I have a test (virtual) machine running a 32-bit F9 OS.
My aggregating machine is a 64-bit F9 box.
source (32-bit machine) :
[EMAIL PROTECTED] ~]# ausearch -ts today -i -a 10038
----
node=v1 type=SYSCALL msg=audit(10/24/2008 11:11:59.162:10038) : arch=i386
syscall=socketcall(recv) success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0
items=0 ppid=1 pid=11761 auid=root uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=1 comm=prelude-manager
exe=/usr/bin/prelude-manager subj=system_u:system_r:prelude_t:s0-s15:c0.c1023
key=(null)
node=v1 type=AVC msg=audit(10/24/2008 11:11:59.162:10038) : avc: denied {
read } for pid=11761 comm=prelude-manager laddr=127.0.0.1 lport=4690
faddr=127.0.0.1 fport=36291
scontext=system_u:system_r:prelude_t:s0-s15:c0.c1023
tcontext=system_u:system_r:prelude_t:s15:c0.c1023 tclass=tcp_socket
aggregating machine (64-bit) :
[EMAIL PROTECTED] ~]# ausearch -ts today -i -a 10038
----
node=v1 type=SYSCALL msg=audit(10/24/2008 11:11:59.162:10038) : arch=i386
syscall=getuid success=yes exit=5 a0=a a1=bfcc1f80 a2=25b0c4 a3=0 items=0
ppid=1 pid=11761 auid=root uid=root gid=root euid=root suid=root fsuid=root
egid=root sgid=root fsgid=root tty=(none) ses=1 comm=prelude-manager
exe=/usr/bin/prelude-manager subj=system_u:system_r:prelude_t:s0-s15:c0.c1023
key=(null)
node=v1 type=AVC msg=audit(10/24/2008 11:11:59.162:10038) : avc: denied {
read } for pid=11761 comm=prelude-manager laddr=127.0.0.1 lport=4690
faddr=127.0.0.1 fport=36291
scontext=system_u:system_r:prelude_t:s0-s15:c0.c1023
tcontext=system_u:system_r:prelude_t:s15:c0.c1023 tclass=tcp_socket
Note that the syscall is listed differently.
This is using the 1.7.7 code (on F9), I have not yet moved over to 1.7.8
in case it may be fixed there.
Also, (at the latest) after F10 GA release I'll be migrating there.
Thx,
LCB.
--
LC (Lenny) Bruzenak
[EMAIL PROTECTED]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
