<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Feb 11, 2014, at 11:17 PM, Shawn Wells <<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 2/11/14, 10:49 PM, Kayse, Josh
wrote:<br>
</div>
<blockquote cite="mid:23630C3E-2BE4-47C3-A9D8-9187E3F235C3@gtri.gatech.edu" type="cite"><br>
<div>
<div>On Feb 7, 2014, at 7:56 PM, Trevor Vaughan <<a moz-do-not-send="true" href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr">Josh,
<div><br>
</div>
<div>I haven't seen this happening.</div>
<div><br>
</div>
<div>Do you happen to have a cron job that is trying to do
something with sudo or su?</div>
<div><br>
</div>
<div>Trevor</div>
</div>
<div class="gmail_extra"><br>
</div>
</blockquote>
<div><br>
</div>
Unfortunately I don’t. Could you post your /etc/pam.d/cron
file?</div>
<div><br>
</div>
</blockquote>
<br>
$ cat /etc/pam.d/crond <br>
#<br>
# The PAM configuration file for the cron daemon<br>
#<br>
#<br>
# No PAM authentication called, auth modules not needed<br>
account required pam_access.so<br>
account include password-auth<br>
session required pam_loginuid.so<br>
session include password-auth<br>
auth include password-auth<br>
</div>
_______________________________________________<br>scap-security-guide mailing list<br><a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide<br></blockquote></div><br><div>I figured out why cron stopped working for me. If you disable the unconfined module it stops working. So I’ll open a bugzilla for that.</div><div><br></div><div>1. semodule -d unconfineduser unconfined</div><div><br></div><div>Actual results:</div><div>cron stops working with the following log and AVC generated</div><div><div>Feb 14 18:27:01 localhost crond[2673]: (root) FAILED to open PAM security session (Error in service module)</div></div><div><div>Feb 14 18:27:01 (null) (null): audit(1392431221.248:729): avc: denied { read write } for pid=2673 comm=crond name=lastlog ino=666024 dev=sda2 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lastlog_t:s0 tclass=file </div></div><div><br></div><div>Thanks for all the help.</div><div><br></div><div>-josh</div></body></html>