8afgdkkmap4ri4ouh0jv2" a280="/tmp/sess_serce5hu612mgqvkd49r1596k1" a281="/tmp/sess_sf38omn3hbq31vdrpnam1irid2" a282="/tmp/sess_shm6476n2crj1t9p4ulrsi3qt4" a283="/tmp/sess_sivs5qqoac7o1l6k5npahc91p2" a284="/tmp/sess_sp65d1d73ts4ulc83futp6ocd7" a285="/tmp/sess_sv2sccr7r0t7tn3ra6bnh7sjl2" a286="/tmp/sess_svp2bbd2g8439j6jsdc84b7tv7" a287="/tmp/sess_t1947b6lj19p7722t49gg2m9c5" a288="/tmp/sess_t4ndcqs3prtd39hu6n50k0m7f3" a289="/tmp/sess_t4rpif0tlp0pse1gf7ed9gcd21" a290="/tmp/sess_t87e0cpf14ghd8jv9i841haqt3" a291="/tmp/sess_ten6kko7jcq43t7h0eu8mvjsl2" a292="/tmp/sess_tfsgs63ugsi4oq4ng8bn6t4rm3" a293="/tmp/sess_tg8m4u257aj9h1hvesph1asth1" a294="/tmp/sess_th1qddbie1defqjf6j1er5fnv6" a295="/tmp/sess_thnfq99d4lu7tlqfn5c9q03us6" a296="/tmp/sess_tht4vlhisfaft8ftf9fh0fksa3" a297="/tmp/sess_thualnmsaehs81a0qha554elo4" a298="/tmp/sess_tqusg51qddpm1sh21q8p5npur0" a299="/tmp/sess_u4lj1blurr7ftkakob2es9f257" a300="/tmp/sess_u6otj1hgk9s4co7aogkojpqmr5" a301="/tmp/sess_u74or5jjlegdlse66seckn4uu1" a302="/tmp/sess_u792hm4feekqlmrf22e3999od0" a303="/tmp/sess_ucmqcrartq8jj2srgbk27gj6n6" a304="/tmp/sess_v0uf4pbddft8cvqj2mjpsc5080" a305="/tmp/sess_vab243vq6ohej686s20c3d9g95" a306="/tmp/sess_vbhmtu5fge0r13qmv66sfb0l36" a307="/tmp/sess_vdp6t9g0rseg0maght2ap0sp77" a308="/tmp/sess_vgpk8mmsaegbv0e427u4clfok7" type=CWD msg=audit(1317576601.336:181678): cwd="/root" type=PATH msg=audit(1317576601.336:181678): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.336:181678): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.336:181678): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.365:181679): arch=c000003e syscall=59 success=yes exit=0 a0=24d69c0 a1=24d6ae0 a2=24cb110 a3=0 items=3 ppid=11732 pid=11735 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="xargs" exe="/usr/bin/xargs" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.365:181679): argc=3 a0="/usr/bin/xargs" a1="/bin/rm" a2="-rf" type=CWD msg=audit(1317576601.365:181679): cwd="/root" type=PATH msg=audit(1317576601.365:181679): item=0 name="/usr/bin/xargs" inode=73375 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.365:181679): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.365:181679): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.369:181680): arch=c000003e syscall=59 success=yes exit=0 a0=24d6970 a1=24c8c90 a2=24cb110 a3=1 items=3 ppid=11732 pid=11734 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="find" exe="/bin/find" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.369:181680): argc=5 a0="find" a1="/tmp/??" a2="-prune" a3="-type" a4="d" type=CWD msg=audit(1317576601.369:181680): cwd="/root" type=PATH msg=audit(1317576601.369:181680): item=0 name="/usr/bin/find" inode=70860 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.369:181680): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.369:181680): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.392:181681): arch=c000003e syscall=59 success=yes exit=0 a0=7f96e7560010 a1=1ff0240 a2=7fffd1b4d388 a3=7f96ed9c49f0 items=3 ppid=11735 pid=11736 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.392:181681): argc=2 a0="/bin/rm" a1="-rf" type=CWD msg=audit(1317576601.392:181681): cwd="/root" type=PATH msg=audit(1317576601.392:181681): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.392:181681): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.392:181681): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.408:181682): arch=c000003e syscall=59 success=yes exit=0 a0=24c8a90 a1=24d6d10 a2=24cb110 a3=0 items=3 ppid=11732 pid=11737 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.408:181682): argc=3 a0="/bin/rm" a1="-rf" a2="/tmp/v??????" type=CWD msg=audit(1317576601.408:181682): cwd="/root" type=PATH msg=audit(1317576601.408:181682): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.408:181682): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.408:181682): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.416:181683): arch=c000003e syscall=59 success=yes exit=0 a0=24ca5d0 a1=24cf540 a2=24cb110 a3=0 items=3 ppid=11732 pid=11738 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.416:181683): argc=3 a0="/bin/rm" a1="-rf" a2="/tmp/values.*" type=CWD msg=audit(1317576601.416:181683): cwd="/root" type=PATH msg=audit(1317576601.416:181683): item=0 name="/bin/rm" inode=70915 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.416:181683): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.416:181683): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.423:181684): arch=c000003e syscall=59 success=yes exit=0 a0=24cb6b0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11739 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.423:181684): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki" a4="--password=gVyof2u2WM96KSXR" a5="tiki" a6="-e" a7=64656C6574652066726F6D2073657373696F6E7320776865726520657870697279203C20554E49585F54494D455354414D5028293B type=CWD msg=audit(1317576601.423:181684): cwd="/root" type=PATH msg=audit(1317576601.423:181684): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.423:181684): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.423:181684): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.876:181685): arch=c000003e syscall=59 success=yes exit=0 a0=24ceb20 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11741 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.876:181685): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki" a4="--password=gVyof2u2WM96KSXR" a5="tiki" a6="-e" a7=7472756E636174652074696B695F736561726368696E6465783B type=CWD msg=audit(1317576601.876:181685): cwd="/root" type=PATH msg=audit(1317576601.876:181685): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.876:181685): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.876:181685): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.935:181686): arch=c000003e syscall=59 success=yes exit=0 a0=24cb7f0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11743 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.935:181686): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki" a4="--password=gVyof2u2WM96KSXR" a5="tiki" a6="-e" a7=7472756E636174652074696B695F73746174733B type=CWD msg=audit(1317576601.935:181686): cwd="/root" type=PATH msg=audit(1317576601.935:181686): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.935:181686): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.935:181686): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576601.985:181687): arch=c000003e syscall=59 success=yes exit=0 a0=24ce940 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11745 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576601.985:181687): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_dlp" a4="--password=Jdfoavihm0Kdtir6" a5="tiki_dlp" a6="-e" a7=64656C6574652066726F6D2073657373696F6E7320776865726520657870697279203C20554E49585F54494D455354414D5028293B type=CWD msg=audit(1317576601.985:181687): cwd="/root" type=PATH msg=audit(1317576601.985:181687): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576601.985:181687): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576601.985:181687): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.031:181688): arch=c000003e syscall=59 success=yes exit=0 a0=24ce980 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11747 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.031:181688): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_dlp" a4="--password=Jdfoavihm0Kdtir6" a5="tiki_dlp" a6="-e" a7=7472756E636174652074696B695F736561726368696E6465783B type=CWD msg=audit(1317576602.031:181688): cwd="/root" type=PATH msg=audit(1317576602.031:181688): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.031:181688): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.031:181688): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.085:181689): arch=c000003e syscall=59 success=yes exit=0 a0=24cbbf0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11749 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.085:181689): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_dlp" a4="--password=Jdfoavihm0Kdtir6" a5="tiki_dlp" a6="-e" a7=7472756E636174652074696B695F73746174733B type=CWD msg=audit(1317576602.085:181689): cwd="/root" type=PATH msg=audit(1317576602.085:181689): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.085:181689): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.085:181689): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.129:181690): arch=c000003e syscall=59 success=yes exit=0 a0=24cb630 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11751 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.129:181690): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_dlp" a4="--password=Jdfoavihm0Kdtir6" a5="tiki_dlp" a6="-e" a7=64656C6574652066726F6D2073657373696F6E7320776865726520657870697279203C20554E49585F54494D455354414D5028293B type=CWD msg=audit(1317576602.129:181690): cwd="/root" type=PATH msg=audit(1317576602.129:181690): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.129:181690): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.129:181690): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.178:181691): arch=c000003e syscall=59 success=yes exit=0 a0=24cb5b0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11753 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.178:181691): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_dlp" a4="--password=Jdfoavihm0Kdtir6" a5="tiki_dlp" a6="-e" a7=7472756E636174652074696B695F736561726368696E6465783B type=CWD msg=audit(1317576602.178:181691): cwd="/root" type=PATH msg=audit(1317576602.178:181691): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.178:181691): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.178:181691): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.223:181692): arch=c000003e syscall=59 success=yes exit=0 a0=24cbc50 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11755 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.223:181692): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_dlp" a4="--password=Jdfoavihm0Kdtir6" a5="tiki_dlp" a6="-e" a7=7472756E636174652074696B695F73746174733B type=CWD msg=audit(1317576602.223:181692): cwd="/root" type=PATH msg=audit(1317576602.223:181692): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.223:181692): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.223:181692): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.267:181693): arch=c000003e syscall=59 success=yes exit=0 a0=24cbcd0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11757 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.267:181693): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_gaming" a4="--password=eEhrBcEz" a5="tiki_gaming" a6="-e" a7=64656C6574652066726F6D2073657373696F6E7320776865726520657870697279203C20554E49585F54494D455354414D5028293B type=CWD msg=audit(1317576602.267:181693): cwd="/root" type=PATH msg=audit(1317576602.267:181693): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.267:181693): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.267:181693): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.311:181694): arch=c000003e syscall=59 success=yes exit=0 a0=24cebb0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11759 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.311:181694): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_gaming" a4="--password=eEhrBcEz" a5="tiki_gaming" a6="-e" a7=7472756E636174652074696B695F736561726368696E6465783B type=CWD msg=audit(1317576602.311:181694): cwd="/root" type=PATH msg=audit(1317576602.311:181694): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.311:181694): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.311:181694): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.336:181695): arch=c000003e syscall=59 success=yes exit=0 a0=24cbc90 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11761 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.336:181695): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_gaming" a4="--password=eEhrBcEz" a5="tiki_gaming" a6="-e" a7=7472756E636174652074696B695F73746174733B type=CWD msg=audit(1317576602.336:181695): cwd="/root" type=PATH msg=audit(1317576602.336:181695): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.336:181695): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.336:181695): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.360:181696): arch=c000003e syscall=59 success=yes exit=0 a0=24cbd30 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11763 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.360:181696): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_rlp" a4="--password=iHLKGDfg" a5="tiki_rlp" a6="-e" a7=64656C6574652066726F6D2073657373696F6E7320776865726520657870697279203C20554E49585F54494D455354414D5028293B type=CWD msg=audit(1317576602.360:181696): cwd="/root" type=PATH msg=audit(1317576602.360:181696): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.360:181696): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.360:181696): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.390:181697): arch=c000003e syscall=59 success=yes exit=0 a0=24ce940 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11765 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.390:181697): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_rlp" a4="--password=iHLKGDfg" a5="tiki_rlp" a6="-e" a7=7472756E636174652074696B695F736561726368696E6465783B type=CWD msg=audit(1317576602.390:181697): cwd="/root" type=PATH msg=audit(1317576602.390:181697): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.390:181697): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.390:181697): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.422:181698): arch=c000003e syscall=59 success=yes exit=0 a0=24cbcf0 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11767 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.422:181698): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_rlp" a4="--password=iHLKGDfg" a5="tiki_rlp" a6="-e" a7=7472756E636174652074696B695F73746174733B type=CWD msg=audit(1317576602.422:181698): cwd="/root" type=PATH msg=audit(1317576602.422:181698): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.422:181698): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.422:181698): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.552:181699): arch=c000003e syscall=59 success=yes exit=0 a0=24cbd90 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11769 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.552:181699): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_robin" a4="--password=4uQRy5PE" a5="tiki_robin" a6="-e" a7=64656C6574652066726F6D2073657373696F6E7320776865726520657870697279203C20554E49585F54494D455354414D5028293B type=CWD msg=audit(1317576602.552:181699): cwd="/root" type=PATH msg=audit(1317576602.552:181699): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.552:181699): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.552:181699): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.574:181700): arch=c000003e syscall=59 success=yes exit=0 a0=24ce980 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11771 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.574:181700): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_robin" a4="--password=4uQRy5PE" a5="tiki_robin" a6="-e" a7=7472756E636174652074696B695F736561726368696E6465783B type=CWD msg=audit(1317576602.574:181700): cwd="/root" type=PATH msg=audit(1317576602.574:181700): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.574:181700): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.574:181700): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576602.600:181701): arch=c000003e syscall=59 success=yes exit=0 a0=24cbd50 a1=24ca2d0 a2=24cb110 a3=8 items=3 ppid=11732 pid=11773 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=320 comm="mysql" exe="/usr/bin/mysql" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="64bit_execs" type=EXECVE msg=audit(1317576602.600:181701): argc=8 a0="/usr/bin/mysql" a1="-h" a2="morji" a3="--user=tiki_robin" a4="--password=4uQRy5PE" a5="tiki_robin" a6="-e" a7=7472756E636174652074696B695F73746174733B type=CWD msg=audit(1317576602.600:181701): cwd="/root" type=PATH msg=audit(1317576602.600:181701): item=0 name="/usr/bin/mysql" inode=72705 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576602.600:181701): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576602.600:181701): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=CRED_DISP msg=audit(1317576602.625:181702): user pid=11730 uid=0 auid=0 ses=320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=USER_END msg=audit(1317576602.627:181703): user pid=11730 uid=0 auid=0 ses=320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' type=SYSCALL msg=audit(1317576607.844:181704): arch=c000003e syscall=59 success=yes exit=0 a0=7fc228d9ff88 a1=7fc228d9c310 a2=7fc228d9c328 a3=7fffc1bf5590 items=5 ppid=7316 pid=11776 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="index.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_user_script_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576607.844:181704): argc=3 a0="/usr/bin/perl" a1="-w" a2="/srv/jfgi/index.pl" type=EXECVE msg=audit(1317576607.844:181704): argc=1 a0="/usr/bin/perl" type=CWD msg=audit(1317576607.844:181704): cwd="/srv/jfgi" type=PATH msg=audit(1317576607.844:181704): item=0 name="/srv/jfgi/index.pl" inode=154781 dev=fc:11 mode=0100755 ouid=48 ogid=48 rdev=00:00 obj=system_u:object_r:httpd_user_script_exec_t:s0 type=PATH msg=audit(1317576607.844:181704): item=1 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576607.844:181704): item=2 name=(null) inode=72888 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576607.844:181704): item=3 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576607.844:181704): item=4 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576614.695:181705): arch=c000003e syscall=59 success=yes exit=0 a0=7fffc5ffe0a0 a1=7f2e2b837e20 a2=1c9a880 a3=1c51940 items=3 ppid=9719 pid=11777 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=307 comm="sudo" exe="/usr/bin/sudo" subj=staff_u:staff_r:staff_sudo_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576614.695:181705): argc=5 a0="sudo" a1="scp" a2="/var/log/audit/audit.log.1" a3="/var/log/audit/audit.log" a4="rlpowell@users.teddyb.org:~/www/media/public" type=BPRM_FCAPS msg=audit(1317576614.695:181705): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=ffffffffffffffff new_pi=0000000000000000 new_pe=ffffffffffffffff type=CWD msg=audit(1317576614.695:181705): cwd="/home/rlpowell" type=PATH msg=audit(1317576614.695:181705): item=0 name="/usr/bin/sudo" inode=73257 dev=fc:02 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 type=PATH msg=audit(1317576614.695:181705): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576614.695:181705): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=USER_CMD msg=audit(1317576614.714:181706): user pid=11777 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='cwd="/home/rlpowell" cmd=736370202F7661722F6C6F672F61756469742F61756469742E6C6F672E31202F7661722F6C6F672F61756469742F61756469742E6C6F6720726C706F77656C6C4075736572732E7465646479622E6F72673A7E2F7777772F6D656469612F7075626C6963 terminal=pts/1 res=success' type=USER_ROLE_CHANGE msg=audit(1317576614.720:181707): user pid=11778 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='newrole: old-context=staff_u:staff_r:staff_t:s0 new-context=staff_u:unconfined_r:unconfined_t:s0: exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1317576614.729:181708): user pid=11778 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1317576614.730:181709): user pid=11778 uid=0 auid=1000 ses=307 subj=staff_u:staff_r:staff_sudo_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' type=SYSCALL msg=audit(1317576614.730:181710): arch=c000003e syscall=59 success=yes exit=0 a0=2abeae60a985 a1=7fff454746d8 a2=2abeae84f7b0 a3=726379656b2f7274 items=3 ppid=11777 pid=11778 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="sesh" exe="/usr/libexec/sesh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576614.730:181710): argc=5 a0="sesh" a1="/usr/bin/scp" a2="/var/log/audit/audit.log.1" a3="/var/log/audit/audit.log" a4="rlpowell@users.teddyb.org:~/www/media/public" type=CWD msg=audit(1317576614.730:181710): cwd="/home/rlpowell" type=PATH msg=audit(1317576614.730:181710): item=0 name="/usr/libexec/sesh" inode=392379 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 type=PATH msg=audit(1317576614.730:181710): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576614.730:181710): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576614.740:181711): arch=c000003e syscall=59 success=yes exit=0 a0=7f9d91f6d010 a1=7fffe4a47dd0 a2=7fffe4a47df8 a3=0 items=3 ppid=11777 pid=11778 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="scp" exe="/usr/bin/scp" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576614.740:181711): argc=4 a0="/usr/bin/scp" a1="/var/log/audit/audit.log.1" a2="/var/log/audit/audit.log" a3="rlpowell@users.teddyb.org:~/www/media/public" type=CWD msg=audit(1317576614.740:181711): cwd="/home/rlpowell" type=PATH msg=audit(1317576614.740:181711): item=0 name="/usr/bin/scp" inode=73181 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 type=PATH msg=audit(1317576614.740:181711): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576614.740:181711): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=SYSCALL msg=audit(1317576614.755:181712): arch=c000003e syscall=59 success=yes exit=0 a0=7f01bd8e3834 a1=7f01be7f81d0 a2=7fff9ce71310 a3=0 items=3 ppid=11778 pid=11779 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=307 comm="ssh" exe="/usr/bin/ssh" subj=staff_u:unconfined_r:unconfined_t:s0 key="64bit_execs" type=EXECVE msg=audit(1317576614.755:181712): argc=10 a0="/usr/bin/ssh" a1="-x" a2=2D6F466F72776172644167656E74206E6F a3=2D6F5065726D69744C6F63616C436F6D6D616E64206E6F a4=2D6F436C656172416C6C466F7277617264696E677320796573 a5="-l" a6="rlpowell" a7="--" a8="users.teddyb.org" a9=736370202D64202D74202D2D207E2F7777772F6D656469612F7075626C6963 type=CWD msg=audit(1317576614.755:181712): cwd="/home/rlpowell" type=PATH msg=audit(1317576614.755:181712): item=0 name="/usr/bin/ssh" inode=73244 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ssh_exec_t:s0 type=PATH msg=audit(1317576614.755:181712): item=1 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(1317576614.755:181712): item=2 name=(null) inode=71171 dev=fc:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0