From e5f5befb74402e8a413ef70cf703f424b39aef9d Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Mon, 3 Apr 2017 08:38:47 -0400 Subject: [PATCH] Add fileset for parsing linux auditd logs (#3750) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PR adds and audit fileset to the system module for parsing logs from the auditd daemon. There is a sample dashboard for viewing this data. Features - Parses audit event type, unix epoch time, audit event counter, and the arbitrary key/value pairs that follow. - Applies geoip lookup to the `system.audit.addr` field which is present for some remote login events. - Decodes hex encoded ascii values that are sometimes used for the `system.audit.exe` and `system.audit.cmd` fields. - Remove key/value pairs where the value is `?`. Missing Features - Decoder for `system.audit.saddr` field present in SOCKADDR audit events. A recipe is described [here](https://unix.stackexchange.com/questions/102926/how-to-interpret-the-saddr-field-of-an-audit-log) and could probably be ported to painless. Sample value: `type=SOCKADDR msg=audit(1481078693.491:873): saddr=01002F7661722F72756E2F6E7363642F736F636B657400008983B330BE7F0000000000000000000070830130BE7F000004000000000000001B00000000000000D128B7ED000000008B8BB330BE7F00003B00000000000000403E4BF7FD7F0000447F0130BE7F000080150230BE7F` * Apply fileset overrides before checking enabled Disable other filesets in a module while testing. * Addressing review comments - Renamed system.audit.type to system.audit.record_type - Renamed system.audit.counter to system.audit.sequence - Dropped system.audit.epoch after parsing it into @timestamp - Dropped message field. - Removed “and others” from the supported OSes listed in docs. - Updated dashboards after renaming and deleting fields. - Updated script to drop fields where value was `(null)`. * Document old_auid, new_auid, old_ses, new_ses --- filebeat/docs/fields.asciidoc | 124 + filebeat/docs/images/kibana-system-audit.png | Bin 0 -> 132347 bytes filebeat/docs/modules/system.asciidoc | 16 +- filebeat/fileset/modules.go | 8 +- filebeat/fileset/modules_test.go | 4 +- filebeat/module/system/_meta/docs.asciidoc | 16 +- filebeat/module/system/audit/_meta/fields.yml | 74 + .../dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json | 13 + .../4ac0a370-0a11-11e7-8b04-eb22a5669f27.json | 18 + .../2bb0fa70-0a11-11e7-9e84-43da493ad0c7.json | 10 + .../5ebdbe50-0a0f-11e7-825f-6748cda7d858.json | 10 + .../6295bdd0-0a0e-11e7-825f-6748cda7d858.json | 10 + .../c5411910-0a87-11e7-8b04-eb22a5669f27.json | 10 + .../d1726930-0a7f-11e7-8b04-eb22a5669f27.json | 10 + filebeat/module/system/audit/config/audit.yml | 6 + .../module/system/audit/ingest/pipeline.json | 129 + filebeat/module/system/audit/manifest.yml | 15 + .../module/system/audit/test/audit-rhel6.log | 12 + .../module/system/audit/test/audit-rhel7.log | 2447 +++++++++++++++++ filebeat/module/system/audit/test/test.log | 2 + .../system/audit/test/test.log-expected.json | 94 + filebeat/tests/system/test_modules.py | 17 +- 22 files changed, 3027 insertions(+), 18 deletions(-) create mode 100644 filebeat/docs/images/kibana-system-audit.png create mode 100644 filebeat/module/system/audit/_meta/fields.yml create mode 100644 filebeat/module/system/audit/_meta/kibana/dashboard/dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json create mode 100644 filebeat/module/system/audit/_meta/kibana/search/4ac0a370-0a11-11e7-8b04-eb22a5669f27.json create mode 100644 filebeat/module/system/audit/_meta/kibana/visualization/2bb0fa70-0a11-11e7-9e84-43da493ad0c7.json create mode 100644 filebeat/module/system/audit/_meta/kibana/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858.json create mode 100644 filebeat/module/system/audit/_meta/kibana/visualization/6295bdd0-0a0e-11e7-825f-6748cda7d858.json create mode 100644 filebeat/module/system/audit/_meta/kibana/visualization/c5411910-0a87-11e7-8b04-eb22a5669f27.json create mode 100644 filebeat/module/system/audit/_meta/kibana/visualization/d1726930-0a7f-11e7-8b04-eb22a5669f27.json create mode 100644 filebeat/module/system/audit/config/audit.yml create mode 100644 filebeat/module/system/audit/ingest/pipeline.json create mode 100644 filebeat/module/system/audit/manifest.yml create mode 100644 filebeat/module/system/audit/test/audit-rhel6.log create mode 100644 filebeat/module/system/audit/test/audit-rhel7.log create mode 100644 filebeat/module/system/audit/test/test.log create mode 100644 filebeat/module/system/audit/test/test.log-expected.json diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index ad8e3476290e..eb5550bec476 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -865,6 +865,130 @@ Fields from the system log files. +[float] +== audit Fields + +Fields from the Linux audit logs. Not all fields are documented here because they are dynamic and vary by audit event type. + + + +[float] +=== system.audit.record_type + +The audit event type. + + +[float] +=== system.audit.old_auid + +For login events this is the old audit ID used for the user prior to this login. + + +[float] +=== system.audit.new_auid + +For login events this is the new audit ID. The audit ID can be used to trace future events to the user even if their identity changes (like becoming root). + + +[float] +=== system.audit.old_ses + +For login events this is the old session ID used for the user prior to this login. + + +[float] +=== system.audit.new_ses + +For login events this is the new session ID. It can be used to tie a user to future events by session ID. + + +[float] +=== system.audit.sequence + +type: long + +The audit event sequence number. + + +[float] +=== system.audit.pid + +type: long + +The ID of the process. + + +[float] +=== system.audit.ppid + +type: long + +The ID of the process. + + +[float] +=== system.audit.items + +type: long + +The number of items in an event. + + +[float] +=== system.audit.item + +type: long + +The item field indicates which item out of the total number of items. This number is zero-based; a value of 0 means it is the first item. + + +[float] +== geoip Fields + +Contains GeoIP information gathered based on the `system.audit.addr` field. Only present if the GeoIP Elasticsearch plugin is available and used. + + + +[float] +=== system.audit.geoip.continent_name + +type: keyword + +The name of the continent. + + +[float] +=== system.audit.geoip.city_name + +type: keyword + +The name of the city. + + +[float] +=== system.audit.geoip.region_name + +type: keyword + +The name of the region. + + +[float] +=== system.audit.geoip.country_iso_code + +type: keyword + +Country ISO code. + + +[float] +=== system.audit.geoip.location + +type: geo_point + +The longitude and latitude. + + [float] == auth Fields diff --git a/filebeat/docs/images/kibana-system-audit.png b/filebeat/docs/images/kibana-system-audit.png new file mode 100644 index 0000000000000000000000000000000000000000..6d9f4ba5a2e7441dfbad196066f443a5a14f7c99 GIT binary patch literal 132347 zcmYIvbzGBQ*f$8GQqrk(NFxl8(J-0;(p?gxTRNn>bMz=_=?0OI8ZsKByOC~u=kIym z_uXfI?8JSpxX%^md!0q9D$C+vQedK>py0^Mfz(h?Fd!%>=pSC9A$x#Lg#Z*3R7GnI z9XB1Y67Z9wJ*TO;qnQP#r@a$$90f&K%+tyAldXjtjhTg&wSx%VNqaXPjkUQ5oi-ns z8|)-y0kM|zcCk?RR@V6BZTm^koK8#>Q`i%TT)^JK&6LK|-p;`l=qWakCYnllVuFMhC1)BjxB~LBq$%&++L!?*|$ILC*Jlf**JQ>@+;w@A zIJn;fxdnmT?`i(`Lnn$!BkW>s2~-2g{4X(NON0*M=H>+C;_~qD;Pl|-bab)edM_v_ z$i>aW#lypaoWbGh<=|%O$>HEi|8I%^Sp#I@`pL!G$<5l)f#%pr0 z{Vx@ycwGNaK4jznX~@C>sTLQc{50~_K&0-_tt7w_C@8h@SP!Ppk!@60HCaiN>ajO_ zC@5$ss!AHtfB*j7+}sqdo_KnCWJ~KpHs_YsHa0eds}S3g;o3bu*Voq%kB`TvXHS2h zrWTfFey=!&&&@5aPR=i_udi=yZCQ%6OfM{VsC6tYEgk+jompH(%q`~f@m^kD0jm%< zH#ZCUhO4WqmX?-TS=rq+;tLB4mv{GvhlhyS-&~nJy-G?K7nj@h^~T1=cXzisIywu> z>ztgNd$Q5z=jZqL_k~5pN=iz0c6MrNYV^Ud)6>(FlasNrF(xLaw6rudG_*Hw-c(gp zmz0*(H#Bm`SFNn9j7`qV%F33PSH#E1`}z4zOiTb1DgXdLS65eLWaR$-zGKx7fr1~v zvQZZom$tTce0==i;2_@grh$Qhnwr|(-Ca*l&*9qBDQ^Y($;RyyV$685RIODn(irx*m-bJl_D-fT(BXMNP5Z_N z52qCyryp%M_^`3U8 ziR7=g-W<$dF2jHS>`eXE)fB<#mHJh$k&eDm{4}|lNu#;))yp7*fxWqbZ>1>%wYznx zONR@kie#1cZQSc$*EZWi$Fre>trgjR6P9&jb8%Bc{$BeYB|ks)T(^$jT=iFLYr;K7 zErU{$;rch7mGBm`Z6oRBi;*8scU$pMvv9wB<6q-vW##i;of`?ZwSIXIr`TT6dPdjo#4;kX}*I1jYq zWpTnA6wQ>NMS|9M`1cL+c7%o#9o9)Dd_aX_LOPuRo1&_;iI?eHAJI9*G9<$=2mp6khz$Hg=m-b&tDdK<*^}oZ_(qG+m-9Ti`UJZ zi*qO4sD$KJ2A*qDuOEL&{dM06pnVxcGw5_PGk{e?`_!^cas2lpy64xUCEl-xUw=D% z+h0oHp-Y7IHb;oQqYMpr=*{2p=S4>>M(N`s2gq^%rjmdIFxpGR-cg`S;BCf8^D)f)2S zsbM?;*6O5_Ey)uIVB9kH>|{39;t*N$l_|%4zc)+E$IDL{{i;?CqavSy6 zPG$-^_w>kB>3y0hOCgPstKwrF)O^<~r_!2X*+_8YY&`QrL0K~>Mq~XYwlf0$Z6SgE zCv+L(ad@gAAjN%dCC^pu7uh0bbJ`FC6idv|`Fu#%c_lPhnm(2Dcf;O1SeyApJ742o z+lab>iR-LkS@L1r6nNG_;VLwET0#^($(z2hI7HRrdpS?)aOkZ}yz<*&vVe%zqv4PS zewF<1OsSSoAtEDP`;pZ~8!QSJHz^%UeUN3dC-fnAjV zY!0IH0cBYNRO#4wXUmkSfY!1M8k_t-zj#ia<0kn13m9m zM@)!4?V2Sny`?KzAxxOzRb()u15H3PpB_xZ=ToEF^WQ%r&ZcSql+UrR?wnQ7d}&NH zmFr+Xr?}(C~2mP7wbqRF-QWBymVUhToLettp+W%z%1aH&s6=cfNZw`;(eWgUP zmc9!yU90wUT=f*V2CG(!WPwSJ9BcD1=qw?nIF9zUi`G`E6|0<7rCO<)>|36S30%RL zA6Zhv6uNR$Hne)@O${M+ARei0=sWvNQJOj)&Q2-Xv*Eq)q6N87ef%V8Yj^5Gv#pDf zdP&xb0_pOXWrKQ|v?7z6X1p4a?=e!#T4M}8w!@`Aho)fdD`i9Uu+OsJ2xb+|@bIMZ zO>mV2P~U!ZPOE94ojt}>GZ@~Ai9zSWW=l`B3OgM>x8Tq<(z0g>e#qyvNh#Z+tNUWE zG@wPtWL!dS2VIM{?2l5RZevP@94nV34Yl)gDK5KRH-^S9rYMLg(q*@+WmWqew*5Fr zOVsr+HrDa%oXtvF*3`Kflpad?X0Ur_Mg7~?<4h=?$jHObcsf&{=$x$B8le$EtX0vm zOs|cPAPWXdYZl8mWeUT+Eg~AdQ@#B%8q1Gj;hIzt8mSp>_!V+g6{l!fucy=U4WL^9 z%0sxO=9L_84%P!}oeSC**3O?Lh=YUkz4Z44vWcbd(u$j`A21q~)R_c;&`XLuQ5*MZ zc{T-Bc7MU#u9q%a-`_ouv@>S>($W7x5^Jbkld5gYZW_;-45{oHuraB+El|x=D~+aP z>x~g$aPOyu0jwX+urKBJNs`}US1ul0wq^r!MEVq5`G8zlh@J1wF4G8 zQ#_OOwqGmxiHY?b!L9o=ke@9dJpkelBunuwR5C_MghpW)I=}r8opq4Y4~(2qQ#aw_ zr#y$J=@~m$DU^8#F4-h5=xeIkqqmmJywb9cttl8#uXqK5n^#Y9RQ}Lh)FG)ZL!|22 z1WnPXjq}-Diqa&Nr|T5*aYhge2#)e;3WmV~ftA;S^z6Ca$ahCG9hQpW(zCD0Mrq5& z5o>{0six%v1!RIYQumc=edXoKac>@S%XL7;rSS5Zdspb_boKT=Hfe^MSAMw?hiS20 z{;iJ+q#5)K0aenFx>ph}xHFUm+Z1pnzc~4-uH)WU^H&iL$Xda4QzH4Ogd95rVZ0 z=2gcJQGL{l=?zLS6S(5MBds}}6turUp#wG*km0IEfQ`+DH**MpxUm?l(70H7eVfB@ zSgZfcIZI)7^MWl)LruK}C}20D!_A|YIzLh5T%lqJV8cbGLwuR^&=ifLuC_n5=H>0} zKI*2s^Tx|lOF491UQO*jx@)~d?U;@S$6fxeyKC^Qwsx)s-_CD~(nIZ7-IGg?bKB%g zOTQdQK=jjXfXZ~D3ZPVivQfE2t~`mp<5G#$_nkL;c$K?f&ybKHsMNA2$D|K)6(2T z2PdL_H=yGMybv$;2qv9G#oIg#Bx-b5wKQdj+Xe>exT3Zw*`TNll=BX(&S+XI=yDY@ zYBvI3Lw@Le5@&v;6NA#`6qXQXD&57ZSglcgWvzpf_lqJafi5gWuo!NEQimxNScOQG z_;~A2sLdytORp8H@(i<>zz)bFx9@J_@kvB{kSK6sfGn_(PD9rMZP1EGT87rJPQOKm&47}nPy-d8l)zFDA7i~~ldlYqFsUG-Wu%BslVVtkF*{gr>u$|&n9&3}x`{6!tl|!}6U8jm zA)*M4cM_PF(yVB$C@=RbYS*zP#z+`a;a^%R=24y11uGnCr-FI%Qxz0=qh$I9J8=~J z0^w2UzMRo-*NJ0hQ?N`G=SUqiEQg)!P0v47voa=IFjZ)x|F|`uAmt|(|56-kK~G{a zXEpPak^GG+JX*%cs!rGa^LrLgB|D`ZOXBCirUi4}2nH&(E`9U;2b-MX16%%kUjCqL zZdd{AOa8?A$JZpWn%ftxfG+l|ViuE;q}ja|@0y2wCM%MgEJfm?hghBREzC2tIrcND zY+%i7#f+fDjSwTNVO2I~(pKsoMa-BbxEScFKV>ZoV2d+wH62*adX8X_Z%OhsKfnC7 ztm)}BaewIE-NDwnw=kk!X7Lkr9+1b;0c2!^$)Aq+33)ADY5-;xI?G0oPH>=(sku=F z0L4VHCkgRF>{5uVIpq@=z>R8BBT5?jw$7es?=L`^tUBH;GE)#3C(4z!P$-c!_2J%D z8X6y>zQB*=>x^=GKC+z!(5r|d1j{+F)&cYs+(3Y0Om{3UibOKxdBo~1?Tp>2wQmVG z%Z-JN5rC>nLns7NL{|eMaBO&Q=ENkZ|N4FEwBC{yi`u!yU?j)&__S1r~ z8i2NZ&5tttDZ=8?gmf^(hsgkDd~k5KKIrXqs?FAWGs#R~p_OudtmSjCU6*A<#CEkg z&yazB2DH{InJgEn-HEnuBh<(ou7o?4!I3+QpX)$543oM&+c*vc&;Z2ScLC=gzp1*D z3~NL0%{0qEx~8h(k{yuY?-ST>z7XI?vfD1kQIHE5O03M@=WDD;()Xm{L39&RQzSB% zOXJI};d=Q@o6N2~43%d25VET75|T=j8kYF94@f_y%*_{sFWj&{iuS$}rz68XjK&Hr zMtDYt`ASlvaB2lYU+SukdIN}JAFLYGaVMD=miPLI?`n<0KvD`?!)hPZ#moz1V;$x# za*wQ&dqw}=OAfV?=J_|p3M{m5#LjdSnNWAa%<+NCGi-k~HVz{b2^$_ZNhnG}G$eMW z#x`-hoL9dPjYyY*x|xKIA}hPHxK0p4jAIW~(zODR=aUd=%?wg0V!T6ZeRdd2t46{q z<<|cN)0XenOwFXODGCDxKOI#>6>u5LilVFD`Nt!S@nbagri26llRmIra5iIYHpgKm zGr=jXtcI5kdcbe*UFme*yEG|a{7bmKRrTV}r9h)W_ia-+Rsaa3e&cj~+1+ul56+^N z_paeExaySU57?pe7bHL|rlyoQEIbTemm1$I8UeygT%}fO3isez-WxGB^IuuZ!`sZF zIo4UxRB9P1*saIvv{FATwo=vBF_29Yw-5Tp>k|{`R=`vFySwB{E}>C=H1RL&IED#q zV@53|EB^4+S9T1U0YHk+XfWm7q_u42memNuV3y5Qt#h~*{ifCuV0o`DQItfAyx(ts z@RCW4Ju5oiF$TNR0BNkzwa@H2R=bdG zO>2tk_su61WL(RLq&CU52r_-d7)x{MEOmSTprB1~7EYo=R@GY8CakInuaZ9I-s;P4BC+bnt2&Zek?k!NP}FVW>de&4 zG?*^7XsX**OY9s@H>QXmP62X64ne-Kq_#sJS$RE@6Zs%fx{a4$hl<7Gp>!zV_-hHw zpyzLnsJxf-92_)A$6({aJ*E>^*s7MuQUZkEL*l%cq(H9PYmK3y9>%%YWz=jPR}1Y_ zi4HIiC(#k@oF%uVy3I=uF&Fza`sQM_zt?S&P@}Z<^m{5&L_|{7V3vo-k7${!icfcv z@5>N&W<#Ix+LiP)U5mBUbTx{&%1B?ZQ~1f(D{!W3rf8(TV?+!PbgJzT_@wdyL=36e z=o|%J)RQ@p2=x*8fHf1lBqVlbzI?+>kJQ{bNMV2>elyZ(m6Q@g)VKxM_6MIqG21~0 zEC_8DFsp5-teN|C%BI2}Y?*|5l*Z8?J33wfm#i_fR~c9_VT+hKOeSO5%XU20O3?h7 zD!`tBsZW|-`4qPe3(G!7Ths*h*4H*^-GW*jip|PjnbIBWNub@?oBe(Zs0&}=6$UGS z$zlM=m`DdJ8`pTZq-!)_r?t|kvMLnTtoKFC4p|iAFhRob4>BW*I4WB^F9*DMrfPzwIw% zo;K~xtHIH2y)S4 z)YPZ%c~cf~sz6^GA;G2=Tq9RysiVow#K+@S&CXC6RGnztUK!fK8b8s6lA$`dWM*!L zU!})%X|v>?3L22J5LByKBuOy^Ap?#yD7lb8c?S|_KoO(UxdlrQrqCGT{XEeh0y>U} zP34_YWiVqb6(uxt*|qS-OvcJbCrC<=J;n zsRE6tlUZ8n_H6vLQt&%&S&e30=)+q-w+_W`^S>oDTj5Oa-N}kP%R$KyX3^p(0 z9LJYl)7Y5}6Bm|=3pU)I5V`4VZeJSKLh(em9k zOhJE5ENAI*JwimUumfqVp8J*ZvM7<&q~ds$@#|CoU7LGjrbg--JZVeCC@~R1>Q&p> z`IhseZ;2-vb-7s7ASIu>CK*o7;Dk0?N&2xHRqF7T#>+vimyghvr=bp)NUTwX|c zK|ml)6|IjW)nXZwZn7R&p$_jaDQ0(kmU+lZ5ea`7^lDO?8WO4SSCz~4@T4f~Jp;_u z+T+fR4Lfm3*!%>}j0dj`sjs&Yrtorijg^PPsPWJA`q<3+F(hbV$%ed?t(LcXX4l96Z-#lFbaLBCm&*Ot zGrKo+v0?wv<1s?XUJ&pNg5mX>mXkrhJX~eRv2h>QXd>jGpcrI`oW#I5o7ujw_2j$X z^^(WtpvmN$S(!o3Qr!kN(KP#$^&Pz3`Uym(Q~=0+wfbs?8fa>*`VZcI2Yphg z{jH)25V%%E-xV0&4lTt;M8tljMVCl$)de`W^BPfmENqn0LAyfg(H?(_>(@%ky(E*N z1j`kxNm~%4QchW9umvLJ#EoV;u8bd+psMm12ddC?g$9Y|% zLp#d19xH(4bteLH==>@|VWXHXq3@`dDArT%*J8)ICFf5sGJJ4Zo==_hcl{HN`1Djh zIT}4`E=@EIS^Li~j#>W6A_W+G$E_T{v|&!O|E2^IXRd($AGwJ=O7nUCMkEv-iAJBuNU7ujsEvKOllX7OlKuN47oVRGnX;|jdk2qFML zL+c!dFOd)-W2B|0uXlhgSw-zZh}=-EWQal6aC+!wqzL`RYwnoxdf@TUiVEPlzkZ)3 zmV`Cl|IDI;KG_4B)*29G;mYW{)DzhTfJQXrQPE$wnug2>K=71DcK+)h_cn+(Bfww< zm4{8Fy}>Y`pY~9gNx>Fq*PCBMRXNcl+DEbYRk%|K%?m1_qb3Kzc<|JqZgwmW3M4PO z?9i@zNFay=?W71<8X#uA#9oO$AClf!r8Fx)5I3ZG-ZWvv5^mz)CtMwdL4okhaqkn} zQnmRxih|U4y)HoV7s_pu0^c{Z$+0+6cxc|TfScKQU|W51v`h=5Ivr|l+GuJ>w?hRS=*fhV^1_YZQum z`6SfpR!jQO0AbV*KbZbAuTM&@b@!0!f?IP^m)FdjHy4)w*SgTMJ#U?1gdf7{3bn;G{7lt1NiLlly`p=6u>II?5K>EQod z#D9L_<$o%ZKwyuV=K_iU(`!r=q=eHkug(2n>S{~<<3H~)I2c{h`Ph0{MIe80x3lnD zMIB&9?_kIf>%5Mm&+tAfJUdv(P6H9eJXOmwAi|>z)9rG1_x>`ipPpv`kpF$UJwH3i zQr-SA=Qb#lvFw$!GIn+@|G4!`l-B3O*154#`OSYDW{#a=wW;}nsU$P!W*4x3S; z{^g%ZM49+kbj@9%xyoUAtJH94g3^=hdg3O+^48V7rpl<@ZBK7Kt79iEPXiFnF%qYL zzScD6uyugKzjotQT2V-!s3S7n3^H>6*71XW=FGq`MrNc!WO=ep25|e^q7^iOgX=|H2s#Q_zRzypWF9Z z7pV%ohT?}qlERtKScWYp>Ta3rpTZ(9oRgm#3?|-|z&^fnGLEfbAM;;dR&(bam2 z9=Aj)_9XQKk}_H|vKIt6-lHUl7`7In%<=T9{04fH*jk%T@+WfwJHv~qzlP|iH@GKw zSf;=aWR0wIiWVHZyhBfHfuy@WY?4Z!43;{|r$31{N7TYND(EG7br=-Pd|qFvk+ z!J)nE$FYOOy=)v7mo@=6_F%vBhLeU%bW2P|xfdRpty~Ga`TerG?Bh*&VngkQ1|0}{ zW;Qu*ehC3%2XPMzSS%ZN-BI4F;?*Me<^OvZ;N$fg$ZROqoWtTteBFIdD6+5Q@C)IP zo?65r$UmZYZG9$b6nyak$S=VvAfZTW&MsZ=%kq6S%2u!W{Kf%nD2r@eoTV>dh=mie7*!E$kV`kCs2Of~+F zd#&p4t&EvT%~#D0hL4?$BJRA51|W520i9T-S>Zs{StWazl^#o^f#qk$ZMf0}nbj5h z=TWk6O_c54W~uJxeipU;q&-QTbvi##M5bOw6XqZ7vSu~4D3a(cu6=FS!~?TvV>Nl| zap;~lRC|fhQNy$w1>F7OjaSq9JcjO{Pp%tIntIPl_X!*F(#~kgYc-I0Y`k>-T5-vZ z|K-ECyo#y7qJw(tC+FZ0#31#%(|6lZ-qC;8&pSg))_v%FfW?1x4@2HP-{E`Y6)A?&RI zCC0ZvH=j1k0R!`}^ZGrBd!9wZPb|=~k=fq;tFj}~%HsCgM!#Ddot5;>?2mv>(K<1) zgOJXKw8nIF*om(UX0iuC&e9j~_-|UBH79*pSu-)gGp$~#^E;#S-izNScDA-2D zApJtyq2c&Q!PeBVEz*LEgQCr^=6vN87oqRrIgYNa*Z6V7-DN=tG%HE{V~$C929^nQ zw_&R^^zS)qL;;c7rYDnDsjDzR?ObTpw8gKq@*t2U(!&ku`sNLZHSdjj^5a33)zVq$t-nFEfWVy+Oi8cMk_f_!Yk&YT7kNt}O=QwZftdL`wVp#sP3TH03Ga4G->S#y1{r6C zB;$xlJh{EHhKs2T>8eJvWhApZNka9Zq9co|3TtO+e5=A6AGs~FYV)V0 zvB$#;@sJWwi2WNP6S4f~sST)hWmPKedQ)%b;=ud?F}_~V4cWb9vaf^-f!Nkt6$qf% z-&T&|7GOnG=AU>p#i=B5(nJj~?LD0aQ$0+FGxf zC*Ot>)Cj#f-)=lEsP_>X{4$#;AP!hv%ws@|87Tu!I&gFQ-Q$3Nw@^O%%sy!?IujC? z*vqT@N@^lsl_Rqz7Y%{j@KcO8_0LtGi0l3ob^$1bXM$8gBw?b6m$t4_uStg&nIf1H zNx<2{+E;086`V)ZJ72C6^= zf9afYET#fW&ESM_W4nSo2P( zkk}}Ri?lSECKogq9z-Ccl`nt__YD?uLz!OAhZM)$g=&dTGq%i0ne9d)AoOFAC7%-@ za+%7{2;SKevJL}@Iw0O}f@cP--c(p;;l7vB#;szh*rJCrDvBp&3`B=vMczePzIxPw zkzk9Qcd?CrWB}fv7yXWa5KI}TzPiD!(z)_VAp%>74 zp-Ra`F)NN>5VT0ZLUeAwxUY-5C-L5?pJ@8DHPBUk5lb+C;&#f2ZJb3yrU%HXlNXd! zATk2XYXB|^eI|@Urma4)QgrQC)@&aJC2Qq4bMQ30m434vurWeq_Qel6JMXvs3uwK* zN_BqFth7d&Me<7d0R4TW+@M3V2N-L9pTXxh7108ujSBbFme}V;k(?PEyF#eEm@<6i zolt$AmQJ~SJ>xGHU`)Df%JqQ%c_Z7!N zO&6cx(e$ukrGwdPTmBx}bE}otUY-GX+R}7AStfZ7AI_kylRa*)_ohE@d%?hdtOHJgh1i-SD_O=^ie|lf7 zg~9y{#FHADFB^`2El*0(Lvt+_0Rf40P3Jxj+#(9sSM0}otCBW#%G$s8jkIBgyS3cg%d)cM9~eW26Pg6%)!%(u8OIU~g-be8V+QoxQ=d0fc2>vv*) zD=M!w=zQfZyFtooQo?{4e2gk_N^Q zACcCJZ9HA4({*4*+V0-oF6-*az|F@Oy7J+hb-3j4*n|8bOt;Ior;NNUT=}*jnP(L8 zfiZ08zhx8u`KGo@9YSJAO{i>@!@z^|NjKegif&efINlM43g32 zy37-8K5W#nm=VEsKbH?z&Cz29;o~5`JbLdm-gkEc>3(p0L83HRQI?X0)ecTm)3*l{ zbaP-*B&J7UzG)h1ZnvCY*w)7X;oF$&PptOORFjEsLRxh-3R@WoFs9eHVs&Ft+%c3!&jj$CC^peLNf- zYn>cHg%!;OS2zl%VuIdJvsKc@7Y#t-e~<Oq5z@__%w*8X{CP$IuHDoJuhk5cEd!LSSr6g zV{uwi&V3J1K&leo+8SF@_u=OHh+>idQ#f3mo5V~Op=1&!hmoK{qQq8|XAzCgA@OJ0h56eH0Tv!-)#;lajpumSSDmSvim+@aUWcsrz3K*<8Vu5i z?AeIm%*m|T(KQO|ZKdU*P!XG^Wf0-00m^dN8-5w~4ZF|Z=(2u;#5Uhc&Cy58Fgn+> z+Nf_>N)H70Jia3r*WY|0h&4VcyCCCYdc;M?^^CZsaUe>r_N~q%nVl0692BZJmoMceQE$oiRq!Il}-^8%6!4t4zD)ZW%cNSSt&jx=NDIIyg}gfOQ_nQ zK=)Buqg%_@fD6LGnpU4=zs(KFWZBql&>+DVFE7R4p`MoRMn=o~{_k<3EJqVpxlspo zRf@+dCwcu~uXguB-4gQ%!G$>nx(BWOnB_$8pzr&23mxk;q>&&ZiXSXfg(Nc`iL-5D zbCa@RJ(C6j8kUR;zo5h#NIpudGe*cn!^rhB$S7IJA5G&>IfjxkL(9EUeBK{D5W64&fj1DU^h#bMz|qL7e~8`~S(8j*HD~z{ zDj3{H$%!lVb%3F6FFH8C77qcC)@>>oKH@}^b!MUe%(qTL$!kuhFJ0@i2&(tp)BExK zzXdWT2>dj4NJG;Gl2~*4pX0H!PTaFgaI>NAE7%B|Op>N%h*wltlkDg@1;>(iCBe#9 z$$WpQ!gN)vjJ`cA;(?p~*n!0820cw8>S*34k+Kqti+ZKCSkEft=SOnheuO5~Bq64J zbg{_loqS@+_aV0#|2?j_y_GYKAM3oMywQHL{q{qh1sqYRQU!CY%DhK0MO!Ogvi)p7 zU(3ry84vj9$lxrLmX0n@6UAP}0q3_Vvefo|yOV~Laa4X#LijQB4(4b<^USYYUophk zF=Xb9hY^~RO@-Ij^uG=sDP6HUKLj5 z`L}HqH$Y}yqJ_O0%@xUV#U&n7v~4;}$>#I1e>%VBY`fN0IVHSQ$jdwkhT<*`GWs= z?$5Q`^t?FYf)qE>iD{+#%iMP5pHWAW$Nlx_fcjl)hvA(lBEWp4rF$%G!hMAZ)JFEJ zgnWNRSugz?iG)`i6fMXo?cBS~rr!|Ya}+BOC)(*Z(=%;cX>hB=j1NaRl3e*e^t4es zE}jzL!`lcWn2spN_+NK4*!~#VzLh3b_iv22uh=C+X`~1Q*2hzRpFg30oqB;fIv0ur z$_cdr`soCm8Fz2Id>!^fNZ@fe*J8JuV{FTwN3qx1)Y6# zg571Qye)eFfRdYV65+=jXRqFlKSUA2`+em$Tv0xxPOgFEdUJ=Fu6`i-!IUfcsSsfg2iMXCR=9VU-8avDpp=B~MAo?d@Wlitkmc_WgkpVdK zD?a?L5v|o^zmG5$UCY4xXEfK7`%bco=VD7RzN7~x-OdLn7@=~rnr)=|Ve zA;Z!y@u2Ly zY$bqtsnNH)4@`O>*L$&()}7pdA9=F{AUctTLb|tkcJc2-NV(*Q(dEUtirDm!3Pcb~@Ag$NIzvMt3cXlcJ-Q+g zU1A_d3D#=D`q%i*bU%cASnz(uvFmp2N2sHJXHe93o|&Gcs8FStFm0dx00P zMLTy`p(_vPm$KHgDCuPURP&t&yKR$@!o6R}T#9-wR2B0Hirj7noIPC)*w$Q%`u$n$bYX=Sg8W>Y0c4`tgU2c zk}OC$7jISQplIzgF@cblZxXb?<&CFvNlF}Ji09f73fwzbGJ%&c{P?i z84Eb65%qMMd8mQ-pa07H-Rfj|;uGKG4>W@nRPogd9DWb}SHjIEgvUn;IJ6{xGkN^j zb!=xUVC?akI(_wFLSLopQv8gMmNKv;=k2Ov5zK_h0SJK~kE$q?-R&K!O=3 zd0J1B9d4+^aGYN~JCaND6$VT5n4CRcShI4j{YV3xd8`OFSRjWxj@=6!QJ5@!QSqn} zq42Q@0R@*M^J>9akQAW)jFhb#!U&_4fCt_FT|XFmg3soVTQAKUdpzw7G3WViVbM~q z-cD%(x-*yM&TF*AJgjOer+|^LkG(O=*0Ud?=;q zvqKD(9-Ww{T6u46-*w&zxC0qMIp9CM;^sSF;8kGeCXwpVh}ksJ(gwEJkD#C=0DaU5XU z5f`WF`1fwM+yCN|{}1_gJ4-Z<#f-6PAobf3UBXyaKhan)1s<9}ZoT1#>um~E#pI!S z+jn~=#VbRV@*fn%V;HEwk(Y>XYGw6>HVOEQw&VB~q1klG0E|Wc4Y{H@+{!L9b`bC0 zu)5g<^6py})=zPOO4Z%^b@#5+OY7qfQ#M~^@Hz682mrhS7+|;ciMB%hav z7F`HQzz3DsR`ZmJ%L{p3rlNw_E`TbUMEUvU<@hha6k^Y$H))Zn?HY*JItG+{{cxrG zr!=*Dmvln-XE>lD9@E{*Kmbso<Hf~!H}vwAt6vpdokYEHfQZg4(_To@112hkJpbHoY8v?0Ke#UN ziQ9Y{J2pb>MuhQC$M}&#DyWbVcBp2hBsn)?$R}T$c&pd-bO|jJJGM~9G+LS^h*9X9ss>)m!VIoSkL%mT)t>*@Xd^mKrIO! z3Qp;C4$TX}d`*!|Q29@E(A(~XEu8s}Q3+aIju}Y@~t83L;wUX0~bY5T0(L z7CLMnN@j?zGPe*Cupt3k-!_A0W0;x9~5Aj!d_#Cd>afDqA=&%g71AT z8hF(LWSe^?CE|NE6_X1XvVdW^EhP2hc zUfuwyzcA6d8}8Y`IK9c7@KHAPd!UbSJ>bO=ExgAuT^y zl5LCK5QU8SHf?xw5IA`*_{i&%Ca=-k|p-RCHmfgrea&^&++-7?H|x(KsCY_6Rxk?3pe+t zep(2foOFjxWBK?^k8cG3W9~{unAJ(N@An3Fw7hnLQmf7+fo%q+_{2peo_>cb1V8pM zSN+5#QWfHuQ|zlfXHVZjxddcw(lPuYm6iIkm}O`l_*Nd!@P{mkNOt-yxD5) z(8NT`{n519(qV04D!y%1W+*d))AbSRMa2K-KdTqQM!su3Q!c-=?;c07)MF9vZ6(3jRHT>2M9J zMO~!5xtO3xsBI6_k&_JrjeYS|hqfnf1l@N9JPAsgLQL@G(I;ke?wXq>(2hfC77dlx zTVkZE!4vG&R$=rAMzjB@26;P2&aLO5EubLjo4NcywmL84UNZpTka#y z+tobZ0-m&ub2?Vg;*=%@fvU%PgaR3oPP%@CIB~oj3!e@;8-olA`x>{#%Pqq1)y4mP zJZVS5&VCp2#OY6(l36np`k(7aWM9wFmYwP^qT7bgyRHxSk9%26?or>va9=4+CpH8Fc`{$6Kh`sal zZ8@tFmnhkc@<48RyT^gp2i_c)qnrQjc_OHbDeUets_XeJ5(NZnRDlq0zzmH&+6Jx0i| zfF$Y-ZoJ*!`SKVR{}UpSY2rC6`?BoxYt5b{`Ti)tL(-H>kZOnP(~p~J9=HEsM(V6t z*z_Rq>3315ZBTGXPcmXnSudd7fxtvU5BYvuZlU@AG~SPZ14VrI9oB8%#}W?7!hg^^ zr{ZP#^C!|U+wXS#fH}ut(^VIYruk*e5&ql=XW-9v0nteWlIRaxqfgpD?q8cVa~n)V zvs_l>d<1++#!qrCHw+&kN3JjKe`M&k{vva_e_!!!t|7s6O6GZ8E+FP5RPqiWpd$c% z;7M>ORkVG7?rB?b!JE^R97(v_`4qb$$<*U+cOv}kcbT$M0d#&XHlvdNVYgIs!=>(N zb0J8$y}|MMWgaubYH~EgRy?xARiq8*%-he})bDtip4#$ZvJ0@z8&kA*l069ppm&HX zpD_{?Y)&HQUj1L`|7NGzW}3$3zc^e>RZLmJdv_|rtjBL`n($}qMM5bMsMPy6zl-B3 zV1(A&)o?1SH+e^XlOAa3EqWn7M54VJmi(H^+pD0E$FYqRfrl>)RgvHAu|&vU^)( zk;7Q(t~f7 z`rTkS$_j<&)84gNKpXgS1CQXk)BoG|VbPYC1V>ix^C}RT)5%irhjbM=u7En9OQmxB zG*F>5`Wt6pHa`L3IWjl!k(?kCCT=%tAF`0j5^v+@enOOZJxL4&JVr^8%1}FhvPE)} zPRZ_30*E5^e~c6nEO(C#ZZ4yiTQ|hcws_3O=ph$~8DVHuV9~7rjL{Z7N38@6dH=d!(x9mDHc%qF5;@#Rgb4Fc%Mu-J`- z&~tIupZJmHYv*A5lM{U-is}#Trza;}9e)s0d23Cuz@3QC9bR4aHrL8DLgKE^+wegV zcLi->ca}soR#d~xvK1guC}iO+{_7n;#E^zLf0eY&6n2t9u8$8B4!@?H`%a7cop&t^Qs z=r?kx0Y0fK+O(Bp85L}YihlN#Y6=+?c}UqJfyKDvy8GYqjIKJA-lkb|ouk9cs+J=&R33gM8!sC>4fwi@q=ck>P?hj(UA1rqFu!&P>9fVdTy{A@_g`j_}MVLn05@*9#%yk+>jwXF#B1NsW zB7K?Ofbg&F2#d232LCzEfVYo)N1^XUzP|p0bV^_(4U@x!@}M9@;buzpH5f~ppEx$( zr@K8t9FYB0Hl8KaQrlg1=Vy!!&LdJ4Q9I67fdW=2EHO2owPPoetj_cseK zE8nFMFHKTuE=~HPB-(6uvN}iw3S|xz@qD-falHB#y!vOmpetKEtN-Vb{L3;HwW8rS zW97j!>@ha8-@n^X=8w&*%+*Z@AkW80k0AHWU8WVnlvamz zq)h3&#f?=H^3!(?$cqbb3@>y)zF(MHl@A0D>6g~APJC3oD+)8$OlHOxC4&M!L0#_Kt>aUIOjL_;US?BBm(c_WFYMS` zz4}0)333t)-LIc8=Q)EHFBVl|>3`+Yd8JSO%fViy6!FJCX+ekl8{TS}jX!c29(?;3 z#|C4Rt6zn$ipGM1ee%a({~HqZ>}tJv-|WmXH@t%`>w{$_Rro(UVyizXW&@rN)SNA$ z?Z`eRgmFRD8c z4amQhXl92B*RF-zKr|R23{A*nNldc0nf65`0&a`5v>K@2lPqyCnxe}qH&jqdeb&V$ zuGO>$Fw4O-(lCD)+t_)9MysRX=xE>~YbZ!-$|`$x`LVJCztGNDo%mY*D!SbyJ=rC2 zEQ3E)bq9oO1oH(y0bO$Qm`Xu#ckkbP@wp=((}#4q%z02#BURD`U)?kGjH|B}d1Ile zVW$Zqi>76vTI49Hi4^g;astbPv9cF^fm3pTF?zxcfkA)*w(uOz=lq(7A^nPmUqr~a zwn4lT4vAK-dnAunP%NWAT5caNVqgl-l6fZ@KQ-i|zFmFeqsO@QyTrek^WmArppE`g0B1Eo7%41SoF7?Z1}( z)S=scRe3?~Lk|UNeLg%JS7Bb~BZfX_`zbwaM?QNyZF>G-2OVplt3=vRFC)QFvUJ$Z zth3SLI5#@o@9NAY_&S{a;dg7#mg<)K&_j@u9TT2f?4r$A9kErgkX_geT2G2zoPU~p zDJ!B*@3&n<9MM@>3W7vHQ?V)Q*RWYp-MdO={ZE2|U%!))>n_a8TBl~b9(&d3sEq<{ z{Afms7esQZ$D3#lYgra-Sf>)BqYS;bM;y{M zY@Aadb(WK$$>`zfF1xFb96H2XJSZOm-YAA*Nm=|0=Z~=^o!sU^QKVvC(hQJ^wfs7eV#Q#hgdOs2VD5CCP5K}@~@$*=MTeN21l{SA}WY>%2B z4qh%oaqk*0>vw-ar9aANWYrIK4dTxzQZ)T{qrgge>_~~ktyW1%wGUBtW};hnkYpvC z(WeGt7;=V#H;X9>_*H7}#dWvuU^UtxPw56VoX9{r*EW=X>H;h=){n!P0iP8$afH!h zY?|cGXSVdkgXFaQV-{>5L3S-XM#4eH_9N)F)bnvVW`O%3F)6^NU%0dyS#crl8dmyx zK$T|IR@Gc@;l;isSWxVz9I@5wWB{4frk>PHTqAJsL^5cITwna@rf}0sTHq&g_*Xwh zyp3zJKiJ9u=H3P~WJOM6{q{>jYp9)ECJSfSkl!M8^Q=bH8{!$25+r&cvzO>IhowkL zC9)Gq-Hm*{NO!BN!Bk`bY*PZVd%E_{wF|mN=f0oXwa|GNz4j*3Ct|e*GFGJJDva&+ z3yj}uNP_(a@-4+F1tNk z^6@{XSvv`G{hm{Q5TInHLB+_EUdmWHTg~L$U;%@$m zQvT>cg)Jv25z8-9uYlQ`5K@SU#wD9}breZG6nO1IDw0U7-sbqi?ddC=?4P2Xz-3se zLnim!wsg{&TRhS|>!|zBe~oz!F&-GdhUynQ1bEiTD(%oguQn zBZ~3!H)-tEmKmX>&skY3NBCN3^=J6fN#~!DX{^~~4t*Y{Qpgf_Y2x`bXOT!6TtFYc zSQZq$PX!`zy(@!9jL;&Np&7_+(4EogVv^Syv^RTM)wY?k#4VXBL_I_<8;vNTomFW9 zggkY+E|1w7_(meTYj{AV57oOZPR1Oa_L8JC0e}))wOOPIq;LU-b+_d%j7i_UxSqh1 zLRnV34lR6Og7#d8@O>B4UM5-5&id}UhVgCb?TX~yPyc?(8Dt*}6Wf1f)_CWOKOksR zY(;SQH`BTGvLIGM)k7!m<+AJ#-Xqz8=X4}^5s}5g62yxBvP#kJmcpm7Iuys(Z zZRBdyWo#8jO-i-CWJm*4JhTk_PK_{0vw*!C?YoTvsk5| zdNOrV3~6}-z|jFVS8CUj%E$AWXgL9^D1f?($8>I}-4rjq`SezR!mnJrCXnbEKRcE)@vyj`?j5L;))ReMz9CAx;*n3QD&`HxJmzn1tk!1;32-2B%$ z6?EdL!y9C%ssHW}ks}6sa1b?ePF_0bhaIhVs!vFz<0Y98*GUG%bT)W6!|B&n}86 zKM(A*?Wme?)+RQrdKyS`%{>ftTt%1Es@AlJ}@?%nE%g(Mu7H!ZFMGdG?Z zmEXptDyXOdNvWpD8;yFaN{TG3OHFuS;QC*bd0~X41l1%=)Z3HM-yU9ZT`L`4To*9n zR!&=Wg)c_tzI*3yj?c|3;3+*20eJif@wnadmOg*t6;G{@1wjS`0N0LJS&5;G6mKPh z%edZ}+dDqJ!3_Rqcz7WBqcM^SA?mo0&24>Or>Ylkd`HGdp|1lU zQ2=PKRM@?(T5^Y@q?Asm_tZhQ$p^l;MgeSNZBZ6;^X+V=19v=n`20_Lzspk1R8>>V9DVd|D(Mg|?dAtn7tPoMO#SKQeCuZ+Io`b7>#y&zNa zJ`B6>ujHfzkKX(vBB;>#i$T4dt*CWYqB`rb5uKtUrr0V8uwVG08?3VOV>+&~wK!0r zD$wS7X20viJt1C^;U8a?xqG0keL#@d?$T~|?R|S49#}Zvk>Ub}dftoePee=gABofh z11U)7piBB8HT7lIMBd673^7YW!=b)inKB`!am5lCqbEMMPj=l@gQu{j2z&T@3U56_ zMePZy3K6K3K8IGxrIztBs_wW(CaiKoOWL%~UOKoRkLvH)S^iWzgAdDg0i&8!<76Sf zQB2dM(52N>P$|GUn3y3Uf)$~9RpxKOnv2{R1k8&`m}n-&Zfp|aU}>kQ$u~{+YqAyz zFveNTy-z)ohu%tMYGli3q1A9F^MOrNKRm+7fg=>V3%XjAK8J2HLTXTrx-5(_rkh`gSPqD}gX1SKUP}aCse*Lo&dzdd)m;iz zdLt}FAQFtwV<>iga&6pky<+OQLiZi19UJsiqd)(QC_J<|6<43wBbW5b+L*DHRX9a3 zC#3eUet?qlt(WS&9HJDWct^?MaIFaDb0si8E2TB!COmd5Vw^|iy7JS5F#t7Iz&e}+ zfqal|K?Jtz5aUiXCYFh*8?4h<*f$FrD1>kq|;w_DRdt^d~u@iky``g!YC`E){8bai|H;H?xlsjHvz zC9qo)71aC<(DR^d{keLU-_g0RgmE{0pViICfu$D`AcY=jg=a^N^A#42L7K)uEnKE^veV_7WQZ(17`$sF zHh}Dhy?&L15_R7qa(K>vRIEsCc~Od#{dfh?(n9G-NPhii_M74gW8FI_zuk*P=PlAM zsg^>CvvtC=^oj-e5h3lb=J}kKI--#oa7(3p9SwL*?${vSA*+aS(;lT%T@i?P)jc9@2 z_i$?R&sv!$jK*(iJi%kkCB8kgwToRTk#mkiC2)CWgJaG0NH5dsk=>Wgf}X>1WB}3G zxUYNc)ciKHF??CFy;{SAcJvZQ`>h>D*07S#!%Y)XAPF*nhg}sKbrc5ZEh>RiB+X~4 z_SQvCJE57+Z-6?L8*-9RCvpPN^@3Yu$}mzqO80Ja&LHz^S@;N8c`JWi&iA3r2#a1} z{?$&aX7OA3nk<7d6o5hqNHhY>ct!Zx`~7f9*FBD_e%4KHs?=nall(qF(Axsm9HFew z_|1mxZ)1FDCG7X5+>-jgvx1{BN9~iH3lvZk;#@vuf57$K!>w7kfIW01hL$rx?D(+lgBT5_NKzD|{>N|ZrVxEt(q$Kd*8w`JEEc7bb6 z?u&Rv;EM}ub}Z<9dceDr_zLg*_-?H~eG)fk6TzkqJ7dyJT*D@kg*t`KG?Om;Q3aUVon83BH}^(d6$hHAqMl4*SsG z;I>$V&$a3}Ka3j`_Od_cEp0+N$wz50lK}Rww;W|a1U3H;?eIjD7ZH^@uz;)m{C#k; zZrHiwg$?eAubG-V*DhU6D;EBYg)*1J#C)smJ!-(F6x(Ktm@n3!Cqfk2tOQGkEmGWT za}0(zCGCIUbml*$ih}ED=~2mE=vIK)8C%*KX>E0w-%ra=r@7|#JT!urJ>|LkX7+x_ zi3jL)3{_^@yhV2K7d;(*XCp>0i?=z%Az)!pI}dBUqwN(%jl>MV&|uSv2t)Ln0)R@< z;vCG)i2K{d4*+O$I0cX)K%;WNVpG;G$3*B|@@oW5$#i-1JF*a^FNK&%TQZDnJ8Sg~~C>-$fPOuzXC{20coyCocQn{R@Jsg&^8o zOanbnM5fB;N6^cOu*)BFOz2g+Nh-K#)7$Myf}+-V=9rkIyjy7TTU5rWEOug`k$w0d zffQ;v8#sQ+}gd_pnY-$GUTXd#rM-8}!#dvU14vgx}n7cDNqx0^?@QG{KOSA~)hoI`D}$`Ry- z9P~ZJUyo!Xvrh~|oWh08z6@`O)=&d_I)Xlt2s(5h1s*?+bihmlyZxrh?NhO0F_Ff0 zA&s>SCV*Wa>@I5|E*lbQq}I@==0x{GUB48_rB>cq_4Xu)4Y}pvV3B(?!-sx2Nf>I- z&!BRt`G_kqXz^!Y{DOxPmwl{L(FuNp%#kAOwM2kl7-t3nsQG({rPO(cXRhWX=-Jo8 zox;eI3b3zAeUVpq6~^iFf*3%wcah`q504D+W9bcA4617AZgq%Yl<70)sC*>ddhmgKw zXPw!;oL7;~I==_NE~o^uON0G6>bPkU)4{5qX_4HSUoN<1!yJ}9~5>%PQ4y(^ZI)jYoU^hOeSJ2(&(Uol}vRwap(h;5}cS!4#E z6)QDNgUC(BHk=K|lKM?GrHS#&h~-zMmUe$*voCA-Bttj|+0{9Df1fRnL3hzu#O8nO z67>52qMMluw{_Sh^DISoL%m@|r|!>g_6!QtlkCYa*PXF= z`0OSX%j3t|K0}1gUJfHyu^hE7yS3&-U_}wO{a)6W|6f0R;GNX@<`JyjcyEj zo%Oly;VVnYK8abX!ea8eZcvI^bo2O_FbVi_sWS7!SiZ0bXZO8E6XFyMH&Fi>I)z=& zjI=ZN?(@am>eWZ7)ZIzDcj=0P!AQ6;P~>iUSJPR_|5{2n+=hxqtlt1hU)aa1VM3uc*SNTHNNZ!4wBhSiFswEIFiBukCV<94dnNTizCju>7G& zeX>9UE&e1Y29zIV_Q@_w{64pu!-B*XZdtc?-hZdv^1Lap*!uo9ZYs-|PGM_A0+g4w zki-A&^A69eGhQHJK~TJ}6X}#V9YDROCQ{&=(zO2WkYa z)#x?y(w|TF+c+F48HM2sXsq5%)ZZ?pDU5nFu~damluIK;TvKRWUt$p0-;?9anP&>+ z3wBJFU>+^WzEO7OKLTrl*CN^(T^2cbJtR=*2hW?s?OXglTgcufp7R3LdN5s{BzasW zvq!=a>ibgXR|S=qXqA(Mym$FAfoAE_=Q*}lvbAZD4^Xk@JuFw!&cE!kVchf~$#~K% zhsU08+i8A&RJi;8N94c_@Yawt1g0MAszi|UEz|+a_Pt!vpy2QGsAV;H=~qw*Jm8xb zt4s|pC9T~x&?8Q(vQA=+VOn28LyXnQk2L{V9~p#E*HxPRD@h;`8%nga5Q-SE?+Oqe z8PDpwU34kWH_XU2cVpiLjJ$Z@Z6e7T?0*?_0soXb!`m!W}#+xDUEl=3bQK_i!uLxd5yyF1|dE7x+e2z}{=+n`t(?0{2g3FglCnn>| zX%veq8NC~vZLTU)+NHU7Cg(+86Vhh=buRHL0!;QKw{vnXr*eTSn#Ep2FL8eekXyc1 z*uKzW!2_llO>@m=n9nE0^YS36c3kOj z8JHtEVBZq8^8L^3{gC!;6fshQkYypko$z;{?{qQs^?>AOC-a#@z9p*g<(zjM!1*CG z9d}oO^maAsIIMD%mdS#gAELsjTT3jvrM{%Q8En!SwNMIivW!~?68(%(5K;To6`392 zKDd*<`TAn(5#$zzz&P*EJ&%_E ziR|h>b9%HfK?hNs3xUq6mGZN3^Q#;nfp7dDdB$o-bcBvQ+OH!@v?jS8h46AGMUNh& z^kF9|9&NW0W=12+{Fg`YAnW@O9DJTEYM|$?haWF$Z%kt;4R}aO#Uyewd@pWAXM(`? zj-R*Jwg~N{_XjgJh%|MZ2NRmoPi5U=wcRU|AdvdPuFN7RULiG=)aQ*R4u~rRv3KxG zPP?4rOXau-1+CXr`yiDJwb5kM=8hg{Ff&R%h~ z_@#WIoInK9Ii(@YuyQ=nsw-~l<~)F0R9+z1RbI$$R;cZpO)Z%_Q6{51zSa0(>l_@w z4oPc)_j5#C+%ch!QK|Oq$!wQD6&`7$H|py4 zWR2VoSW@_;vSs-MKYbSqL*$ckZSYrEPkMK!vCM1Q-EA|RI5FbozRR@!-OUA)zE56~ zrJ%=k%e$!;#{lKJJEE>@BtbAlgsE7N{^ASW}75`_`Ww7?$jX#|FmLstt*b9Tx+V=PfQa?@zH9J2)>nzn~^iUJ}5l zxuh0aaIA}vsMX!B%wZrUox@C>ycztt(*QQCuMRB zkiGnP^3maK!Ok79{CvilHUnYfR+^PpohS8Cqd$WgcA<=+baO!7!HhQJ>Q~b)u#&oR z$$K<21J|0x*g$vVHOj#;cd9{fczW6(v=}w?Y-}>=(LrNF5oH8YU&ij|GI|?d0(k{c z{hyjKBOGdS zux6$f0=&B(r7i z|B?or4qD-v&*QCVmH4wZ{Mp@1>STZ@;qu_CPq2V8WE83QtgA!rCB(0FAw_+2s$SRg zbadXvp4VcEtx`)SAnSjXZSuiJes8yKNfd=TkNtMy07;;MT@61b2p6p`?A< z!(ywOkajJr+Cty!v(pwZ%UHnEvq~V7d#bv+niysRGGsQhvBmXfafa4%ZWPTys^(}y zu$270a@2ltKKC@+i z(lhsLkG{S>_d2LcPD;Bqz|(7Iwq~LIU%Zq%0Wn~o>>ubw8R)!;70b7p&x)mnwt{cY zTFu$Zg2B3!!c+7wkEX_bq5WofD-tf%l#^%tc+rcq@&E| zKhU|a{?DejfG^h*PvM+78E)(Ta`_`JYwdn^AAsB>Ka-x_z!gkjL&J3xfVK+*P-i^% z8(rwC8I>OP2e{*V+~H6C2o&uFw!Vza~tC!f2Aj=!TsjOb;b!dV>&ffc-{}Km8((?z6(XXVO-lTez zc}vlRBQA`8Oy}pJWWD##2;h1J*r-H@M(p>*UF$^TSrmrQE`;tWdqO;ki~&O-h}U8A zd0GvCw_mp7>#mVkPIq#!%Y-it$l=%XEMlwGEv@bGFUe#?r1Gh+3RBK$X^)`h(LuU5 zwy;MD!+$H<`9eBa`?A;2rPYNuQ$}X~5Z&~f#J7^P{nPd9?GaYPR@7dZ>EB(mvg1qyex0b%G z-aauvj7bQOm@id0r~@y6j(xIQf~8a{<|hC{7JX3sUsE`jVy~)5DEX4+NSbt_K70jnTxxgrQ-o=% zFq&v4N+{(>vM$mJ0~bQ+)kN<*ra;?x^QPfAbqqk1dL7LNUQObFNU$cWF1lU)1w6st z(%Ngl90db;LH}g2a^7vF$Eg0orM}?n6Z%pF{nNi}E ziG=ijy$c;K3HT;X*cE#^JkT=y84GxQ8V<*5)MTI|YLXpS!A{kLf#uE(@-9RR;tmcE zb5b^To0m$W{y-r^ZBvAu2?Id7w8{tQzEVM9OZnacJUx9OyDHOWv|u4y*#m}H$cD$Z z+U&FJ+vwT(oR=CO2w*S(mB=o`q;s)i+q$%hPKDH4!_84b2$Y)?QF-}V@j=9xs+m^% zQpRy8vIk>QEpyuzsF4*1Dm-#21PxE`J^YPOXV(EgYuI0Kc&kX5vtWZ5!VnGPgX5Bv z{!Fmk56btprYyn17yP$p{cy;TAwcpsF9`c`iY?4$X@8cJHpSO77kP)^z8;Th$>OBa z+E7*1V38r?D}r0KC$(~Pg7f#V!y#g}@TkanZ(p=wp~R)Mn0c``eEvL63SuREuhkMK z+NMwV`je!}H%kKN)xx9P*!IWD2)HTG5h(aR7u!88e({L`^C@-fSdAZS58Z}Dr2q%$ z$5{0pCee|bUZb#N5fA;B>NfQ9c~0+aSK%w9ko2C;n*p#$zzt?h<{o|Chk%>IL^e&+ zpv_YY3{^!fK}*PAE87cDu78br$cPcU?VHj&{x8d}vU##GeKV9tH)*OWA*B`3W#G^< zmPpN~;tJamxT-4kowqwoMI0Z*tSVhAfW<{^7+UW!hxrA;>0qs8>i%m1ofZzbEYU<~ z?ZdN?!9kJ0F%n(j1LAzj<8ZRzKIEtQu3CcqY1mISfO7?!lt_reBbd58I+gOEm zPsEmtD?^u)7NiBogCL46@P}! z=WaTFj?|-XvbjGX6*rEZhG$4=|EAXFw^RFUT&3WSHjGEIxGfbPk*iy=(FtduB-PJy z=v9(V{bw%Iv{vclk(WKMi|gaZlWVG5Iz2o^2EXu2b&LFKxQuULHV((Go<{+|_)(!P z0VKudTCiC+RISEnQ^^`U7;wnQ#uyz6$~-jcmRFUIfI74_<_u1bg+^9)d@Ie3&0Jsj z`7i9}l6IC7`}PaSQ`UFZYBwouH{OtA;xHR!FjckyxgAWyKl0(kkec>qcN&EBTTu8M z3au7%wwIc8W=35+28ux!U|~p^F!mGi$#YF8OJ=t(f99}nbpA={>S{B0ZfBnC!7q~m zQo|-SFDJ{Hw->BSssa*$_ln|X8h#z8TSNPZ>+!ygPKt>2^RK73>(9pM1SZDfnqYR3iu1vFtIbt8cD`jF zLNN!LVhw+4B>eT5{2ZTAN2%$m~@K{B2wi23}jo zSZns|_}`N3<-|4v%PKy|s)CT>HBq{oje%WSoivaopn+XbP$1yljtUlIuX5^T5IY7` zDDJvP3C78OV<4b}$iz`DXHoA=CSuF^=_QlxZ&{;Y^JjTB{J#M#7x{)}k1{XhnwzpE z%AIeTzV8yAK&8I9grw{q!h_S+9S@X5NUKVFB%DGBxff`5e62B1m8;}Sqx@)Pi~5q4 zWXqz93hLS39t6Sis_rc6tN9=;dNw$ien&KEaL zvO@-3$QR)sm$F4G-18R5#IjD7A=6K5$iHF|c4LEak?2%2^#}9C7GX zq_qvf(uK%O2sZ|l8;u|XSE^70hZ-YZsVnNg-*G@r7zBF10zMhsATtJqEu?^8KVwzi z-UI*5i%O222g3D4WWqrj5)Zz$;K^MVu$K~u`9IGogdqnv$f$X#4ElLPdx039<>{Ie(|m zQ1}F)mXr2sScXGlJz!_b$!@(%tZucZqouFw-XmPW#wjUv!eG=Qjc2lbz=6)&2hVWp zNi~4B5E)#dP>*M}ZgdAd!V2k4pXXZr!M*!y)Vg5bQsCsnfdYNtMbvXzxA7m`v%NS0 z@UCGu5q~wC8`WQ1IYzVbw)ii%z(~??Md@;2L~2j$>Ge_+T9_W-GrQ`OiVBfpDva47O z%50wJ^8upu9@y&p$D-Q1>EjQ&V5$x?PTQx`8Tz27bIE|W$-{#)O5s#=0Z-iF5-$lP5o18ftc2eUiS|k-Si*Nc{7@~52QMAt3kj;suu6w6bc#Qeir4ZA1SifjI(7J(_Md zEIxbMNY~qimRWAntuU5cZ3)T=WPUv=V#W5PVA#>RLr<~&?y?am zkgc+jJdOs9TB7$#8Vk4$J==j?^E4Sy^K{-HcbGlj-k%WV`?cOlyBBm1#Y|O*XjPwV zn@Qe@EYM5b5xt-;j16GI^(^_sb??z@aP8s7{6qQsb)lrsXR-Te8o5GJiwT8FSwKFP+cp zfh%WqTm3^dwudWDOA(h@P(E+#Pz1y?pfKciuAn;*bUL*D>wVsCY)LrwH3snbb9PRu zI6srzsZ9yOv;hlB{}%S}P#pXjod7So&;rz1ZKe{H8_$r^Vquaby>)@T{i^tv8Z>}A z&%(X5V2p`l=~I;qbS#u zp4_~>T0dtNmNaw}wlyMCiw6$0yz0SMeVG0=a(^c1am@%3Hz`XMbyf6$xvlo)j%Tmu zbnlo===b@*Tr$s$G=RYpLv+;`CyW9pHLrA{t~ng*dp&A0^p=>UQ_y)jl%+4H-D%Hc zZ+9OP`r+0pvGXkd;kaO;Yf-`ec+_IIi90+jrGdknOn7(H|AY3RA*e7Yn}6kpyCOi}7U<#IE)IN~$6C$c3voZ+Lt>5stn5 zS8Z6?wk>>~TyHh_{%2MJ&8Oi98I2NY{(s*u#6*7;R;%KTBMVxtrB9L^9Xv53qfDB( z+f(Vs-PQ)rSgSC4-$p{y9(PK-Z;{Q>&@tV*rhS`P;8K^dv zhtfB`=u8ymp;)Mo4?IY@RKKb{YAC~JfK+)7 zotFL01$hVOyXQU9kCDpLSUGiiJlj;mcv@FK(tmu!#F)8@=Lfd?n!OX84Atg-G`R$e zpd*Q%pgazLYd+e%7)!W~)piRSUO$QIdVuD;ucj%U0md@Yvd3@`cij$VJY8+8Z{Sc(5Y2SB(WNpeV*mj}z z#erhDiL3qeUdee%iSsb<1zzXpZ+x4k43XM#UXeC6#Ait(3QUjvj?x=i;jMkgU(s+l z3mGZ2NVpHxu~xI4H-d*Fx|ISzb4utakk>Un*4-CZbP&a=u>hl2w-T{jfa=i5(j zpbC9Cs+#2VAL{%#F1ljH5W5)+g}qXW{78@`O2)#7CWd?mds9X z^8s85bn!vS$sN4>qC!GKckf}_(7a_3w)DAaAF{ek7Qdv7uX3g>H}GSv`xLm{3ys9aFZLM4f;QEhNLM!) z9&Oh+0vnosuHb-u@hP_KL<9$2%pecWzq`*Ys=TQAJ7Zff8*p=f;Ys8${Ng8mt6sAB z&O4TH&Y5PmCCr?aH*8*PpRgpg=>mex))_!w5%4iPZ*&BvzI!eU#s_9~$`#Mo&~&(| z9|NhVIx0v2+bbXTPOn{dgJIeJC+tx@kXQJ;Lf$)SmlC*n7rL*01m2@x{C{lycRXBQ z)He)|-n-~ETB3*1yAX8{q6H!9=)FZ7L=e3*IzhDPUG&cAqPJjlqIaH2e%JNh_xpUF z^WV(poPE|_d+l{r`L4AOmn8qMn2KNAe=(Jz(6E%|`27S#YwBB5vcUIbemVq>@zNwG z=)X^-#lDUF#O|`=tQ5oo{#^ENHy-|+@1{^&M~5%iM@%?~|Ay0-bDq1oIcYWa($eUg z{4dJOvo+VizPfa(bNKwSRQ>L2A zQo)5)q6+CRzbL`<9(%~Js8|f6AaMBH`)_?rOyfcT*m9iV=f%v6&Eeznjyy&&%aR+V zoDaNVEju_198reWXX%OjH2;eQa1$G;rR@2_vOvfb7~W(t{&`2GNrlgyxydUC`_&RV zNLT_3Q>$B?l_&9cpG%I?B-8oJAN=_uxxNrdju-gVgzh$YUOro^YrLsgB*Y>V@lEg5 zMK_%_LbKc?km+^@t1THx@M~guNxBE<@)?1?I+huODtG=~lnl#sr%Y4-B1pGA7v7tl zLDn~`(-@sbSWw(UqEd!&@QOADw1hycrIryaxB*)(%=7eJlaAxK{iZzXQyULY%BbUg z&%}oQf)>amP$H8+AM_gkDa)D`{Kke36}ID}?Z<*kC+h!gn1r|9yS4D$w-uuBc^_-B z1;(g#r%#5Xe*UMLY;RFX$r@{4?2?B3JO>?U%1$2^lkW&MRs+HPc?bts|Ltmt282c(ILaLcCLl0#?Dk zM?&AK@l4`T@N>9ELX0d?cx5W)vo{g(UqKR|7nH-z_iW+2@)EY46gTKWLI`VSvu$@7!$6^Zt?0<=h*A6~Va2^mrTi*bp?ezP!;G1J9> z9+y6VJZo9c8Q9|C zHVHkjg$*4pZLc{pl} zvMDNMkBGRnimOLn9!6ImHgo=?@9_2~qi*U&zZ_z8YRSF6-1xIP z6?`@Q&@|DSkAUj7qBJO26gy?U)V6e?l{dROg3IJnCwN?*WQv2w^Sqhazcj>~H~BY~ zrp_RuTgFzb8&eJ0J^MO>Frz`<&>Qe}2UA=N~wO{`dPd*#D)Wjb@+*7^@p=$~-F81&cLqNO=HS;W^ zW&WnUSrF?7l-4d1GsrS}i6F=LNoiu6K^r}1XuvFCnFx?yuCHGBsodHGk6{33vTNZI zL4nZ1w*wkqz`6M%`eIv26LQllc4e92xE7Juthx=}mlQAR6f72c-8DqS=0+EPksJ|8el;lb4ju z@oxW}fJGgcO8X6pZ$qm2s9e;m!v*tGRxNmQ|})cc4k0* z%ttx$HHm8`(mx|JHSxZ>p+*Bur3K-Q+U@PuWyD23t9FN_wx*x}gcRN=oGuOtF#L#w zS5HPpjV>pt<}R&I z3CV~p4owgZeyUor1TYymRu7t$)RooGw+Wtmm)E+6rIe+sk@@;E#D6b|aJtHDBC-Z= z4rFMucO<6s3tmOLk*rcCd}*0p`r`R!r-6uyl@%|LGJ&6cRfM09)$z}F++okL@ua>V zOUVtiaiXqATLb~DDZ>YkX;c=D$BNURcmljgvG2fN(P6VYVhQfrN!zO0oDgou3E#MM z3mnQ*KVV-jH-xDy6%|qJ5tv|GK>him&#bN1HKIIIt%j&Lrf`pHy1}|WMGWoOIf73C z>yrsoRSr~$V)C|)h-z@v<#PDv-6VPprI3GmnH>I9t%E^=Z>3L&VxEuBR-wi6dOGl$ zU6v6+K-8WZ;%f#BeW-0ttx1}kEbDm5s)86Rb}z%V3@Jw{ zXsp{T)49Sf=W6@}0RVpie&;#)uK4)CX1*D0-hI-7=pKSofd1u2Td>a6cXweL(O7IC zzuPp+1q@78+zFn@vO@xuFRz1t1bnaM*RIjwb5~{crK2lKrw_O<4Lv^*^D@==PKy?` zz?hEVKI8SiXkTYU5hO6jDKK_88m|ju_Q}c2eLr9ULe-E`|mrHbj0*!$*e5(e;GG^`oNC zZB9K#)B|6{l{q^R@G{sY(@IM_T5qjb;*11vUuX60wS&j zP~dWF`qP@E+fAn{AN0l^;`$5<)SdY>>aczoUGfP5p{}e6)=9QSQ~c8HJ8H(iMvvXk z75foUR#;D$^EX%{=+wi-m@?ZZ`e!LgeIa#mK{q@{Bjyuul6bGW57|-ENF1v;u z1>}nL)^r{CCu?1>VwjsJOb-K@PRRQG)SeF=TkWTK$rYwp&m5iM^yLRpaZd{Y{_ba3 zR9eZ$K7D*gV8b@EGxIv4 zD9WjqKy86*{NSaceCOFXd=Fi*F&Yx_OJ!(b?b|$-pT4;3*1Jg@lOL+%9alDfRx{dQ zEemUyrnnUk-Tk3sKxrclmowCPp3+Kstj3p~3(om3Y%Y^M_G{^dhL9Z_m$T*9&!Qr) zUQ`n?ah-FH$>k1}kEWui)}~vIW0!L;;8s^bzjd(Y=x)lTq@uti|4fc3DoG)MFyD7a zdF>4qfg>|qYijsp&MsC2t*5DgdlFVW#6uaP7mKTpX=%^BNw%H^$BvFa5|eMF|4-9resed&i^75bmayTk_N9LhJd`XbK=MWQ`J3=l6a z*%&Qh|D#$blfU44nb(!3)&Ag*2jpb_^2ORqtvwZAgj$BVysI$>@@9DU4YJ7i_yw&U z)E9xUi)9QFNq=h*ke!x>*^7zV`l(?Np!#dStU;+3Da?y_StbS(J!UTRa8u+Ys#>}DZbf^wx3x61y>cZIyBfWGhFRGO0wN@7xR&kail8W*F3&s+ZBaH)y z1R1K)EpQqDZ%3Jf`{FS`H62(%CQ};;U)XEp)ElDSkJgpVI=c7fjqiJ=xgHCJ!ffGs zrpt|H>y;*;;E)TbeHq|l9$5RQ$_^u|!(~WPFKq)1;QkI*y+{Sx^p8)Mm#LPD_q31# zpClY7D$fO#oVY$S`aJ^9F$|yv6k%+44-Z4=xWf@aQfPmXckY>kWO(V-4Rg!RzS9~O z$!6K_nvtJ>pxRH}Do)D$U{EG7&IkqcA+pv~l<(;C_<^D}sMhMH4v=bPNmvpl)kRxP zi4p;C?n2Jn>}^#~_F0A3CnHX^Y!y){4#|-Mx^1fGGSjOZjyg0aiOl08 zN`3;eV$5F2X6iwj8~V2$$fMsg-@RLf_SGOj1a#xyD{Ay<^99rQrm2A}1=-$LW2*sA z{k|=giwp&*ydFS}BcK=!eu7~Eq77F;x)v8-?E7yeqkJXcD66J%eguiR8cA4CoIQl3 znoPryW^!SOQ38Lfh}?afgw3UWMQCz_q4ybu=AF3AvoedBIKURS_m_h7w=dpZ1i_by zrL}hDGYOV74~0w9_4|AXLl7TNW#lOM-Op`ttz+SCW#He`q81-mc@SS?J=l7hAh+|s z|7y_2cktT+e4vBIA13F8O%9VQloaFax>Y znXytqIGLKkE^MmjiERT$NGK&lGnaD;Z+mljX9nwI= z#O<8W`Nl2x_o#T+w1Q-FJ-EOh#I-erKxme;t$MN;c(1^$%HoDm2zW76Y`Up;SZP-5 z0a%bWwg-Ng(MBgmL>g=vG0Tz%cKd%Z%x52k#TX5Uxlc#?*8~Br%1rgQY`wa zh96bDHtPZ2yydAzwyDhJNgxHJ=^2T)tqbJ#&tdi;^G!NdmJR@K)y_ zp&{l)2-2;65QCHXPgKXf`hrdd;u=i8=cohNSULxvarJ{$*8eew2ds=OUfK$QXd)xk z6T5gkZDh!6z2>4?7?kCL0v>?Qh?IL+<%JSPSm2L9)H?9@x`d-`(iT<*_71E$g9Ap> z3AuaINh#d-6UeQSj6qptIrh)=c1WPhev?4G9uBb?)l+qi(o!0V~ST zoNEH=Ec~42S~ys6I!YZ2vC6O9?IAw^mh%E$XY+Mpx(W#uO#M=^$lR~f{G6&Z zgq}0(7iTMQWkanRt0t29G8i~BJb*)yAdk-qA&W4aPWv>UW6%iGKfY#T=O@n|Ao!)n zNk*dMfzX25=+MbG_B!a++{r_foMqv%f1wAMP@E!sotM_i7wPtlH@FD3frx{S)2pz+ zxML(*-jzrMUyN!XN=7VwWVCF=0d>|MudJ0LZIiKuH%t&^CLuZV2rWZHP+97VnmC%q z_6!Rmo2xN{1C8H6LfrYoA&_79r2h3kga$h3tdlDiKGx#YvF2v&4YcUj-&GpLKJQF1 zmec^r{DWF-o(@xKt#<`MM<>}?TQ3kgSUa$A^B&MrD+zNk+Rd29@1GC63OK!6eR?!* zi(}<K7Z!KxE_Y5CHFWDi=wJtTqX_{&n_R%UA zo87I>?nl5Psqs6ORys1t7|`eQ%1#Jo|4JG_OVk(o@!8jo%#QNCN>F=#;#=k15T#%4xMUkzWiTqkpfxp7sW3me6MD- zvdbv{1%b9N(_EJ;?gX5Cg z2*;(_cr1k%m zghQG$q{rJ9i~l7n7DYyAbQrrfb?2*t!~sQ&XoG_1Tag7U;#M`3tbo9=s09oJtT3(W zi-kJ^QC9D>_Ka6jkSNylB>{y0S0c&|W&Hi?Nh;Ael1Aq9w+2Nk3s}}VgkGLZD-Vc* z@I7fW-DQyLo~_s3sg`ZC?_&$w`6s)DYLObyOC)o@OPKNFDeSDN*daKPxMOZYy6Jy1 zGT~zGyPv1hu=S}9@k5Q2Fic(r7XJF!BZDwCN~mP=o72CbBl}*w%N-54Fz*`U{$)Rt zG5-Uf%KfyeGl#;l^Nt4bVSYCLod)r0pKDVItM6~mQ17jV8!YQ>M#XcV10zE)ZH4kn zlvVmGw5R>wis4ad=Ub~~P8#}#@mD_`6p49%W&JVgK+B(6Lm9%Z2|C*zg-My-oEURT z3foG}Z!R@yeoz^iZc;cP*G|i+`i_YyeDVAGJwpe|W6iM#r&h;#!3>uVYzGr+pm%^< zr)z<|Ae{aO(IcbY+i2=&XJSJk#{R>R?_S?#a1Gp%M$G@QVUJYZfUmA+p-3kw45!Th53$nDfy{Fj%9xfgl=|Um=#J zffO8WvHX7Psw$4OmLET!^i6jKSxSJT)qny5ao#vMrwcslytu8ZtgK|rvnM@4XsND3 zWQFO`plG29>ojYe$lpARUhUtp(LfVONJWojh?*)I0SnKZD3Xyf2NcUa9jlZRo!5u@ z7xO5hTL`=e7FW$I7Y{#r!1B`A$Y9Ko*(mTGO_IQoO`hbn z1w4^}sh%q8en*;sjw-=4m8H8S&dbV0qf|UIP+8I)Syb?0ufJN zQ(s?a>sIUC9brzoP$B8DJfYSi<-pk{ zQ|~yjMJ0~l6-hGizwdjUd5NPCLo3x>D-FsGp$1K^hUfPni@q62Dv-BUPe7IKA8e54 z+rOT^zYnJdX(gE7?$rI2sHU8ktml!1cK$S0FKoDtA8TpoYEM)eEUg-F_${!64I15c z13zRdB)gzH0aZ#jbFLhbTAM)G#|9LABpNjO8kCylHlqln)yxpeFg(%RC#F!cL9 zM|~zVu>Z6)(M!^=))B5`8ct&nd#l-(lAH|hPbnOWYv0)Cgx-XQIPX~mpO}&0^kWu$ zkgNwpqC#JGElJs4ZDjkUW3bSmI)N zdy#5l#_eQpNH8*e{&Ivr1paFTabC@7Wb5j4Ws#}Cbk1xbi`PpQQ2RIzie3COEkyGZ z580o=E}wLN37CiOFx&_NGX~n0`pEJ(%Nd7<*=h zj6^4BTOT7Za$3-wcF1qZJPNeGk~d&Y^oFOY`!mHAhG~wD)6=PW?o!gb8$*`&jv-;O zdta@5{vb&oLYfg^hghWFAH=dl+&F(zT!L-QWcnd&*gB@0(s~E=JqEM)CODf9?ck=W z>GM7w)=ro6K4her&0n83`X=%fuy6}miwdz7bhGlojLAc1=9~kBEHbW$xJM=Ph zRba<->c@*YBfq;ZW%?C#Im6F9nvjHre)5~WzToC=xV_Hn2@em+?=P5r#Og|QZsM?5 zpR3w<7lBxI95e+zy+pd2-QJDX9)qLLgNz8N8qC{I2Kx8u*|Be-C8_sjHK>1w;F` zdPmOheYK_<#RXnvJ$0#$sPk@YOii5~9#NqEFBSmDJm!pKs#3ZwN}V6)Y-%z~Xr8B} zO9q90ZBVwJn04vxP55cRllQib8&XAtE?p4v<*RiT! zPJBy@oXE)e)FD6U`bO_;keyU}sL9A#x$%yx{(~PXDk68Lu3Fr$y;Ot97w*F7Hn?o4 zDpZn!EcqwxQmggrEM6M54u+SLxuB6r?~u*PP;bmKShbV(yQz|GR zFA+IG(Z&%z;lB+p=`*!rHA%fpxV?@pU66H z6W0pNKx*`|b>FgCskooh95sJtkCJBfJOWWpO;uSdOyhNh=+d-@fj39b04tV~(ramI zz1@pAnNPyrRGsM397Xui6~X8>vs;*RU!(!<&G$xHM&8o=uC}^8RVFX3NU`g-Wl)m4 zTCIvWhsB1{ibew#+-&POGn&43w;_BN8&60fZ#TS{yl5%k+lQghJepRy8$x>IiE+*Ml6q zwj5lftT^Aw_0cL@eZ=987iQ5~j&PDcBw7juqjUQPlzdBsweTL;!O6&W5WbJPVY5Q9 zZv?1?0%&scxW9Xr;+es}Nas;st+j5ME%9(3Quk8yS`#JG@E+973(QH=_w1xhU|s!f z5;^%C*XK=c2_+Dg-j$=T+tv#!G{U9IEAm)zu0Q-slo$#6pU!=rpXZZfk49-O*fjmt zQF#nuj1UMzb>16t=77_J40mU~XHMf^$H>B5fMy^?!VoVB$*30ybp2wBmu@h;V_Q84 zxSf5wTX4AlEp0ycD2)Kq;_=ea_?A8(zEE?%acXykyjs2`{?~`K=V@T_=`)FNHR{so zco(OKV!F{^Djbs3_vK%*bSTzH{AjHD`-u=-J)j*2++R;sWJ$BZE<-ZQ5A?1^_IV!4 zzoldqs=borhK-ExS+>Uf0x!)#M zk+=xypQupD(RTnSse*KVFrgJlFjoE+A{BH3`0E5$1X^w{TP>1$)Qh^hZ^wiEuj4;c zq5-YjWRO6%OV}pFzFb_Q;|?Yh=HKO~IEg}Mn6DL?zY;M0^^<*akgiRw@-xPyW?JzO zYrH&Y4j6l~N3`lN;InAJS8=tb$9rW#p|j`t3iI=eNG=A)kLEG4>N=lEInty=OMj^J zu>E7~+wqRmXexn4qQ6AgnkpRUI6n1{nQzaZxs~uQ*&M)jG!6NMyBSUH_NUNy)(}mO zvUI*SkyifvUE4&2?K=LNIZwj}9mpEBOZ44K?QDrj zQS)x6Hwha`D`3-h>uYKm@snSjVS6Mr;M2o}WA@nU+l5b=@mL+-tLA9&#iYx-6?wdV z8V)y2I3)U7y0P31CTyk;epY{uU8f*DrJ8l!2YNe!Sr?~943c3A z$vz~s;SPB9Go-R6i56FoLrFq!m@;JHEC;C%=HAKropn3Z87=C`Y22~|7Q23Ae=<#alL~zVml@~ zJyrbn3JQ`oC35ZjOvd)jp?&PmH`s*7y+FMRk>)liRSZyp!e{GO!4wSTm; zFiT+awEb24t|`oQ%$l7XD7J}sEHS^fvSw!aNZ@ZoglaJFq`()hfM{&?KDGUXARWrt z9CFk9GSj-dx31FdcRSbPszzr{ApCeVgnj6GL_GyeA9|#y;O_G>yN}aX9jBd z`rSNJ@!|6(%ZXoH^8`ASd7OI@3=v%QoQjYrFme$d%2ZZwq~k$oCo+~(@X`p}f-en_ zX2hUQVnTN`^;^<|j8+vg0=RnBG15J%3Xup+w7V%Cx>&C+-M?>E0k#jGU2HrBJkm4o z`a{hV@~JT}*y0<_Oig@U!{7L^ugU?}o~}2ZZjGNBq#hl~YmJ#&o+_js$DVFto*aLp zn*ok64hIM%zrJZhlG_-aSxVCHh>@ggubZDAV}yyL7R-~k-=7ZiwBOCHD09{StQ6QN zwEY0in}LPs<0rz?!A0UJSJ4Z426Gt(A=IW-H;1Tz0<<~0Fl{e2TF744(vk<6CkQvv zk#$1ud79i_;Q-)q^Lq5i!RMYeX5`857DI{xV<`$M@Y{3_a+L-qL{Lz57UO?E)!taJ zIzs;d3rv{)sg7AvAFWq?`OipI5zBGLc@>1@>vqD_@Q(ZgAFkW8#OPB0U2(ffp;V5f8V;_K_%ScfhT&Pt^UWHN;g9%fG+-d{BNC=KL)Rreia?Yi=QYp@G$h>P$FW(ulH^$mPT z`;ACYP)P7tq5M^Fp)lK(y!m;aHczJE`}^a7+i_FC{chUcNS)a01U{20d{Zrx%J;sS z=zF56MtUzYi9leaIEyWQb*K3c!`jLbEQDgZX|N*a*`AILx!`a(_U!!*H*C}}`6fM- z0(q@MA`U)$+}wwiUP_%i!d!mQjDMb&N6itG{NQ! zvCIWakM^LLX&V#DuCzm3HIOB{Peo;R&Fp**e$F2q>fmtaAAPb0M=STfb{{|VNc;~A zO6MMKv!(o9JK^#3^XjoL&J^0OcV9ieS7S9Y^Y{9O1s%o7Y8!h57J2w#g14-5=PCxKlM`eUO}%Lz(-qPDbBjK5i- zfB21%3_N9|aU(s0MZU3Ip$|I0luK>laW#X z)3fX+w0QGJcu~MD%*K&9v_{0t#3UTPtO%S9eSiOkFp6XT{(3*)QNT1^H^tun{N$X6 zu>byn$N$zWV+0ok1!Y4(W~uUl`ZbWdFyQvW5#0^t25u1<9DSYUvlH`#?J|=6TPG+m zFwhy}+L9;=$K}31%)vh@b<^qz)4PW$lRpO!ES8sR{B)ZgaCV{YiMB+@`}dk? z47k6TZ4XR58;f-(JoY`{!`UPYTb1^|Iq@PD0^lMpRiGozTTCf3qyHW<`FG`Y%DEn2 z&j#Ez1T;2=02tz(o=#l^R}&{FA$IUCYgDDK090++W!PA$pJ`k$Ld%(W!(I`udQETKVosao1 zvXq>i8j*I?(=m+V%wCbiI4uK1Y3B^`KBrt$#O(7rDTu%fgZFfgSBn8sY*309e!pPP zn=EReWAYf3nG$*Pdg}f6IgJu6_?BkD5pGruQ?b#_2HJq?Dt2z||0uA!ZdjF#m$^PX z9t$fZjzIQ4nPA7LRlup5o94~0Q2^TdR3Xom?Hic*(Z)>{Vq5lh(R?30v^UM`?D)Hx zob%;2h(Wkpi7#OV0K#*&(wzEa<-&oFZ>-3}K`z!D0>|VH9h0np+;dsnX`3!n%CEvW zfA#iXCK{p=-PEk&!@;r3lp;l4#?C7<@dEUL3(Y>$4Ebk>bD@jp;AA@vfpFJEuvT>7 z5wV`J9%di~E7gCLr<~9SILSk$?&qa)>W-`mRMC`qdNl<}7t!lNG{m!M&E4omCVGZU z?xu+K7SMa(`Idq$k{CI>33uj5avI1xJq$QNbi~C<70EbtzuwUP(4GBI+9La7v>&dE zB&`G$8kYWGsHbO#&nN1G8o!(sB#XO^Ef&Ys7{HBZqXG%DX4oH{urm!uN9+s|ygs!1 z{r0EFtEUr!?z*T(YGQ_}plMTczI2#NaOCI=vGT@9E^t(%aec`Ii8{9`>`F-af`<0- ze}q`LU!g%2|{I?o^ z*8_3$-`h7FPBtpqS0s#wE#InHY66a=Fh>ngUKH1)&ryCO&es|JAZUfCuVF}VZ(xac zkOW_iadLnBH!!^*?EY3k>UN^Pow96;3=W6OhQmTaVC+r_=$u?E4NG-(A%}IaCZOVv zv0nII_Y|AZHk_=mW3S87E`dY?HJ$i-SA^Xii2)V>`e*KtPnnGuiy$k>$s3_+O!98l zyx<%3e)lKY0rxcl9<%J(j$1A&W;ea2AMf6l)W3lI9CJ;(`SkHn>Bl=g=S}aO{b|!?_;(d<_@rbvM|sfit~|_+TVigf|F{H|M%khym%4jedw-!c zzyuY+e@CAL5#*72k2KSSIl!q5b|r?`r$jW$FH6K58ragY&@_mo(WK6&>$zZ;r z%^%E|B4121!Xq|A88h~y&)+~Rjqj*8FII8jMem&kC=AD^9%*@owrra2K#6; zzW5!gJ-7Pvh}w}&bcQ@gB;g8ZiNg^P*!|x?f2IDfNdDbI|4fVjmq`8-?Eeu=ujBA9 zgkddSYcWUgY6^;D0P+nPw=A~fnGNCx-URdEP7;SfC{a%O_P$p1#+=7qfqE@Q%x}k) zWnul!x-Tbm5Im!YYtacAMag51wIkeG}2}tp3cnRT5D9+**3%RNN{Hifg;9PfM7RAJFHqR(mgA};nWUIYxs1p3T; zJIcY5lq_E)Tv{U^BX4=c$FNx zaS?h*8JMw*VkNVbNNc+l6*|x zafB7b22tjiG%;vRj*|9{)nEgD+_?;7AyJL2;D(U{7Wn81-FynqEzbw zR`bFxW2!J;?1wU}8x%U(BhLwP1n7Bl4?p^9jMPEV5vJl2fZ-LY2TsQPaOIW=Zr-_m zj0-s4@jW_|zWQYTfQlM@3W%iNm8OzJh_@dhXj^e|N?|k>EZQ-HqlZBRu~k;=)r`+oXVNgy`dmO;e=Wr+Rg z$s~8}7qU;V@i9nTeBur)PEQ==Juc1EiY^+8yn`QBSj7XUwM9`90fVI^KZ723P!+>4 z+`N8kID2>q=yuPnhOWA6+>);e8ClVLq))G79e@<5c4X%fn&=_FHeCy|G7Nn1@LKWN z3gg3fF^h#O3QK9AgXgkDDy3RNUrSN{pQ*9KxXM!ZC0ONtro_Mb!FJbo2VatkFJR!? zJj8;(z0IRUH1T4SE_m%UiPqOvIQ-!6am9-&HYE8R+S$WwH$gp+@kaDu*kzTqBhk%? z7YlzYLJkGu?dt~Z6$m>ajFS?U5D}4>L#ZQ)p&ALk6p-71O+a>;>OE^wwyxUBuJB^t zv}_UOQ5u%7gPxf3WbT8)`VIw)yMN%Tf2M_rNQg#56a!Wht~?2raB3M_yh4EsLPW4p zneh{yJB9v-(La-6;7bfS*GoMLiYsZLIB|KLfa@OMF)n0Pw#Z>Sh~B6&|NIi;?1i;C&X$<(M(*4rTp;lIxvEX*yQ~9b=4ESBlB?3 zN3v3@x=?4xsy5Ms|ED`zM3{M9bL=GCcI>5(Xua9=MMnNXPu#xm+Fr@}M~9fQY{1mA zF9X8XZPd*>dDj(}FFGehnJ$uc-0`OLa1P_npLw?-W|~s>Nb%S}rzkpeaDHK1OW=PeOgb!{%5TxgUe%@cb=RWGBgHzOP4_WSmPh zr(rM!0bw~)%JV&iAiwGPUHZ#Qoeyy2&wfzun+h*u}eCBjuZy9QM2~3f1~K<=vnlIB?6z zu%4iv*`?lI)8EzMbtOkasduKrHt^==&o!x_>BHKeZyr=gY<|+y1o)y^8PPO?x)7lN ztoVM6&`M`Ed~fF4MFzClE5jAppjMYn$lCfNqxkvxn)wqDXNc`Cw5XpL+)d)4h94cw zcE^VCJi0URgfREGWt5#7V^pEiDBDdv-vmW)Z9|Jz8TfV_0-`69yW1Rhog-CKA8)Q9 zNN+uy$KG+$Yam!^x;rbC5uv}}#2@Jxod_{1-vHVFA~0E1PF`1g@pVAqPqoCc%uvw) z`nH>klOhVH(cCdQRTKVRJO*~KH@1@D#<^idd6s1MhRvL|d$<1PfZUfC?TS?(&qc{2G!kU2>Yg|?u z_dcAk0*pwU1#ia;j&E%B$Iv6~>gTrH@A479+1z3QeD2Q%G>TO}9!yyonC#C_Sq-Ph zDU8ucIW)_mAe!hlMr}JuAOc#~Q&x!YEmnQXYwBT@0;_E9ie9Ok^Aod-OwzwBg@uNf zTjcPBGEB&ITE#G0f5VB9LRq%pIytvSL-U)We|<#sE5)jM*uZDlb?atpXYy3`@uo)Z zNWTo~Tv1v1$Brb6y+4IqdHBo+R9R~nBuBEUw=&d|H5fOu1xsSZSN!_le0r>6QcN|# z;SyvWzl$br`T;$XNV^tz;j!8DXOGrj(Dyh>?8Qs6M1{~-%4*D9N|S9^e#MUhGWsitU=#jEG?l-cW2Skqv|?#H$(PDs<1p{uv^ z{(Oy>w>QaAl+yCy?*t3Z$-feu7dWCQ_`g_y8^TV%M=Vm|^R4;Qv#qgh$?f=v;j!(w zR}kE9{jsco7rwW4o}I=A&`%VMNOw8w135Fu62J69b79B6*Alj- z`R7{w-JJiq{Ie>BJt6=`hS)y@nvJNZL&>@TQo{(NsY@RYYqVtZhEbw=B~ba*ePWv6i2r=G!{n$=yvYH~J!_C^ zN9C*|H{NWnrnOf2@RsneHaJSOx|HR3{aKd7EFr;%v)4Ox1h{{4S#_7H8?Qg)dbwM; zRErCo9-Zu|db?O!4lOq}=&qE?_LLqSj|?FYd89!}Lf+oTdN0~swmQaflyB`#2_&Ko zv~zzBdI?CLUOIK#R}jnc&_VSB<jb&^|Up+3ubq5c8T_%T+ z2<2QxUsrIqA&G{3xI}SWN7{7cBNhMY=~U9Mid+tZKvAITy&)n#x3)7zF|vNvv)#>p zv?DBwY*3OB+gwIVWR|5&FVJk%k@riEKV7y0L*dtq%%=a(N~4xJ9bH3?V@T%o_6_U| zeGV2Cebjeb@M81cK5doNBgHr`bFfL2#1OqAUe&73jg$T?X!DL`)yi~PR(HXsrapkFK-gPm|Pbh1%0k#?fFmxc?$G#hp@G5s=CBBCiy~l9)?$aFs|g z{qxP1!rSxyb5K3hbTJb7&z9M%)3z(#Q<9q6356^70Q~5=39FT@87_*|@*e{`YjTR= z7T`z&TZ$drHvyEJmv2?H&YJ7Re%tV{blF^|MNY?0ZKQbgn#uB~tW6Mn3$ccCI6LGEG!^3vybrS6+GOwqsWAN3TAc`krP^wG zwDZ7{XfbKs-LpUQs{Vj;Har#uFaC9R6WlMGPX8c7{(A;TA!P84QEfW5rg%QBBG?50 zl7UB~We5s);^7w&VLI;)rBNBTx!Axu${Bub_OZ#hy=F=9QzwMb0D9aSKG*>f@Y zi==1x-kTJ^W>(;$T*A)b7*RU-OGoy6Cxpp?^o3+ZF~OahHu9xNm&xSdSf|Rz(pV?A zChwHoC1qO^$k-T1nGS5mJ5tip=6q!7`pt_%gsL}-P7P`?3pQ(KFjX)}b}pONU;Cfr zGV&VfkakOiddA1kx|7YCzB#25bBZR&<9(+7%DU2Hi%1mCw58x{BUL%n_M@8t}O zA$FWgDn@g~xTC6s>BZH?E(qMHAbC|s+Q^dM1Y*If^C~ORW~sp9osw@OAzyLl_Buh9 zCKExs=^UV7-{k=z#N^MDp3F5EVMpuaLiGC)w%YNGeTcg;OS#yp%{}e2;rMOMt*wZ* zqn=Iy@VFaB)!&gRVm~ASRRFk1poqe6;#&fiD-k=y5wbX+Z<`1cvnuu?1dXZC`6l2l z?$wt&TW1ah2he96@BJk+^j}=}HdYnl)+rK{5#nk4nn7In{x0Uk;$Nuym`;_!B;oGc z|3%nZyt_c}cHJm!R48QsZLj%5S@3bigTc6v24r$RBy2Rh(8aV4oKN2Wm$ zsJHlkLy6Kuf^LT7<>V2BL7yi^pbAQKP%uomoaZtXNFCSasnjMPel$gJG zd<=ocfcXh*nB-S&{WvTTe3ywWE`slW6vL-ldYx>c_iRhMt7^?}t~N8oAet`yZ929P z+-okeGF1OQsEDMYa#%!1GzCB>!7o>ojn&D}Dw5rBtgqoE$jKS=byu1BEpN+Us>k=Q z6KEsijJ>EC$Xu5uqm9cWj<>ZzOj9DzWUb{BSzc^zw?>Vxqv}bYAEigd9Nt=jP%iQj zyum1>k+}~30%!@1vSVeJgp5zem9rtL_4WCF=|lZ20f3*kAPx3ePhULpDaEy2XZieN zI-Sfl_4gQ&$_iZ>=cXvno0YCo**x&tvU2fH%Ruff{boVw=lklf&TU>51^mdn2$HO0 zi8LqE9fQjjk8~-Rq0U``pP6&S@ExicsEOxw4as18L_ilkkICDdm)A8Ej)x`UZWoU`r0 zFR?auAW#v@KC~bf3*WZ>MuCtU#n&mz!^A&)~h>l7M4~f}3 z7K&l?~1$(il?rfojy49xlT(%R?Pak^Qbmk1Qb2eJI>qXEL(HzOcn8@ zk_gT#5oZxVsr(Y;FNzI+K6Zgr*rp_v0vjXgNn=0gLPAA%Z$$Q)kayltHejS2Z0UCy zx3T82`?2PEeb#G0g;UReV77NpcXglnX$i*=%J8hn#Wf`3FpxA$hmn6FgZkv3y#r_| zd3W?yG>BP4*>ipaLBv4pTLa{Pfy0q78W$Io1gpidgCd&H~|tMvhBcD z)3Y(_T^2VoD@BoONP&QbZlCequU0K8E>(_KEgVuS?T5*#wFK-uFJ`ugq2B(eG>wlN*P~v&|V) z7`3rsm{9|lUDPlqf1n6!1o{1TiApt-TlkiY@sf8D^B-#*`q0@Th{)ZZ$t%e7j=87l zyC-wM5&JnKlAYFom!2auj$fFIwYH!|DM$i9xBEaESOhH^)GT0n>HAENG0dAHTWU5f zeOW~E#GIAxm#ca?c}z$ij_cqiozYRr+8}dvWT>dO?{1=6hMW(RqyjKhG0)v%8qb2H zF8%ZzZCr7~uc246Q(=Ov#EiGjAVYPyet19y*^4XM^J@A&U`C)a{nTyuMSd44HpbYl zQOn;a>l6{K5{y?ZJlrf%&DVg|QoI!zU9&S=dsrE<*wT_PiEg+|E0DK06%dbcU8qIL zMcLp+BfyXqVyX`)`kJC92oY0#g!%>p@bQ7i0&8Hj$L>AWqiKaV7Le?!BV)+84npzJ zEr39;oIf=iQk~S{FQksmU&8D4W_eisrD^7PB(d6tKmo*`WtZFl1M<`3sjTTbETQj4wKL z*^5Nf%!;zcP>dcKps^qflI);bcDYsH{*Y?>91+CCaujA|R{Btmy~!Pyp=R?fKp8%MrUrj!4hgukXYY6-f3WGeA$ zh%c(q4P+g=fpag*0@jW}p;DI(u|0S$bOf<58<9jMAd+p583a;LA2%I?UUaR$uJ-wz@3lGVZ-FW#YR!7A>&XiuM z9hs8s+N#ZXS|G_q~j`{Zlr!Z@)g}h-)=fSF*Xkl2;uBS ztX$8|mKEi&4AhPu2}Xs=m`4N0?%1Okb}~b`2)rvkDlTWR_4KpqokLvck`$aKhxAK- zTj`UjZS5^0Eqe%4(4Qd8@`yViPV+$=GUV7dcZ6s;mcnJWgba=_)&_kK7v! z=Mg3JI>H@~mtz%<}xkv4}Yn$DwHcdDu3 z?Y32UpT!_#Gevo+R)24Ie59kPGHOVsn&^?k04p?QQCmtDD__Rx3+A#ZS1BuR^4hD; zHD}U1Zu7o7TIz56TvmPlHa^4OiQeREGVpMKtNO%_JLP%4U&*Vc2?uLFGk+S}mQy?b z`&;U6EZA1ptJ|R3XTC93{B(xDj=JqbCw-zK;I(VQh#&8wo66$xFIsX+ClRd$s(3^p z%@?_l4m!q0RZYA_QnUuDQ*YjZv}Ty#J`%L^{XI8f0Jz7BV!pm2n@<_eQT+!a_4=J8 ziqJU}w^B5nPU0KvTe8lNT$kg$5z2Nb!E%a$@lkTwK0xh4fts7Oge(k`BJX*Lu zdT+T^pSGa2+qBP`XyjQ2koSI&v@~l%qDB31{oo-q0c~8-&eCoXzhAe!6t~X22X0&j z0Rg*%#!0Fz;PK+0dO}&_IheHw)W)r+OdQfU&V%*B@rv!iEFT8U4>mqW^md3BNB3T?2!A!!ZL4z&5W zp&2N8E^g226d!C;9rY(ZtfFtbvAjp`m#P|>4QaN^_N*(y7rHDJK#A4WVy!5BdXb-L zO)o@5iNzFqWQx#-gXg2ZYMt4iH01ZHaHg|-;GGm&0mDy~IXZ&s?^d7enBHuHUYmUH zpvQA|HlUu)==n8^E_0dPCn!SdcbODZv*{jKDE2((KP(3AuQN80kBcv{UTlS~IlCfa z9$frSUgHz2LO+c}#C|rjhuhBTL|Uxn29H_}N`fUF3L<}V?s70vLru2MiZHit%^$1~ z<3nq8E4Lt;ywIhT7}l!le!2NfX&VLsvycud+KfS$r%-bM#?zFfj8W_Z{O!lcy-*r5OJn^zoL-m^T7CD3Ugg>AOY+s@!-Q{ZJfFaIp%CLDBVloh&R3FJ&j zIMN`pJ7C<`R4*+r?NN$4wDgDT^_~DeD0Z{?2kQ=^;0(R(K~X!8F*E7Q~p-!HN;*&cfk5a1j~44HavSHU@v=469x+3bd@f)TOb4_0VR~!-9x_9 zy_x`S=j0@=kj`6+%2~GO2E)sj%*F$>3C&rb?8}4S^opUDfrFwdc(IQbbl^|2e;*kw zv~TH1i`AVuAaM=41FvS-9r=TC?T;&w!fU~ouja3~3G3%H|CLM!LQuK`qC=vLjGdXl z-)B(~*a|goyVEfZA#zCtCDpn$7qE;!BBT`o(?{USe! zV4lMXu3?@yZ%*<%1Y}ZfEL#K z-NuW*DKH|dla>_FZ#8#7-Gv&8>zmtA$=h#aUgz_4>)-3HLx#DxGlhH0eJZCBvWrl|6__E%~sCwh7}>1?txonYi|EE>d<%>D+CKlmjJ=$-13 zhY}4j`^mR2W!Bw4{B6>X^ZicywCsJhFjBMbXqGHsR@Ghu-0!DF>mqA-bBG5@GP0v#fpoBs>471srs|DS>d{ zk3exVL$lhUYriv&Xa)x!aavdJRiM77DJG(SD zZ19si7X|EtN7E7WSpL`1!ZAUN5|E>OK)Pct`Q0Tg&Zw^pRqU?D>mq|;#gRLAEe&6a z`GTCIG>Y^%$HQ0oow#5|LG4*j(*=3EJH?nwCA`LLs5rV8+8s7jCN=5mzG%-1LH?_I zhyP=)2H6f;<;tWSZI%iH$v(t|rBUgA>29>Rdeb|-G_|%XUKB6donTzgBqh>qI8M|< zPcW5Jht-N( zziJ69y<%lac15u>qDCzUX`i>?TTe*cW-0R$>62$XZ)ySrE)`@n=dTZwwz?`dn+gV< z4(JCB7MMMWrp~+7jI^7m)_ixECvYN7{DJ(OG~Op4;%bYN0BrnSo!YB~6MQRm(^#pK zVQX47UjMG=3Fg%;D=J&mGBskZsDtdFMOQNX_3t)Y-h@4Uy2+*N#>&Qpsi}B6mhp0`8Ro#BIoVMSkYd2S%U3K9T?%V%(|OsxV+J;cHiL zS8!u6d2euDN-@5T)@|a|#738l8+di^HkpJ-)$L77xMqggHo-AC z@PrxxQfhc=a;RjH#E~MJx8ME5t*4LP*q^^irG*!#QUQ-I;!8OOU{e3E|1j-nYR*!~ zoC(5vT=yN-Z2i$(9Bl=s@{`xCO$?}SFn+Yf*c#hd#)93V*13INF<2E2A@t8>IZl0B=$?#`*1c-9Kejd%&)x&d8r%TLzr*WeoLh zD@y6qpUj&=AF~N~Xcm=lu>TOdh)^9c3(pwibFquJ`_$>#zXRpsFp&1&^4B~N8u*v> zLekoX0K4Pnc_GuZSfaqoWM}coXOq!LtSeRBDl8th;&r1)?INi*5z=I}U(}|bSsYV4I-ta{eF{}AIV>e2HJb(hHDF!xF- zPn3E+)cPaH&RIW@RYl*C+*b+jz8!93UVK8Oc5!y*#1!YzTkc;HrYx$(p33-vzvT#N zck{&NsGJ@-RogWcx0aH;>uoJ$a{49q5nMo)z+UOF9GA8WJJ>j-e8wTp+qHZBBbA@6 zO8Ns*&Ltr}=%IcU9)~-FJ=#btH9Ap7DnmJ$1EzK})8$;^gr8%^N~MijzVn~au14|> zB(1r4kp>zC$t#Dr<~n;AlqROaDapeYYVj?TAF$%NgDXqryWmIT&YVn_VjQ>;ON$N1 z46HcZhXFLD;p9qlqU_AD zt1OT4M|yInljH*K71DR7Y)AwN-iRLyxy8D|K;i;}`!^iYSdihXQT#@WaAJ5sTQ-o< zv)FNd*a<&b`i3?YYDrBW0Uv6{>EyrDEYBiBy02I4kpQO1JN22osT5qQo@nvMMR`ij zuoBTy!!2>))$eH=VXJTD$-%zXpIb}xPLT}nNdkV=nfT;a=KyTYGYG2UdNSi z7;n)n2xtef2zl|M$DkWWe+c-meh9{$%A$%hsoMK2QDV>y^g8$wiSs%_F{on@1EDJI zos3fk+s&@zFV;07{$h{x`bHimf3;j6)sxhOZIoXSWXZJX8>{x!<{Kmv1XJn|jsX)# zk$mn+KKN(Cd$s{%kl(0nftyAIPAf-D|23gVW_m0?Y)w*#zb?C$@%WH`3i$8L#f$*` z$WzP|zb~S>*fwc_Rne%>_{XS00>XNOaKt@~wp9mD>a0-FAktCxar8c_)qxp3_`A$5 zL%4x?c90o7`g#;_V*|il|K@ACY5t|LL+GES`nm8 zYS1E&RGRc=79BhOy@7d_oA5_UH;BHM%~+qRh@|6UZ5XIWkRS$phy+?)8*>vlZ?4JU z0TTa6#LcWomjYhtC*gC1-gjHU&r?gyUKJE{mXKFz??3_C=SO3I~MtGm;;$smE|u8>oFaS{2r-8YM-lnyM|ho{HbkWEg%n*sfB- zwrM3*SHniqQNFM2WOs(t_S$^$_|cI5E-LKCjI zb<6}C<5Tus3*`1dM~?5YLbS&U!H)@4z?~YnJMmA+&iyWCL_q^Cajr*1%svTZBMkWX z&ba#ii#k|*1#a#934MG0Ro4^p2XWg^oMf-(>gh026GgsuWwGu;pl!DRXq-AH2epP< zxCkztN9rrnI9$$pccoC3bBgpL4=*GKjZd@+xvWHhcwk44aO#XW_Y7)E1$5aF!eY8$ zQ3mahf0O| zNa!O9-+n#w`Iq|qTSV+>^Jx&_50`51+hZv8%feyt*;d-UQY#3b0^rmdmNziFBPpI+ zP(cSv!Zk?rBC65}Tk7|)<2+}nmyR^3@;$thX~_oO?wo*C4ye@PVtV>BTB?HqFT{56 z?A340Et8BsIZRlg>h!08so_kxr{OZ4t}bi)*A?~+50L{5GOgAD4~521xPnc$Txryf zqFE-Q*{NF@A$H5F9qcJlG|pze4-ENrG$~D|UiH8BOC|5@hX!8c0Bx6&2?p5W`*J+IuWND*-ePDj(tp3DFSIDfKrf8^FVpQ`( zQzu2tKGQFhYD&X3jbh)^%VK!4VpA~nGbBr)QkZ0U$WB{t;(jH9w#VCgpum?djNc%Y zloOj@IEE~^#`eJ|@IiJ_fg8u_yf9M$&jL0p`Fx6^85eoijeZdN(8RGNlB&p1?OHzEQ+vArMj-e~PU&@uY&O2b9p zt)Vu+F+fk0lHkEZtUud>`1ZR(Kw&v_SP?%`tMf+TFYF=Ie5A0axkbN z6DWPXzTn(D@A&K3^KhBLt6x2bz-bD8A+9mYz0#r`L4iy-ArrT>%z&i#z4=M`KX!JD zVM<2u$@t&7zWM9K7m{D^0kPcY2DlcZcACthN0={ukC20vEp4u<sPAF_oqI1_79C%(yroQDre{?G@RrXf_IdrC5tMYhg3S2fW_k)pm7 z{-lJBva10iPm8I19Z3Y%mc%*Hm|j@<+s_ju1pb6qMh;S(?sC%(oVpfAGl;kR2+Al` zvHyjjeB0%7_z`jOWK+jSaxc3De(aeZOcY+w|Bft9QG@?pLq%aApxd7E;M>J7LdZ6x zZ{Pbm@4ttt;FX%c_QcfmB^+1!rvV?*6EN#t+OLVGiU56)n3)= z&T4OMDA#iPCgYM{8~sfq8Ng}o(aH?^{7}N)Y~}+F$gr${iMx8_LX+-PIenxHRnR1$ zCy_<`(V92VZ?@vpXFT&O@IQF@ea==pC4UX0WB;~f{_2`)k3Ih~?h|LC+rz>le4Aot<$J9_f+D?s?WN zT3r;>3QSnxgQ=EWMZv<$4n1L;&<@%dNd5<`Wu8_X!3pEt_zt%QGyUOaL3$JI-6SPb znRa`3m#CIxqqMz#c5R32DI=8CVCR6!OSz)ak5*XENN+p}d9h!M(>Zi1orU|%jny^m zHcFC8s2ITavB3IY_mq{>{}W0SQpk4h-zm|TasA%sum1OMfYiTwioBte>YHo%_Fwr8 za1%>daWPk$)-Vr5)nhwzTxZZb-q>7%m=tcm@jTx-trt$eND#|P7B-DCM|xr8eW+(r zoAR5If!F_=7)9gjR@jzM9Sg)lm}A-kmxa{VzvKK(ZNLIv5fILUYQ9OT!Ug> zyutqUE4~|_4h+6ac1PCtjnK9!ENk!%l6nKa)g*O|V09rr-}0XhNz=m*eEkuij>BdJ z6~H+eG?0wwEz=zv2O5jNkm$1YT#Zt%%4~j@K^{1r* zeZW9l3%wDgu7Kdi(-{qG231T-XV^$piL>N0$+z#{yZ-p4)GQa$K_fFquXQ#2I+~yS2t4zb2oF%XK4k>=gvnE=0I2Ao zCauD|5&eMn0DADh+r|ToskxVVqI1;?JFsR!jsaDv4mAx*d<#B!6(j-65W8UM`D0N6 zlxch_*SYChOsQ3KYqY~f&O|X`h4{-lut&4%jLZ5->w-*d^8Ra&Stgct%m7xooL~mC z0vvAm7kZp5C^*Z8pE0J9V|wXo+(}lY%GT1en$ZZOQ7UAx$=aOmdwEW6Y*BzE84VRZZm0Bns0d~Z*0X=j$eGJe)xZ3w@z2cAny;6almv1v ze5IS3ff?k2L88tENQfnD!N}bBKkMuau)xE}!RuB&U5)G9nU^7^T8sXs3pbEzU7n3h zruM7o#I&1V9l~mV}_+9Ym0wY3f~^I z^c1bU{N?Af(r?h%!BFWB8f0epD5@Yo_&j~Go962IG}#H`K8WXq!ZQ*zCutYjt}+y3`B~& z<}!AnQhb>uWA&5Ky|YE0wg}-P_azaK->Ax_dwMF&@SMj-F0c$Y9h6@sg3t6*7R~2Hga^N?(~!czVt8oy)SQVy;Cnf zCfN7i9?%{;WUe({fqnlxYPcoN#eOR9K8{)3JT95S-pTORND8VB;yxFDdiE=o*B`Up@?E~KUvtk(Bf{q5KD^#?fp zbIpOn5;R&?(b+6lbVtX_##uT=iTNz=D-_#vROq_MZ6aDPg5d-ENL2!t;|kKeBaO(} zHQsn94S3cb^gx!4XyKJ&9A>5R4w1of-PwFlejlGb{-OgTpU8XE_<1}~Ud?r_&J`Ci z&xc&a9&w4~<7W1N=+r=4ZMCzI>8l-+^EN!2Og;3gOil?^6^+DBxQkJlw-~%wYm#ot zmk|3n<~B_fc>l3Kv`H_#M>jQ_w5*^SToUEOI%mpg^sLI1$7ZIOdtPLmla-tBF5Xxn z`~w9gx3+nm59uU(nVU;O6v^G*oHAWOkP7k5*rDCxr$?JV6-cdzO;__g_oBJcQH`D-NQ;m85tlaX_)%c>l$*Y302kYxR9dgzNI15<=$xnrG3 zf8%NH$c@WH+|DG=0(CTzNkl+rg~ez=P_=u5h>J;-T&Z%~R5&xfuA%PY9A-?5a`VTf zo7JbkipxV}E%gz$*+kdKn$n?iznl>bRqN&co{W1V5h533>y*YlQ2ZaN)q}A_C1xaV znL(5fgu%~an^xb^JXF1SFFwz!xclI5iyr@gu>s~6JpmU*ekt_l;hP@|JS9tUwb*aJ zu3}FqGfVJ{C|~`Wg_YyR@7X8Sq#@zty1^?9>Xgzkb@vx70dPdA>ALML*(&zbL`>A} zhq+%fEIO&(HWs-?SLf3~toek%+UBgsBv6NLNjyCAY%Fs&M$)X`Zl`iH^&3|hOy3s7 z;83HE_Ba~r9kXMHdG1UV08(@*3O1H4b(6mP=V+-}ER-JaCuV`nHFc4|Gi`tGPgBfF zlACV(Um%Ae<1dYOU!yFvw+d9Ru&&*|^AEc^t!rjZTviXJubtc*=A8>|LIpFvnjOmR zCEm~vd`I|f75U={t~Y^u5f6y#Zdyl#=GBmhh|_W-oW~_ob%~@J3(Q)ee-<^`8Q%=q zY;X#fPo~1Fzdty5SIt0!YP7O#3W~ZW0=L`{JU#-w za?W28kP{hxsdj@h@BRcF{f_hODeM3@x$P^dfysEbGGhizC{2TQ;uq`(EU9Lio}8{# zu*UI=31qBr+DMy@CcyQri#?$i^tYvtpWqrZ?!BarkDOZRVoKOL0()3{;?;kX@z-B2 zl~khxl%chZcoUI~1F*r!4H%!9)JEMC$r9%z12FY08U9D)!&g9N_s?A1Py9xmsUBm< z&e!x3t{b1LPvnY$g#V@k7-t^f7`{jz>EO}|uuO|?raOw>x=S97knu3=GB0>H9u;Ea zF)Kp;!qaA+Z49M)8-DXC5>n)#=v6eRQ-D{^12pOH{^}aG&5qhLS=q4 zRF*QO?q@}@q}!g#kTKBd#z!{B_H$tG6K3Q zl?d7`ig`Ll4E)9wB8=d}@7Frh=7BgEJs;jDI}K3uR+ks3|^ z-Vqa@OL!eTL1#;?ZvVXt(H)HH(wXBeB_WcfFedF5OJz}`>y|Xe*$@n;6?WQoHX+Rx z3Ocv25>2i1tTM#K6(oYlNXF%zO+jZ4XSKy`L{07IF2#mZR!dEtosV@}DD}B-FlE<) zd-8mmLEvUQ>yKY!8H1^2&L3sP>(1J)7JpHVzy(}nrIfYP3%mP?vri=q8@-)wzulVS zOy)FlrgNqcj%@_x?+?Gi2BbJrr^>lIGMn%>)1KqAhkB;Rqg@!NjEV-DV{|6kD~`!` zXd|EBH3V{!QTt#DbO@o^3)~fWd|9$fmewWFRDZ%Bm7L2)oxbj&`hqzxjLhd>kNmLw?_t=CZG%U@ zx27d8~M}xwMZ)dlMsng7mby5&8 z5V(~!r2?06sqeJ!TGS2=UNB9OYNCPuOdAAS?iJ7XOqL9y9lX2MGR96#j9BgY!$f z+&}u$r>BgGtP?f}S3SW*gQ~JnO3xMMq9lH!LF&C^o)SGf?!`$U2~x5r?w9RgDm$`} z$9^vez0Vni=Ay8q>5w9_KrQ;%IHIhA2U4%cuO5Z^dZepPJ9BR%dezQ0PNhCo`}%{i zQ|p7qiv6&&9!-8nIEB`(V8E7RrRJCT$gHnh2ZAuB$aI6TyVPjX9Wtq&pD;FL5P{ZR zv)Tw~|ND6WBvQ{ett-n?%*IV z&P$r#X^hSHL=<;0Q9RliJM+*V%{YFJ}(!| zMoa)<9u!UdEQvh;usjdmBkqWT;!9{Zm%)+VAR~*44W0d+B8;d#gC#|>Y>esZrVxsG zRZXj`>t@&|bTD@?t%&IH0r;{Bl+LK98J-pREC5FWMnX#*TI~)ytBZRABb_h@9}a?@ zsT%KhCAXK!don*nN+TIUjJMl`b;R+(tPtC1<5cjVzLh z;C$)tF)37@7YyMod3<2~I&1SKWdJ7cpj+rT`ui@A3X&j^gf@&SG!Fwv3>HTW*>(}^ zQkus=^*lj=9C%eeZRy}&o9YfEC#8DY3YCID<|DdVaN^nOIIGL`f&DM4VJYa&GvE=nW+eq#uKRZ1xnL3$#5>6hZAA7{h`T$#~7wv2EI z=DR^haa$IF0EQJ2WliL6_O$7w260uboOi*$>FaFsI~;LP?dQFZTfFY9e~xSme1z#y z)Mxyf|8Fh)PpTbQvTaIK5Jf4*Px`lENmqZQM@afk*lD-!#J!HSC7E>Q1ItxMC_(MruA%Z#cwYI361$J)V~?IZ#W)vnhR%yg8XY@tL^iXH8%Ij zpz4eO$-r zUUUB^D!ns0nn%ZTWYaicBS0Zx^$J(N96k4_2y^QwJyQ&eG4f z+F=!#{F~NswHq5(2NXq`3|Z3=ymhrX_LfOJYe@NWK3opX@_+FWqSpbT3}+XPqLVpf z;muL9s%?kxhq+L^zI?kGBI66-`+8qnMj{p7!TS{g`eE?v<{%uje(>rBh>^;b|I#a{ z#0v#M(Rm5Zg%-DNY{-Gv!>))Q&K;q|dQ)2fJX^Pc8dv|Z^yi*C1UM?BjQz|TT z65b$HV|UD;IX5j9BgWWcubnzD+pQ9vl-}HRd!pOOqOyTT?XP?*TfIhJg#(%q%)X5N zOh$g+ic5sL_?@_a7}mVFs`x-bg134;5qzU>HMajd5lP5 zp(OpQh%lUJj>{F#otDp%ecJ!7mIvT=mMJbV%cNl|i>i5(g34roZz6D_u* z$?~0ysRv%%7q@~~tSi4jvmEg#us1WerppPC)H*XniNG|4CKcA&Y9b-(Qt4TT?09RN z>OrB??jX;!{L+;Dq2I}(H(EXyNle*SrheN(WqFL|P_5~3L8CC>&Cw!T8t>leRz-xf z&(_py;qCut0X(04oY{`5o8PNG&HE~3SG_u;kLB-1>gM83y#<{W;*HJFHB5O`pEEm% z{SN9k%5(UDOt}A9H+ZmdhwCjb-A(6`5zwGESq*C(gjLErpGyDxEy1EnpDT{T9Q2Rd zA6`%-mC8HgQZmil$z_v=Z6$9ClB+4WeRCNwF|(A`a&>r+`-V1k&J5EJGVRWR(cz6A zUN04fIYCP5Qot>V1_IjeiHa?{W&e6swf0!Jm)s<0xlC%WOLhdUhkH{3Opyhq^x`@l z(tBrCzg!okS(yyxj7PFycbyuZwpwn89#_Mw3YA!0$Y{=Cs=ic;P+IdIJu(bkjm*d#D`gsM|qTl$Ehkob%%9H-}% zN%QeZ&!)H{Zm=G)H-M2*!o7q!-kB_Bt||dGjDR>+%!4TaYr4Tee3 zlyw0sMB(ZvhDPGm>(Z9`gH>~UbmAc>(8ADU=#!e18s@N{XUK0HBaV`!6oTR%I12W+ zGyFoivp~J<8bbZk@zXqX%}>7nEO1w{)`+k+8(zfGx$4r=!cES8Dt+R;(c#zKS1Q+w zUMtXdp&-k3z=*86L4X}Hp7q5Iv#<}oc&F=-Zv+1C@Ll&xzW|0%0v*oKMk~PQuwf|0 zl$QwHJA;32>h)jsx|b!|U1`I30soJtt6+;O*|xX@cXxsW2-diJ2oAwLSmO|A+}%A$ zTG&>)RVaQEQukD0meA5@*M&Z@na)Xq#c9U3mW%00bI_X_y{LEv92NG2rc_`HUi z&R{bjD9O}BctyS;WPj-QSR$C!|21v=LNt*jj~m%aQiwNCQDlw_HTzcrGhsSuLOF&yB>=?BeZmTU_slrMyrxKwU-gzlkt+4_yO zF1wQch}`$=%GpEDpA8W%59gi#PMvdIm>I#JrAbYY3?exSW_}#n9>xw@2gYieG2T>| zh)9Ae{}SQ6B!2oF`BrmPIaL7dVh|#BWz^GU_uB9qQ;7F?Em@?@eHXs$CGFDgA!)Yl zQk2`Hkw<8;LuJWZLfunbPT$J!>&HB29um~Q6W>sZI~eqi#%zvYYE5ziVXw6Qy9+cC ziHWaJp}L^~?^Dg>eF+;iM7QAtCFneFkss5egfHw62ZcCd`vQq z>cq@CX;c&;c3ub1AvdolUD>m7cnY;wuB4hF#?B<-L>Lk?@m!-W-$0ZCH_}R+pYiC` zNq!FUO3rF7?_aL&3yu9`fNF`_yA_H;a7faeBE>k?x@#9)QZFuw|3KV~#9y>bf&nJ!)Fggh;4( zZ4M@>n|4M`%HqDS^lXe%N|B#oF(valpZ+|cBrQc>kM-oQQ`W8rVQ&S|_fEtEZKQD zIkJ{H1byMZ!>W;i$-Sm=19Q-ne;SO-m=-2!h>OW8iIOn@W(W`sLUPw!K5mM5Jj_Rj zL$X9VqdF9()nA`SBRGDV*c5?nd2h$`wp2`JXET13>fwdywnkP{Cou#ZF^-5P#)Z#5 zMaiU;KxdK#QOS~)a%KK+U9c95lz8@W< zpx<92#yv-&6wRS!)0$5;&AW;fI(2h<UVqUhP1&FTy%yx2u>lkaKD-~1N@k+6un^-~eoE|;4AeXV(`6F{I^fyJdRfR} zg<&usQ+Kt#gRniaj;ERHf(;VU(Q?!(Idiqk8?6ouWw64MS?(xQ45jK~G~-4g{1Sl- z9tS=@78ToT;4Bg91PiDFzziRH!{&b_9|C5qha#Ba<^ts|^}gCAoaikp*@ zy3~ZL#%mw5pDER{CW<^bi+4ItQ6*prtOGSakVD>2hQBfeOA>Kzj%*kfduUJtUX<7nfX!+qgGHtn;Jztj`C5dj71q)4KNHPQv`l(v%lvC zTj6MDfY91y8+)zIhxm8V@w{9ip1flj_z-F*seR}$MOIbrr0Fqbc?+(2>jM&9TRf4WvM_PTL(!S`OD-po*;Mu9`L3O1z~~%dy_*#DY{6E+xLW}Ils682+u|`$fJlm=1@^ZgD6%1Rv4B`;AqCbyi5fBaR_l zoDNYur1@j6*iYIBlIrqE+115^+6i4H?s5xPm{7ATjaLqfhna_-XXi}_4u);87KTwZ z(?mU^Qsf*6U-i9DZ&t}iU$EA()VMY#63wTQEQ zPTZCDcl*OG+2*&n%VK%~OrZ7eVU_EMyphxjDInTYKb-b6`&Codl+LeSU!9q64YxwB z@P|3N!7Ha#v{~}1%jeq|4LLSWCKdD^=hV44n{bfn!4sBCe(>6LzG|B0CrZ>$UIz#* z-2ET$WUOA|Cv+uVCO`WE@P?-Uw(m?GR!{@%P1~P`CoTk$puwSzV{vXKuqjtCv1#1_ zGXH`O6wt*Tkn%S1>C8sqkDgg(VRWJ63nuYatkjxVa}>ep{E#Zni zfaJdH6QAdpRcKcxl3t_jOx(|M8nmBfAka?JYmSr}wxdp~r(ROg@IokgeNtp<*NLIQ zyCLX2iv+>{3^6{W-0n$M!oG#X?2Urt8&=!kK}ehj*gU2}Om(&`zd)mQgQ1sRWN@Zu zVJgHNTr{cv=`MCwrLp-xl1>R7po-Jn{p!%URCNl2HcO>LniCpWx+!*t3h#W$OOE#F zWHI=iFb7@5~CwjdJbpu!nsJPM|c{j>WaI!X@i73mceD`U=zK?$ozamE6tH`ZEI63Z!0 z{3D@MBLObsyPpZyN82=WO-+$B$-wd^kKcZg$kfpC(osY@fvA+o=*(zC;QHa>@5cJ-oHOI;12TaNLIfJPrQT@U~HMHyy@Wo=JgiU?X-t~4(1XF3$K5{Luo#Llvh61RO;*;JKyE;<67z*qw{0{R|rj_1zg5V@y(JLQk9lXHtIC#FA|&K+UA|GE0PWe@*U`j4i*2S{O#o_j$|%<`)m%L(DUxnfj^RZ;z~aNcyb zunrSJN3#>`Z%Utw=nv|=_0Y_b{z&4s!WiX|1l{OiuRudB%Jy`>`bNjFkd)p1L9DW; zb>XnU$e^S8bJU}^8o*wUuvF|eLFdy$GlMdY{GIqn7M17Ocg zkF!KmG7srt>9pFl7ZH2bJWy_N_fx{5LXLT*@k3jbd0{t9_Rh)&fIbU!VaMyl#4;Ja zvF5L_oV(QrKHX=yql(agH?OLCyx76`RNd7XW6!E#>ZFal?rU#OTq!;LR_X3!l&5ZuCa9nw^l7SfN)2t< zksm0##~+b*4UUBZe@#*h!EEClgn@l4*_ia)7Ub#&k9;63WKUl-1c!K}((9OPk%XC2$oo9zafBDv@r!?cLq@L!q=$gQgHbihRe_x z=N$UnrJVVCx&->~vDQWS72T{#M_b9pMckHXya^zHRoO8oX5bDJ{pmJ|&JBR&t#&A~ zAQ%@&zAQ-V3mwv6M|#KYGbKF)bkOU)*84d&1ik}3wC`cqnU^R=Dv0j@4L?tzEFHMi z?L{6v#LBbw&G6(jC!j`!PVJ~2)wp7>6iRjl7xER6S$nBhPWxKgHPQ7?s*$|5Wu zjB9z#lXYnfT*crdn<$JJ4KqcLrE6WQ8+k2|9~*8M6y}k98lz1>(T*L$=EdxA_9pgL zC$6yji_b?#>%@8PkYBPNYEfV|nh)0`#}i{b=J4u(C#K+uF(M~q>pM-q#io5})j94= zPTyF#y1|ebawL#!l0IGtij})6pxia^rRtAweV6cJeK+8k;5qD7NQMK~6fwX*wtg`= zo{`P5q0Y51tva(JKEcD5gwI}!uin6tj`mF;o@HU;RmfZ&JUrn0J@9bG>y0&1;!|!W%bs0AwRV?}g z1&K+GiX7u>*matdD`FEFTc`2A%wvMF3|%gX;L4e|+NLMi1i5*3cU{BBAyx9Qyk?BE5W z{9H|<(MY+Q^dF$=pA&P7)aP~B2|R4HV|zJD+NqgqW8WO8IT^R42i5pd^;Xe9m0Fe{%NSx6#Et+i~Gy4e~iIS?-0gzSGLLCv??~p|hgZ zjoH?^f18AUF)F7(K(9)$`CVqR45pR=y1Ab-Q09!G#jeZ-en+2-N(sS$@7Qhy%m!nk zm(%^sX{?GI(4&B}tr3l}>9K!B?HBUo z^p3ud7wzk>l311YzHj+bn5z`NZ!g-lM_zQ3&-=ctgPU_OXbvv}e;-pYD1@J{p_{XP zbY9)Og>>&fyBU@4-~9FRB;Cb3A%%BSOmFm&Wlzg@rWsqq}AA z=jzq7O$tE!s%5jSHrZ-pqN~2V@2(R0&6lVoE(hf-#fZfW?TxBWE_CAJLya69rU7h( zS<;`6Be*OGERbY*DXu+SJil@Ne1dPyFVnGDDw*ILyUDn++jwdl;@Fxu2))qD@{$#m zpw&j@*|+TN(@)r4>tLGCfC0V|`P1!A#Q~~AUwh*%x|x@6KtEbKNVQNzcBr5bADEpL z6&`cD-uT!kX0|tF-T5=VK?RWZw38cIhB>9*P+r1T2rGjJ|JbTQw;Z*Hp=fn}c|~oj z*3!f?mD2jtpp5Xu#h$)r@cgFO$ngVa92Zor3`vi^NiNCFd=)CJ1^jRc+)=%hD;=p+ z#D)%P_$<5^zR_??Y|-Bnc!+P(yiSXhKeJ>0QB!0-1IrPaB;_KcCpZpmcI-Ow{SidM z4=U|8>)i`AQ+9}pY!X{Ak$d;N^jKGw+-JuPy|fRB*=(^=$Y2;?#BJj{WKYGl2n#MT z#NaoXr$+``T94*;hQXwWz=u8{(T+ibL%ND(U^k>p8pR`c(}}ncTBtq?OH5aggs9|+ z%g^moD&n)9r2Y)qcprZv|9R+%aDnNjDs;6C?1mBnf;2OzjO)D-0iE56HGk1G_$py0)N+#>pB^5}WpL{0C zkTPqd>Jkc>P+-NW!jR9#=6=v?-j&wDzkJWT)WXz>u2)5H9Bq92;c@*a3_8qA`yPtI z-y%U&)Ur)Y_t^H`$3DKWd6XoZKoK3CAsK64CMjc#$Hu^@ROGw*f^TmMt~NMOT5ILgJ#Ltnlv@h>g@w<6<> zi_kqX>H;ygzN^i6UT#z&hY>cT;r!_rhdPu>Gqo-~G|7jT^i!z)0F+ni%bHq}BZ*l0 zZr%Q7a3=2M{lIcD{wSU*K5K()R(DU|V0C8s|03Bx_pOj48rWXl*IRcdoy zGU*bq{@1^!u_5g{$;-_RSZn#J|4KhYwO5pTXCT$I>sk=s<6o&C+0Q()B1)|!;jNI- zK>qQO0ezGMxs>*#x+U=>>bT1s`j%gP~ymsKnBiMZYPT2h=oH*n< z71p{k#|$>WVV>g8Ft%Q|>WQEoT5=$C3fDQfZ(x)+wRXPxL8tde8V}@@-n;XGg|5zTg`Wzf}+e?YmN9pWN zeDrMp6@UDSCEEQQCO5V5Ly9JVT)g? zq_k7>I;<=bvBSDVgsG=RwX#wYJisJU`eDg*jP3pn?^O zV2v^QqMR*US?TXXC4D_UQTb*XEn9@fhTrmQnMO+X(17lvTYLD)4#gbpOQ6FiKXMjn zloR#LqRIXCd{3bJ2a__v&$Ty@mxz)z z)dEZ`q~Jul>|zSK5*{>;t2)EDqu}7bf|^wBI4ktvZugMv0cpCq3p;2i#qQBoHH0Y7 z%#O2hg}J}Lbn<{4i58xpe({-(PqI0q$5DLx zG`4xF_vVkF@W3Eeh|0$y*>BMx7eP{kqPXBXuoUdIcu__!QPPLB9v7e!WK*!hp+}U_hiHtBW4n>GAJ?0n5%EbBF&vvN`h zKOSkKWc*>RxIJ-^EBwxoo2Cp|z--C7_r^iR!N=|`*t`Sf6~Dd(V{FJ>?*R1>5e+kb zE_zR(7aZ7;W?k-EY3k{9I;0v zIuR?rzEHa+f9p*v|Jm-~!uda8g%u5mO^!C|(Ur)A<6tetZ}38~kqE`y6rS@w%qE<- zIjOu0WSNo{2kAgp{Nf{w<4(HK*z*mwsKxiNHCpJ!4?b02HR4TV6MCpN^a zPeKe_l+0R@mT%BR6j|z%EH(2N4TfV1;{y%WQ~uHW)3W0#h1la6Yb7QQ*3A2c*WT;F zcO6BDPZZ?LF5J=hz&zs^a;(bg;|~?z0sWO;mR$?8OnGHXlKLkQsx?&hwzE)!S8ujb zHST$_U-=J>u#h*#!Oa_JwE2AhVo?gqhY#uFFwhFS#s)A!ajq}Fvv=A9?eK0iN_=L) z_8_uec?0<$KPiXBb1vG+tvdF%3W7fR(m+$l!zs8CU8^0=Ron|NcVvI?WA^%+dI=;k9g8u^A<}vS;JJD7pJy+L$AD=wKLq> z>#oD57b-k!1Kyv1Nqz!Xi6XgaS^bD@QT6(Gv!k;PV#5Be-RWOMnR{; z-FUZ%9eKW2h`Ult5=C~SeY+#Fk(K4IFejgwNYZ@JjUW#pPF|Qx;~@s`{lp|Hq{8=S zoo^OpYXx><8g0yn$a23Q?)p_a`Ok#W4}QmEfRXG|{&L1Z#k3OE2R2Gfc(eI-Pp4&e z7KqC3>HP3n5=kCkN3{N{V<6+SozKy=B`(y3A30VXlj@TuDfT+5s_5rR>j3N+YOH-L z-vAs@^!?9~VeB1q6wKk{NP4GX8GyhswE2Uqh+wY^tjI zWTwdbPwW@H!j+3JaYbPdGsKMU>s@I+#-hAOU$T&{d2Q5wYon(i0GS{FS)zS(>(D%IHLrt!F>Vwn22BFUk(DX{F;z zlwQ0;f-J4l|C69oJ^=iS_FxpW=K^GGorv%?on%N3xH`U+r`9V|pxK2vRdUT+61SfK z`9qIc$RUG$X4%=j1^#~coI#F~Q`wA7W{f|0JTJ}|S~po4+l3)ZgdCS2EDZQCaJU(D zWqX7T6tf7&qMjV4#_zuNH04c#ZiYC|KyiulpFMtKo1;TT=Q>zq{l6FBx7(i+4RDJO z8$B_s3CU9l7XE?_k)rk28H`_KvD)>8wYpmW9)SU9g^_$?xAg=Jm}qqJ0VSh*w)1>8 zJEQ}9EpUr*34LuyOd+FH^uccw5mQ3>N`GLqUv{6#uL4IbVPyM|Uq0Rl{%D=0p4bu~ z2erx%y)q`8M=DEUj+y&tCkny{oBqvFf03eR4@fXzAs+_l$j2Y0T23Dy!smZ7Tswr% z$XqGEk2GIf zuv646Jz{}tLp+t(j^^d{Q_lRPii(QFy}`f3Xi|^nG)TH|C^GdWQZoTSL zA*vURzS`x#YY$i`l}x|5A2|d3czR-WS1r zVZ}~|fXB@TuiSsBe*?<8+7@>um zgar@W9{+?_*%Yp)HTrK=8q4+2tUh^b@~TL<33&Io9YkLS$H-%)JCrUxRaa3u*S6a#yh6G%5&!7>P`X2o@ms zUCq6i$8T;MGeg05cX@!HqWezc>pN4TA)BB~GiaSFAubv;uL7fUc2obBo{q8=cVj(2 zbFo6kcJk_;t|nUf8dcQ$9#%_V6{$sa zJB7^cNHlbTWtaLBlS`V3d~GV;*%$9m2~d7b~`tw&ZH75L0jIqr?3iT$VVzavfk zI7j`!22D2lFK&1>ta2v_xKem#*-|80C(|d4n~b zS%D={z7!-eA(8J^BlG&>W~j%6fgu|i{&~bjMT8+He=2c;Vo$5i(!-vA;7Rtch*V5kG(%z1o68MXA4 z$I{zt>_0XbccdRVBtbZ(UM74ra_anWDqOq%(fKX(g7+1{=)&=|I`hp3zv2>ue(-_f zkTpc?H_y<&;pqNIY8AU90Q0!o*Zml^OUl5ltrxU|RE0vs7_MT<=J~2#$5rf#QJoCW zKVCr8-6k;HJ!Au4GWL#oKTp=Urv$Z&){{z06B0FgQWRY7?X50;QDHrCB|{ORk+|I; zy?U$xVaEn1rebZ&h`sA7)kAsjb`dDB$)60$>prRORqC!O^AC=Z+!gxIjkqVh6Lmns zMhRKHjzr%7_O zR+1$k7Q9^KBwgWHXhj6UIjH)omCW!JY~(>V4~H${`~B`nQ|)`zOFS%~r;~w+Tk4A{ zvb8SLp%yYvCy98SG;XqB&OqP*?FQk&PdDD|AsnoCX0Iyn#31H2vYV$lB7^80%n5@-eyD%q6M=Bpq;NKRehVwAvYK`o8?r*p|Ij98 znL(FHW3#>kp)J}hj)p~+@FoGSP4g!@y++7LM6!4O^3C(F(rps`oX02T=gT%G-P-dylg-SZ8aan zSuUM~bZW=hubSxDODBkA8^nMl)qn>oSo&mQE!}8$ZmEhBIK8Sw!O>xn>F?+S{95QN ze;m<~_(Qpg%(KZaFLcOY;bNR>x3yq@m=_P$-(9eXVxDYdvo`4Oyn=!r2I<~Zj{S{u4SP(5 z@QzKog}yJ=A>C{F69&L!%>z$^gDu&zYN2#nr31WezKmTdl1|KH>UIA~H zim!l|?znkh0@$XDX`{PcPGQ*3yskS11xjxfGKnG?ad1!1d4U-pdIX_k>8^geMFvMY z7Vxo+tSB50YN+=)wAHU!#R){zPDpjAqscU(hv@Qd*Jb)M#>79B*0Er)rDOp|k$Owm z{+wrVH5hb$J!*>q`Sd$?5TUXeF;ACfG>^`h?#>MULZM3s9<+_Y3KAns3${N9I}Axu zj5Zt^6KbW%nHE{a*f=|cZpT61d_st}Go<}4P&8H?4{4{=nf~hxf}tRG^V$fLUbz+Z zWaRKVL|+^?^DB>$f6t&A5t{xOxElW(Shl@1yrV&VbtEJ0)s?|n*DET7i#!g90<0)C zo`TK9CT9z!7zpcGLOvRB*+0>g4-Owu#rvr$kVSE{WNSVITaSeNh|&L%kdU)7d`_NF zQYH0F7be<4%p@;5;J$g0l=_)!2=?}lf}E@;R1F7w*xQl#MB}j|QH(7V1pNOs4A2mnknxn)_fu=_io?TaPiBp3Z}}gH^SZh?`e#N(c20 zyJ!Fp$YF{qXi7Kp7g+_7Tq*J*iBIRODuD+DhzyK*zC2W9a<`r{HCtuIm)vqX?r-4L#9ym1Hvi2axouqSa8c@(Dyy-YG%ezg*DkTXimb2KIbjFkm{htS zLw=u{g%%vMzuQ>ey=MkUlg#b_N-fkM3mvY3QU~5d zuZ4gWI6<0kbyI4*WWiC-q9Gg22!ntBEB58)cy)qUE*v`3$Y!=p{)2{--CymHkF-ha zXs1Y@5ahk6v6AHNGiokaC<9=v!Z@iNe79< z@CP~kAeMS0XQjWz7fkCI6b(E+Vi$GxXR8Q$`~%s&!2Pd3*%3{=1a`2gUTwh#ls)DS z`C|RE(eUvu??}xN#wF8gH?}eGI@C0FhWf4$bY3RND@Ktb>zf?f6xw3zJI|IKy^@!DOX%k1z{OAQ<<8Ks4{0mq0*R2l+TZG&u#Q5r=lWThi_L_^Mx)d6#iqG z{$s_uaz7m(omv-8T<#4H>c)M9H`J4PE?x+3ed%6*f=NorxDYzTfbs{%*YjWquSSJ~({cB6#QkPgU(K z_PRpffA2^{6T${BNNpI4O!lKuxh&80Y$qCiHwZQ`)Ipe*!i5(YH3^sV_MX#Hw^yxGt8C(bsWO2d}Vr`QLZ8`|C>z!qBY>F89}^Q$=(J#~8gylEmlDE51S@yaU% zY24Ce-jKgH0_KqfG>_6~YgeV1v-cA+@U{ln9xS^K9(2FFDZGMtA zuU##JInB+fe{CxW?Qg}$7{2W^=Dx(wr%%`yFRqsp3j<|We4L;2^^Unfg7EbFl`b^p>3ZBf4*79=t>n%%4!TGUZ*a0t%JY zd62HQ_h$P8mGWhrM12wSK#qE3!ATE*UP7wc!zLVzWxSO-X-RL_St= zla-}<-O@I^Xsq#FgMjA!I&(%A@j7(~_v{@Rk(j)ku7*y|Ep7Z+by?S_TQl~#p`Q}m zwUK3Jyvi5!TvxYOs`m2Z`~@Tpf`w=DESWfe=}75iQa7U&ca4f5enB(n&j7aEd%xoN zpK_P{C_VKT|5;oXvwUBf9`6XYn$g9cn_O>b!2T4v19k7k=bM+Pgoy{Q!i*Oo3$DA1 z`@<;LBdg`YLbu+ysRb51|E-0$3ONM)w$Unv8(o@p6wf@-=N5s#aTye4q7z$MXzbuE zGp4_Xxw`{5ZE~6B2Cx=JgR#~gM0u!8phNKbrZL(!8Fvc%`J)1kG(zYo+rG;eWlu@D z#p`s(vnPF9Z69fesC4w08HW>>%DI^_S7ccy_^;qZM8G#qJ04fWgiF1>$S4UdS>yG& z#Z+G7hlaQ%VZM zmKo#5VsGlXNHcQ5c)p(xzUdz_} zsvDKpbEDX8`gr~hgpjA#n(Cjy!){(;n0ZXt{lUlaeRFN@MW1llStyQVGU4OAPU#XN z4Y3!J3epI*-bXkOZ2HEQuWBB{O*s~{%~LXS`8s(97gkvxNsB>0sj4(wU3+BklibXM zCQJ4-E+DFN8b1&tkC;Lpin@Zi`r=+VVB^X#MT1azqfIgrOOfizc@n*%>$4FScsu19<;)7 zJ6ammKQ@_Ejjt@=@03}k$kY2UXlq|QJP1R6X`o1G-u0vumfEC*548^WIH_~#tIA1; zL^#JN&)&a&wx0`i@u#2BitgV>Af~%kb?R?TVlf?aW^H!kAT1ith~nEC=Oy@yZ+89T z$%*Gnhdm1jl4?1&lU&oLQ<|@LhS#Y5Qe`o`=f9upSgif^uA*&_cm%C`@;PAR8+8kt z5tWFH3nMZG4NlK_IJ`isW+oOy7 z;s1P2?ZcHLoBp;b0e5i(7R(Fl7t!g#dlH)Tp&c_W1 z`E11^sIDr!h_Qn_RIla9Wo--R$$8Uh|EMnXbTcb`7Q895T1Q%X>QG!|C})P&gZ>_^nZw66)<&jebf?)dH%y%O46l68&lI;4ToO<*=k|aRRjFUo+ zZ3q8j5~m!28y33qH@uF6WT{s^H^80D(#=#=hcN@p6j2E*C=yneJNZ)Jn^A`263edX zSKyXHpe2hdI!s*@ZlAkh^=Z0uK>VSQ^)23UYJX8tRG(!;iD1^&vo3(XmJ#n zir3purg8R{>{_w^@eCZh48ln5dZ-_guYul$Bara8?KG6oGQM%J<|%vIxZ`=P8j`>H z8kK1(@^afOf+czUu6+TqB=3gSeSI}5_~9p?ap+*rmBs}YH>Os)C&G#`gLvtJ9x#s+ zB1T>8N@C0zJH7j&e@Og&vqVea|GgdOEiJ6jYZ0rb)Hvz$8g0(7teUz%|H+G@WM94h zt5!a0>LHQNgL#c=&@o{%;Of?j?}u&vv*Xf#*RPdekx*ZFbUU1IZ|1UN3%k8zwz}9qP_q;0OA}k zXWg>;?cr&Q|1+jA`XdPQy_qJ;{8Io%+JYr-=~gOX&sAn@)DmSp$pKbj`OvP(Hd}?Z z*qlI{lv zTvbNeM-`1(JQx+eUjk+68W<%A(4LQG50VEzQ#A64ww;?Kt|n%#i(b(l^^BJL68XZT zz$RU>yJ=c0UMJ8>3;M*mYVj0pe_x$?&iOH#?zw`=|A`7d9f?Ya@U7Fv%EV9hvl}9c z>$ti`5y-|d9LbZ-fq620tS7>0t9!BOsiO~zWgk56nZ1ZHCGCi5CqMJlr&`5i z2h{slM)Z*8zhZ_Ve&5nP$*$U-EV!||%%&w6YhLY8k zq+==A_DCE|y3pd+>?$f*(|hkFe0D`)DG-RU+!jCflvQfHNUyR0v^5$)@!QE7PmqRZ zlJFMQRd%l|FAGd*=qB0%0e712)*|K?y(FXnDcm5z>SGVWL+kwfdNtIml`?W}Alz1` zvH8ax+1rCjnT4M~I;uC&-XAnC5jYu0ci2m2$wwgUqC138>m~9cke1L<{@q7+=|xTV z@i%)PC%ft&$`4S!4RuoQlweV(!oLY(C`bx4aYFC|@-mqj>#Y7v#@fj=L)?szm#ms% znFLf8yd`jT2z~`g7IaQ5y@`6Qs;;h5{1t{YG#+KZtu#OXX{?N-s4hB3!IQI6-paPK z45c}Fy4)2ZZFo$xE*>(?DErMlnsb_9+v-%I?sPA_?sQB9w-sm1?<)~klmKnj8fBbK zT&N2&Ud9e;KVIs5C~621(y-Zd0|}f*Zp{Oe&08lFcmWykZl6iKaDf=-VisL@h9h{uF?)gV>We$S7v!wT0rg; z7651_KV9@MX4nQ(C=iiiGv3sC3^5B6BL@MDv`~628LKE?B3l?rcatxb)HeUnnz3B6zUDt~JzUO=`IWS0B2k$zHDg)>(Z_`BAw%Cugi zQq63+2DftN%t5tL-M;jIz}qaba5(zgTuX-j+^HIJLhUCmg}yp2+h9%{=C||4L4Uf~ z3|~#9K6wd0$6hoI2%)n)#=G**R{=8gqxsYM;23j;GdN>? z=`C7RH{!Ypp|`9vIzKIQx9cTcOEk>9=3M%|inBzi2}DypYnSlH{Xb3Au|2(reip9R z7Em}d&-I5>?{A3c0KUB!5a>Vy)L8RKid@fDd^AUs!o}_YP$hAMIpIi2h(-iAhb66N zrjJJBgsMbOzmOL~CNU}(l8`g`)wi54MQtLy9<{5!NY18z;d0MHjiH*`6&N`Jf4R6eG+8BzNRo-@HrATRv}8XIpJ?z{nG6hxT%=Mmc1C ziTcW4ZPfMO#+jd8@_&~V5hmyV@z(3CAK9Lu33HT}Xe|tyGV^4bYbBO`tdAO1d}9JQ zdv^ysy*JUcorPx=WycPXQU6qmdO?Z|7^Nh(GvU%rwVOQ5QErQavGWb>n}5uYeno^Q z3rGOgI2kqLf#(WN%Z8E1&Z#m<>sAl$>7C6rBRu7^?RuRbp}_MAI&~WI#Wz~$O7R#m z%u`I}b%y+^73<9OA9qx~Vsb9v=6sUePby$4ELBw|Ltg9U5cR&F^KHu)6bpA*7RoM9 zhGKtkBuhW_2Y;C{j{BpJU7wo(y9lb|Fx})>tti^k3+I2<e>E8Xk)HScWPkOY<%z;w`I$wM;6~O)leZKOQ3**L6@5dLYh=&2TJ7zPO`}h;I;RkL@TbQj z8Dm`@Uuj4vPs-E(djWPc5Se_W;050r_}UoRNEWF*QlB zR*2Io{ix2?LF)QUrtu%V?2rtj9LE1BWNrVw-3y?q`(TCi%}IPI@wm-!PPIVbn$BvA zfHl^)atnrtyxWg?YlpLI-EtG@lj(v{`@-he+5LB+Lcku|yX7X2d0+;SdAGGr6W8&_ z+oitXxA0d(e64YWl&|GW0>LurB=&kODm!~udRc96;bo|!ZC%;@mS4@R4x~}Q)C|}* z83e~E((*?HK-MYo>t&_0$~OVN$?bBNH6@nEk~(k#;f^2x;$| z++t*UqobaHpKO>wmJA*dX%HIc!oY(xN0|A`eR>&SW4obi!QV)8yT`Px5J13V=-OK*Y$QU z+TOHytSgPD`KU>XcZcEh2)~R^-eBRw!PfQT=Le~dw6xhOsd`jn*n}6iaa6TlUoNcx6o5b&NQu zns@wfeMCS5{MZoVEk>DDow`NJf=<-^B2Xr7Y5!8fd||D1%a_UwzlZQp8f>NUe0Rw= zBGrn?)GvYjMU46@>|*cgeqE?~`P-!Y8v5TG2ZypcCh{5>V#Qc-ZnUiKl2-{~{KcBO zw$;l4QX*b{h3W|tslS*F00`SL++4}}g!c_@KWbkbZ(xBJ2ayup)zQk$CqPh#j6oEr z!b$BM=!181^2X@5HwOd3;YN5n!;B5tOoX8ow%oIBkl>>Odr%usk7h!qO{+pH<#4y?# zHr0`(@el9}L7}k>qNZa2s83ir>Als}%|NqD*MwXFu1!UxVvj`9bh21ySs-0?vUsG&bs%mv(AsxKW5MD*}JQ{x~jUm zy1Hwc2ls5FA0BPU0N-%OBGH0Ccup1?9#Ru|?t|J_(%}xqDxQ{8<2uA0)qeLnT`qNU zFqb(aJ+!OaI~VA|lQI@e{@TwS9t=6bI%iMesX%Y-;))Z*5K=6!sl$V?%Er9|!hK;u|N&P|O5PJ#2A8b=?`+RHC3FT-5q3 zapEUAj<}+b_Y>nqcoD|%~ z!7{w9649iZfzogEn)HJx>Qp?Yn3Qq9*zVb->?U-45TmQ?C4keJ?opSJ?gNxlk^@ZZ z=y} z9WmERrzlrnr zt6M}hjs^a-M7k_+0uD%@Znu)=wiLHXnAH-5*e;jwhA3q2Q~-4B-+&dSZf^(@%_es? zu@RPtXE4f4Q-2)lGIiRuRcv_wSN`A3PiXz1T&NrgiiGzo$$C{aCBBv~jwZEYc&(}=O4+2Z`Wy$4 zI_HaXioYN;cEH+pkk;DeDR$o{k^LgsNRHH`mN6n`)ig$4A9H6uq54rJmeKlC9fRMg z>?y0wHB6pC`ldIbMzysv{S%AMzzZm?CK`-87;#|n#?NV%jm3^iO-CspZ>0E2}r&iS~+8+vjMBq>e3@?ee0bR}r_56Onk0T&@; zGu~-i6#6C8>!$L(i?O(1x)J3+^~K5;(rR)wgGWy}6P!-DN)+ZYVF~P6Kfb5NcU~zf z8xo=tQ{b|#O1=WVYP8F4vJxiD2)tF2Lb~G!@t9#&r*XTv=AYyx;E$=D2LW8e17OKN z^YV(=s%TkuoP)_$=6bijq~OoeQ($5R5fcbw`bhZIu5VE0qsrv;=Z8D$yrO-D=p_O0 zNtdR8T_0!}JDX`%sm{csPmb1ag6UfVtm5q_4HyZOgvot|^r{Lm-&pi^n~K&YOP1DB zuA7E|!+IAa!TGdg;#xzFhq()kc-}%;GVvArsXd6ej*-Bg!t)^0s%kA`x`5A-P549t zd~a*yi)Ba*m|j2;pa{(AAZE{~#5ErP`4ra@h=Al=GV_|9{%p@L$!b^aiw9Of@FS`_ z@BSrok+{5GUf+TQQs>dTCRS>V{On`2o1^{2V7 z)`XFCeRAXcI9H7)i#P|V*|DK2!rD*p3pg_lt ziEnB7Y`?#3Wp7^p&L5W;43@`+k;b7?bVer*l$%e)sxsmhS%{B_Dz9r$D6`$E_u>!l zII95AQPELXcfuE4_vm$zgRMr7q#HapQ5}~r^*rxsVK-h6uQc~x~S{7wGIr2WD{Sp0v!Vl1NS!=Q~xCP z$7S?gkJZb~&L(e(n{xPz>x8_s6wKqaZ4I4#;AqM7$ty&NCaSg-Bh&PD45@_hZ80#4h^+5ru_B$ zXt(#~nxK_N!CC^u#jTethu^el&LkvuoRC-l&g*e%D122L9hE?V4zHz@Tb(gMDkTCn zMv5kSI#dqA9X1;jy>1y?F0p9{F%Z%2DwCBfBBkH1|3u2H-7`O|Vm+h*TPC8^)Z6+@k!cex5a5AN1G70C}-K z`CAV~6={@+HnZ(;(nr}~#x&V1(OQstWMVTYd49X;PsWx5qrt^lvv<$UMrVJlrZRm= zbE1V2S6D-Cui;y)kO7V5MaD2-FGQwDYMZhdaC~8R~6tY!JCN;eqmjZ$e6RVdyfntN_ zkc|YkC4BztznYT;nC~UN3X@=LFxWJ|0(V=F9=|5}HHnV;4%xJsaE~b|Jv`>nPX3-= zdGx~GEB*n*bC*Z8cur?M%~zboJk^6~U)9BXFRLnUP^Db{XDBUd7@)@#Dod|x`??q+ zPx#hCjnEqX$(LCuL9tPW_)8M9?ctIUF%B0> zJt3itFBHzlpbsgZana=XU%v8;`6F}pmcf5;c%vWrYg+q6$YDRlGK^1wLR*SLE7?S) zk7^%#tMSgc@92nmhU<(POf=z=M{Al};4Va$662h3&Vh2a#bOiL;M~!giNFX0>sb84tzpg!GL8lk!ZL+iX$lYZKZUad^`Oj;bXsv=N6 zdmaf9_^cFlvk87ZfV}tsDXi4gJCTtxl#a)>+{Cmf09^%r?Kt&2g*QfpiH-6#&!k;3 zbq|O@PE@wZ;f4~73X@FP2AHq?X4tQ#(J#%Iwv}Rx38~Qbfnm#8UnKsL2Z*yx&IuQY zOKk2k*s6yL1wAocaYmPGGEX!(Z&-H_nOCXD%QOmZB`bp+*Xh+m^WNpB8jf{|ivUCb zeqq$981qs2lnE3m?A-GCidQ0jP3Z>fKss6V=^3#tdE9Xjo#f~ z#%aVwYH_G6yf|bqztQ_G(5RC3dkJFvJKpbCDD&@3Alkfz8Bvs}C%*3qUH~1p_saOB zm1LIP>V2vGnCy0{&o@jT*IhBuvvNVsFZVY5&hx)8tJc5|MfDEdNt8GH(OqsGj}Hbp zxosQY4NBPYu}^s~{$9onm5q&?GboO;y~lr{axNV;_g<7e5|!+;3ioK8#n9GtCN`cl zKnBq@q;$Ol$9Ra$*dbsZZW&}Z$%tAWT&vox0s>lfyp+u^vd$YEq_X&qaTRwDgI{v{5G#?W{*ZD*QIKrBqSXvbtz9O*I6Xw%CQM_a?a<&rNw<^?u+<<w~BZEshn~`jU>Ajxa5=yh-DTwI7jB_OijT z6!HrCpivs_9(jHjMvMlyM;6cf=C;n zJ*xi+`e_a(;F`Wuuxl3o)5#A$3`>0VD5=mrI>K_mE0i6H$ydy7`McNlQm<&b&d-^8 zCnGIoO_32zQ|nK(j3-tk3+a2M8aJnP{dQUss(cJzbZB%JdP!)4c9}9=lBG~lr1=1m zJLA-~rhfF;fzy;%JM<&oW&_cbDb`b|x^uIHSid|A85YuOObo7XectWus^Z^|f<`qK zum?#xF#$7(9gmMQ9gid-NFm!BI1#zZ2S);F?-=zBgIL?oV!qVMRV}bd_<(xhdkD1M zqLONK_QYMs1*KPnniV*Qr4VNlL3~2##x{-^j;LI=Z#Gz|4AioX8i)?9sck`psYp(a zIn5a}VEjepXxua+e0i(Q@HqJ{MDqMU9edHhAM$w)dAj~(=@nQ|FC?HNG2D)Vfd-Tq zqpz(ECENw4)o;e{%tW57+9bsDh+YU|zM!y1iE&|@w}pOjWH8VuaWHOFdP9l(Lz3px zJJpSuk*NHWLadP9R%?~>JDFbXs*s|5bq1MU&bM>#MYc+&Wb!a6m~g_{V~f>21=@gP z@4Tq0k_~7?x=uHE_0HA>uGfBt7dFn-b-es%){%#p243fw-%nzDCTVlI5tA5Bjxai# zYicvYr_V2G-P`Ag!kU$vPQA?))+EW%??bx<9(J-HREB3Ok`^+#u=f1S=u!?Hiw0#= zEcYZQeJOp|!$U5z=x}7iWweXY(|UqaB*{N5s`PBCV1_K}Ebo=cR4E@M>Hui7#FPCf z>*y*$KMzpss`Si?V=i){3+eCl*%^&%q%FNlEHf{R{~Sg7GEP=*)J+^^a#RoH+X7%x zxtyj0DvDHpHRf}b_3kfcF(>_P3p@kD?{dF~t(a|-!$3&H;)^{3$J`qiI1J(vx|n0x zRmDJUWwwS~Imdj~m{IF#8SXDxCCExv|lz00CmmU)ayGbZtZKtZ2u@2F;>Z2I_C&EvJ zzY(z_K$kGuo_3ihO1){*j0kEsZ&o7iW*T#?u7|3~^as5!PBn*EyAnN7KwTBos#)sR zhwsDLOSp2>NnVGQ*RS7rlD>DEnTXoXwc}gj>Bul`>bq4XU+1R4OrkfT+hKDo-ocRd z|7RU504N$srQun?2ASQdX{i5HyEm9c!sp`a=^FXJQXtvDpF}V2?#!1H`c`++N2q?( zp8}I0v6u5`1)N`segjQpX9Y1i_uziSW~CJ8Yce0eqH)b+uXgDz>xmR)bAE-gigY9p z$a<@e@sGXCBmp#vwo^s)uM+J?DO=wvlCLS)PkI)KeivM6#a}4}OPYC9DCkb2E|Ywn zhzrSY>$~)_$nK4{ulN|jtuwE@8%Y>ypjcafRrMp`hsY;F+``*Ab&Az57ygrJiZ?xc z8Lt;;FxMOD)WFC#_7vls&aYhSpDm0RFifz-C;G(5>oBFRIlE7+GcIMBjwNH93|vFv zgS2$o;0nHEkn!0_E7RfJkO@|@gS9Ij2^o+{y!ciafPWX%Za<^Q})$W5xG(A&x#KLPYyt_1JA`IA3p@~ zALGZ`4VRb|_;IoLA%a=0@;f21FlLq8D*VLVUu5ipfl!1yEVVKDSq(K zN@-&b_#@X-whTiGw#}D2w}YQ_xO!s3sVbyYWe=R5W3oNXFl+yc-Cy z_N#xy&IX%a!a$7~9YekT?=dF#x~Zr(=Dw?ecq-Bh6J`09-rU8o3hmkJ1w>7Vu5)fE zP-6P4QYYy%2I^?cF6urWB-ExFmetfuQ1J|oac5846hF<2JCdj@L-01cn9Ia7&{qp#-$DI*R zgv`B+5jQ+45=Ne{DR>N~Y5V~~si~=Dv>wTu$h69L7T-JDZ(rU&aL-L4$Ez4BAeY^C zg?&-I3kq$bY#JMm+D4JgSI3Hqu(tZ5tEEy?eFRHZm~Z!aAF@5a%K*=7C!`zCC{(99-NDZ=>5_X4kUKz6s#Ed!@23EVjS|d7cny#p| zkG=L1b_tQ*+|` z0MEF7AO*w|4pkpIyS~uiT&VZE( zv@{urmjsWyjn5t!1K+B8FViimn%Uz>=ETWJRKbKvFriFBWL1s6Ydm^4sxJ7?&N>(@ zWIKLRC#BtaKpV*M)sfJIER`d(@qCVLL2t)0+@^L@gELsDl!@=F`0FOM<)NfJbHjNn zX3stSFnDgyy4)st>Mt5BDWIMtAON$foF3i2CXM?qLqzWMA89{OIUN*+@jUu2Vn;Lr zzCIXoMdJ_PRr~D(BAWL(ZHPs@ChHDQCdH^>Q$@G@!*`k5nJSGRQKa?l;>@XdCYw$= zlDexxPn${FNtizy3daBJ6W$C7LByo?4NOW=7NbGRZVCck^cy^E-wQt?IjlEhKtO+? z=)$pQhI_OeBd>9hZ(<-+k*+HMfGLrf*rG}9x>Bq`ztpY~BjEyTV#--F*4b$~^oV(Y z!~gC$YysA8pm)dc4c}%?p?E)T*N52$Kv^XI(YT+jm>{;aD zb3Tea$?hXk@-pmuJl1?HFd6YzEd7J3?-T6HQ2S3d_o^fCZc6wb&NA(QQlvUzRofKzV; zy)@whO!s|#6WOVBuP~`Fp>CF%oO6qK_QD;RV3C~kyZ?ZY6GC^7CCPE`hfLHoZc@B1 zh&G}Te+Pn5hBN0fBnk-W?$nx%Ttq7KqLk^0AUG45w;Sh73KiO~I0p8?H~4^wGZ&cV z2ianxqfB7EIzzF9i*PE(M=Elq!I@)*98+_^EYBi{Jui_I^|10S+;`!YO|bPKm0Jfn zFYEs7CAOA!_?7)z+nnzF0VI7eBMA3iLfQv>i64NZgSCr&8f?ST9S znKx4(Jy?nZCdCNv<7D^p7N;jtaGmOLWGN^+6jUuf_J^M7uKZ=+zvR~M>SDh$1|(_r z7?2_g_?M&AOXN}WrT1yQvH0%HO7l{i^!P2`@tk%Srr<79*mk0B$=ey9NoAFQy%*+@20prGwH$ zkaPq@96-x4M}->d8qA?ie4RX5&9$!dS!>E=P48(4?VaT|56&(H^Y^~ZmdoH*i2(lj zfp`cy9*$DLrp6B-zDE*G_gmH}^ebr=6YG9y$4Mfd;dlh?^|_n(*vkE5D*(5U=s{B zO3g=h{8?EX!^_Jtcq|Z_PTmMJDCesdcwLq#$c_NjjpE`&hp4T)`obP(%&1e9u5)+= zLSGl3n+n7*Tz&|=F*@$%AEV7bBq9^WglT=O75hHovN5X4m$o$I@$xN2euf)a+HVQP ztX3<-A~8S&q+0bmCu?`@7FL*7^D@{Sl6^TnW-3gmrsU=I@UtHY9m5$p1c{OGH~9AI zX2thJK&V$ID0|TCDb}7@hgjr06(XBq9p9qz zGU>=H#!$F-4G-Nj36$_Jo5of-h?h>T-8OIBfIW|Y=Cv;$%*;ngXbUC?T7s^}V_t-8 z6JkIr9xvef9nE3=-RXMGiSWJE(;<*!2o5-|DwGqK;APXVIJF-RFg6g8KbDBBYz}qD zi5&|`^KD}oXj9)uN$HhjL7YF4WUh4G4yVeRw#n~fWTAYT02@5DnOvA6*2UXvIT}0$ z`F}Qf@VBR$F(Li~E5DeVoIO!#x#qrVN6C~xb)9ZU^TpYu1xzf`%(vuIg@Y{Rs`K=5 z2_1W``wZ;qI^-O8ksxSH;aB^|0<PSgRVZ-&u%*&rS0;E~i z*SL)kfe3VDIx9J0gTns88ROgskdc#1`4d{|c`U`jHg3K(EYS3Unov)?n5gbS^EJ6a z3V{@0SwH*pw}t}O89!q`xukLH>7MVOAKB!Jj1Mp}FDiJ~qsT2nLj;{N9pY{&!)1EW z?*^+L?sFpHb6wmpr-g?8U5*ZsBnbebu&8|ps_Jyg*(Tghd&;*1%!4FP0<`5^D;~)XC5e5Y4%1VW;#zyAP%q?0?8$sW6TDW{``Gl zlawrC`{U&2-cf zM_~3!7f%=-O&C&3{S&g;lXZhKb?={YKO#SN#B_TkvQ_2>dqz03&wmP?hO>QU|>`})oz6E?P!)<7ih zVD%)lQ1w|T^^UDc`=P3=PL?9oL=M0O`Sy0`>F5bYv>I?K{B$9_NV-~mkuiM#1m7o- zkpL$tP%=789%p)#tA47>pvD*WMAW z);C^%vsfZPF9`!}Zb`kZX6AeiYhim&+2D7dUqfXFVW3RVPdd$;S^_jWHb`w&B*x`IcY$uZg7W#!|? zR$(5ux|*7jp3d9*S=SHaiXZr6VS!?;!fuZzwwbNMUSaygUt7iQmKhh^y-k1ti7?!w zO-Z7!96=>t0+X^1StQ0~6|U%Cw<^HB*vn@+yIR#-i#4TFT%3Y}gQF5PdZXv@R?MrB z$O=u>+Y)7q%5^!^!UQwX*bHs_)%*fCl#cjAY5jIDx0Atx;1-sf>-d%mwB@!DZmyB#mWYb6<5?GsCweRWvV3@|3 z50Be-(Bnt%(~rMqkVkw0*KBwA=(Y%LvkMeR=w=HryE$M$X^P`G)`donFN@%uLHN(4 z^nJBAZV@mL(2%adF`F#)>a=@B^^?f_9aLWtlQ+!DzX{7@1f`ahg*#-}8240aND&51 z);^IL7PYmAW<7V}Vy58d9cEuHR}k~xmuiJC5-oB7H(CHqYA9sS>jhp3^Bt~sr$|Kf zCm)vE`FY$bYs3V3cp6!neCb!~6=#Ey&3NnH`?zBu5*L6;k57ZV^*YEl1m)nA*k93j z!*xTZP0ANBcWOEG9a6gcb)dlITR$AJDI23k>vN~F%OI^ysn(5k?L5o0jR?cNiA~d< zDFL$7jHJ8V!w2s*cp|Nnl|vx`P^(Wz+XZZ@GxKP z^GIcydviki*nhx%ay)m9w%jf>>*K0e?f5jP`1H8BdKb5Yoc?gWiJ(LO!Pn#LaqfO+ z7t)E)xo8Jta1t{0>TU`T-`}%AEFpb zE(tmg8!!Ks`ygHOw!w_^8eA6d?5SyE|AAaVg21ZHMW_;0&e&Fs}C0q#(vw7(UMon z!B8@2tGoTvQfG&-ue==LyCv@%*y_V$XZH?2vhA@^_s;6k2jty?ET3jY8#g#N8z5%C zKwu64l}C_91UlxBRl5Iejz)3pbE@{#G-W%u8bzrxO)YjvIV_aMzgFIQ{CbzyD63iSB17iO@LY-(;3iYXLry5t9*GLBFsV*pME!x}UBtJ=~wTET0@N zt}MZSA!NDLNQRgi1)!r^>%S>Qe$eV=w`ldUs|=&v-|9v_LCfsmcQae^bbR`GH~BO} zovOj&5wd;Msc5?ltBo2L>L*7QZu5=w?eGX;5%z7Y3CQdqi+hvV`uFDEmK8qz_Zucl zJy@6Az_J4xC7)47ju?zmI)EE1EoZxk-=H`!u>%;=W}{G|c+jZ0Ug=m~YI)jT#kqeJX}rkvh)SV!~T1rO{1dg1F3+QVw<4b&EK`-<<1i16NBjT8e~Nm zkLJta%E@vCNN)zSo;eoy*-byL0ysH^ykcJ3ECu927EnLBwLhG$K0E|8*peI{ zA07(zn_cTK3%lJoq@l}GDB>~2FxBL{bHm5t$VI2q{W~J|U5Ar39oPov{W~IN{#`xG zRnp0K-(qKMwc}p!$Zj8n1E`(< zw%=ftd~G=&mw8wiE}e58QVC&C87;+KwXuP3y}tPr>wrnG5fK^uW-mm@bOoywvig$r_sL^iL6 z)jpN6E|wuRl~d#FGAr7!NfOB9O_*ZY(3)A_wK_}}*HXs~wZ`&%(@uzJoggf?u?1lU zf{GWaTlTH1OSOC!ENbWyZkL0m2-UTT>a}z@pZsw$GKkyf>EU#?g9267udi0GJ)3fk z7NRy^oftJn=B7b^vz4SM4VF!B_c=&b+PeEK^g2Xf=w+vqvUKFmPP+Ex3%(c~eo!Kh zRv6k;Z)j2UvSj`|D7yu5fY9K)N9xmI)Nn#lS6yDblx9}48I1}uK<5x{i4nHx9Qp3H z(Syk8ys@+EC}F@09dN|pnDeOl$?8b*byAnqTp$~yIJu)xIUM@+pg{wJY-(Y;d^3vt z-OZYL_)kM|w~5Hi0@*9p7)PlqRq1Nkl9*4Po!@as7#N0iyefi~stAS5J}ai}-wk*a z=NkJ<8Ebh*zV!J7E#z523u>x0DpF#~SQE;!nEuK-kc7F(iVuiwaTGm1DCH*_xYS*w z)kxM!qTAseFtBowg}cyS*-w9s-fF$r1M+2@GG0p!j5bBcT1;(JD{=z#6N>Abv?woH zEa{X2GRe~^#Rzh?+Zb6aWY>_RU z@^Q`sJx?_9t6;!34qG*`M%@E~^KB^NB!?^sk-rLk!puT%_ zVpX``iMDzeT|eXZ$fTd@298opsZb4SV`yKNu&94gc)`#Z`BDXqEbhh&QP8BAcVE|7 zP)&LB;7{ry>@|!v{}(gqB>~n}YL@W>em5Hz>b}=!)e|ZU)zcT}lipqS>uVI=aV%~6 zdv`CzX~c(8sx>}cxqs&?$MvFZmV79;3OAh#mqL!!2>=1wzJF1T(LSq1ifP2M$>szA zIYulv-XK!kE__dVUs)MGP5}x3o~|$A+>eSHhWe?Z#a42xCf6f*z&+0+l`^KkOTYA| z@%1>LndA~Q$i9bRhXvjNf;3u+G4T!-&i+CMFJ2)0*0NIraukexf?%p+n@)&D8o->E zTCGB(`(E{Cu^MLoYU&KnbqQL*BP=@)HN;M(USOdkAn4L$r$Egxi%jHuhO$o4aSX5d041#wAs^}AO^|1N`IyOk$}}Oe5}9cxouC+~&s(9Y zm|)!4?iDGGCWk}jvK00Q12U8@3cflWa)0kJuR10yVjFF*Kr%{BvrcpU zteseJES5g&4UTXD9B3{?RA>W_o|f7MYq}TFR@c1K+Qmj_#r@rXKvmv_oG3yvviuMb zR{1dGsj*`qBjf&mdsIW@IQ06M^cI@Cx!R`B`KW0&^Gyyy!D;V^E*VtF*g1G&R~Kro zsM1Vc@DA)@zr#hZN6VklocsUbJ>IpM!UFdFFdXc`=>-l~jXEw{(EdN>8$4|q@JP+2 z=1@w5R3!=sKX+&yIib-&X(cEQG-td%pN%#FlS^UDzfKif1dE6D_P8e3V1)UmdTE*8 zWi>wF{y-gUnp6cL%3CnycS*xJp81*M$>1DMP{x3*J-mqczS-Ek<#Zk!*LOV~QP8?r z_MZTU-g9cpu6;y&4L2-9K`87c%H|xO0KUN*uVJF19KW}1eMt2K*4-_ftdvZ(^wu)ni0}Cp>Kvpb+?U}Tqjn9Ks0_dAJGy;= z|J9H1T%KbFpRbaY`9CBL zD|XzOW>FAEhCQNF*26LMw&%FH+%quvDeV5PvtUIEx}pL15-qg&ItY0GwZ@V`gjebZ z@&Ip>`sS!VhK^@-c>GA|f#E*roi(WbhC#xX1{RW@ZqFbUr?cszDwZ!)2VCCoT_>@YLeJ5u8;bF^wWjsr`e|m^i zeI?r$7S`8ue%X6Gq;na}l6Cg$@$N3kKbnkUtXuIH?HWemb8rnCz>#MgyCsoc0>HW#3&SF}>d+eJW*Z zBxGB0TVvoe&sG*ww)@}GB+w)5PfO+4)ld5lG;mM{46}LczqgV=jTi)%$QS$;SGIRg z+K>B8f5Wyb>N}F3t_)qTn5Z*5)cbG0ZmG7yUMfXaJWAx~^=oWx>ZU$k?A({JrB>)$ z2et`atw3yl{SS>Wkdy&|ZPg;|em}{;=ix}l=^`u3_b%dW0k37)7HYG8F~$&5W2cRl z=6e^qcsg-*$DQ?bw4K#Xh6~~L+`L(#gtJ97??3bqvU$V5X-xlR59?T&6$vS|H*LFk zNnk^sILkMLgg5^Q&oCOxL8$e-4}Q|&HTB)6g1B4#tsbQKx6f^Z{@#Z?U;ihH|3~Ql zFR{C&`ksJ_ELuIe7U)OnOpxJpXB7Kbd0I)$_bjzMuZ;JV=tAyXQ z+JG)g8|X)U^TC&J?EzN=<$j>RHl!DtaDDNN8!n^@7xIyh%Quco81#;g6T&r131@1S!3fSqLpzYB*Ap3dZXxp`#<>Zz?}SX^Ox&i ziBR{q;j874qdrJlKdtL4!(c2_2Gx?OZd+XP;;J&-Ou3JY4V2$ME{(3_!s+r13WSat zE9^U3O@jnbbv<73Y?J@c&IoAzd->RwVck7$4B8yW9Y@dp?3rbFxbo4V2Hl`T7 zp8O%iLpXcULagzi!s_;H0Wd0Sjj!np>)r;FTzh}{oaAsK3)w^8?PuyF_%BZ z*TB()H+1zQSVCd2XzAO7!tPN3cg0pq0joD{;PNuoF;Jl|2?MpB3!b0L zR;3&14BDcoCC6NtVK9K2ImmXd%FYJUoy9nT&3fI`8m;1{tidn8#xL0%h1(bvz zPmiMRK?5daa1!==E{HL|SNassIJ+Swm<%e^;Qt`>aE3!D3Lv^UX>&i_SYRe6vtuEB*j`@nJn_(i^AjA!UdJZ&*NSP!d9 z59a7Z0sT6F*+9>>i~X;p@Vy?-9)b%pLiKCdRg0%*H{?YmC@>^eNveK9@cXh^b!!(_ z@AzJEKsEb7FpR-)zO7cJf~yzwo&73XvCe+rGPg zTs|VJ84WzqU-G%$^PXF6(b_WHhK4SY86jgv=w7>=TrWp`2#WsoQLypmaBh6qYNkfT zy-V6txZT6S)@;BI9-CV&7V6v%av7iIS+}zi$H@3sUI)I8T?kVBppBbdkv;Z;} z1odm-_Q%V|hlkErq>NWE5_{)g#@)>&=I?4)@Kmw}BE(qBkPBzmz5>dGAX1{g)Ad(K&8jkc)s2)!=)d-$^2=BZub&H9yQ@ zrsjPUX!8$5PxAofnF8S`P~Dxf^f7VFLgs(cW*8#DW0m5)#z{uFW`|+iHuFD0QPTp5 z{@b4NtUP+P0k3X^TNH31(og@>CkZ-$E;4@d0CBj*1ZR9wNq`t*s%34$#U2VgLhwJ$ zhYHt$|JEkQ;y_j+@D?IS13#-O^l~oToWu+_nTGc6Q}6JF^3Qx{PMTl) z!`MPyFlZK}t@7H4*<#S#z9;>dpUsnXQ||NCOE|UO)1;c4q5mRcLp4o*^Y}~T?GF2v z1H?p^ZQ*LDkjRCf%BjhCz(%rUbgQz9pdY&?r ztf0naoQZ`Wj?8g$MdHJhB8+dQ-aivB3RIu|;#hK?AXoRA&N%reMy#zz>vDR58}W87 z23c1*XW(TrC|&1`d=SQvW{B4<2a&x*3|D@xs53` zY+Stv9ee}NkY>zL!J|YKB)PItmVCU#xL{WAT*0tgl2rQLRj$D;uKgW zx}@Y2+r&G}6Qe;;{%hgwAOah*&HVz-0KTK6aCQ}rF-L#8aV$bVAX8_C0$v?g%iCWb zQb7VP1(ShgfC9^e`|zK{~i3N!v z48%YX{g!5-CT$PKIY>+XTKPRj?4VQu=^l^Rv@}(s-#ze<*h_1>i&}B0sMCz**9OWn zp#nfY-@YD=CVX8=@k@u_fZM@go$2JcGt8fbo`3$ol#}gCpx8f2V@25!0sNV@ey$4v z$te8gKLPw5f`#go@%+H5Xv^ro|NOMf{$2kc1oT-AJU^q01ob)}#53?ZfBPSL%z+>w zcm$iG&(pnP`|UB-e~+aLL%q&=ZGGTl$dXyd0|d|DKPg^q1#h>kJdLBBcAs?I<7fX; z#0UyiKxvAtJ?qaKS>x477N+zR4YF3C_)?*;M7p>DyzPhSj%GWr(FAq8P(D}f^Xp5}M zpuOYuJDz9-?o2wof*Sa^CI&~lXvwwSKN~N)741M%=qXp} z^!g0#o#IPOX&Tc$M2g_{^?gd9_rQjHpzmAY#nMSLec77pN=6C@7e?4&x(+nKI!6)6 z(*KZBnqIAEV4kJ(XZk8sEAXSs{mVP+ZJ~|FzkhQQU7SjPh~_Gr!S)p75)lD8T9XxH z_VX4^T1$(p)ode~TawVG(x%(}te73d1>2M3g zB9`Gu4jfe6`3ez6cdU=5@2KRp9(ku1-w=phIV)cfpBRsh{ zso+&~zFG|4^x^QL4rwZ(lcZZ+`HkW)bIH%2ZCLk_W3=qbp2FpbtY%c=kIR7s%>2AI zm!)&ja=&Ia2yyfpZtJGkpl7|7RR>9@0p(>sFqddN_Ah=WiLYn~qrPidTB1uKI=DtJ zXLTfN5eDZs1*d;*Og_*Dd}GssIljuwO_(%Q@r{32-PdsyskLZO%!>D1ny4eO9S2`C zjLby;_@<)74^-e^+(HSlikr&78N1Fbz1#wzDQb`X=;m z(y=B_8E2hM`k&dYvr(|zbViy>AE^n}9^wx6dCNPFR|87+t@x>RZmbgf@qK&ZLA9>E zByUFK?CWaF#G|&y&e)i9Kp%No!f)GPMjS@??(l;C}BHu-w^G0AJ3hljsypx&%;%OlWQ~ot6cDq2&}yJ$D>Mzq1}wC_A&Q z`k`XC_LqDpnu|RbWuXU}&;yXnf%K@kc4ZnTJPld!#x_P@H2aL8=K@Jt_L9mBUp0-AwjEidYGm?I#*iLgEi)-afphd51B^zxUH!>+Vn8Rck%ny}J9UXVuo$lha-|ma@Of)j`a|Kvrl>~4nv7;ETq8BKx?^C@HT)(M1IuF}N z7Vh6S3?|-cyesN(Muz92*Uk1`3N|sDE5@6NWz(%5q`TpW(pRQR9ErjL<1wwp#R){Q z@Qa+Z(LZFXIJKC7j>)5J>-1TmOiu<6D#~2_y;Zv^-$;R3zdro4_sSws#ic*d{nIEq z#LZ5IHQNfv%yk#L!>0U685yI&?XT#=wL|kAsoq4cF=M))U#w!mVE*-1sOEz8@xdjqT|{qHJWHT z>YVX-0>el6_9r_-=$0L|46RPJDF}4?3`@h3>Nt$0P)o`bxzOVzCOYDR zK3}Oh_UX5;Lb+lzX%2zYj92qIHny&jj3oPrwC^izL%nl}{41W^K9h#*8TACXv%o-I z6334pua22I{K9`zikp&(3_~*`mZ?XI75+9EFvBS-Y_VVn!5X#vTv4>r4L$sqas^5a z`mLj=uYceWz=FVH8lDwd#;L7-dXO&JW7SptN; zmd(n4l)cb(viD5<_XU+f<61^Sb!JI4lPiZPiRM0hIix~czqI=>L`!oX)e0~YvxDjW zm92Qy@{Xc;Kio22!)9?L*ZfJaC=+Ot+^U)v@d2}{H8?L?-yNw^wIL-}*Fl2SG?&d) z&?B~#y$RA9hAls4lLzh1UP|E_U-8vh19e8}S8a>HCU)MNJCv%!=&vK~SJyr1`Gr#h zi!L}Lz*t3m-VgJ6_!Muih-vg*z-s!(0d`2uV3d-7V44VR);KKp#$G2RcjdI(hocHw z+N#mMU#cER=cx)Gu1iQ>W(g+2Rtszsn|8%#3_v~4smXK--HnNEWQ*%m?{CssnK3M2 zZ4t!fOLIXM)-L7F!*b;(vLGCnKrcz%~bDl-)_4* zNySL-5Z4Q6$x`A2A7Y1$+uem^GakIa$L4LDqAF7!e`x&?Ep($uSZw~)M04_2@eM;{ zg_d+F*P`bQ!Tq2$_q~PSm}84T9?%f4Y)l{l;JReP+H|Nca_sTU8b^eVJO;tl6fLwL zs&RhUK~mcJPjJR~uI{nm8tYYD>bT-DiO)Ay0y%G&)lsQ;UC52Ht9126i>mfWvPz(P z>2DvlBU?I6QQZ>`=_sl1f3#j$dK>V!tg5F@xUEOK%F$+l+9m^1jbekXaV?i*D1DI=yaShc^%jWvEO+P)5hBclP6pef zLn=AM%*pEyRmg?>nhfI1)#HV7wHz=@7C$Kcsbd1^AiFU$KFE8MoBTE^9iZYz@oTgj zB;lTT@%2rO;sWVLDi%!Ifw|-t)viBTC9u|D)yVBW?jt2F51jw|m4Y8miDuP)WIe;Cc1akD_`!^g$o7($h+@GMYKS-)8=RVqI`S4`le2ve$L4T@u$iL?!RQiC;^C4q(QcMeeM#!m(%>XPS{5GSBM*B%*6zTk{e)_V~&McJb%D_ebq3I2qk^+Qfzf&^yKJ+Ye^OtZ0lC3u(nx@ zkJY5Hnu(UyY_+B;8u(bn_U>%3QlF^~LC~c}X-r_d;ZM`OP#lM%C^_Y+=u8sIPWM3^ z(Mq|eROKKd?4>_Mt>85zFT_y5TWKy7(_=Q9Ih_? z&&6lh2tb?0FbO)WPobi<*p7w^%ir8>xWuMYBe$o(#!Jlz(|E2!Hv?hw)%F9&g#-qZ z*iZoalgs!Hx1Cs(h86`HF@bt2!)*(3EO11)LpMPpi+W5V*ggsG1)d}(w#Yhx+AC%p z?=ROX5ry49clPJ^K)Oo@IpwzQ8Q8W0j*L^YGp~SSg-EzE*B|O~$nGSf*tlsv+Utuj zH4ihi0cr?+)9f)I4G?ZqYJ18$tS6cA&5RSRQuwO+`Z5&p*x<})VQPK;_9mSnW$I}Z zqgCmZOESoX9YYEG<#V?@-Irv~RWnKBrgc*c(J$-VMfzpdXItT#XV4I;&{@c5UfbC)y(~$%Gh;OZm4CIO3QKeWr)|0NZsfVGR^Hz{3yaYHa&4n zYV>nnaJJeuWoDp#pfbAFjCfPMrN~Ju6JJxrVW{4f{?l+u_v-7PY=Y2(gH%aD=u%2tO*ZLv(>z5n9sRfL@H-kmUg{{E!vg z9PNU%o9+?Y50bKdov!I$brj`6zs`6TD1-tkXmcKHI|K@8dQX@h5E?F=*c^OcGVT)( zSu69wVviLGIH{788u^P6COPYukKB47(s`IPu@f1oYE0LR#?r5;m$Wjyc-@VhH9;_tA}eMj;4Xbp96>Eprae`#gt}sHPJ6*g@@F+%0-1`wAbn3X zYCapQ;vjP=^kn-YW>XDK`+}9jUjW=IThZS!<#EM0HThRzAvlq@rq{XMsR0t?tm7;~ zb9=rVmmM2b4R|*)^Q0=L2aU}WB(0gIGt2x|)aC}(SXr80+zj2EJn0}OphPyEXGSF* zcPIV6SVFTJm9mTM&`PrM6!xLo>hHOA7}-vKW9w**lAkh0XNp|Ra@U>Bq0TFX!?dGf z6wh{euneL9YEtkuCUOA=?OuFKom!f0XSKU?S4I#!aC01;{dopz`# zI{uYyGH$6!TMIymUjX!|eK#A~0+G_TSV}-hNMr~6kIHbb)Nx$7y_YrJ9!%3Au7S{H zE;!ENq{$pq+-XqL@FNtt8%4{p=y~4l{2FwgN|Ki&#VsA@Sudyu zjk`rz>RLCVxBY}gvxDd~UrJ8zP8tcd25{wSnK!#eN%sEvAmvWR&ewt@1%GT?iHfc! zoMJda{kc}HMwWvdGkHnz;h4?u^~Nm}##pkZ`Ge8IZYH#DvhT^OkbEijf;-?Gv8O&= zOov&njYWJYN|FfG4_^jJE9==rmta;~#x=xerK_XD!I*BaN&+QlxVAZLRV1mLan*($ zL7k?A+0)cmX&`}BwZ1SBR&NwBw8 zc?@s6F|J8jF5jJjX(Ay%X7kn|{-xa3^&9TU3S&DYQ?MnQGmB*9$fyO9@N^G_SR1bD-x zXXY?bb9EwKIe=Zi)f{Rrnd)d^Hifb*n3m2+8=8E(Jro4M zNY2-s6X%iMOy?4CYNMy@{h9@+lXGw%LXT1+nUmPyj0!(DR)_76tqjKaF&-nBy#Mnu zG7*YuTSBE$7>1!Y#w%qU8=c{0K7e0|XAW%C>?}S6vry~}(L}5V6_TwyroDv9-G!}dwxoTM7-W&mF&2_4sXugNuj#2z_y``Qd#l7qX za-wc!iwbC+D9K&OP#Wv`5Xl~1+wT8LM5yF?5xxrp1~5r)6elpc{ToB_U2E{LPr3~| z<3Wx$sYBY5PFEtZOOERfvaca`k0#cy!NR>Z!(O&?an?YcX(%=e(v}j0b~ArOk-NdG ztCsM?q_2lT_g=Cp=T=q%gCDbP&xomoBEl}2>>|k=(j|zd?Ir!B^{nBM6Z2HpT za%76lA^BCV7T^z-S!Yw)8E##276j+OWlx zu23M>rDiCoclAmcNkVPV)EZ`6#&sNJc}+0|2WD-KnGr}r+iC7;wMU})qYK%w>;@+F zEl4&-!sokWTF5L5&2au8;y#?{!7c_W$aDW<-9=jX(x#gFkOF zQT>$PgY4`up55*ocx2ki-0u*Um!byLqctd)gQ>J*G+;J-Lat zp|hckMamJ;6i*Ir{&_+%r>05Oy1p$(?}CD`Xl+sz$&O+2vx-y*1jq zgMz#1?^C>!Cy)3TH@Ym!TOhn)_3_#T6&A-LL2J?pFUe2gDjj#1Y~;x*-^9ZEPiosD zR)?uU+K0+?V6UxI7PZ~X7@uAXncY$Zr#jeKHLlU1ND{1BBS>tW z5~%r9$n`FUDiqbBhU_P-Jw~xITDTY;{NqVa7C%BhB4TL0IIB%-lN8%e#J_&i3y%jO zA;T3;n!bd~`&NPV+L`77rA1li1ExC3&LB||C5u92&vO-*akLwawTV3z&U}O1_+<=R z2^pxyjYfTvCO^-Bo7k7oJg<~>KVSQa8Zo3s#ETWI1xE?zXa3zYo6yhD?O^k_a>> zijXN&Cas3Mt~6UX|25Ns@zBahh%tn1Y{#^5KR4rlD$!o~o!A0~n7{%@wLV(6l2Vk| z66_4u4!862z~(g?4a#k0SYEL#73WH`6cyET&CFFI=5VEawEQ>X*Jhkq$g%(K31|&Xi=4SUyCMbfP`i_Fd* zJ!VQ}9-A=Ma41?7D$>-pOhqN^1~|~s+7EM}GzLkU&tp0-fBHZ69CEmtM5v=wsQS1Y z_UT?LL?cIyv{e1JHH=1}cKX9o$0YXmcf_(rYS$>`+f!U`g&iIz*JuW-^U)dFXXBtY4pin2YX#B(4q7h#@D8A1(>Y_t&S}M| z2QgI0k0IvKu@l$>?(K%}3@0z1of^g~&YM1}QAWw->|Hyh0*$c}X+X66(`&f%NeC7zZ;yAfU?3WAZI@i^CFb&H3G~zkr)3LRu244u zll*=tNDiG3#AH6xgo~TQe4utB80@bgVRRlq;ttA|1mK9Q3sEkNGFW;|FVb3yEb0?l z4#bL4JO2#o(-b=hh)2Owum0QhHA7e;S4wvzqBa%gCq-s$&3^R&&5!#6A!@oIMS0YF z3r}Zx2mfy=etZ+HtM8T~ZmycanMq~4-;qF(z3py1j=C|oF38Js6;|!#mvp6GEWml|o z5Vy+*qKMcbHhbQykX8n5qt}`{zLs8WqhPR@x5~4iYT-;H^n^P>%;MOaOLH+-tdezu zAn!ek!2QUGWkBgp1CEqG^t2xKDYS}-Inj~lv90_<2&7!~%KAQb!$)Fa=~-^p4*p=- zWqnj*8a2QLcx4k`eh0^KSi_4f-bnmGC6Im`D8EXn6#jhqRQ3k%d~wmgB91Hn&I<5yZ)9dDGZ4;YhCAt_VO%>=MXeoa(b zsy=k~t3I3_r{4JZ9t9l+zdoGd2JQaE8oUY3Fg$kI^gQH()b8+}qt;1iQo+t=dhQ>B zjS=NxhFck_8*}`ms>Fq58`C}*8lX=uq5l4Yxd~S~ri>W7=TMobysxI^mA_d^z~1d4 zUVfjWD}(;vtQJeVs@Tq05McM#>T(~|U$kXR=;aPVp|MaAQMG}TN4 zq|hlzQ=p_UWkB^_JR)a;cyi#ZXofM_Idc17$T`;T{)SD-iSkSA&x{@Cq-%o{?%3sw z(wP8i&-)!Q_@?z|1LIHh&aAFdxK4`hXs42ZIiby|0I1@KfwY(ra*%KnJbr%AcP=b# z?(wpF3M3nyoh;Lv{BAVdsb=R@ug!u9?Nfk3#|H0CVZDAk;Iw7*rIuG%Z^;zC)Ud6) z?5s0ZC2vD94^5Pf;%=I-mK&;u)|-9L#Ckhlt`;T1cVR|V<7sAi^vtZ$^emyW&hNfK zzI*;_E9`rZh_x!C{%_nOdNkkDcu@{+*?1t^W9=gO>_&2}~f*o+fwO)z)pog2h>gO5l zL#vldd`kQDMoS5S=aOvQ)x##y)wdY%i|gKhEDi~h`>92B;c(UG_FAdF`!35^&6wyc zT|Rq@!?;3&Cw~Wk*;GjGHjkHB^?dIRcAP&=fF+_uc<^Yfu6+7CJ)clv#|7THwduL_ zVg_5npZc`tPYd5BaaMe;D0QxCRjx{QTFy}LV@33i7*26TGd%N@2lZ5h@{Qr7&(>jD z)JtvJRw03^k4&#yG9#_cTzMK|9$LnmQ6Ds0TshtHGw-t5;`__fI#CDb;*8b! zh)%9^-SBgki$b;>ec6tqU3-`1M|M}_<)tlTlq}_IDBx^P%K(yIQs_|_9#4$@#4gr~ z>Hb5_GQ;$H)IZJX|7rnFLZrZpLu973>n-kGIPek}%;q_TR4;XYvYaAdtub^j$U{i3 z18djtFp;*nO9g>7t!tnbQ8GAL;R3T|3wrI{4VKTVoXDJoM7v{usd%?!OyXA!i z_2MBFwB=c?K`RUxm_R=q(BYoy61@r_@L?nJX$F_pc#+GRJQl0P^5#W9${X?P4zDNh za4T^2YJC&@$B*~Io9nNo@b>|d4{d~lxDO@S@Ba|s&-Z!E@*V6ykj{knoBz*|zgHeg zaTX-RKYT9#5@tU5`rP{G9oN%I4HonJAO2jSS@eYSlg|A358=Pai2uX?_Wk|=`2T9} zWuB4vpZH+f8+f>m-zqF z{(o-l8VLz7C%>+&z2$o&X>^wxb?-E(cSAJF;a+pT`tsB{J!+v>)7$vP(c679_ls50 zKZyDaX~Dkr+lHOw(&-au;TmF6@FDC~apb}N*|+!8Vdg_m;`+1x|$E1qt ztKOu|jb=}`-eTnjuI#msw89fS$#ajewWqq~`dqTAN`7b;mUs-jjMpRL~^j$gCEXHS6HC0);LRE`KNRj!`E zem=7SaE#+fu>zyx{Rfj%7T1Su!dLmm`Y~smFd`N(4KGs?# z+;oVk<&dA22G9&akd5`|LOSXN_Du%qAXKy>aV@bRYz1?BKWrX@oL^Tz_IPM%!+s&f z@=wVh2SIo|c0lt=1`nsH<}=tlS$)$C!3Ab24ztNX4R!LRrbL8e5fm&R+%jl7<8XZL zrJvV1_58JIBogwxTBh~7JYsLep|aaga$UvV&%b_tZpv}>n9yVxrx2e(eAvJ-iN_H3 zL=#4UEA<)X<^v1yMULBye>B*$n)uU>Py7iJe8a{jzAsu~>U73{fm3b&_tclKiGIyPwJB zJvj3VymjSlo5?{>z-??;p?uIjmtUB*jbn}xOMG$LW`maFtQKN_d|jzAE@&70wd1u9 zUdjm>Z`vz>h(#&3dYV3c;xAX_7n!pFMf%uzoAV1C_@sg7n`ecR$eJ+4;w@ZP^;YQz(tGosF&7tIy!J5D3c>Vq11^94P z@cnKZcC&hpXDz3UiIiJ9zLl<9KBN<`EmNh>twOBc-NJHd{`Y{l#T&Oe#~zsn#LuUt zoc2_+OTP;_l1LB-$G1sOts!0NcXyB?qtr9aIl2dH4Jtm?pe@PK&2`)lz<|;+mQB?Z zDWNV8iP51Ay>#o>X4@2sZ!4!c0BP?it+}*sj@UiY4%sqpVtjJt)8@&(ym059Zrxpt zc$~u*ozR_1#zK9LR$LgPl9%jwd8?DDrr%zZX?ikek?G^09f>1Tes?+@$@lC<1`W?6 zZAYz5JKgeRrW5mEI|GC>O2l2)B>V;8KJjcYO>qOt=J&YGPUwrw{ED|>?|5XbbtmFx z7)A!|<~>e=u(Fb`&{Pa{y7a8rFPV;vuzhG8j}5Ts=x^(IpVA{F?+DB#Qli{vpv6_n8`_q z;oMW997LCH#2u*oX$n_#KnS7-7yZ`PamF*o{!7?D(-wOzx|2Ip?HVk6XpAn-w0t;P zd@Uf5K#U&^=jH~J1jqN@DZWvniW%+*3z06ayv~Q1UnL&*4{a&vp)GTj3-S z0Wt^uG&ZAQF3D`c(#h(iq+*KBK}a?a!Zk?rnZIiFYRPzct+5Tc{g}>GuXV5*VA`{tX_oiP9G5!cG5`Lp(Nqvy(RZj)}I)kWAZzgEtofxkz7~ zHt(vdmnQ7Ow}x{^%(9Qs#p=m7Yb^QC9PIp+3=%SmV+w)1n+NC5Ox@vUAVP4SHe%P^ zapZfrd|DbwBObsjOMO!gbz(Uh!OSD(4ABZx8)1!gFDP6xFh-^3i>!p{1Qn?7@>-GP zulF$ePGC7@lUi~Wg(Dk!cD-KC?Ym36V@z$R#ap5-f7j>SWa4ZNZ6ecdqjgG5jPkfS zS?)j3Jw=^{QcJA#54@wzKb=?29ni{V7fsem}4-4Q0oks_Reh&Hn7zdl74} z`|x(tq}JBSY}O^|xK5)z;m^T{++LXW%*!?EKCxyieC`~$I6r2NXZtE^C5wU&j@~uw zd;c^Im&H}_1n1*`-I%cC4)rdCL#$1h30U8r=bWP)qjFB_Y1B+dJfL%3v6W}q-urt! zXdRS_6S`S*z#aA2=@Z!Fg(Z)@cX01U5Xk)cbA~sYf>^c-#Ch87d1mhJT&WPm%6Zx1 z2L*S8LVnK>$&uaeoPHqNXyJZn*fKAs4Jr5yQT-{S&-Y0CV75z(?=$>#hh%{(8XLT$pCM~{3 zPfL?C!`;s4YatriJ;VNa2dv+r0R}Lqr1zxA;#;Yg2VlQd79?@+p(+ipW}%R%oY4ux zJ?U=^%{(FZ`z_YRUSJ4-8pxbjs>5M$aFYsvat7OAg4G0*Z8w$1b{N1kLbY#?dvrz8 zRb?MOHv*gmg&;9@%y-PO)}2TWc=L!}y&;#=eRuz;Hr(zP7|g9Ky;>v#_$Frp#AV; z0Wsc@$`E{PtGYMj}NVrXEidv{yi7Ir!LIh@bq-}fH0zmNv7 zi&?j^c&xnZ>-d{_55}EiJ3Kb;pgcN#GiA(mEj8Fr(!#-s2^AyRx7gnDQ%hsrHh;+J zh{=6xI}=f>!!Xu@D>Aw^86p$M=>r7(GaoR7mHpGw;)UuqAx=}+jD0O1TRq+t0#I+5 z-NHzl&)h`80L=Vc0NGs2?A>rLs$>;)x7(xD{`n=A`rD2h=Ek2(vsGYXq^dgV_aBqb zi;^Z`;ed7?KW7Y!B(Ns!O5Mj1n-7FrE;5G;iFJ6wGn*d>anbnmrGVK&(1;*XAJ{xq zG`+g0D8yCw8+u%e9>0Zg=jH97<8Mu$)QRbdi>wPrL_GVb)Y?!188J(5J%krv2WdWv9qpSb^|sG&*bMoXzMG2`x;VyPsIAscn@%Rh!n2`yPgy-XLb-eBPb*HuUW~%b9IM8%ZUSC z-|yat$@VA7o}8_1h&_nNp+^xte3)*i5ua7fBm>jG=vH1NR&YhsZj|Z%sb|>0es*r064?Kwxny!Vk*%v$@v{6MJNMsb;O2WV8Nn2y!ww)9!rH}k8R z8E}o)qdkI2fQ%!1T*0*$eR_dO)RNQPTZ%57g!Ev};wjY-e<#V^2C1;Y)G#_Nji|8{ zwx`=gNFvMi$4|&<_9-yc4HX)dR61qZtT6j@h%x>g0*hNnm>jM}W0ow#fDH>WgEbrB zM<)C3az&8voX?=}uxCHv8XxMVQfU(Sl z!1j3LS$sE4QBCpl_HZHNckug{l9}cYUTeTYvF6#v5S24gD(zNBrr+W69p~!JsA^6h zgR!|9Y>Yb-qWy}6MBWgjkw>TQI@GE$Xng0nZs95&mWMbSi$Ds~sV6i_4KUD2#xA0X zC7rFr!jw*neZy8(g=ICEupvnITbHpJ&Lz(y)2|KR+Wl8&qqzyzEuwzi0RbB` z!*QBe+>n$r)Epf>)2h{V@V--@q^3%nC8NLWU^HqQWFv z9SB#nfSuVgh`h}f99D<*^_J5cK^NC27eQE7n(z0_GezpC%O0H8*~j*HjAfJMeKZp; zlTWjs3QLRS+Pu5hW_GFj1`~AJ+w0Y*J2p&(d4nQTthngLRAT(>JIYk+Y!6Zr(b2z@ z#XLLbl30(hFzs60=H+l6%xow;5buOPm{eJR0R^%&^US2_3RccyL(BU5i50^` z-GXjU`%74^=HjFPyseOWRC7x~w;Z+%7YaYdc6bMb2f5vyX1(Uj*a2s*889BQa^ulV zGv|^VvzMKS4z~}$ba=T6U_S&cYT+R*%}t0%1>KN(U>LM!`!ec&~ZWH3q>K9 z9-nLw^o1orxR;$HfZpSHsl^0Fu^$|v)z064%0lXu?rZ2g9ujz-ElY=3^t;$Zr6y{{ ztN({U!!I&cR*PkyAI;5Hvgt9F_sGhy__@rtKF(7X9#@P(MqIb6E&|SKnvDbWesw&o zOMvd{V9=Z2ew816`ke;D$BRCW1#b`WgKu8GFMxsksCtejfsDriRUt>PLrM_`J2TxzmE=n@85ovIO0?y{aseQCtrn z7`qaCthWh>3|VY3)fSh8KdBeri;;oSS)PyOeLLt$T=>&eMs!>JN)x+xp1aGdssW+S zRE(Bxz|7)%3ziQ#>owTPLW>Y`*UMWeiG|;0ofJpOQMz>*@r}#^+k-el9_&-GGiNJR zrakZcU@*Gh9v+70+97uW%~Vil52m32m547p{8WF? z^{Y`+J-O*HDViLonggsE;#~~blmj1O<9XZqVK#=Pe)H~ z8aZgkZF#tE1Y*TuTCUkoH|sTzw2_phu^at-N|ehqJGMwAlXyc}yIw3f9hIm0*+U$9xJUd@slr5>d4GEZhc zZsPS$f-JYQFN@&p%Wl{8;P1~F#dh48@70>GrcNJpJed2JJ;%vaa;~TL6YmSUmW{k9 z775LEJlt2u#VRm+Pob8M=sE(EM)mnNk23g%xvwco4Z$3p@PLVqJId_XLfdBNyq!-5 z1Gf=YT$_E1KRM`3<(4UDyI@dS`a|+GGfb?<@FPI82R5=Jmz>(dFo_%ia}$yf3>4F= zJnV6{sJfw0Ol0V*iQUXXIA^Btu7K*RRJ!wR@j#m4(;Itai*uuom-0rN)GVJT2xWJt zOhl5%AoAlE(YbYg08=T_wSHg?smtYQPJ|q*#U);Il@0``e}O6IccTn>;$rwqTMrK& zJh(?}nEQDfLTATa4({>%(LQl!ej4C0nRZTC*ST_4vSBvy!J`>CENN6@!-!w>wpiXV zBk0RAY&-1JUc8l(eT68*hfI*y#tMWh(cSoM>|=#kxhI#sw{aRH_L1of_o&^$y>pG* zKE5#7GPVA|nMzuT0`EOc`UBhdL=!CAAit*T*TV3CGbP(C;rT>>7;j73C81CukBh0r z+x0GFQ25|n_(ZJZ(#AjjG&QxKJQ6jg&GwD6fCsPvNv6NzL~Sb}@t2ARW2QMQ2dafD znbN(orSm5v`AtJ-#KpYI@XexM%v00=ts?%9-GNBVvYB+UFva(5uq4$ znLbJitH89UtZ4pGdQs#G-7*Q}XXkRwyZ3(b{8gW~;WdH}W*dcT(36(y?ojvFvQpJZ z3*hY40tAG|BYK|P*v0ZZs(y>Me<=mJgSioY%`Qw(hxqzNTOZ1G3?wV5nb+`liciTn z@OxsrZc&H*z5nH9?wslB;hO4lsiL)pvF>DkIUmc*X`qGMeoCj@4iWJY2(uvVb7~~j z=`8CndTr{^zU4trehorzJWP8$DT#U0QXk$AUdMkvu(A=mxDa&# zMrNOHb7tQUIxm1G)z%TNUd@ow?@kOoOFf>z(5_FhJ(NL1udC&&105dLEEvtFtjvcU z(mXx6Pusf4QN+04AVuLTx30Uu@ggVP;%d75?A_ARIzZ4ExC;)~ewc-f{itwJpL%pw z1hsdV5f?mp12Z5p1w*~`p2z$UQ=2B72>b&XFeCpZ!E~S@D|K|M4u$(rc~>5pbRzZ# zO6-_HP!)eT*zWRp&>&@rId3Wd%$=BpWw=g|B|BcNWb8@bX3LT3HE!1id1wD{#6~PO zMrfMQV2=}*K=~B3kb1}|RXzIX9Hw^|MkpJK{;nUiX8C^;(aRm#zF9~4t$eCjn4CAJ z*6G9X8FRCs2l*-OIHRng=nX2Z@60Yz(HtZ5Yb*En@zsR_Z+ss22?-LWHfM`by+(@- zxgHrcOW;)W*uL3~5a-R}j0Vws(vHcugLG?7EV63lXycrQDo*hJlIQHz9xdkMgqcpq zWbPLA=MO*1m{0h;xoy?$G*XvF2AJ@jNa|O1V!8NqPx3t|*$SHVb$Y~ znFrt0{1{*uK|uO-Ve$L2?nYj zdX$v`iejaz|Iop}n|mhi*7ZJd^7OrxpXJx^XyYG-G8aN7^*DWa z7+ZOF96a^0<9A6R$!nfDOAeJhRVpksTMYt>4g{-dhDES);36C;U~|RR2Z|%$6vNC^pI}6i5=dj{)#ve= zbZOd&R`TZb;o%jC5Ui-?f?+BTuB4^FJxd+(41F_ZPxKQ)p|rr0_*m#u$MyJ7sux)R z0~g6ZBKYjckYBWa`yR_ZJZ8S-7LU#uji`W|t0fh93qJpa3ghY|9MH+gJqR&GG9`V- zXp3153u&l%Wl~MVV`^MBzuPLW>}NC5LBe2afh%W5lUDdK;UIP9w{PZ)iL8b8+8VsJ z6I?@yqvXq6IOdwtvMGqLSE>!5GlM!RH$~BF@tYmRp z-F3P+2)epmbGVA=M{5NnX*>Q9-a%9kt0vBzP5;MVzl9-cIc75WN&H7&KQ(GMAr5cd zl$t{mcnQf`y~i%T1VVscBK)(;>HB<-$>5gzwt|}SsJ2-z#d!6+$^M+ln>F!tn`E|X z(ej+{@2W7s#rdE%=gtsd=QYd`ihJ`yq0=SeUC%-DR`LB$dGna|)$$+AuXz^A`Y5+Q z9Kmh(oBu&hLIpg>k3T!J|B^ZOcOKle3P$zd2E=~UkNULwR1nrtkYJ$li~A3c zS2u8Aq>Q6GDiY{+T9gkYJ^b!1Ctzx2Kvq2~V6=}p|2y~e5K!v=9(Sm@KeB0+ z0#EDKHbZ;%EhQ#&yb`jwjX8x*f65{r# zdX+SSKh@%y@;k@usoaB9z0M!WQtscDP;%X|u`qWThHcoAD&;p)9F;f1)N)(l?E%}2c{2KIun z`f=JmLAS4kqI`+xuH7AObx@M95vT;W>C^ysm@+S0C$oeG35{3;0}j>m9>v{fssjE|&RY<&4@A-(tFP^Egr6u^bB+H;3qbBA zl81u)9|Hb|KmG-Q`yaFY{X2@qCx^^|y_MaEjc6g!&S%=R_xgw2y!&ErE_qRd(nc#= zW0C&a(M4ZR>b^WF(_8M(Y=5Qn)6yA^r&Dt)4TxT2V||S0R}FnHo}8+Qf`j(UEKXgF!&Y7K5M25*ykz0P_uWvUHVo9CYzumeM{xb)#CYl z9sqcg4WRV-{_xV6mY95SwY=QkztXI_oHnO+pi4BSu1N&HpV{ChU16{Y<*APCF4jcaK&b@#3#+-?r-gNLR>7hkm4It$t?w8?xOW%L<(T2BJ z9zQGG$OpRRpBjNOjBE5ywrgM}>qmDpUt4N3msQPr zP`(XU3)#o^Op*Gxr+t*cR2i-ESoGPAYMqyv-V`UwEo(z1_AZ=q`HwH(%Es@rd9|58 zhK*%^seFw!aPxkDj^OufF9tW$d62EN z6k#!qI76%TGhIsMG$d*@;v%VxgQbmD`B0Y3f=#2x0Y7Wnh` z%?M!PdpE0fdh;}HlGjB>KkUm5tcj^4P3k1Do~7faR7T}#t)dBIGf0X^vMMxnRH~A= ze0*W>m&DujR$4P1UHVP3L(T6BhBmdO`K@D4;`&YH!xef<+#43{(yX4JA4>;`|7kzo zchW=0UKhCVC;AdjlO`$7#v{dAl)7x!UM&nw?kO^#v zJ9d?y>Sv!D778-3Uykic^T?T#u_K8t%V3@YeMO-v*`e;RU+t_KcMX~wA}(|zKN)ie zqE)q|a>|)9(c5;+Bz8(GRH)wST--r*$BGOUuk!b!;|z*BF@G8b-E+(@>9AR9{n#o_ z(DKA`bv>;-X;tMjOTFFsU468$(jf4!Ln}xb5zl=pIe@&M1?&~an_@{7$^H?MqX#HZ#dpr z8ngeMG70vnhc)rmQ;PHl1pq+iQB+rdL{y3D=hV)}XVF!>GSfnp^O!Uv{WNzs(Z;lB0;zn^tWEdu*Ns zwSm8RV4S$8saBWlI1s5mjWl+7uvNfK!uIVT-E!S;?3PSdD(a;6dH6EwK~y2=BroZZG{{&OG;T{76h>>V5Hx1oxAtYLni*C^)BhTTVgdzwO+aF*~d zkk_+|!1SCmB33NsEb4v*^ZI1l=VZ<`_^t3@GTy_pte_E6{hdy!#RO9Mcx~zClqQ%f z<;+QCRX!tm%Uhp~R8Z0v7811ul$TeXji+}IjltXIZbM6(f;ox77(iLyp!h+edWSgP zajCtlb+Gl!hy$(mSaT6n!d&e$hkY9|H%F=$V6)jxOA|6LF^{d@HY%;Xu^N{bKNn{D zLfaLR;6+UfzO(vOQ$dCa9Isa zwwiil!$XjzrQRYJ7O@ru++hj06E{<1y0D?Xs`PzcR0%1^emMsVenc!nZear^o+=8H z9F;0#kaUKX9@06CR*l+cLakm6@XxYhYBa3JN^yvOD3RK`l|C|sN@tN`)i3)mmE5j% zRR0k>RaBZvec8VB2AU5%Zgn30hn0WMoLpA)HflvSqo*bcJN*Q70nP0y^LVdurg<5u zsx^#|wTm+RDm}2>T$N5kU}}ZON}>et08ddqy|}XV_;=YrZ9R)GJ)-APzOX? z0Kxj8wCLTCl}qJ{UD2H|j9#xp90X}OVh2LM3VAiVa#4N3PeMd5@&r@4fKb)m)x}## zX|Y&(v=cea2S6(P@qnNvZYwN6Wqzr&*3AUtLBp_O4#zyIVT>*6UlGfTmr}dy`lOM< zT0j6J01a$_z-7b}mHxk~JFBR;nsr?V51!yog1fs0Ptf4*!7aFZaCdiiXtZ$&ZjHM; zH1591|F5;SpM8C9<``Ylb98lebv@trzO$@b{cyEPnTgflo1wCPnzjxc6h$B_(ez2~ zcF{!B55+2Y^c0z9&RmYrT3N+SmB>mmg6)y%bx5M;G8SvRtQmX*lj_|&F!cRD(o(fg zi`y#D0Gu@In7dgVW$}x3RX$WAbX&G_w-=j2^a>D9lfsaDP&%iML z&ZpcZ-(2e_<<@wt$$VR&fnP04sdv6=D6^L_d;0vWbZc2UQQ?89H`5|=lX)CGTqvm3 zZ6hfwil}U?ojXC~g^+lSh85c-Ps+7vmq}_=3v>Ng9Xl4s+rXK`0xhCr1>ScuSv3rL zw)KRzI^ohMvYU>KfgV&uf@qPKuD3$%TK-_4zf^Sv;(;v#TIoNZ0Btcd=blr1Ka)U2ZeU=GB zxH0C%km@V#4AcQCH5w@*X`=N|DvP12(_{sWyRB@?t>aSAe!YjXE2$zOby+$|^~3t2 zm?N3Z&tvANHB4B8damaEJE2<5dm^T#FX5ZpY-W2bnwr~3#bwi+Q+Ri|~%X zo9@H7nOsI%yskXVaeeehsN~)~G*qayTSBn_wyOtwm5Y5XcG?1SEywx8=De>`jMHWO z5%EJM=bqaw!ncb*?dI3&9K>Ilu(R!?u52zxA#&sAZfU}NlpP`oR)B6nv4_4^sqsy} z?2{7<`p5Lb+**Gq#bFySX*MQvBJC>^mMU>()2J&^l^GV)(Ok27Uf4;M?*5oBrLn+e z@hI6q)Rf?~Q&~lB_WG_Om&U6U%s?L&FCTR0uO^^wt}Y*iU0CWlHPC0JJrhE5uk_b+ z7I(3pGRbI7Nq-yXT;=g}xIpv_gZCSBllJSYom;4&v(0p`X)K) zQ@hH8q=7*IHswXVgfRvigW`;<^W|OsiV)~;-w>6R%|JXW-M%yB)&8BYE2~Z$(T+7|GuL#OIX5GNtC`L&nJD(l)S59Bk z`=01*2y^ao%|>JE$e$v=RXhvq=Ej)fBNByl=5 zoSX?OsvC#BEcJZj1Nc5D z++{G&bkH-+K3!E7eu)3G+UP!6da}s(Nv|{dG4a2x>3=lCZyS}5|Cz=9kMchq{xiY- zdxt;ecYAPn-~MQWzpT?fq4*ZwWWByf{Qa8sO+(Bc^S5C5X_WOJ=x2-bSM5Jh@T2K} zyTLyQ@qaG==jV9Y@D+auaW_9|VHEgg`C=cVQ@KFUGPFJ34&reDk{7 z$f<*8N^xitvjZ3F75g||v(lq?rp^k!eYma|O*=wu@jr!8xNr{u`0Chc3JfqhsG6uh zJhn47%K^G879a-ESnUdHS?wo%kD!{Dyg8Inr(THJ$Fk7tXxe|W^O@7HzN4wpp}8dH_9%2}F_SUB z|J-6}rJYz8#l8`u-TBZ1jbMkkHm3QWdS2QQ>3ym@B$f2f#HE-m@{VteG4Ms~($2}% zE>c_v0}%Rq3>#x2C~bupKwCJy({{&J!g5MR#2$YjI=D@SJQ};d_kG*Nh>zF*3_%bM{E66&YD3ocL zCbAIV##4;YNm+Mk#pLa*qY$GsGxa)<1@wj+I6+zV&g0qD>-R+Xhz!Cn|>;KULpYW=W@PQ%&5pm=*uHGL?Rc9*VwXfyj!=1xj7jc?{GKb8l| z+v7D>-RN(=z8AW(T&E04k|g7gG+9#{W0GHPgS5n=Vpyn~7V;@~)&t^`#1Y!Sv{T1@ zt%mD}`Z4O%#}|x*Tbn=mjz@=ZH?c;M*^@;Y^AMZXhrzgG#eCQA7ZGK&d8!}-@~*WV zU0+b~M&s{d%nx^*u&KuTH2!i>qqG&&u8o|lyX&G%wn=#(MIZD}$e}p#hbsjW`5h+z zld{hil~DVSvM-q{4Lf*wLW)3nbeH#RX}?AIP1@(xkTA}%cvZSqA%X6Q^!<$JR>&?B zd*6HJ5k`P3ywS2^0QU^h$j8!kq+s>8NH{yX(Ir2lr%5f-#9r2NGq`~=S)XomB5V$p zo)xK$-j&j6NwmM1d6WqbBB8eqI|$HLVG)6>ijR*%&^E;t%dzUTEo({I9~5=guw;GK2KPLht^VHw7jlLU=)=RZtuh_omm2q0%P+C=0ou@=n)Nc9B?)0|Fhe zg3S_r`?8ByCXww$5mPbx{7nqY!9-`wErrw)vHRJ~)TWsB$@1$LN$l}DgKaIAxAaif z%aA2sb(b4MR6EP8aey{(?)WKdJD(25er(Hjh4+(=P;#Ew5j0<7%XPi$LGrOq7Nu!axmF)W=-5vYmgI3PjRp3(u7DuQ4y zWMD2yapg~hBU`nvIH)JzL$SOn{Qw)i;oy!X9BFljwe7L?4;@%*o-`vAoA?fVq|Y!zPYFPBq)y9ZZ0n!+ePP{K!!lQk<@mbW$4r4BL3v}^U9I=B zI=$Yyq8q(i$Wxagt&L$hZi#kr30Z$p?DqnzO{hNQ6dUBaqyQHW@!Tnj=``|gUM5C@ zk{2mp65#N&!S6xfL=Vt+ArlYz62G^uHwoputk<~|xsxthuS`oPl2zOBp~QbxG0v9*%$^=}OTW6G7G}Tr6v2X* z28XwlGI=36V==z*xnx<8xTR=D3mD@@>%Q%H_lvu*+Qktf{i9}02AY*3OR&Q*)%NV<^6_?0C-rSgc)^XIue{C$rQVQ}#B3mRk(OAbYV~>as``9X z`a=)HqWogRH2Yc*d>|)p*=Y!RxC)LYRTTB2ayD*nhG^nnilQsGZ)jp|?n9=tINlb< ziQo)*nJQ>uUsy;P+@0fC)Fs~T!B~@pmG^n2+aO?wf1{4s!n@S#=5+S5FFgjDB?IXW z20L2NhRtMyJ*kF-6eLk;Fzo}WE zVd0n6=1pk#E6=eyiXo8?SHtzxT!xNA@kc)42mcvq8x%I3rvpnx7Sjw7#6j1s={l@Q zaiJbW)53Ht&bz8e0rCKX=STbb9$<@x7^ROhrM?%9yRZ$<*5?4MU^P`N9+07084I4n z#WT%@JR(#j)F|K0C1^u`K;KMGm6I0XFQJQ5`X8qv;n(t0GFKmb6%js!>e-z*s`H!4a}DcfzENi` z(LSH>r&Hd1azPU|z}{YSW1coHNMfdyIB#mUD_ZJ4TgKPEe9buF%eGxx&2D-W%Ne?d zTqIkr6M(r|jOLxqsNva)vbdtJ1qw!wPo93nXYiCd2XzKvl#PvtJrQeLY_<&Q6h=N| zA_AeFAAO#0`u zVc2o{o-4s@f)^KG9DFu&msDHp%JPOImr9%tz)hI$}yYHKwS6IG24YnUS=;Wno-m#PS<$njbhC1{b>|=V}GdHZcBox?bdByt7A3J1#uGxUfAuq zd?{FFULEWJb6_e18@=c-Wk3sazK)p^O?Z7`36tU5*m7*`S`Kt1aX)6*C_pr3&_;U8 zq^z&un@;aySJ289;B2 zayET+!7%ZEzjrE;$TCnPzrO%wNg$E8CE?k;I7uK;!oJ|To0D{(BZ0_@@KUt_AkTY2 z$!ueqM%^FbedHP!v2ibDpj+Rr-pMi?(At}r5_Bj2fw2X42X89zA|PiJ&f)(!yyzY+ z%L{t=K;)3y{iQptU1xtsQhgtX3{=9dVmO1h_tyJfkpSJe*f&u@F6kbJGQ-qsvAy7U}FFg z50$pq+(HR=e^**hwT*7SuychtRiuz^t$J%e;R4;f?d zJ94xn?^~pq0+ckWnYmZ;Nm+ab{fuE)!A5<-!qi13wD0xGj${)=+uWKH+I(|@Hn0l5 zpN9wD=(I)rL6DQPZ;AT8j8ncsAIjdwkT>n(3PrQKB5lIC8D-O%bqvEVmz z)a?Gq`UWD^ZenRn=Dg5X7=*ZEnqQw{UQL7LB$OSz6*FOh=$y!#+@bA>JEx-o1r zoU<=xNtsiBWqpl5N%8zHZ%c44pFB$XVQv0^)7#= zj3(*cyND!H#dcrI^^6LA#8eQ;?4-m@UOj6)-}JB-1%zhhX0AUEX`yC)d?t)AOZHNW zPzLiNRDGNz*wyRS3Y1$V^d)o+iiG^&j4X_*z#e6ChLenGv;@;4dNoT9;^(tucs3q3 zZ+-;8J~zoM5@|h#Kjvo%IYcKM?N|Is^O}`RSq?sEn$YaI^<^d4KW0e6z{P8hOOC!~YE={|Su$rPsgn=RdIc zp5^}+2W-KbI(yhVSXAYudemQ%*GHP)aFTdqcN-@Si@i;?E48U@NAtAjTvQr*ItCpX0YvKQC zGG+Lm0QcVg;ERMhPUU&hv|zd>U>79M!cWYy2B5n#aCh7QR@05n%OOflm47Za-fi`i z8)al(D@!qtv&-TpD{d z=d!{a<`rnN74teNUS?^mIGC(Le3}kQfe@wATlxZAv#7`uCzPPvF#nU?A^z`lOqu^L z+h$Gk{8-SV3moH#8*$VpDlNSJ5?bd;yD=;L;UCy@IfN}qLCf!FUp7}K4+{UEzRi)q zSSu6ed*0p*;Zvp+uJQ4Vz)Kxqm)y?f7FJUAYWI8o7nvs{#>nBkirpK1Vq)|HAGqFY zkTZ*Zo&LiUfC}MzcOS`#{XxAXbN)FX&Lkf7tGWZ%iT*}=0ZQn}$dP@k=?}b-okvAJ z#vK}?Mef}qrmSZll|K&6>nzR|5sqnQ^SZWi0ZVtNJNCJW+O#`CllwtR-W`#0rcpDwmIU}GX-sdeS)jMIg>+lY~v{6e!t&I&xQJ>61UyYIt_y_p2upbzVc$i$Im zEvv1KQ+~SErB6}t_v4Nb2|5qG~Opb>a|R%zSx=5G4H!4KjJSw>cG8MfG_`OF&E zz61HFZUfU8jyqsS^S3d$R*R?$$86aR#9s7*Y?5Uyq^BYD!l9WsN!weU?H9gw zlK+JDK+oPPOFZV76v@IVRMM5Phzgf0qBwq!Fw}v8z-quRHE?HIFUcX2cuu2n2bg5Q zLGp<&-gv2dUUn+f%46!MWiX#EjEt|*egW49oq)2BAAEPc|7G06)Ae%97=qy25X2=Is$2&5@DG+=g9Yn9x( zU4Vs6wIloZ1ueH_EQQH*!^Gdqro53;+_|$rHB?_jzUq_FvP-Dzw(qWdV^aED0UVT| z`BZB9idk(yKfHa}M%~y>!YE$za$|pf4tDkOmL|CVFZJxRT(ahapU+(?%4 ze8bKJ-*{}8PBt!lUYia35YHcwH%2I_O)R&o;^bB~pOTfmv7)z##m`9qUi_kZd{U@C zVK}FL#LHB^Q5ZoSZtOYe%!Hc3ocOiU{$L>^!Vnj)#v^@>gBR2@L&G+g!&m)uwxwQ_bwrLx}ne54ho^cAA{JEBlt@sEf?)xODoyrKPxS(atWa%U&6Z|+1SYAYAo z*b}qb8GAL}$o1E-rSDT~ATwoO*gcTfNx$X9L9pxr3~R9Gd;BO4d;*942g0@WLYLbn zHa&lcPxN|1DdJp^3%^X^>Z8TvxpRBJB2BYuAcY$)mdSjEjmyVSv3y=j{XOHDO z)AUC7P5d_SM&1PwSX4W5K99&tq^pwX?=_S8r|bnNAgNbJ0A5D41r*w z(Ac;9{>rH4ZP!@~6=Oq7T@fZPTX~^k%+CbTVF8gU|-eTd%ts#RyqHxiplsZwSARaW|Itlc~biqF?=U>D35q zW*_GpDyp^0BTlY@t+MRuP24u%chz-=VI5h!_n`hbg*sv3EigKrqIbxF>Q7Z=S*2gl zU7fT;!1awf8?}5OE%=@iUvssaE_XAQ1G5Ai*+jnK(v=4kW9q6z?%~uH)+!s>pKghl=QsP!6utyTpU=9odovt2^u$V(>v z26((TvsiAo#^@rP!C&v6j7Rx~!Z57IvT2x(w) zaD>rdnk4`jCXaP0hf|_z<9J)!e)xKvK?9YMGB)BcezlykWG{f0k$)D&)8BhPTSDwG zo)vDwgg6U8Wv*dg->N4cS6Wy@5`UQY^X2Vs=4NfWq#g4SMivsjv}-)IvhRG9LYzWpEfr7Hxp3eJ$|Vfh>wA(nRna=dl$w9|wMUg88cJ`wBwK zVl|>ve>g0u$6oSTG7yK=*1ye!T#CzeSk$OAcj&^kijBo3b&_IS4?D7c6{0fq-GAr*>^SHTqB?5KOus;o zbtOwp!AoUZci6_M=JeScO8^FhpSmJGLJ08(d~-my={Cn*5|O7F59z@-x@sD@py;<# zt{2~(oz9<%$E>72S=BzX^J(VYTM1A|NSKK-z}YKZ4a3HbAmIDu0rz>4gzi$KL}OBMl{E?GM$0!pL&odTUs3MdxK2>Yr<}At+R9sWJ(^`|C`b9X|PclG3ZA zGEH0hd`%q*)UK<#aVsJM=#U}Wd5MopRU- zqL=FPn~$s%Plp?iMs~!R9J=0@tF6#8Dq8i`)bEe|{(U47(SsZaX96aPXOatVlRCjz zEhAojSJT)}+Ay|o|0$D~grRpeLsxKKBaO%972jrLOUNekXPLv5Q`03u!sP;M^-5Di ztXy#p1GVlf^Uox39gtQ9yHsKa5Aav9!V1%kni3YuE_ z98VJq_gKcQwyBc88{3rGf~e9cRcq<_5~5O~ z1#T(L>docYI1EB{jan{FN#*)XAm!vI3_CJulryEL=GY?Sv#S&5d;z!L*W6IsLE-B$i#4({q5?G>XEp9Vo(u@?}fbGFf&Rg>bY3?sIgu(5m1?ebidP}6}o$HSzWSUN4Y-8m~-5!s_mTg5yi zoZ+=N71WZ-1;ilul63nd+LqXLwe~4x_S3FfZYRds^p=GTjaDY%j-jiNnx}6sy{tF~ z+2^=ghHcpM7rD0kKD7Yg|9Snpl;p zJYT#$=mv8QdTv+afd~N?d~J^0082Q+K-|c5d4J#ezkj}E$Z7Si_tm3SX~o)DoXEiA zn#p2675Wm@5*oqeyWvF9mCTL|N$AhQp)3552V#HsJ6ckW5 z54PtN^h9`7ux1u7J~l+k6>DoX+-$Z$QCx}~Z|CvQGI-oPlQQD3X{MSI&6btL=lD5V zCxKFP>k4m_8Yl`K{Oq(U9Gl%_@GP-Raxm+4kj=Gsf|^`DCH41DK`XA}r0LLeCrOYo zau~UxD*~G*xsZ}mT_%9(HKj)&DimoN#*Xk$^41)qA~MtUpRKV+#qTelKqPFA8jn|J z7I*=8e!q6Z?ka0{o^3pXB-fJ4vi)cFn&#_qe$Or67aN+4oo;}{zu(7sAPhm}B=WeS zY8i=B!@&A|%DK+?$TCU09phM@k+^ZN=m-MN2#)%%?721GnGH%CS7&#A`9Q|j zfu8k77`YDyZrAZf4721{tr$6ZtRVdGx6T<)BDZ- zJ0xMnhhg1U;Xm(Mbw1Y-PnGxit?FeR_pfdsgLiN3{C)+#T|VV}&iPaK)$~taG`znn z{#o^}ioYA*VPoSRlSWe0k9%)t%+q?w#@!mNw%&d8J{4rfhw%$yS6 zy+F>)KasaT2_*MK?7i&VkN3>g z+HGE|iycoVC__I5djmk>P^3&_-YVhU8)ZAU>ZZ;)OOOL9{eX}J)@Ow5@q4wG<6`eQ zp-e)*k_EY*pCKJ&UC#%SCpdWGLx9YuEz87OkLTQV4rlG*Rh_*`BOpIhM!cYx8oqi| zmceGAzJ{*SyOU+s@^x5(rJ?jP-5V_}LL_`r!51DT>0%91ck?qHe zOIej0{JcE*t7}J8JpKXw4T2_fUtX0*udUf9zKy)!l%r-_Sy(tKk!)8xy)eD77e;Tz z%SwE?V__ERpITX|sm{D^n1DTb+Tl3tA-kn7p>ALOS{hW>o!OgKjC4KV?H$|UW5m?v zkiu6S>o^2kRUrp6Xnpqmc22IP<*`QB_X`-mDmd?D%9zZnA*;L+7r}4m6v7Vf&T?gs z0Aluc4KIcwmU`T+X^W739sta;Jdu;8 zC9Dv~42w zuEGK25+tg|&$N@IFc(pg(apjyJPnIDV82*Ogoz}C0W4UfZhD6Fp z>(mj^$^xD^?ZZk@sXvfJ^WVruBMTkzH8m4751Cxx)efX~b+0sqDOxiDx+aZo2@<#3 zl^tF? zXBhQ){IZK3kw5X3@4bR!@`f-iy5X4%ssgpDmdXdb>jaCdhX!eM@yfC}JY&)e z`xJj36RO(*9zg~ymN)$dYe_Ttt->Gu281T@u}sXSk**6l5Nx8jeU)v@ z%$@*3^r2Ht2sY+ND4ZuJPXjxKdb%L79`yFVgkXy9uzCyJ~Cls$U0~b zJ&$Hb;KiJB^x*}1IKm-zcw^H?CXI4@m}Yhga2fyHx1hnHp+3iW(t>42fDD6>nTulj z

^7*P6Z=()JZ*9_17Z2F|w}9#dgWls~*p#PB+Yp0GWY2j}wEOa1mpWQ3`D$(!;} zub^S{Fm=AHClE<_i>H?WTDri@S#ihxx0h`m+r^TXNvFyvBqq zify_-XkMY-V#Mje?u+8kT~F6)&Y5IlO&rm&N}wxq=-}Czo{I1(Vfn4eb)-cPzF@xw zne)rm_wBPzOJ2m*!C8?lPF&M))W;Wgu8HiZ`|Y7DWMOX)N+b-NnRnYlhV82n^=*Rf zyAbhm71@X>Ep@ddj1e#bp4VX=b|vG{bG<;vd~X z(`??{ZhTk-m4jiCe1+s?1GtDsB8C7?kQh5N9p=($Q=y?jcCA792ed*3GAetUjdx)t z94?Zk4bl`c?u9w)W1ru$2@2Q-I~ShJ^^C7Tyk9@V8b+orkZ&F!wAnfIei40}0gtF5 zL>zURllEf-FecPd+vsgAVNwKL3!6FaKEftb2JItqI~XH7lH=}5JBw!Xi-qOjAEVw3 zEeSrz{|f1jln{2rA>f`2R3Cj4UnR+%qzYve?Xs!b8~0SJG0XGNDeFan;>}{~C!lw& zSYh{}?xE0?=Zj&pQ8eCjYnb4(&`UKJseE4*N0y#dY7f!r%zD7#qTv6j!-n(0;-Lxc zcM=(!&D!&`OXu2J+w=RJ^WN(y6E>|h+qp5i@r14lzZJbSE^I3-#&Q!?JZ^ z(Y}fiPb`Q#7I2sQ&P6w3Ui21cO$&D^mUuDOfLJAnv8y{R>2lT&=u|mpJZ7A?=6tW8 zIhd*LOcnl6&IMID10I;1)yqmTJtt6sJmN**Mbxpj!op8!7){26W)gM1oV-xc@G}os zB)Lp(^}BejxBYjW=$nOv>E)iMSq$!Kk-??RL=nSx!kL|2c37m z<$)@L2%KQ(W5C@w$)GfB#BY@|`;d^=KuGk1A}a)&Vzv_~c8z#8uJc_3KW)@NK3w3$ z6>%4Lwntt0lGcMaAVo*(hlxI(KXPXv5s{LkXcL?!&vK?)kqSs_^Rti_2A;>w7^EAJ zX>3=_|DaI&&#+^^4g2f4!H)SOv5mKispyrtjbiN%R}kjVdW80r0u?0!jRA@K(6<*@ zU88Vn_#Zf@);%0IE2DWl5Pauqy(L$$c?ZSO7~Eg-t#=IGtppSpiu((-+e^EQEC(hD zvqt*SZ3iIPCfu;4*q7_ezZ1!E+oMg%D$XfIO_J+~=4u0hy0*RA+OfE% zUQjh(7=X4_Cpp`QMJuS3W2zisY8{Ebve=MDyCG$C<4`_xxv4+$i6;U4;sI zvAwJLM^U&qwou=1@v)(IN5qfM#j+NWv9y;$atM1q83htS`$6Y@XoB=cR4QjH17ZlY zP9G%90BTrx1crw>DrelMQ_Y)$zWPhmwJQ+62!V+*QsONuTZYWsQ7NlA!etzV)M|*y z`WgMrZsKB4-{ErF=|zWQsnL!c-_{h@@%pLU3ocQUqe#j3*cFEU)KmQlfBtCS62)!L z#EUI^Ss(Ejb=%#}|L?GX9=1TLQe%RG8xC}Bw<{waWL9r#L|08!UG7#?a~u4!c-!UI zJ{slbkDQn_e&=6Gzfx@usoVf|zR8$ax!JY?Hh1&{h$U>nBm5to;;gK^=}dhFIfszA zvtiqcr>0%6gBt37@OPdugYiksSdf4d?Tbf*Yu;y^J1%Z0n#4V2dxr0`YK1(A#c515 z0_m?)nW{M1_i|&ZAHVImSnJlc#`i4hauN!11Z>GXC!`l=olDLrls0{Fx=n^CK{DZbS=5D(Gw4bg56_96A;s_l`AXW>qeU@h+ zT}-l`ohop3+y+oSeH%1NWbDv|lWzDbBmg7=dl2q=Ilx4^&;&gh(T4OYX@p~TKfs#R zqH$N-&X_~phbICc$TIm%n`bHHZy_Q;Kvyqwn25^xboRM`+4S>(#w(MbbI_DitDHD~ zpV~3r{(4`;+bBh;T`%JBJ&8o*L>VpPU@cL5w78u%W@=S4|ac8 zI&l0Fktqu5&cL+(YZ&%VZtvx&$rH%OQ{DuY{g{l}IvCn9df-zrsgwoQo_I;=>{~zv z@0T#j2+o~cud0Z6#@_&sGxF~MU%h93XM$Y{dK2Wgk(l65WA!K~WYaminjcW~oi00~m!mi{ zN2%*8jpuG;Nb;%#aaZG(?gj3d7gym*$4j1f(z4)7zw72h%0vhn2-+Ob4CiKDEEa96 zO%EVwvtVlAUU=N^&#p}u%;x7FX6V9l8q=0mq-1~PT31n&J5kUh?i9ao0=ORHF*?_y z7`?D1VRmcwB@5%Rt8t69?Xboo>v1Kt`F&h9%BKm?k(I5`gS6)h|(?)iwwX*s*Qv*kA<8W55es1>YfrX*CBI9;ZcFmckF zjP5$s*<(?ZX_p)LbBHr_0oJt4sG`2im4Nd+IBgTDLJhpwdE${V2q9Q;*n6o4yO2r{ zM0;~LY~OzA|Y@wR`+No8-d+S!_EkS+sT*+>$)`S zTohRqv(g_>Dt+lvu)Y1^0Ls1oMI2~37bsehenxS29 zneBT`t4@QL*9`Xt`0li^T#vOyILqNZncz3Wuu{Xq!a6X8FQ1-n%7pD-oNR@3OQ|J1 zLwn8AHmW+NGpw4zqO`<~%sc!m>gZ!X1+OvWy)9zbLZ%GuZeEY5B|N%WiBM0#fZf{2 zmAc~dkAH~yFJ^v%6&4XOc|+dcHq>m`uYfR!H+&8DjtJkiXRx983uOiR17-dY?j3Z_ z{Z&==AMg#9`CqVRVyS+ r^-k&Kaqac!welt6ubYRy!okx;Xs8UupuU}Z{_dNYtZ1dMp5MO#VOO*; literal 0 HcmV?d00001 diff --git a/filebeat/docs/modules/system.asciidoc b/filebeat/docs/modules/system.asciidoc index 9ba33031a415..756989d1e121 100644 --- a/filebeat/docs/modules/system.asciidoc +++ b/filebeat/docs/modules/system.asciidoc @@ -5,21 +5,29 @@ This file is generated! See scripts/docs_collector.py [[filebeat-module-system]] == System module -This module collects and parses logs created by system logging server of common Unix/Linux based -distributions. +This module collects and parses logs created by system logging server of common +Unix/Linux based distributions. +[float] === Compatibility -This module was tested with logs from OSes like Ubuntu 12.04, Centos 7, macOS Sierra, and others. +This module was tested with logs from OSes like Ubuntu 12.04, Centos 7, and +macOS Sierra. This module is not available for Windows. +[float] === Dashboard -This module comes with a sample dashboard. +This module comes with sample dashboards. The first is a more generic syslog +dashboard that shows syslog data. image::./images/kibana-system.png[] +And second is the audit dashboard that shows audit log data. + +image::./images/kibana-system-audit.png[] + [float] === Syslog fileset settings diff --git a/filebeat/fileset/modules.go b/filebeat/fileset/modules.go index e2bc4b5b7c0c..15c40a57c104 100644 --- a/filebeat/fileset/modules.go +++ b/filebeat/fileset/modules.go @@ -44,15 +44,15 @@ func newModuleRegistry(modulesPath string, fcfg = &defaultFilesetConfig } - if fcfg.Enabled != nil && (*fcfg.Enabled) == false { - continue - } - fcfg, err = applyOverrides(fcfg, mcfg.Module, filesetName, overrides) if err != nil { return nil, fmt.Errorf("Error applying overrides on fileset %s/%s: %v", mcfg.Module, filesetName, err) } + if fcfg.Enabled != nil && (*fcfg.Enabled) == false { + continue + } + fileset, err := New(modulesPath, filesetName, &mcfg, fcfg) if err != nil { return nil, err diff --git a/filebeat/fileset/modules_test.go b/filebeat/fileset/modules_test.go index 9350674926e1..60ac12d3031d 100644 --- a/filebeat/fileset/modules_test.go +++ b/filebeat/fileset/modules_test.go @@ -38,7 +38,7 @@ func TestNewModuleRegistry(t *testing.T) { expectedModules := map[string][]string{ "nginx": {"access", "error"}, "mysql": {"slowlog", "error"}, - "system": {"syslog", "auth"}, + "system": {"syslog", "audit", "auth"}, } assert.Equal(t, len(expectedModules), len(reg.registry)) @@ -98,7 +98,7 @@ func TestNewModuleRegistryConfig(t *testing.T) { assert.NotContains(t, reg.registry["nginx"], "error") } -func TestAppplyOverrides(t *testing.T) { +func TestApplyOverrides(t *testing.T) { falseVar := false trueVar := true diff --git a/filebeat/module/system/_meta/docs.asciidoc b/filebeat/module/system/_meta/docs.asciidoc index b4ac86b34d12..5c538fb3b16e 100644 --- a/filebeat/module/system/_meta/docs.asciidoc +++ b/filebeat/module/system/_meta/docs.asciidoc @@ -1,20 +1,28 @@ == System module -This module collects and parses logs created by system logging server of common Unix/Linux based -distributions. +This module collects and parses logs created by system logging server of common +Unix/Linux based distributions. +[float] === Compatibility -This module was tested with logs from OSes like Ubuntu 12.04, Centos 7, macOS Sierra, and others. +This module was tested with logs from OSes like Ubuntu 12.04, Centos 7, and +macOS Sierra. This module is not available for Windows. +[float] === Dashboard -This module comes with a sample dashboard. +This module comes with sample dashboards. The first is a more generic syslog +dashboard that shows syslog data. image::./images/kibana-system.png[] +And second is the audit dashboard that shows audit log data. + +image::./images/kibana-system-audit.png[] + [float] === Syslog fileset settings diff --git a/filebeat/module/system/audit/_meta/fields.yml b/filebeat/module/system/audit/_meta/fields.yml new file mode 100644 index 000000000000..05b16091eed3 --- /dev/null +++ b/filebeat/module/system/audit/_meta/fields.yml @@ -0,0 +1,74 @@ +- name: audit + type: group + description: > + Fields from the Linux audit logs. Not all fields are documented here because + they are dynamic and vary by audit event type. + fields: + - name: record_type + description: > + The audit event type. + - name: old_auid + description: > + For login events this is the old audit ID used for the user prior to + this login. + - name: new_auid + description: > + For login events this is the new audit ID. The audit ID can be used to + trace future events to the user even if their identity changes (like + becoming root). + - name: old_ses + description: > + For login events this is the old session ID used for the user prior to + this login. + - name: new_ses + description: > + For login events this is the new session ID. It can be used to tie a + user to future events by session ID. + - name: sequence + type: long + description: > + The audit event sequence number. + - name: pid + type: long + description: > + The ID of the process. + - name: ppid + type: long + description: > + The ID of the process. + - name: items + type: long + description: > + The number of items in an event. + - name: item + type: long + description: > + The item field indicates which item out of the total number of items. + This number is zero-based; a value of 0 means it is the first item. + - name: geoip + type: group + description: > + Contains GeoIP information gathered based on the `system.audit.addr` + field. Only present if the GeoIP Elasticsearch plugin is available and + used. + fields: + - name: continent_name + type: keyword + description: > + The name of the continent. + - name: city_name + type: keyword + description: > + The name of the city. + - name: region_name + type: keyword + description: > + The name of the region. + - name: country_iso_code + type: keyword + description: > + Country ISO code. + - name: location + type: geo_point + description: > + The longitude and latitude. diff --git a/filebeat/module/system/audit/_meta/kibana/dashboard/dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json b/filebeat/module/system/audit/_meta/kibana/dashboard/dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json new file mode 100644 index 000000000000..04dc54b9251d --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/dashboard/dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json @@ -0,0 +1,13 @@ +{ + "hits": 0, + "timeRestore": false, + "description": "", + "title": "Filebeat System Audit", + "uiStateJSON": "{\"P-2\":{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}}", + "panelsJSON": "[{\"col\":1,\"id\":\"6295bdd0-0a0e-11e7-825f-6748cda7d858\",\"panelIndex\":1,\"row\":1,\"size_x\":4,\"size_y\":4,\"type\":\"visualization\"},{\"col\":9,\"id\":\"5ebdbe50-0a0f-11e7-825f-6748cda7d858\",\"panelIndex\":2,\"row\":1,\"size_x\":4,\"size_y\":4,\"type\":\"visualization\"},{\"col\":1,\"id\":\"2bb0fa70-0a11-11e7-9e84-43da493ad0c7\",\"panelIndex\":3,\"row\":5,\"size_x\":6,\"size_y\":3,\"type\":\"visualization\"},{\"col\":7,\"id\":\"d1726930-0a7f-11e7-8b04-eb22a5669f27\",\"panelIndex\":5,\"row\":5,\"size_x\":6,\"size_y\":3,\"type\":\"visualization\"},{\"col\":5,\"id\":\"c5411910-0a87-11e7-8b04-eb22a5669f27\",\"panelIndex\":6,\"row\":1,\"size_x\":4,\"size_y\":4,\"type\":\"visualization\"},{\"size_x\":12,\"size_y\":3,\"panelIndex\":7,\"type\":\"search\",\"id\":\"4ac0a370-0a11-11e7-8b04-eb22a5669f27\",\"col\":1,\"row\":8,\"columns\":[\"system.audit.record_type\",\"system.audit.sequence\",\"system.audit.acct\"],\"sort\":[\"@timestamp\",\"desc\"]}]", + "optionsJSON": "{\"darkTheme\":false}", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}],\"highlightAll\":true,\"version\":true}" + } +} \ No newline at end of file diff --git a/filebeat/module/system/audit/_meta/kibana/search/4ac0a370-0a11-11e7-8b04-eb22a5669f27.json b/filebeat/module/system/audit/_meta/kibana/search/4ac0a370-0a11-11e7-8b04-eb22a5669f27.json new file mode 100644 index 000000000000..66e6e02edeff --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/search/4ac0a370-0a11-11e7-8b04-eb22a5669f27.json @@ -0,0 +1,18 @@ +{ + "sort": [ + "@timestamp", + "desc" + ], + "hits": 0, + "description": "", + "title": "Audit Events", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"filebeat-*\",\"highlightAll\":true,\"version\":true,\"query\":{\"query_string\":{\"query\":\"_exists_:system.audit\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "columns": [ + "system.audit.record_type", + "system.audit.sequence", + "system.audit.acct" + ] +} \ No newline at end of file diff --git a/filebeat/module/system/audit/_meta/kibana/visualization/2bb0fa70-0a11-11e7-9e84-43da493ad0c7.json b/filebeat/module/system/audit/_meta/kibana/visualization/2bb0fa70-0a11-11e7-9e84-43da493ad0c7.json new file mode 100644 index 000000000000..a99239f18737 --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/visualization/2bb0fa70-0a11-11e7-9e84-43da493ad0c7.json @@ -0,0 +1,10 @@ +{ + "visState": "{\"type\":\"timelion\",\"title\":\"Audit Event Results\",\"params\":{\"expression\":\".es(q=\\\"_exists_:system.audit NOT system.audit.res:failure\\\").label(\\\"Success\\\") .es(q=\\\"system.audit.res:failed\\\").label(\\\"Failure\\\").title(\\\"Audit Event Results\\\")\",\"interval\":\"auto\"}}", + "description": "", + "title": "Audit Event Results", + "uiStateJSON": "{}", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{}" + } +} \ No newline at end of file diff --git a/filebeat/module/system/audit/_meta/kibana/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858.json b/filebeat/module/system/audit/_meta/kibana/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858.json new file mode 100644 index 000000000000..57104c8c177d --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858.json @@ -0,0 +1,10 @@ +{ + "visState": "{\"title\":\"Audit Top Exec Commands\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMeticsAtAllLevels\":false,\"sort\":{\"columnIndex\":null,\"direction\":null},\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"system.audit.a0\",\"size\":30,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Command (arg 0)\"}}],\"listeners\":{}}", + "description": "", + "title": "Audit Top Exec Commands", + "uiStateJSON": "{\"vis\":{\"params\":{\"sort\":{\"columnIndex\":null,\"direction\":null}}}}", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"filebeat-*\",\"query\":{\"query_string\":{\"query\":\"system.audit.record_type:EXECVE\",\"analyze_wildcard\":true}},\"filter\":[]}" + } +} \ No newline at end of file diff --git a/filebeat/module/system/audit/_meta/kibana/visualization/6295bdd0-0a0e-11e7-825f-6748cda7d858.json b/filebeat/module/system/audit/_meta/kibana/visualization/6295bdd0-0a0e-11e7-825f-6748cda7d858.json new file mode 100644 index 000000000000..a46013440c46 --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/visualization/6295bdd0-0a0e-11e7-825f-6748cda7d858.json @@ -0,0 +1,10 @@ +{ + "visState": "{\n \"title\": \"Audit Event Types\",\n \"type\": \"pie\",\n \"params\": {\n \"addTooltip\": true,\n \"addLegend\": true,\n \"legendPosition\": \"right\",\n \"isDonut\": true\n },\n \"aggs\": [\n {\n \"id\": \"1\",\n \"enabled\": true,\n \"type\": \"count\",\n \"schema\": \"metric\",\n \"params\": {}\n },\n {\n \"id\": \"2\",\n \"enabled\": true,\n \"type\": \"terms\",\n \"schema\": \"segment\",\n \"params\": {\n \"field\": \"system.audit.record_type\",\n \"size\": 50,\n \"order\": \"desc\",\n \"orderBy\": \"1\"\n }\n }\n ],\n \"listeners\": {}\n}", + "description": "", + "title": "Audit Event Types", + "uiStateJSON": "{}", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\n \"index\": \"filebeat-*\",\n \"query\": {\n \"query_string\": {\n \"query\": \"*\",\n \"analyze_wildcard\": true\n }\n },\n \"filter\": []\n}" + } +} \ No newline at end of file diff --git a/filebeat/module/system/audit/_meta/kibana/visualization/c5411910-0a87-11e7-8b04-eb22a5669f27.json b/filebeat/module/system/audit/_meta/kibana/visualization/c5411910-0a87-11e7-8b04-eb22a5669f27.json new file mode 100644 index 000000000000..56acd439134c --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/visualization/c5411910-0a87-11e7-8b04-eb22a5669f27.json @@ -0,0 +1,10 @@ +{ + "visState": "{\"title\":\"Audit Event Account Tag Cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":15,\"maxFontSize\":42,\"hideLabel\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"system.audit.acct\",\"size\":15,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", + "description": "", + "title": "Audit Event Account Tag Cloud", + "uiStateJSON": "{}", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"filebeat-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + } +} \ No newline at end of file diff --git a/filebeat/module/system/audit/_meta/kibana/visualization/d1726930-0a7f-11e7-8b04-eb22a5669f27.json b/filebeat/module/system/audit/_meta/kibana/visualization/d1726930-0a7f-11e7-8b04-eb22a5669f27.json new file mode 100644 index 000000000000..2b81cc06eb6a --- /dev/null +++ b/filebeat/module/system/audit/_meta/kibana/visualization/d1726930-0a7f-11e7-8b04-eb22a5669f27.json @@ -0,0 +1,10 @@ +{ + "visState": "{\"title\":\"Audit Event Address Geo Location\",\"type\":\"tile_map\",\"params\":{\"mapType\":\"Scaled Circle Markers\",\"isDesaturated\":true,\"addTooltip\":true,\"heatMaxZoom\":16,\"heatMinOpacity\":0.1,\"heatRadius\":25,\"heatBlur\":15,\"heatNormalizeData\":true,\"legendPosition\":\"bottomright\",\"mapZoom\":2,\"mapCenter\":[15,5],\"wms\":{\"enabled\":false,\"url\":\"https://basemap.nationalmap.gov/arcgis/services/USGSTopo/MapServer/WMSServer\",\"options\":{\"version\":\"1.3.0\",\"layers\":\"0\",\"format\":\"image/png\",\"transparent\":true,\"attribution\":\"Maps provided by USGS\",\"styles\":\"\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"geohash_grid\",\"schema\":\"segment\",\"params\":{\"field\":\"system.audit.geoip.location\",\"autoPrecision\":true,\"precision\":2}}],\"listeners\":{}}", + "description": "", + "title": "Audit Event Address Geo Location", + "uiStateJSON": "{}", + "version": 1, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"filebeat-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + } +} \ No newline at end of file diff --git a/filebeat/module/system/audit/config/audit.yml b/filebeat/module/system/audit/config/audit.yml new file mode 100644 index 000000000000..56e3dfd95b82 --- /dev/null +++ b/filebeat/module/system/audit/config/audit.yml @@ -0,0 +1,6 @@ +input_type: log +paths: +{{ range $i, $path := .paths }} + - {{$path}} +{{ end }} +exclude_files: [".gz$"] diff --git a/filebeat/module/system/audit/ingest/pipeline.json b/filebeat/module/system/audit/ingest/pipeline.json new file mode 100644 index 000000000000..2b176e90fce7 --- /dev/null +++ b/filebeat/module/system/audit/ingest/pipeline.json @@ -0,0 +1,129 @@ +{ + "description": "Pipeline for parsing Linux audit logs", + "processors": [ + { + "grok": { + "field": "message", + "pattern_definitions": { + "AUDIT_TYPE": "^type=%{NOTSPACE:system.audit.record_type}", + "AUDIT_PREFIX": "%{AUDIT_TYPE} msg=audit\\(%{NUMBER:system.audit.epoch}:%{NUMBER:system.audit.sequence}\\):(%{DATA})?", + "AUDIT_KEY_VALUES": "%{WORD}=%{GREEDYDATA}" + }, + "patterns": [ + "%{AUDIT_PREFIX} %{AUDIT_KEY_VALUES:system.audit.kv} old auid=%{NUMBER:system.audit.old_auid} new auid=%{NUMBER:system.audit.new_auid} old ses=%{NUMBER:system.audit.old_ses} new ses=%{NUMBER:system.audit.new_ses}", + "%{AUDIT_PREFIX} %{AUDIT_KEY_VALUES:system.audit.kv} msg=['\"](%{DATA:system.audit.msg}\\s+)?%{AUDIT_KEY_VALUES:system.audit.sub_kv}['\"]", + "%{AUDIT_PREFIX} %{AUDIT_KEY_VALUES:system.audit.kv}", + "%{AUDIT_PREFIX}", + "%{AUDIT_TYPE} %{AUDIT_KEY_VALUES:system.audit.kv}" + ] + } + }, + { + "kv": { + "field": "system.audit.kv", + "field_split": "\\s+", + "value_split": "=", + "target_field": "system.audit" + } + }, + { + "kv": { + "field": "system.audit.sub_kv", + "field_split": "\\s+", + "value_split": "=", + "target_field": "system.audit", + "ignore_missing": true + } + }, + { + "remove": { + "field": "system.audit.kv", + "ignore_failure": true + } + }, + { + "remove": { + "field": "system.audit.sub_kv", + "ignore_failure": true + } + }, + { + "remove": { + "field": "message", + "ignore_failure": true + } + }, + { + "date": { + "field": "system.audit.epoch", + "target_field": "@timestamp", + "formats": [ + "UNIX" + ], + "ignore_failure": true + } + }, + { + "remove": { + "field": "system.audit.epoch", + "ignore_failure": true + } + }, + { + "convert": { + "field" : "system.audit.sequence", + "type": "integer", + "ignore_missing": true + } + }, + { + "convert": { + "field" : "system.audit.pid", + "type": "integer", + "ignore_missing": true + } + }, + { + "convert": { + "field" : "system.audit.ppid", + "type": "integer", + "ignore_missing": true + } + }, + { + "convert": { + "field" : "system.audit.item", + "type": "integer", + "ignore_missing": true + } + }, + { + "convert": { + "field" : "system.audit.items", + "type": "integer", + "ignore_missing": true + } + }, + { + "script": { + "lang": "painless", + "inline": " String trimQuotes(def v) {\n if (v.startsWith(\"'\") || v.startsWith('\"')) {\n v = v.substring(1, v.length());\n }\n if (v.endsWith(\"'\") || v.endsWith('\"')) {\n v = v.substring(0, v.length()-1);\n } \n return v;\n }\n \n boolean isHexAscii(String v) {\n def len = v.length();\n if (len == 0 || len % 2 != 0) {\n return false; \n }\n \n for (int i = 0 ; i < len ; i++) {\n if (Character.digit(v.charAt(i), 16) == -1) {\n return false;\n }\n }\n\n return true;\n }\n \n String convertHexToString(String hex) {\n\t StringBuilder sb = new StringBuilder();\n\n for (int i=0; i < hex.length() - 1; i+=2) {\n String output = hex.substring(i, (i + 2));\n int decimal = Integer.parseInt(output, 16);\n sb.append((char)decimal);\n }\n\n return sb.toString();\n }\n \n def possibleHexKeys = ['exe', 'cmd'];\n \n def audit = ctx.system.get(\"audit\");\n Iterator entries = audit.entrySet().iterator();\n while (entries.hasNext()) {\n def e = entries.next();\n def k = e.getKey();\n def v = e.getValue(); \n\n // Remove entries whose value is ?\n if (v == \"?\" || v == \"(null)\" || v == \"\") {\n entries.remove();\n continue;\n }\n \n // Convert hex values to ASCII.\n if (possibleHexKeys.contains(k) && isHexAscii(v)) {\n v = convertHexToString(v);\n audit.put(k, v);\n }\n \n // Trim quotes.\n if (v instanceof String) {\n v = trimQuotes(v);\n audit.put(k, v);\n }\n \n // Convert arch.\n if (k == \"arch\" && v == \"c000003e\") {\n audit.put(k, \"x86_64\");\n }\n }" + } + }, + { + "geoip": { + "field": "system.audit.addr", + "target_field": "system.audit.geoip", + "ignore_failure": true + } + } + ], + "on_failure": [ + { + "set": { + "field": "error", + "value": "{{ _ingest.on_failure_message }}" + } + } + ] +} diff --git a/filebeat/module/system/audit/manifest.yml b/filebeat/module/system/audit/manifest.yml new file mode 100644 index 000000000000..5eb0b43f76c6 --- /dev/null +++ b/filebeat/module/system/audit/manifest.yml @@ -0,0 +1,15 @@ +module_version: 1.0 + +var: + - name: paths + default: + - /var/log/audit/audit.log* + os.darwin: [] + os.windows: [] + +ingest_pipeline: ingest/pipeline.json +prospector: config/audit.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip diff --git a/filebeat/module/system/audit/test/audit-rhel6.log b/filebeat/module/system/audit/test/audit-rhel6.log new file mode 100644 index 000000000000..dceee8427109 --- /dev/null +++ b/filebeat/module/system/audit/test/audit-rhel6.log @@ -0,0 +1,12 @@ +type=USER_END msg=audit(1489519230.178:19600327): user pid=4121 uid=0 auid=700 ses=11988 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' +type=CRED_DISP msg=audit(1489519230.178:19600328): user pid=4121 uid=0 auid=700 ses=11988 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' +type=USER_CMD msg=audit(1489519256.192:19600329): user pid=4151 uid=497 auid=700 ses=11988 msg='cwd="/" cmd=2F7573722F6C696236342F6E6167696F732F706C7567696E732F636865636B5F617374657269736B5F7369705F7065657273202D7020323032 terminal=? res=success' +type=CRED_ACQ msg=audit(1489519256.193:19600330): user pid=4151 uid=0 auid=700 ses=11988 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' +type=USER_START msg=audit(1489519256.193:19600331): user pid=4151 uid=0 auid=700 ses=11988 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' +type=MAC_IPSEC_EVENT msg=audit(1489519382.529:19600354): op=SPD-add auid=4294967295 ses=4294967295 res=1 src=10.100.0.0 src_prefixlen=16 dst=10.100.4.0 dst_prefixlen=22 +type=SYSCALL msg=audit(1489519382.529:19600354): arch=c000003e syscall=44 success=yes exit=184 a0=9 a1=7f564ee6d2a0 a2=b8 a3=0 items=0 ppid=1240 pid=1275 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="charon" exe=2F7573722F6C6962657865632F7374726F6E677377616E2F636861726F6E202864656C6574656429 key=(null) +type=LOGIN msg=audit(1489636960.072:19623791): pid=28281 uid=0 old auid=700 new auid=700 old ses=6793 new ses=12286 +type=CRYPTO_KEY_USER msg=audit(1489636960.070:19623788): user pid=28281 uid=0 auid=700 ses=6793 msg='op=destroy kind=session fp=? direction=both spid=28282 suid=74 rport=58994 laddr=107.170.139.210 lport=50022 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1489636960.072:19623789): user pid=28281 uid=0 auid=700 ses=6793 msg='op=success acct="admin" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=ssh res=success' +type=USER_AUTH msg=audit(1489636977.804:19623807): user pid=28395 uid=0 auid=700 ses=12286 msg='op=PAM:authentication acct="root" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success' +type=USER_ACCT msg=audit(1489636977.805:19623808): user pid=28395 uid=0 auid=700 ses=12286 msg='op=PAM:accounting acct="root" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success' diff --git a/filebeat/module/system/audit/test/audit-rhel7.log b/filebeat/module/system/audit/test/audit-rhel7.log new file mode 100644 index 000000000000..4b193c8d559f --- /dev/null +++ b/filebeat/module/system/audit/test/audit-rhel7.log @@ -0,0 +1,2447 @@ +type=DAEMON_START msg=audit(1481076983.819:7798): auditd start, ver=2.4.1 format=raw kernel=3.10.0-327.36.3.el7.x86_64 auid=4294967295 pid=251 subj=system_u:system_r:auditd_t:s0 res=success +type=SERVICE_START msg=audit(1481076983.864:6): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=auditd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SYSTEM_BOOT msg=audit(1481076983.876:7): pid=273 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-update-utmp" exe="/usr/lib/systemd/systemd-update-utmp" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076983.879:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-update-utmp comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.075:9): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-hwdb-update comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.088:10): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-update-done comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.163:11): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-udev-trigger comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.212:12): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=irqbalance comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.521:13): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=avahi-daemon comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.521:14): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.526:15): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rsyslog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076984.534:16): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=irqbalance comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076984.827:17): table=filter family=2 entries=0 +type=SYSCALL msg=audit(1481076984.827:17): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=390 pid=391 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076984.858:18): table=raw family=2 entries=0 +type=SYSCALL msg=audit(1481076984.858:18): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=395 pid=396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076984.870:19): table=security family=2 entries=0 +type=SYSCALL msg=audit(1481076984.870:19): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=398 pid=399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076984.877:20): table=mangle family=2 entries=0 +type=SYSCALL msg=audit(1481076984.877:20): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=401 pid=402 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076984.931:21): table=nat family=2 entries=0 +type=SYSCALL msg=audit(1481076984.931:21): arch=c000003e syscall=313 success=yes exit=0 a0=3 a1=41a15c a2=0 a3=3 items=0 ppid=406 pid=407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076984.939:22): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=yum-cron comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.945:23): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rhel-dmesg comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.953:24): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=acpid comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.954:25): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-user-sessions comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076984.960:26): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076984.982:27): table=filter family=10 entries=0 +type=SYSCALL msg=audit(1481076984.982:27): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=422 pid=423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.012:28): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-logind comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076985.031:29): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=crond comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076985.043:30): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=expand-root comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076985.044:31): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=expand-root comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.069:32): table=raw family=10 entries=0 +type=SYSCALL msg=audit(1481076985.069:32): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=439 pid=440 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.104:33): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sshd-keygen comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.099:34): table=security family=10 entries=0 +type=SYSCALL msg=audit(1481076985.099:34): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=445 pid=446 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.128:35): table=mangle family=10 entries=0 +type=SYSCALL msg=audit(1481076985.128:35): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=41a15c a2=0 a3=0 items=0 ppid=449 pid=450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.164:36): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=plymouth-quit comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076985.166:37): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=plymouth-quit comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076985.167:38): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=plymouth-start comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076985.168:39): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=plymouth-start comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076985.170:40): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=plymouth-quit-wait comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076985.170:41): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=plymouth-quit-wait comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076985.180:42): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=serial-getty@ttyS0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076985.187:43): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=getty@tty1 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.191:44): table=nat family=10 entries=0 +type=SYSCALL msg=audit(1481076985.191:44): arch=c000003e syscall=313 success=yes exit=0 a0=1 a1=41a15c a2=0 a3=1 items=0 ppid=452 pid=453 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.511:45): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=firewalld comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.528:46): table=nat family=2 entries=5 +type=SYSCALL msg=audit(1481076985.528:46): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=25be720 items=0 ppid=296 pid=476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.532:47): table=nat family=2 entries=5 +type=SYSCALL msg=audit(1481076985.532:47): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1819720 items=0 ppid=296 pid=478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.534:48): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.534:48): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=13d0850 items=0 ppid=296 pid=479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.537:49): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.537:49): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1125850 items=0 ppid=296 pid=481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.538:50): table=security family=2 entries=4 +type=SYSCALL msg=audit(1481076985.538:50): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=20a3600 items=0 ppid=296 pid=482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.542:51): table=security family=2 entries=4 +type=SYSCALL msg=audit(1481076985.542:51): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=9f0600 items=0 ppid=296 pid=484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.543:52): table=raw family=2 entries=3 +type=SYSCALL msg=audit(1481076985.543:52): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=232e4d0 items=0 ppid=296 pid=485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.546:53): table=raw family=2 entries=3 +type=SYSCALL msg=audit(1481076985.546:53): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=14404d0 items=0 ppid=296 pid=487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.548:54): table=filter family=2 entries=4 +type=SYSCALL msg=audit(1481076985.548:54): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=c31600 items=0 ppid=296 pid=488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.552:55): table=filter family=2 entries=4 +type=SYSCALL msg=audit(1481076985.552:55): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=143a600 items=0 ppid=296 pid=490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.553:56): table=nat family=10 entries=5 +type=SYSCALL msg=audit(1481076985.553:56): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=109b880 items=0 ppid=296 pid=491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.556:57): table=nat family=10 entries=5 +type=SYSCALL msg=audit(1481076985.556:57): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=b53880 items=0 ppid=296 pid=493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.557:58): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.557:58): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=17b09e0 items=0 ppid=296 pid=494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.560:59): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.560:59): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=25cc9e0 items=0 ppid=296 pid=496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.562:60): table=security family=10 entries=4 +type=SYSCALL msg=audit(1481076985.562:60): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=14db720 items=0 ppid=296 pid=497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.566:61): table=security family=10 entries=4 +type=SYSCALL msg=audit(1481076985.566:61): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=9d2720 items=0 ppid=296 pid=499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.569:62): table=raw family=10 entries=3 +type=SYSCALL msg=audit(1481076985.569:62): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=fae5c0 items=0 ppid=296 pid=500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.573:63): table=raw family=10 entries=3 +type=SYSCALL msg=audit(1481076985.573:63): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=19545c0 items=0 ppid=296 pid=502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.575:64): table=filter family=10 entries=4 +type=SYSCALL msg=audit(1481076985.575:64): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=23a3720 items=0 ppid=296 pid=503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.578:65): table=filter family=10 entries=4 +type=SYSCALL msg=audit(1481076985.578:65): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=162d720 items=0 ppid=296 pid=505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.580:66): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.580:66): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=14b0850 items=0 ppid=296 pid=506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.582:67): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.582:67): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2398850 items=0 ppid=296 pid=507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.583:68): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.583:68): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2679850 items=0 ppid=296 pid=508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.585:69): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.585:69): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1715850 items=0 ppid=296 pid=509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.587:70): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.587:70): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=196a850 items=0 ppid=296 pid=510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.590:71): table=security family=2 entries=4 +type=SYSCALL msg=audit(1481076985.590:71): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1453600 items=0 ppid=296 pid=511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.591:72): table=security family=2 entries=4 +type=SYSCALL msg=audit(1481076985.591:72): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=fb2600 items=0 ppid=296 pid=512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.593:73): table=security family=2 entries=4 +type=SYSCALL msg=audit(1481076985.593:73): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=255d600 items=0 ppid=296 pid=513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.594:74): table=raw family=2 entries=3 +type=SYSCALL msg=audit(1481076985.594:74): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=15be4d0 items=0 ppid=296 pid=514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.596:75): table=raw family=2 entries=3 +type=SYSCALL msg=audit(1481076985.596:75): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=13704d0 items=0 ppid=296 pid=515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.597:76): table=filter family=2 entries=4 +type=SYSCALL msg=audit(1481076985.597:76): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=13ef600 items=0 ppid=296 pid=516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.599:77): table=filter family=2 entries=4 +type=SYSCALL msg=audit(1481076985.599:77): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1f72600 items=0 ppid=296 pid=517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.601:78): table=filter family=2 entries=4 +type=SYSCALL msg=audit(1481076985.601:78): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1299600 items=0 ppid=296 pid=518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.602:79): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.602:79): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=23e29e0 items=0 ppid=296 pid=519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.604:80): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.604:80): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=8199e0 items=0 ppid=296 pid=520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.605:81): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.605:81): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1e879e0 items=0 ppid=296 pid=521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.607:82): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.607:82): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1b699e0 items=0 ppid=296 pid=522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.610:83): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.610:83): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1d599e0 items=0 ppid=296 pid=523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.612:84): table=security family=10 entries=4 +type=SYSCALL msg=audit(1481076985.612:84): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=20be720 items=0 ppid=296 pid=525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.613:85): table=security family=10 entries=4 +type=SYSCALL msg=audit(1481076985.613:85): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=f0a720 items=0 ppid=296 pid=526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.615:86): table=security family=10 entries=4 +type=SYSCALL msg=audit(1481076985.615:86): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=239a720 items=0 ppid=296 pid=527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.620:87): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.628:88): table=raw family=10 entries=3 +type=SYSCALL msg=audit(1481076985.628:88): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1a535c0 items=0 ppid=296 pid=528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.632:89): table=raw family=10 entries=3 +type=SYSCALL msg=audit(1481076985.632:89): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=11735c0 items=0 ppid=296 pid=532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.634:90): table=filter family=10 entries=4 +type=SYSCALL msg=audit(1481076985.634:90): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2553720 items=0 ppid=296 pid=533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.635:91): table=filter family=10 entries=4 +type=SYSCALL msg=audit(1481076985.635:91): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2257720 items=0 ppid=296 pid=534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.641:92): table=filter family=10 entries=4 +type=SYSCALL msg=audit(1481076985.641:92): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1815720 items=0 ppid=296 pid=535 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.657:93): table=filter family=2 entries=4 +type=SYSCALL msg=audit(1481076985.657:93): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=9bc600 items=0 ppid=296 pid=537 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.661:94): table=filter family=2 entries=6 +type=SYSCALL msg=audit(1481076985.661:94): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=20ba7d0 items=0 ppid=296 pid=538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.664:95): table=filter family=2 entries=8 +type=SYSCALL msg=audit(1481076985.664:95): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=c3d9b0 items=0 ppid=296 pid=539 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.687:96): table=filter family=2 entries=10 +type=SYSCALL msg=audit(1481076985.687:96): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1cb7280 items=0 ppid=296 pid=540 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.691:97): table=filter family=2 entries=11 +type=SYSCALL msg=audit(1481076985.691:97): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1b75610 items=0 ppid=296 pid=543 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.719:98): table=filter family=2 entries=12 +type=SYSCALL msg=audit(1481076985.719:98): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1c99770 items=0 ppid=296 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.735:99): table=filter family=2 entries=13 +type=SYSCALL msg=audit(1481076985.735:99): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1b788e0 items=0 ppid=296 pid=548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.760:100): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=wpa_supplicant comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.764:101): table=filter family=2 entries=14 +type=SYSCALL msg=audit(1481076985.764:101): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=97fa60 items=0 ppid=296 pid=550 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.770:102): table=filter family=2 entries=15 +type=SYSCALL msg=audit(1481076985.770:102): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=22e5f10 items=0 ppid=296 pid=551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.779:103): table=filter family=2 entries=16 +type=SYSCALL msg=audit(1481076985.779:103): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=7ec260 items=0 ppid=296 pid=552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.788:104): table=filter family=2 entries=17 +type=SYSCALL msg=audit(1481076985.788:104): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1104760 items=0 ppid=296 pid=558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.790:105): table=filter family=2 entries=19 +type=SYSCALL msg=audit(1481076985.790:105): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=827940 items=0 ppid=296 pid=559 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.795:106): table=filter family=2 entries=21 +type=SYSCALL msg=audit(1481076985.795:106): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1725b10 items=0 ppid=296 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.796:107): table=filter family=2 entries=23 +type=SYSCALL msg=audit(1481076985.796:107): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=22e3cf0 items=0 ppid=296 pid=562 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.798:108): table=filter family=2 entries=25 +type=SYSCALL msg=audit(1481076985.798:108): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2389ec0 items=0 ppid=296 pid=563 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.802:109): table=filter family=2 entries=27 +type=SYSCALL msg=audit(1481076985.802:109): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=22d47a0 items=0 ppid=296 pid=564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.805:110): table=filter family=2 entries=28 +type=SYSCALL msg=audit(1481076985.805:110): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d10b30 items=0 ppid=296 pid=566 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076985.807:111): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=polkit comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076985.812:112): table=filter family=2 entries=29 +type=SYSCALL msg=audit(1481076985.812:112): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d3dc80 items=0 ppid=296 pid=568 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.813:113): table=filter family=2 entries=30 +type=SYSCALL msg=audit(1481076985.813:113): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=21eae00 items=0 ppid=296 pid=569 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.815:114): table=filter family=2 entries=31 +type=SYSCALL msg=audit(1481076985.815:114): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=b0ff70 items=0 ppid=296 pid=570 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.817:115): table=filter family=2 entries=32 +type=SYSCALL msg=audit(1481076985.817:115): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=19490f0 items=0 ppid=296 pid=571 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.818:116): table=filter family=2 entries=33 +type=SYSCALL msg=audit(1481076985.818:116): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d32260 items=0 ppid=296 pid=572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.820:117): table=filter family=2 entries=34 +type=SYSCALL msg=audit(1481076985.820:117): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=aa5720 items=0 ppid=296 pid=573 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.822:118): table=filter family=2 entries=35 +type=SYSCALL msg=audit(1481076985.822:118): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=acaa60 items=0 ppid=296 pid=574 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.823:119): table=filter family=2 entries=36 +type=SYSCALL msg=audit(1481076985.823:119): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d17f70 items=0 ppid=296 pid=575 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.825:120): table=filter family=2 entries=38 +type=SYSCALL msg=audit(1481076985.825:120): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=18cd8a0 items=0 ppid=296 pid=576 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.826:121): table=raw family=2 entries=3 +type=SYSCALL msg=audit(1481076985.826:121): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=12a74d0 items=0 ppid=296 pid=577 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.828:122): table=raw family=2 entries=5 +type=SYSCALL msg=audit(1481076985.828:122): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=da4e10 items=0 ppid=296 pid=578 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.830:123): table=raw family=2 entries=6 +type=SYSCALL msg=audit(1481076985.830:123): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=6b4820 items=0 ppid=296 pid=579 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.831:124): table=raw family=2 entries=8 +type=SYSCALL msg=audit(1481076985.831:124): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1f9b160 items=0 ppid=296 pid=580 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.833:125): table=security family=2 entries=4 +type=SYSCALL msg=audit(1481076985.833:125): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=684600 items=0 ppid=296 pid=581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.834:126): table=security family=2 entries=6 +type=SYSCALL msg=audit(1481076985.834:126): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1a4cf30 items=0 ppid=296 pid=582 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.836:127): table=security family=2 entries=7 +type=SYSCALL msg=audit(1481076985.836:127): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=fae950 items=0 ppid=296 pid=583 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.838:128): table=security family=2 entries=9 +type=SYSCALL msg=audit(1481076985.838:128): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=13e9280 items=0 ppid=296 pid=584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.839:129): table=security family=2 entries=10 +type=SYSCALL msg=audit(1481076985.839:129): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1ae9ca0 items=0 ppid=296 pid=585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.841:130): table=security family=2 entries=12 +type=SYSCALL msg=audit(1481076985.841:130): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=e305d0 items=0 ppid=296 pid=586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.843:131): table=mangle family=2 entries=6 +type=SYSCALL msg=audit(1481076985.843:131): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ba0850 items=0 ppid=296 pid=587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.844:132): table=mangle family=2 entries=8 +type=SYSCALL msg=audit(1481076985.844:132): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=d4c180 items=0 ppid=296 pid=588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.846:133): table=mangle family=2 entries=9 +type=SYSCALL msg=audit(1481076985.846:133): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d99ba0 items=0 ppid=296 pid=589 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.847:134): table=mangle family=2 entries=11 +type=SYSCALL msg=audit(1481076985.847:134): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1f70d70 items=0 ppid=296 pid=590 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.849:135): table=mangle family=2 entries=13 +type=SYSCALL msg=audit(1481076985.849:135): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=24546b0 items=0 ppid=296 pid=591 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.850:136): table=mangle family=2 entries=14 +type=SYSCALL msg=audit(1481076985.850:136): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d30820 items=0 ppid=296 pid=592 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.852:137): table=mangle family=2 entries=15 +type=SYSCALL msg=audit(1481076985.852:137): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1711240 items=0 ppid=296 pid=593 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.853:138): table=mangle family=2 entries=17 +type=SYSCALL msg=audit(1481076985.853:138): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1fedb70 items=0 ppid=296 pid=594 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.855:139): table=mangle family=2 entries=18 +type=SYSCALL msg=audit(1481076985.855:139): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2152590 items=0 ppid=296 pid=595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.856:140): table=mangle family=2 entries=20 +type=SYSCALL msg=audit(1481076985.856:140): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=cf8ec0 items=0 ppid=296 pid=596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.858:141): table=mangle family=2 entries=21 +type=SYSCALL msg=audit(1481076985.858:141): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ce78e0 items=0 ppid=296 pid=597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.860:142): table=mangle family=2 entries=23 +type=SYSCALL msg=audit(1481076985.860:142): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=838210 items=0 ppid=296 pid=598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.861:143): table=mangle family=2 entries=24 +type=SYSCALL msg=audit(1481076985.861:143): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=759c30 items=0 ppid=296 pid=599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.863:144): table=mangle family=2 entries=26 +type=SYSCALL msg=audit(1481076985.863:144): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=e48560 items=0 ppid=296 pid=600 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.864:145): table=nat family=2 entries=5 +type=SYSCALL msg=audit(1481076985.864:145): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1879720 items=0 ppid=296 pid=601 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.866:146): table=nat family=2 entries=7 +type=SYSCALL msg=audit(1481076985.866:146): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=119c060 items=0 ppid=296 pid=602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.867:147): table=nat family=2 entries=8 +type=SYSCALL msg=audit(1481076985.867:147): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=264fa70 items=0 ppid=296 pid=603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.869:148): table=nat family=2 entries=10 +type=SYSCALL msg=audit(1481076985.869:148): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=cc2c50 items=0 ppid=296 pid=604 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.870:149): table=nat family=2 entries=12 +type=SYSCALL msg=audit(1481076985.870:149): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=159d580 items=0 ppid=296 pid=605 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.872:150): table=nat family=2 entries=13 +type=SYSCALL msg=audit(1481076985.872:150): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=baa700 items=0 ppid=296 pid=606 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.873:151): table=nat family=2 entries=14 +type=SYSCALL msg=audit(1481076985.873:151): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=127c110 items=0 ppid=296 pid=607 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.875:152): table=nat family=2 entries=16 +type=SYSCALL msg=audit(1481076985.875:152): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=216aa50 items=0 ppid=296 pid=608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.877:153): table=nat family=2 entries=17 +type=SYSCALL msg=audit(1481076985.877:153): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=aae460 items=0 ppid=296 pid=609 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.878:154): table=nat family=2 entries=19 +type=SYSCALL msg=audit(1481076985.878:154): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=16ad640 items=0 ppid=296 pid=610 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.880:155): table=nat family=2 entries=21 +type=SYSCALL msg=audit(1481076985.880:155): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=112af70 items=0 ppid=296 pid=611 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.881:156): table=nat family=2 entries=22 +type=SYSCALL msg=audit(1481076985.881:156): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=9760f0 items=0 ppid=296 pid=612 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.883:157): table=nat family=2 entries=23 +type=SYSCALL msg=audit(1481076985.883:157): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=11acb00 items=0 ppid=296 pid=613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.884:158): table=nat family=2 entries=25 +type=SYSCALL msg=audit(1481076985.884:158): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2587440 items=0 ppid=296 pid=614 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.886:159): table=filter family=10 entries=4 +type=SYSCALL msg=audit(1481076985.886:159): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2236720 items=0 ppid=296 pid=615 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.887:160): table=filter family=10 entries=6 +type=SYSCALL msg=audit(1481076985.887:160): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2358960 items=0 ppid=296 pid=616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.889:161): table=filter family=10 entries=8 +type=SYSCALL msg=audit(1481076985.889:161): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2655bb0 items=0 ppid=296 pid=617 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.890:162): table=filter family=10 entries=10 +type=SYSCALL msg=audit(1481076985.890:162): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=20a6530 items=0 ppid=296 pid=618 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.892:163): table=filter family=10 entries=11 +type=SYSCALL msg=audit(1481076985.892:163): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1b09930 items=0 ppid=296 pid=619 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.893:164): table=filter family=10 entries=12 +type=SYSCALL msg=audit(1481076985.893:164): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=12a7af0 items=0 ppid=296 pid=620 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.895:165): table=filter family=10 entries=13 +type=SYSCALL msg=audit(1481076985.895:165): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=21a4ce0 items=0 ppid=296 pid=621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.897:166): table=filter family=10 entries=14 +type=SYSCALL msg=audit(1481076985.897:166): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=261ded0 items=0 ppid=296 pid=622 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.898:167): table=filter family=10 entries=15 +type=SYSCALL msg=audit(1481076985.898:167): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=19fc410 items=0 ppid=296 pid=623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.902:168): table=filter family=10 entries=16 +type=SYSCALL msg=audit(1481076985.902:168): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=23917b0 items=0 ppid=296 pid=624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.906:169): table=filter family=10 entries=17 +type=SYSCALL msg=audit(1481076985.906:169): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1825d10 items=0 ppid=296 pid=627 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.907:170): table=filter family=10 entries=19 +type=SYSCALL msg=audit(1481076985.907:170): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=d3df50 items=0 ppid=296 pid=628 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.909:171): table=filter family=10 entries=21 +type=SYSCALL msg=audit(1481076985.909:171): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=c811a0 items=0 ppid=296 pid=629 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.911:172): table=filter family=10 entries=23 +type=SYSCALL msg=audit(1481076985.911:172): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=23953e0 items=0 ppid=296 pid=630 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.912:173): table=filter family=10 entries=25 +type=SYSCALL msg=audit(1481076985.912:173): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=213d630 items=0 ppid=296 pid=631 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.914:174): table=filter family=10 entries=27 +type=SYSCALL msg=audit(1481076985.914:174): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2533fb0 items=0 ppid=296 pid=632 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.915:175): table=filter family=10 entries=28 +type=SYSCALL msg=audit(1481076985.915:175): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=b823b0 items=0 ppid=296 pid=633 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.917:176): table=filter family=10 entries=29 +type=SYSCALL msg=audit(1481076985.917:176): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=756570 items=0 ppid=296 pid=634 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.919:177): table=filter family=10 entries=30 +type=SYSCALL msg=audit(1481076985.919:177): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1462760 items=0 ppid=296 pid=635 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.920:178): table=filter family=10 entries=31 +type=SYSCALL msg=audit(1481076985.920:178): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=ac1950 items=0 ppid=296 pid=636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.922:179): table=filter family=10 entries=32 +type=SYSCALL msg=audit(1481076985.922:179): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=25a8b40 items=0 ppid=296 pid=637 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.923:180): table=filter family=10 entries=33 +type=SYSCALL msg=audit(1481076985.923:180): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=775d30 items=0 ppid=296 pid=638 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.925:181): table=filter family=10 entries=34 +type=SYSCALL msg=audit(1481076985.925:181): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=8bf270 items=0 ppid=296 pid=639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.926:182): table=filter family=10 entries=35 +type=SYSCALL msg=audit(1481076985.926:182): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=14f6610 items=0 ppid=296 pid=640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.928:183): table=filter family=10 entries=36 +type=SYSCALL msg=audit(1481076985.928:183): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=772b70 items=0 ppid=296 pid=641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.930:184): table=filter family=10 entries=38 +type=SYSCALL msg=audit(1481076985.930:184): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1a81540 items=0 ppid=296 pid=642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.931:185): table=raw family=10 entries=3 +type=SYSCALL msg=audit(1481076985.931:185): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=233a5c0 items=0 ppid=296 pid=643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.933:186): table=raw family=10 entries=5 +type=SYSCALL msg=audit(1481076985.933:186): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1824f90 items=0 ppid=296 pid=644 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.934:187): table=raw family=10 entries=6 +type=SYSCALL msg=audit(1481076985.934:187): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=26329f0 items=0 ppid=296 pid=645 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.936:188): table=raw family=10 entries=8 +type=SYSCALL msg=audit(1481076985.936:188): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=ab63d0 items=0 ppid=296 pid=646 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.937:189): table=security family=10 entries=4 +type=SYSCALL msg=audit(1481076985.937:189): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=8ca720 items=0 ppid=296 pid=647 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.938:190): table=security family=10 entries=6 +type=SYSCALL msg=audit(1481076985.938:190): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=216f0f0 items=0 ppid=296 pid=648 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.940:191): table=security family=10 entries=7 +type=SYSCALL msg=audit(1481076985.940:191): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1776b50 items=0 ppid=296 pid=649 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.942:192): table=security family=10 entries=9 +type=SYSCALL msg=audit(1481076985.942:192): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1898530 items=0 ppid=296 pid=650 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.943:193): table=security family=10 entries=10 +type=SYSCALL msg=audit(1481076985.943:193): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=234af90 items=0 ppid=296 pid=651 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.945:194): table=security family=10 entries=12 +type=SYSCALL msg=audit(1481076985.945:194): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22bf960 items=0 ppid=296 pid=652 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.946:195): table=mangle family=10 entries=6 +type=SYSCALL msg=audit(1481076985.946:195): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22cc9e0 items=0 ppid=296 pid=653 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.948:196): table=mangle family=10 entries=8 +type=SYSCALL msg=audit(1481076985.948:196): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=a873b0 items=0 ppid=296 pid=654 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.949:197): table=mangle family=10 entries=9 +type=SYSCALL msg=audit(1481076985.949:197): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22a2e10 items=0 ppid=296 pid=655 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.951:198): table=mangle family=10 entries=11 +type=SYSCALL msg=audit(1481076985.951:198): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=14c6060 items=0 ppid=296 pid=656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.952:199): table=mangle family=10 entries=13 +type=SYSCALL msg=audit(1481076985.952:199): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2549a30 items=0 ppid=296 pid=657 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.954:200): table=mangle family=10 entries=14 +type=SYSCALL msg=audit(1481076985.954:200): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=25b7c20 items=0 ppid=296 pid=658 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.955:201): table=mangle family=10 entries=15 +type=SYSCALL msg=audit(1481076985.955:201): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2434680 items=0 ppid=296 pid=659 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.957:202): table=mangle family=10 entries=17 +type=SYSCALL msg=audit(1481076985.957:202): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22ff060 items=0 ppid=296 pid=660 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.959:203): table=mangle family=10 entries=18 +type=SYSCALL msg=audit(1481076985.959:203): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1f54ac0 items=0 ppid=296 pid=661 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.960:204): table=mangle family=10 entries=20 +type=SYSCALL msg=audit(1481076985.960:204): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=12c7490 items=0 ppid=296 pid=662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.962:205): table=mangle family=10 entries=21 +type=SYSCALL msg=audit(1481076985.962:205): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22e0ef0 items=0 ppid=296 pid=663 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.963:206): table=mangle family=10 entries=23 +type=SYSCALL msg=audit(1481076985.963:206): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=113d8d0 items=0 ppid=296 pid=664 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.965:207): table=mangle family=10 entries=24 +type=SYSCALL msg=audit(1481076985.965:207): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1f65330 items=0 ppid=296 pid=665 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.966:208): table=mangle family=10 entries=26 +type=SYSCALL msg=audit(1481076985.966:208): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=a85d00 items=0 ppid=296 pid=666 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.968:209): table=nat family=10 entries=5 +type=SYSCALL msg=audit(1481076985.968:209): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2227880 items=0 ppid=296 pid=667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.969:210): table=nat family=10 entries=7 +type=SYSCALL msg=audit(1481076985.969:210): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2646250 items=0 ppid=296 pid=668 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.971:211): table=nat family=10 entries=8 +type=SYSCALL msg=audit(1481076985.971:211): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=15a4cb0 items=0 ppid=296 pid=669 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.972:212): table=nat family=10 entries=10 +type=SYSCALL msg=audit(1481076985.972:212): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=ea5f00 items=0 ppid=296 pid=670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.974:213): table=nat family=10 entries=12 +type=SYSCALL msg=audit(1481076985.974:213): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1e798d0 items=0 ppid=296 pid=671 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.975:214): table=nat family=10 entries=13 +type=SYSCALL msg=audit(1481076985.975:214): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=25cdac0 items=0 ppid=296 pid=672 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.977:215): table=nat family=10 entries=14 +type=SYSCALL msg=audit(1481076985.977:215): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=ff1520 items=0 ppid=296 pid=673 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.978:216): table=nat family=10 entries=16 +type=SYSCALL msg=audit(1481076985.978:216): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22bbf00 items=0 ppid=296 pid=674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.980:217): table=nat family=10 entries=17 +type=SYSCALL msg=audit(1481076985.980:217): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1f83960 items=0 ppid=296 pid=675 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.981:218): table=nat family=10 entries=19 +type=SYSCALL msg=audit(1481076985.981:218): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=23b2ba0 items=0 ppid=296 pid=676 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.983:219): table=nat family=10 entries=21 +type=SYSCALL msg=audit(1481076985.983:219): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1530580 items=0 ppid=296 pid=677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.984:220): table=nat family=10 entries=22 +type=SYSCALL msg=audit(1481076985.984:220): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=cc6770 items=0 ppid=296 pid=678 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.986:221): table=nat family=10 entries=23 +type=SYSCALL msg=audit(1481076985.986:221): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=8f01d0 items=0 ppid=296 pid=679 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.988:222): table=nat family=10 entries=25 +type=SYSCALL msg=audit(1481076985.988:222): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=d86ba0 items=0 ppid=296 pid=680 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.991:223): table=raw family=10 entries=9 +type=SYSCALL msg=audit(1481076985.991:223): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1bcd460 items=0 ppid=296 pid=681 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076985.993:224): table=raw family=10 entries=10 +type=SYSCALL msg=audit(1481076985.993:224): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1c49390 items=0 ppid=296 pid=682 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.085:225): table=filter family=2 entries=39 +type=SYSCALL msg=audit(1481076986.085:225): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=24492c0 items=0 ppid=296 pid=685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.086:226): table=filter family=2 entries=41 +type=SYSCALL msg=audit(1481076986.086:226): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=19a6490 items=0 ppid=296 pid=686 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.088:227): table=filter family=2 entries=43 +type=SYSCALL msg=audit(1481076986.088:227): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=23ab670 items=0 ppid=296 pid=687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.089:228): table=filter family=2 entries=45 +type=SYSCALL msg=audit(1481076986.089:228): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2614840 items=0 ppid=296 pid=688 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.091:229): table=filter family=10 entries=39 +type=SYSCALL msg=audit(1481076986.091:229): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=995fa0 items=0 ppid=296 pid=689 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.092:230): table=filter family=10 entries=41 +type=SYSCALL msg=audit(1481076986.092:230): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1a801f0 items=0 ppid=296 pid=690 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.094:231): table=filter family=10 entries=43 +type=SYSCALL msg=audit(1481076986.094:231): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=b38430 items=0 ppid=296 pid=691 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.095:232): table=filter family=10 entries=45 +type=SYSCALL msg=audit(1481076986.095:232): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=9c4680 items=0 ppid=296 pid=692 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.097:233): table=filter family=2 entries=47 +type=SYSCALL msg=audit(1481076986.097:233): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1094180 items=0 ppid=296 pid=693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.099:234): table=filter family=2 entries=48 +type=SYSCALL msg=audit(1481076986.099:234): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1ba92f0 items=0 ppid=296 pid=694 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.101:235): table=filter family=2 entries=49 +type=SYSCALL msg=audit(1481076986.101:235): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1c63470 items=0 ppid=296 pid=695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.102:236): table=filter family=2 entries=50 +type=SYSCALL msg=audit(1481076986.102:236): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=d97600 items=0 ppid=296 pid=696 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.104:237): table=filter family=10 entries=47 +type=SYSCALL msg=audit(1481076986.104:237): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1b49050 items=0 ppid=296 pid=697 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.105:238): table=filter family=10 entries=48 +type=SYSCALL msg=audit(1481076986.105:238): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=c5f240 items=0 ppid=296 pid=698 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.107:239): table=filter family=10 entries=49 +type=SYSCALL msg=audit(1481076986.107:239): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=b6b430 items=0 ppid=296 pid=699 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.108:240): table=filter family=10 entries=50 +type=SYSCALL msg=audit(1481076986.108:240): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=a30650 items=0 ppid=296 pid=700 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.110:241): table=filter family=2 entries=51 +type=SYSCALL msg=audit(1481076986.110:241): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1217000 items=0 ppid=296 pid=701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.112:242): table=filter family=2 entries=53 +type=SYSCALL msg=audit(1481076986.112:242): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=abd1d0 items=0 ppid=296 pid=702 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.113:243): table=filter family=2 entries=55 +type=SYSCALL msg=audit(1481076986.113:243): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=21ab3b0 items=0 ppid=296 pid=703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.115:244): table=filter family=2 entries=57 +type=SYSCALL msg=audit(1481076986.115:244): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1afb580 items=0 ppid=296 pid=704 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.116:245): table=filter family=10 entries=51 +type=SYSCALL msg=audit(1481076986.116:245): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=17f0080 items=0 ppid=296 pid=705 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.118:246): table=filter family=10 entries=53 +type=SYSCALL msg=audit(1481076986.118:246): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=246d2d0 items=0 ppid=296 pid=706 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.120:247): table=filter family=10 entries=55 +type=SYSCALL msg=audit(1481076986.120:247): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=f29510 items=0 ppid=296 pid=707 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.121:248): table=filter family=10 entries=57 +type=SYSCALL msg=audit(1481076986.121:248): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=266c760 items=0 ppid=296 pid=708 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.123:249): table=filter family=2 entries=59 +type=SYSCALL msg=audit(1481076986.123:249): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=e2fec0 items=0 ppid=296 pid=709 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.125:250): table=filter family=2 entries=60 +type=SYSCALL msg=audit(1481076986.125:250): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=d73030 items=0 ppid=296 pid=710 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.126:251): table=filter family=2 entries=61 +type=SYSCALL msg=audit(1481076986.126:251): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1cbc1b0 items=0 ppid=296 pid=711 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.128:252): table=filter family=2 entries=62 +type=SYSCALL msg=audit(1481076986.128:252): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ead340 items=0 ppid=296 pid=712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.129:253): table=filter family=10 entries=59 +type=SYSCALL msg=audit(1481076986.129:253): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1467130 items=0 ppid=296 pid=713 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.131:254): table=filter family=10 entries=60 +type=SYSCALL msg=audit(1481076986.131:254): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1a2b320 items=0 ppid=296 pid=714 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.133:255): table=filter family=10 entries=61 +type=SYSCALL msg=audit(1481076986.133:255): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1602510 items=0 ppid=296 pid=715 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.134:256): table=filter family=10 entries=62 +type=SYSCALL msg=audit(1481076986.134:256): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=ced730 items=0 ppid=296 pid=716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.136:257): table=filter family=2 entries=63 +type=SYSCALL msg=audit(1481076986.136:257): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=10d7d40 items=0 ppid=296 pid=717 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.138:258): table=filter family=2 entries=65 +type=SYSCALL msg=audit(1481076986.138:258): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=743f10 items=0 ppid=296 pid=718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.139:259): table=filter family=2 entries=67 +type=SYSCALL msg=audit(1481076986.139:259): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=e910f0 items=0 ppid=296 pid=719 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.141:260): table=filter family=2 entries=69 +type=SYSCALL msg=audit(1481076986.141:260): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=112d2c0 items=0 ppid=296 pid=720 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.142:261): table=filter family=10 entries=63 +type=SYSCALL msg=audit(1481076986.142:261): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1f11160 items=0 ppid=296 pid=721 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.144:262): table=filter family=10 entries=65 +type=SYSCALL msg=audit(1481076986.144:262): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=14633b0 items=0 ppid=296 pid=722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.145:263): table=filter family=10 entries=67 +type=SYSCALL msg=audit(1481076986.145:263): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1e9b5f0 items=0 ppid=296 pid=723 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.147:264): table=filter family=10 entries=69 +type=SYSCALL msg=audit(1481076986.147:264): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=164c840 items=0 ppid=296 pid=724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.149:265): table=filter family=2 entries=71 +type=SYSCALL msg=audit(1481076986.149:265): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1306c00 items=0 ppid=296 pid=725 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.151:266): table=filter family=2 entries=72 +type=SYSCALL msg=audit(1481076986.151:266): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=d35d70 items=0 ppid=296 pid=726 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.152:267): table=filter family=2 entries=73 +type=SYSCALL msg=audit(1481076986.152:267): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1bacef0 items=0 ppid=296 pid=727 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.154:268): table=filter family=2 entries=74 +type=SYSCALL msg=audit(1481076986.154:268): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=206f080 items=0 ppid=296 pid=728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.156:269): table=filter family=10 entries=71 +type=SYSCALL msg=audit(1481076986.156:269): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1820210 items=0 ppid=296 pid=729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.157:270): table=filter family=10 entries=72 +type=SYSCALL msg=audit(1481076986.157:270): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1f21400 items=0 ppid=296 pid=730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.159:271): table=filter family=10 entries=73 +type=SYSCALL msg=audit(1481076986.159:271): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=19f55f0 items=0 ppid=296 pid=731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.161:272): table=filter family=10 entries=74 +type=SYSCALL msg=audit(1481076986.161:272): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=c19810 items=0 ppid=296 pid=732 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.162:273): table=mangle family=2 entries=27 +type=SYSCALL msg=audit(1481076986.162:273): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=13b5f80 items=0 ppid=296 pid=733 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.164:274): table=mangle family=2 entries=29 +type=SYSCALL msg=audit(1481076986.164:274): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1cd1150 items=0 ppid=296 pid=734 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.166:275): table=mangle family=2 entries=31 +type=SYSCALL msg=audit(1481076986.166:275): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d07330 items=0 ppid=296 pid=735 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.167:276): table=mangle family=2 entries=33 +type=SYSCALL msg=audit(1481076986.167:276): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2113500 items=0 ppid=296 pid=736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.169:277): table=mangle family=10 entries=27 +type=SYSCALL msg=audit(1481076986.169:277): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=132b760 items=0 ppid=296 pid=737 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.171:278): table=mangle family=10 entries=29 +type=SYSCALL msg=audit(1481076986.171:278): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=14479b0 items=0 ppid=296 pid=738 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.172:279): table=mangle family=10 entries=31 +type=SYSCALL msg=audit(1481076986.172:279): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=250dbf0 items=0 ppid=296 pid=739 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.174:280): table=mangle family=10 entries=33 +type=SYSCALL msg=audit(1481076986.174:280): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=214fe40 items=0 ppid=296 pid=740 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.175:281): table=mangle family=2 entries=35 +type=SYSCALL msg=audit(1481076986.175:281): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=100ce40 items=0 ppid=296 pid=741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.177:282): table=mangle family=2 entries=36 +type=SYSCALL msg=audit(1481076986.177:282): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2627fb0 items=0 ppid=296 pid=742 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.178:283): table=mangle family=2 entries=37 +type=SYSCALL msg=audit(1481076986.178:283): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ed9130 items=0 ppid=296 pid=743 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.180:284): table=mangle family=10 entries=35 +type=SYSCALL msg=audit(1481076986.180:284): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=deb810 items=0 ppid=296 pid=744 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.182:285): table=mangle family=10 entries=36 +type=SYSCALL msg=audit(1481076986.182:285): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=10efa00 items=0 ppid=296 pid=745 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.183:286): table=mangle family=10 entries=37 +type=SYSCALL msg=audit(1481076986.183:286): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=7b3bf0 items=0 ppid=296 pid=746 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.185:287): table=nat family=2 entries=26 +type=SYSCALL msg=audit(1481076986.185:287): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1a05e50 items=0 ppid=296 pid=747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.186:288): table=nat family=2 entries=28 +type=SYSCALL msg=audit(1481076986.186:288): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=14fe030 items=0 ppid=296 pid=748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.188:289): table=nat family=2 entries=30 +type=SYSCALL msg=audit(1481076986.188:289): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=c35200 items=0 ppid=296 pid=749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.189:290): table=nat family=2 entries=32 +type=SYSCALL msg=audit(1481076986.189:290): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1cb13e0 items=0 ppid=296 pid=750 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.191:291): table=nat family=10 entries=26 +type=SYSCALL msg=audit(1481076986.191:291): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2499600 items=0 ppid=296 pid=751 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.193:292): table=nat family=10 entries=28 +type=SYSCALL msg=audit(1481076986.193:292): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=243b850 items=0 ppid=296 pid=752 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.194:293): table=nat family=10 entries=30 +type=SYSCALL msg=audit(1481076986.194:293): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=13d5a90 items=0 ppid=296 pid=753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.196:294): table=nat family=10 entries=32 +type=SYSCALL msg=audit(1481076986.196:294): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1dc2ce0 items=0 ppid=296 pid=754 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.197:295): table=nat family=2 entries=34 +type=SYSCALL msg=audit(1481076986.197:295): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1a7ad10 items=0 ppid=296 pid=755 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.199:296): table=nat family=2 entries=35 +type=SYSCALL msg=audit(1481076986.199:296): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ba0e90 items=0 ppid=296 pid=756 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.200:297): table=nat family=2 entries=36 +type=SYSCALL msg=audit(1481076986.200:297): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=cd1000 items=0 ppid=296 pid=757 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.202:298): table=nat family=10 entries=34 +type=SYSCALL msg=audit(1481076986.202:298): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1e5d6b0 items=0 ppid=296 pid=758 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.204:299): table=nat family=10 entries=35 +type=SYSCALL msg=audit(1481076986.204:299): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=7a08a0 items=0 ppid=296 pid=759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.205:300): table=nat family=10 entries=36 +type=SYSCALL msg=audit(1481076986.205:300): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=dc7a90 items=0 ppid=296 pid=760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.207:301): table=nat family=2 entries=37 +type=SYSCALL msg=audit(1481076986.207:301): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=eeea20 items=0 ppid=296 pid=761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.208:302): table=nat family=2 entries=39 +type=SYSCALL msg=audit(1481076986.208:302): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1d06bf0 items=0 ppid=296 pid=762 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.210:303): table=nat family=2 entries=41 +type=SYSCALL msg=audit(1481076986.210:303): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=210cdd0 items=0 ppid=296 pid=763 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.211:304): table=nat family=2 entries=43 +type=SYSCALL msg=audit(1481076986.211:304): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=17c2fa0 items=0 ppid=296 pid=764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.213:305): table=nat family=10 entries=37 +type=SYSCALL msg=audit(1481076986.213:305): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1b954f0 items=0 ppid=296 pid=765 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.215:306): table=nat family=10 entries=39 +type=SYSCALL msg=audit(1481076986.215:306): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=15c1740 items=0 ppid=296 pid=766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.216:307): table=nat family=10 entries=41 +type=SYSCALL msg=audit(1481076986.216:307): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1306980 items=0 ppid=296 pid=767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.218:308): table=nat family=10 entries=43 +type=SYSCALL msg=audit(1481076986.218:308): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=214ebd0 items=0 ppid=296 pid=768 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.219:309): table=nat family=2 entries=45 +type=SYSCALL msg=audit(1481076986.219:309): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=cc78e0 items=0 ppid=296 pid=769 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.221:310): table=nat family=2 entries=46 +type=SYSCALL msg=audit(1481076986.221:310): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1bf7a50 items=0 ppid=296 pid=770 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.222:311): table=nat family=2 entries=47 +type=SYSCALL msg=audit(1481076986.222:311): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=183bbd0 items=0 ppid=296 pid=771 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.224:312): table=nat family=10 entries=45 +type=SYSCALL msg=audit(1481076986.224:312): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=10d95a0 items=0 ppid=296 pid=772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.226:313): table=nat family=10 entries=46 +type=SYSCALL msg=audit(1481076986.226:313): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=c8b790 items=0 ppid=296 pid=773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.227:314): table=nat family=10 entries=47 +type=SYSCALL msg=audit(1481076986.227:314): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1c65980 items=0 ppid=296 pid=774 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.229:315): table=filter family=2 entries=75 +type=SYSCALL msg=audit(1481076986.229:315): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=25d21e0 items=0 ppid=296 pid=775 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.231:316): table=filter family=10 entries=75 +type=SYSCALL msg=audit(1481076986.231:316): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=24e79d0 items=0 ppid=296 pid=776 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.232:317): table=filter family=2 entries=76 +type=SYSCALL msg=audit(1481076986.232:317): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=9f0350 items=0 ppid=296 pid=777 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.234:318): table=filter family=10 entries=76 +type=SYSCALL msg=audit(1481076986.234:318): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=12d2bc0 items=0 ppid=296 pid=778 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.236:319): table=filter family=2 entries=77 +type=SYSCALL msg=audit(1481076986.236:319): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ff24d0 items=0 ppid=296 pid=779 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.237:320): table=filter family=10 entries=77 +type=SYSCALL msg=audit(1481076986.237:320): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=d73db0 items=0 ppid=296 pid=780 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.239:321): table=mangle family=2 entries=38 +type=SYSCALL msg=audit(1481076986.239:321): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1b2f2a0 items=0 ppid=296 pid=781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.241:322): table=mangle family=10 entries=38 +type=SYSCALL msg=audit(1481076986.241:322): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1bc1de0 items=0 ppid=296 pid=782 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.242:323): table=nat family=2 entries=48 +type=SYSCALL msg=audit(1481076986.242:323): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2486d40 items=0 ppid=296 pid=783 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.244:324): table=nat family=10 entries=48 +type=SYSCALL msg=audit(1481076986.244:324): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1744b70 items=0 ppid=296 pid=784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.246:325): table=nat family=2 entries=49 +type=SYSCALL msg=audit(1481076986.246:325): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=933ec0 items=0 ppid=296 pid=785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.247:326): table=nat family=10 entries=49 +type=SYSCALL msg=audit(1481076986.247:326): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=24aed60 items=0 ppid=296 pid=786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.278:327): table=filter family=2 entries=78 +type=SYSCALL msg=audit(1481076986.278:327): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1cc7640 items=0 ppid=296 pid=788 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.279:328): table=filter family=10 entries=78 +type=SYSCALL msg=audit(1481076986.279:328): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=777fa0 items=0 ppid=296 pid=789 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.281:329): table=filter family=2 entries=79 +type=SYSCALL msg=audit(1481076986.281:329): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1e787c0 items=0 ppid=296 pid=790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.283:330): table=filter family=10 entries=79 +type=SYSCALL msg=audit(1481076986.283:330): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1bc4190 items=0 ppid=296 pid=791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.284:331): table=filter family=2 entries=80 +type=SYSCALL msg=audit(1481076986.284:331): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=195d930 items=0 ppid=296 pid=792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.286:332): table=filter family=10 entries=80 +type=SYSCALL msg=audit(1481076986.286:332): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=252d380 items=0 ppid=296 pid=793 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.288:333): table=mangle family=2 entries=39 +type=SYSCALL msg=audit(1481076986.288:333): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1645420 items=0 ppid=296 pid=794 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.289:334): table=mangle family=10 entries=39 +type=SYSCALL msg=audit(1481076986.289:334): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=123efd0 items=0 ppid=296 pid=795 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.291:335): table=nat family=2 entries=50 +type=SYSCALL msg=audit(1481076986.291:335): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2157030 items=0 ppid=296 pid=796 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.292:336): table=nat family=10 entries=50 +type=SYSCALL msg=audit(1481076986.292:336): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1e74f50 items=0 ppid=296 pid=797 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.294:337): table=nat family=2 entries=51 +type=SYSCALL msg=audit(1481076986.294:337): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=f221b0 items=0 ppid=296 pid=798 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076986.296:338): table=nat family=10 entries=51 +type=SYSCALL msg=audit(1481076986.296:338): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=13a2140 items=0 ppid=296 pid=799 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076986.412:339): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076986.515:340): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076986.526:341): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076990.762:342): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager-wait-online comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076990.762:343): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager-wait-online comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076991.152:344): table=filter family=2 entries=81 +type=SYSCALL msg=audit(1481076991.152:344): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=25f0900 items=0 ppid=296 pid=1008 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.158:345): table=filter family=10 entries=81 +type=SYSCALL msg=audit(1481076991.158:345): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=9a6340 items=0 ppid=296 pid=1010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.160:346): table=filter family=2 entries=80 +type=SYSCALL msg=audit(1481076991.160:346): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=acf780 items=0 ppid=296 pid=1013 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.168:347): table=filter family=10 entries=80 +type=SYSCALL msg=audit(1481076991.168:347): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=9e3150 items=0 ppid=296 pid=1015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.170:348): table=filter family=2 entries=79 +type=SYSCALL msg=audit(1481076991.170:348): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=174b610 items=0 ppid=296 pid=1016 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.175:349): table=filter family=10 entries=79 +type=SYSCALL msg=audit(1481076991.175:349): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1ba8f60 items=0 ppid=296 pid=1019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.177:350): table=mangle family=2 entries=40 +type=SYSCALL msg=audit(1481076991.177:350): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=121c3e0 items=0 ppid=296 pid=1021 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.182:351): table=mangle family=10 entries=40 +type=SYSCALL msg=audit(1481076991.182:351): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=17d9f90 items=0 ppid=296 pid=1025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.184:352): table=nat family=2 entries=52 +type=SYSCALL msg=audit(1481076991.184:352): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=16d7170 items=0 ppid=296 pid=1028 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.187:353): table=nat family=10 entries=52 +type=SYSCALL msg=audit(1481076991.187:353): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1028100 items=0 ppid=296 pid=1030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.195:354): table=nat family=2 entries=51 +type=SYSCALL msg=audit(1481076991.195:354): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1954000 items=0 ppid=296 pid=1032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.197:355): table=nat family=10 entries=51 +type=SYSCALL msg=audit(1481076991.197:355): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1fd2f10 items=0 ppid=296 pid=1034 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.202:356): table=filter family=2 entries=78 +type=SYSCALL msg=audit(1481076991.202:356): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=d53640 items=0 ppid=296 pid=1036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.204:357): table=filter family=10 entries=78 +type=SYSCALL msg=audit(1481076991.204:357): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=2435fa0 items=0 ppid=296 pid=1038 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.209:358): table=filter family=2 entries=79 +type=SYSCALL msg=audit(1481076991.209:358): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=b1b7c0 items=0 ppid=296 pid=1043 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.212:359): table=filter family=10 entries=79 +type=SYSCALL msg=audit(1481076991.212:359): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=15aa190 items=0 ppid=296 pid=1045 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.217:360): table=filter family=2 entries=80 +type=SYSCALL msg=audit(1481076991.217:360): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1dda930 items=0 ppid=296 pid=1049 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.220:361): table=filter family=10 entries=80 +type=SYSCALL msg=audit(1481076991.220:361): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=132c380 items=0 ppid=296 pid=1050 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_STOP msg=audit(1481076991.233:362): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076991.233:363): table=mangle family=2 entries=39 +type=SYSCALL msg=audit(1481076991.233:363): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=68c420 items=0 ppid=296 pid=1052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.239:364): table=mangle family=10 entries=39 +type=SYSCALL msg=audit(1481076991.239:364): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=22c9fd0 items=0 ppid=296 pid=1056 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076991.243:365): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=NETFILTER_CFG msg=audit(1481076991.245:366): table=nat family=2 entries=50 +type=SYSCALL msg=audit(1481076991.245:366): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1396030 items=0 ppid=296 pid=1058 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.250:367): table=nat family=10 entries=50 +type=SYSCALL msg=audit(1481076991.250:367): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=13b0f50 items=0 ppid=296 pid=1061 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.254:368): table=nat family=2 entries=51 +type=SYSCALL msg=audit(1481076991.254:368): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1cb11b0 items=0 ppid=296 pid=1062 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(1481076991.256:369): table=nat family=10 entries=51 +type=SYSCALL msg=audit(1481076991.256:369): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=29 a2=40 a3=1dc1140 items=0 ppid=296 pid=1063 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null) +type=SERVICE_START msg=audit(1481076991.354:370): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=network comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076991.483:371): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076991.501:372): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ntpd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076991.789:373): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=tuned comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076991.991:374): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-instance-setup comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076991.991:375): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-instance-setup comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.078:376): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-network-setup comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076992.078:377): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-network-setup comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.078:378): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-ip-forwarding-daemon comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.079:379): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-accounts-daemon comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.080:380): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sshd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.080:381): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-clock-skew-daemon comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.155:382): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-shutdown-scripts comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.398:383): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-startup-scripts comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076992.398:384): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=google-startup-scripts comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=ADD_GROUP msg=audit(1481076992.414:385): pid=1235 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-group id=1000 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' +type=GRP_MGMT msg=audit(1481076992.419:386): pid=1235 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-shadow-group id=1000 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' +type=ADD_GROUP msg=audit(1481076992.467:387): pid=1264 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-group acct="some_user" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.481:388): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=postfix comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=ADD_USER msg=audit(1481076992.488:389): pid=1264 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user id=1000 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' +type=SYSTEM_RUNLEVEL msg=audit(1481076992.492:390): pid=1279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='old-level=N new-level=3 comm="systemd-update-utmp" exe="/usr/lib/systemd/systemd-update-utmp" hostname=? addr=? terminal=? res=success' +type=SERVICE_START msg=audit(1481076992.492:391): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-update-utmp-runlevel comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481076992.493:392): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-update-utmp-runlevel comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.521:393): pid=1264 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-home-dir id=1000 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:394): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-group grp="adm" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:395): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-group grp="video" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:396): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-group grp="dip" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:397): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-group grp="google-sudoers" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:398): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-shadow-group grp="adm" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:399): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-shadow-group grp="video" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:400): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-shadow-group grp="dip" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USER_MGMT msg=audit(1481076992.534:401): pid=1285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='op=add-user-to-shadow-group grp="google-sudoers" acct="some_user" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' +type=USYS_CONFIG msg=audit(1481076993.000:402): pid=1232 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 msg='changing system time exe="/usr/sbin/hwclock" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481077001.763:403): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077041.497:404): pid=1299 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1299 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077041.497:405): pid=1299 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1299 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077041.515:406): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1299 suid=74 rport=63927 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077041.515:407): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1299 suid=74 rport=63927 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077043.046:408): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=63927 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077043.046:409): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ea:4e:a7:19:2a:35:b9:0f:ee:6c:76:f3:3f:52:e4:73 rport=63927 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_ACCT msg=audit(1481077043.052:410): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077043.053:411): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1299 suid=74 rport=63927 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077043.054:412): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=ssh res=success' +type=CRED_ACQ msg=audit(1481077043.057:413): pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=LOGIN msg=audit(1481077043.057:414): pid=1298 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=1000 old-ses=4294967295 ses=1 res=1 +type=USER_ROLE_CHANGE msg=audit(1481077043.140:415): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_START msg=audit(1481077043.170:416): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077043.170:417): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1298 suid=0 rport=63927 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077043.171:418): pid=1301 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1301 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077043.171:419): pid=1301 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1301 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRED_ACQ msg=audit(1481077043.172:420): pid=1301 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_LOGIN msg=audit(1481077043.193:421): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481077043.194:422): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=/dev/pts/0 res=success' +type=USER_END msg=audit(1481077049.033:423): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_LOGOUT msg=audit(1481077049.033:424): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRYPTO_KEY_USER msg=audit(1481077049.054:425): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1301 suid=1000 rport=63927 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_END msg=audit(1481077049.057:426): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRED_DISP msg=audit(1481077049.058:427): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077049.058:428): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1298 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077049.058:429): pid=1298 uid=0 auid=1000 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1298 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077072.307:430): pid=1325 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1325 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077072.307:431): pid=1325 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1325 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077072.328:432): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1325 suid=74 rport=63929 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077072.328:433): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1325 suid=74 rport=63929 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077072.487:434): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=63929 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077072.487:435): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ea:4e:a7:19:2a:35:b9:0f:ee:6c:76:f3:3f:52:e4:73 rport=63929 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_ACCT msg=audit(1481077072.491:436): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077072.493:437): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1325 suid=74 rport=63929 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077072.493:438): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=ssh res=success' +type=CRED_ACQ msg=audit(1481077072.494:439): pid=1324 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=LOGIN msg=audit(1481077072.495:440): pid=1324 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=1000 old-ses=4294967295 ses=2 res=1 +type=USER_ROLE_CHANGE msg=audit(1481077072.564:441): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_START msg=audit(1481077072.589:442): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077072.590:443): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1324 suid=0 rport=63929 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077072.591:444): pid=1327 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1327 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077072.591:445): pid=1327 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1327 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRED_ACQ msg=audit(1481077072.592:446): pid=1327 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_LOGIN msg=audit(1481077072.611:447): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_START msg=audit(1481077072.612:448): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077074.324:449): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1327 suid=1000 rport=63929 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_END msg=audit(1481077074.326:450): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRED_DISP msg=audit(1481077074.327:451): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_END msg=audit(1481077074.329:452): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_LOGOUT msg=audit(1481077074.329:453): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077074.329:454): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1324 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077074.329:455): pid=1324 uid=0 auid=1000 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1324 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077083.100:456): pid=1340 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1340 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077083.100:457): pid=1340 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1340 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077083.118:458): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1340 suid=74 rport=63931 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077083.118:459): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1340 suid=74 rport=63931 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077083.282:460): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=63931 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077083.282:461): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ea:4e:a7:19:2a:35:b9:0f:ee:6c:76:f3:3f:52:e4:73 rport=63931 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_ACCT msg=audit(1481077083.287:462): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077083.288:463): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1340 suid=74 rport=63931 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077083.289:464): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=ssh res=success' +type=CRED_ACQ msg=audit(1481077083.290:465): pid=1339 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=LOGIN msg=audit(1481077083.290:466): pid=1339 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=1000 old-ses=4294967295 ses=3 res=1 +type=USER_ROLE_CHANGE msg=audit(1481077083.358:467): pid=1339 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_START msg=audit(1481077083.388:468): pid=1339 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077083.389:469): pid=1339 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1339 suid=0 rport=63931 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077083.390:470): pid=1342 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1342 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077083.390:471): pid=1342 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1342 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRED_ACQ msg=audit(1481077083.391:472): pid=1342 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_LOGIN msg=audit(1481077083.414:473): pid=1339 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481077083.414:474): pid=1339 uid=0 auid=1000 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=/dev/pts/0 res=success' +type=USER_CMD msg=audit(1481077231.363:475): pid=1382 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=2E2F676F2D6175646974202D636F6E6669672061756469742E79616D6C terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481077231.363:476): pid=1382 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481077231.364:477): pid=1382 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CONFIG_CHANGE msg=audit(1481077231.371:478): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481077231.371:479): arch=c000003e syscall=59 success=yes exit=0 a0=c4201249d0 a1=c42003cbc0 a2=c420064480 a3=0 items=2 ppid=1383 pid=1391 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077231.371:479): argc=7 a0="auditctl" a1="-a" a2="exit,always" a3="-F" a4="arch=b32" a5="-S" a6="execve" +type=CWD msg=audit(1481077231.371:479): cwd="/home/some_user" +type=PATH msg=audit(1481077231.371:479): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077231.371:479): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481077231.372:480): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481077231.372:481): arch=c000003e syscall=59 success=yes exit=0 a0=c420124b50 a1=c42012a1e0 a2=c4200645a0 a3=0 items=2 ppid=1383 pid=1393 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077231.372:481): argc=3 a0="auditctl" a1="-e" a2="1" +type=CWD msg=audit(1481077231.372:481): cwd="/home/some_user" +type=PATH msg=audit(1481077231.372:481): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077231.372:481): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481077231.373:482): audit_enabled=1 old=1 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 res=1 +type=UNKNOWN[1329] msg=g +type=SYSCALL msg=audit(1481077232.471:483): arch=c000003e syscall=59 success=no exit=-2 a0=1325fc0 a1=133b250 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077232.471:483): cwd="/" +type=PATH msg=audit(1481077232.471:483): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077232.471:484): arch=c000003e syscall=59 success=no exit=-2 a0=1325fc0 a1=133b250 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077232.471:484): cwd="/" +type=PATH msg=audit(1481077232.471:484): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077232.471:485): arch=c000003e syscall=59 success=yes exit=0 a0=1325fc0 a1=133b250 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1396 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077232.471:485): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077232.471:485): cwd="/" +type=PATH msg=audit(1481077232.471:485): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077232.471:485): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=g +type=UNKNOWN[1329] msg=g +type=UNKNOWN[1329] msg=g +type=UNKNOWN[1329] msg=g +type=SYSCALL msg=audit(1481077253.941:486): arch=c000003e syscall=59 success=yes exit=0 a0=7f4e7a34ba60 a1=7f4e7a34a280 a2=7f4e7a3497c0 a3=a items=2 ppid=1223 pid=1397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077253.941:486): argc=3 a0="/usr/sbin/sshd" a1="-D" a2="-R" +type=CWD msg=audit(1481077253.941:486): cwd="/" +type=PATH msg=audit(1481077253.941:486): item=0 name="/usr/sbin/sshd" inode=17367919 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sshd_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077253.941:486): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CRYPTO_KEY_USER msg=audit(1481077253.949:487): pid=1398 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1398 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077253.949:488): pid=1398 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1398 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077253.969:489): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1398 suid=74 rport=63973 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_SESSION msg=audit(1481077253.969:490): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=chacha20-poly1305@openssh.com ksize=512 mac= pfs=curve25519-sha256@libssh.org spid=1398 suid=74 rport=63973 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077254.134:491): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=63973 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077254.134:492): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ea:4e:a7:19:2a:35:b9:0f:ee:6c:76:f3:3f:52:e4:73 rport=63973 acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=SYSCALL msg=audit(1481077254.135:493): arch=c000003e syscall=59 success=yes exit=0 a0=7f01f14443ed a1=7ffc04ef9a80 a2=7f01f1647388 a3=2 items=2 ppid=1397 pid=1399 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="unix_chkpwd" exe="/usr/sbin/unix_chkpwd" subj=system_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.135:493): argc=3 a0="/usr/sbin/unix_chkpwd" a1="some_user" a2="chkexpiry" +type=CWD msg=audit(1481077254.135:493): cwd="/" +type=PATH msg=audit(1481077254.135:493): item=0 name="/usr/sbin/unix_chkpwd" inode=16781526 dev=08:01 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.135:493): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=USER_ACCT msg=audit(1481077254.138:494): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077254.139:495): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1398 suid=74 rport=63973 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=USER_AUTH msg=audit(1481077254.139:496): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="some_user" exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=ssh res=success' +type=CRED_ACQ msg=audit(1481077254.140:497): pid=1397 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=LOGIN msg=audit(1481077254.140:498): pid=1397 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=1000 old-ses=4294967295 ses=4 res=1 +type=USER_ROLE_CHANGE msg=audit(1481077254.211:499): pid=1397 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_START msg=audit(1481077254.230:500): pid=1397 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_selinux,pam_loginuid,pam_selinux,pam_namespace,pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_lastlog acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=CRYPTO_KEY_USER msg=audit(1481077254.230:501): pid=1397 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1397 suid=0 rport=63973 laddr=10.142.0.2 lport=22 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077254.232:502): pid=1400 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6d:a3:7f:ed:de:4a:79:f2:aa:49:ec:d1:75:36:97:a3 direction=? spid=1400 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRYPTO_KEY_USER msg=audit(1481077254.232:503): pid=1400 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ce:96:0e:51:3e:14:4e:e8:be:d1:0f:f0:0c:f5:63:a0 direction=? spid=1400 suid=0 exe="/usr/sbin/sshd" hostname=? addr=96.241.146.97 terminal=? res=success' +type=CRED_ACQ msg=audit(1481077254.233:504): pid=1400 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="some_user" exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=ssh res=success' +type=USER_LOGIN msg=audit(1481077254.255:505): pid=1397 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=/dev/pts/1 res=success' +type=USER_START msg=audit(1481077254.255:506): pid=1397 uid=0 auid=1000 ses=4 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000 exe="/usr/sbin/sshd" hostname=pool-96-241-146-97.washdc.fios.verizon.net addr=96.241.146.97 terminal=/dev/pts/1 res=success' +type=SYSCALL msg=audit(1481077254.258:507): arch=c000003e syscall=59 success=yes exit=0 a0=7f01f7181960 a1=7ffc04ef9280 a2=7f01f717f0c0 a3=8 items=2 ppid=1400 pid=1401 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.258:507): argc=1 a0="-bash" +type=CWD msg=audit(1481077254.258:507): cwd="/home/some_user" +type=PATH msg=audit(1481077254.258:507): item=0 name="/bin/bash" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.258:507): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.261:508): arch=c000003e syscall=59 success=yes exit=0 a0=21fbee0 a1=21fc1e0 a2=21f8b30 a3=7ffd20e9bc00 items=2 ppid=1402 pid=1403 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.261:508): argc=2 a0="id" a1="-un" +type=CWD msg=audit(1481077254.261:508): cwd="/home/some_user" +type=PATH msg=audit(1481077254.261:508): item=0 name="/usr/bin/id" inode=4717 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.261:508): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.264:509): arch=c000003e syscall=59 success=yes exit=0 a0=21fa270 a1=21f9f40 a2=21fc810 a3=7ffd20e9c140 items=2 ppid=1404 pid=1405 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="hostname" exe="/usr/bin/hostname" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.264:509): argc=1 a0="/usr/bin/hostname" +type=CWD msg=audit(1481077254.264:509): cwd="/home/some_user" +type=PATH msg=audit(1481077254.264:509): item=0 name="/usr/bin/hostname" inode=3832 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:hostname_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.264:509): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.265:510): arch=c000003e syscall=59 success=yes exit=0 a0=21fcec0 a1=21fd190 a2=21fcb40 a3=7ffd20e9bf10 items=2 ppid=1406 pid=1407 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.265:510): argc=2 a0="id" a1="-gn" +type=CWD msg=audit(1481077254.265:510): cwd="/home/some_user" +type=PATH msg=audit(1481077254.265:510): item=0 name="/usr/bin/id" inode=4717 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.265:510): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.266:511): arch=c000003e syscall=59 success=yes exit=0 a0=21fcf00 a1=21fd1d0 a2=21fcb40 a3=7ffd20e9bf10 items=2 ppid=1408 pid=1409 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.266:511): argc=2 a0="id" a1="-un" +type=CWD msg=audit(1481077254.266:511): cwd="/home/some_user" +type=PATH msg=audit(1481077254.266:511): item=0 name="/usr/bin/id" inode=4717 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.266:511): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.268:512): arch=c000003e syscall=59 success=yes exit=0 a0=21fdfe0 a1=21fe010 a2=21fcb40 a3=7ffd20e9be20 items=3 ppid=1401 pid=1410 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="grepconf.sh" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.268:512): argc=3 a0="/bin/sh" a1="/usr/libexec/grepconf.sh" a2="-c" +type=CWD msg=audit(1481077254.268:512): cwd="/home/some_user" +type=PATH msg=audit(1481077254.268:512): item=0 name="/usr/libexec/grepconf.sh" inode=16779035 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.268:512): item=1 name="/bin/sh" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.268:512): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.269:513): arch=c000003e syscall=59 success=yes exit=0 a0=17616d0 a1=175fc30 a2=175f600 a3=7ffc3c283e00 items=2 ppid=1410 pid=1411 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.269:513): argc=4 a0="grep" a1="-qsi" a2="^COLOR.*none" a3="/etc/GREP_COLORS" +type=CWD msg=audit(1481077254.269:513): cwd="/home/some_user" +type=PATH msg=audit(1481077254.269:513): item=0 name="/usr/bin/grep" inode=2512 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.269:513): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.270:514): arch=c000003e syscall=59 success=yes exit=0 a0=2202d40 a1=2202f20 a2=21fcb40 a3=7ffd20e9aef0 items=2 ppid=1412 pid=1413 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="tty" exe="/usr/bin/tty" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.270:514): argc=2 a0="/usr/bin/tty" a1="-s" +type=CWD msg=audit(1481077254.270:514): cwd="/home/some_user" +type=PATH msg=audit(1481077254.270:514): item=0 name="/usr/bin/tty" inode=4775 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.270:514): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.271:515): arch=c000003e syscall=59 success=yes exit=0 a0=2202e40 a1=2202ee0 a2=21fcb40 a3=7ffd20e9aef0 items=2 ppid=1412 pid=1414 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="tput" exe="/usr/bin/tput" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.271:515): argc=2 a0="/usr/bin/tput" a1="colors" +type=CWD msg=audit(1481077254.271:515): cwd="/home/some_user" +type=PATH msg=audit(1481077254.271:515): item=0 name="/usr/bin/tput" inode=4609 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.271:515): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.273:516): arch=c000003e syscall=59 success=yes exit=0 a0=2202000 a1=21fde10 a2=21fcb40 a3=7ffd20e9b440 items=2 ppid=1415 pid=1416 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="dircolors" exe="/usr/bin/dircolors" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.273:516): argc=3 a0="/usr/bin/dircolors" a1="--sh" a2="/etc/DIR_COLORS.256color" +type=CWD msg=audit(1481077254.273:516): cwd="/home/some_user" +type=PATH msg=audit(1481077254.273:516): item=0 name="/usr/bin/dircolors" inode=4703 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.273:516): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.274:517): arch=c000003e syscall=59 success=yes exit=0 a0=2202360 a1=2201f90 a2=21fcb40 a3=7ffd20e9bc20 items=2 ppid=1401 pid=1417 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.274:517): argc=4 a0="/usr/bin/grep" a1="-qi" a2="^COLOR.*none" a3="/etc/DIR_COLORS.256color" +type=CWD msg=audit(1481077254.274:517): cwd="/home/some_user" +type=PATH msg=audit(1481077254.274:517): item=0 name="/usr/bin/grep" inode=2512 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.274:517): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077254.276:518): arch=c000003e syscall=59 success=yes exit=0 a0=21f90b0 a1=22094b0 a2=21fcb40 a3=7ffd20e9b560 items=2 ppid=1418 pid=1419 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077254.276:518): argc=2 a0="/usr/bin/id" a1="-u" +type=CWD msg=audit(1481077254.276:518): cwd="/home/some_user" +type=PATH msg=audit(1481077254.276:518): item=0 name="/usr/bin/id" inode=4717 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077254.276:518): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=g +type=UNKNOWN[1329] msg=g +type=UNKNOWN[1329] msg=g +type=SYSCALL msg=audit(1481077267.546:519): arch=c000003e syscall=59 success=yes exit=0 a0=1e7e880 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077267.546:519): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077267.546:519): cwd="/" +type=PATH msg=audit(1481077267.546:519): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077267.546:519): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077267.553:520): arch=c000003e syscall=59 success=yes exit=0 a0=1e7e880 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1421 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077267.553:520): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077267.553:520): cwd="/" +type=PATH msg=audit(1481077267.553:520): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077267.553:520): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077267.557:521): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e7e880 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077267.557:521): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077267.557:521): cwd="/" +type=PATH msg=audit(1481077267.557:521): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077267.557:521): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077267.561:522): arch=c000003e syscall=59 success=yes exit=0 a0=1e7e880 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1423 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077267.561:522): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077267.561:522): cwd="/" +type=PATH msg=audit(1481077267.561:522): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077267.561:522): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=g +type=USER_END msg=audit(1481077275.343:523): pid=1382 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481077275.343:524): pid=1382 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481077278.176:525): arch=c000003e syscall=59 success=yes exit=0 a0=a32d70 a1=a2db60 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1425 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="vim" exe="/usr/bin/vim" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077278.176:525): argc=2 a0="vim" a1="audit.yaml" +type=CWD msg=audit(1481077278.176:525): cwd="/home/some_user" +type=PATH msg=audit(1481077278.176:525): item=0 name="/usr/bin/vim" inode=196663 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077278.176:525): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077292.487:526): arch=c000003e syscall=59 success=no exit=-2 a0=134a2c0 a1=132e110 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077292.487:526): cwd="/" +type=PATH msg=audit(1481077292.487:526): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077292.487:527): arch=c000003e syscall=59 success=no exit=-2 a0=134a2c0 a1=126f4b0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077292.487:527): cwd="/" +type=PATH msg=audit(1481077292.487:527): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077292.487:528): arch=c000003e syscall=59 success=yes exit=0 a0=134a2c0 a1=10d45a0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077292.487:528): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077292.487:528): cwd="/" +type=PATH msg=audit(1481077292.487:528): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077292.487:528): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077308.360:529): arch=c000003e syscall=59 success=yes exit=0 a0=a30250 a1=a35ae0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1427 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481077308.360:529): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481077308.360:529): argc=4 a0="sudo" a1="./go-audit" a2="-config" a3="audit.yaml" +type=CWD msg=audit(1481077308.360:529): cwd="/home/some_user" +type=PATH msg=audit(1481077308.360:529): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077308.360:529): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481077308.366:530): pid=1427 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=2E2F676F2D6175646974202D636F6E6669672061756469742E79616D6C terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481077308.367:531): pid=1427 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481077308.368:532): pid=1427 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481077308.371:533): arch=c000003e syscall=59 success=yes exit=0 a0=7fb905da05d8 a1=7fb905da5d38 a2=7fb905da9ad0 a3=6 items=1 ppid=1427 pid=1428 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="go-audit" exe="/home/some_user/go-audit" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077308.371:533): argc=3 a0="./go-audit" a1="-config" a2="audit.yaml" +type=CWD msg=audit(1481077308.371:533): cwd="/home/some_user" +type=PATH msg=audit(1481077308.371:533): item=0 name="./go-audit" inode=33600792 dev=08:01 mode=0100755 ouid=1000 ogid=1001 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077308.376:534): arch=c000003e syscall=59 success=yes exit=0 a0=c42011e580 a1=c4200a7a80 a2=c420064240 a3=0 items=2 ppid=1428 pid=1431 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077308.376:534): argc=2 a0="auditctl" a1="-D" +type=CWD msg=audit(1481077308.376:534): cwd="/home/some_user" +type=PATH msg=audit(1481077308.376:534): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077308.376:534): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481077308.377:535): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="remove_rule" key=(null) list=4 res=1 +type=CONFIG_CHANGE msg=audit(1481077308.377:536): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="remove_rule" key=(null) list=4 res=1 +type=CONFIG_CHANGE msg=audit(1481077308.378:537): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481077308.378:538): arch=c000003e syscall=59 success=yes exit=0 a0=c42011e890 a1=c42003cb40 a2=c420064480 a3=0 items=2 ppid=1428 pid=1436 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077308.378:538): argc=7 a0="auditctl" a1="-a" a2="exit,always" a3="-F" a4="arch=b32" a5="-S" a6="execve" +type=CWD msg=audit(1481077308.378:538): cwd="/home/some_user" +type=PATH msg=audit(1481077308.378:538): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077308.378:538): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481077308.379:539): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481077308.379:540): arch=c000003e syscall=59 success=yes exit=0 a0=c42011ea10 a1=c4200a7fe0 a2=c4200645a0 a3=0 items=2 ppid=1428 pid=1438 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077308.379:540): argc=3 a0="auditctl" a1="-e" a2="1" +type=CWD msg=audit(1481077308.379:540): cwd="/home/some_user" +type=PATH msg=audit(1481077308.379:540): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077308.379:540): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481077308.379:541): audit_enabled=1 old=1 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 res=1 +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077317.921:542): arch=c000003e syscall=59 success=yes exit=0 a0=21fb380 a1=21fd630 a2=21fffd0 a3=7ffd20e9c940 items=1 ppid=1401 pid=1441 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="go-audit" exe="/home/some_user/go-audit" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077317.921:542): argc=2 a0="./go-audit" a1="-h" +type=CWD msg=audit(1481077317.921:542): cwd="/home/some_user" +type=PATH msg=audit(1481077317.921:542): item=0 name="./go-audit" inode=33600792 dev=08:01 mode=0100755 ouid=1000 ogid=1001 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077334.297:543): arch=c000003e syscall=59 success=yes exit=0 a0=21fd7f0 a1=21fba60 a2=21fffd0 a3=7ffd20e9c940 items=2 ppid=1401 pid=1444 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts1 ses=4 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481077334.297:543): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481077334.297:543): argc=2 a0="sudo" a1="su" +type=CWD msg=audit(1481077334.297:543): cwd="/home/some_user" +type=PATH msg=audit(1481077334.297:543): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.297:543): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481077334.302:544): pid=1444 uid=1000 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd="su" terminal=pts/1 res=success' +type=CRED_ACQ msg=audit(1481077334.302:545): pid=1444 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' +type=USER_START msg=audit(1481077334.303:546): pid=1444 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success' +type=SYSCALL msg=audit(1481077334.304:547): arch=c000003e syscall=59 success=yes exit=0 a0=7f683953a5d8 a1=7f683953fd38 a2=7f6839543a90 a3=6 items=2 ppid=1444 pid=1445 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="su" exe="/usr/bin/su" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.304:547): argc=1 a0="su" +type=CWD msg=audit(1481077334.304:547): cwd="/home/some_user" +type=PATH msg=audit(1481077334.304:547): item=0 name="/bin/su" inode=5026 dev=08:01 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:su_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.304:547): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=USER_AUTH msg=audit(1481077334.322:548): pid=1445 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_rootok acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/1 res=success' +type=USER_ACCT msg=audit(1481077334.323:549): pid=1445 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_succeed_if acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/1 res=success' +type=CRED_ACQ msg=audit(1481077334.323:550): pid=1445 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_rootok acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/1 res=success' +type=USER_START msg=audit(1481077334.329:551): pid=1445 uid=0 auid=1000 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_xauth acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/1 res=success' +type=SYSCALL msg=audit(1481077334.330:552): arch=c000003e syscall=59 success=yes exit=0 a0=7f6305e237d0 a1=7f6305e41300 a2=7f6305e41260 a3=2 items=2 ppid=1445 pid=1446 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.330:552): argc=1 a0="bash" +type=CWD msg=audit(1481077334.330:552): cwd="/home/some_user" +type=PATH msg=audit(1481077334.330:552): item=0 name="/bin/bash" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.330:552): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.334:553): arch=c000003e syscall=59 success=yes exit=0 a0=17189c0 a1=1718050 a2=1717320 a3=7ffcb116f5f0 items=3 ppid=1446 pid=1447 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="grepconf.sh" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.334:553): argc=3 a0="/bin/sh" a1="/usr/libexec/grepconf.sh" a2="-c" +type=CWD msg=audit(1481077334.334:553): cwd="/home/some_user" +type=PATH msg=audit(1481077334.334:553): item=0 name="/usr/libexec/grepconf.sh" inode=16779035 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.334:553): item=1 name="/bin/sh" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.334:553): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.335:554): arch=c000003e syscall=59 success=yes exit=0 a0=1389770 a1=1387cc0 a2=13870b0 a3=7ffdff49a5c0 items=2 ppid=1447 pid=1448 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.335:554): argc=4 a0="grep" a1="-qsi" a2="^COLOR.*none" a3="/etc/GREP_COLORS" +type=CWD msg=audit(1481077334.335:554): cwd="/home/some_user" +type=PATH msg=audit(1481077334.335:554): item=0 name="/bin/grep" inode=2512 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.335:554): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.336:555): arch=c000003e syscall=59 success=yes exit=0 a0=172df20 a1=172e100 a2=1717320 a3=7ffcb116e6c0 items=2 ppid=1449 pid=1450 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="tty" exe="/usr/bin/tty" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.336:555): argc=2 a0="/usr/bin/tty" a1="-s" +type=CWD msg=audit(1481077334.336:555): cwd="/home/some_user" +type=PATH msg=audit(1481077334.336:555): item=0 name="/usr/bin/tty" inode=4775 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.336:555): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.337:556): arch=c000003e syscall=59 success=yes exit=0 a0=172e020 a1=172e0c0 a2=1717320 a3=7ffcb116e6c0 items=2 ppid=1449 pid=1451 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="tput" exe="/usr/bin/tput" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.337:556): argc=2 a0="/usr/bin/tput" a1="colors" +type=CWD msg=audit(1481077334.337:556): cwd="/home/some_user" +type=PATH msg=audit(1481077334.337:556): item=0 name="/usr/bin/tput" inode=4609 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.337:556): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.338:557): arch=c000003e syscall=59 success=yes exit=0 a0=172d260 a1=1718330 a2=1717320 a3=7ffcb116ec10 items=2 ppid=1452 pid=1453 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="dircolors" exe="/usr/bin/dircolors" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.338:557): argc=3 a0="/usr/bin/dircolors" a1="--sh" a2="/etc/DIR_COLORS.256color" +type=CWD msg=audit(1481077334.338:557): cwd="/home/some_user" +type=PATH msg=audit(1481077334.338:557): item=0 name="/usr/bin/dircolors" inode=4703 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.338:557): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.339:558): arch=c000003e syscall=59 success=yes exit=0 a0=1717c80 a1=172d200 a2=172ced0 a3=7ffcb116f3f0 items=2 ppid=1446 pid=1454 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.339:558): argc=4 a0="/usr/bin/grep" a1="-qi" a2="^COLOR.*none" a3="/etc/DIR_COLORS.256color" +type=CWD msg=audit(1481077334.339:558): cwd="/home/some_user" +type=PATH msg=audit(1481077334.339:558): item=0 name="/usr/bin/grep" inode=2512 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.339:558): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077334.341:559): arch=c000003e syscall=59 success=yes exit=0 a0=172f220 a1=172e1b0 a2=172ced0 a3=7ffcb116ed30 items=2 ppid=1455 pid=1456 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="id" exe="/usr/bin/id" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077334.341:559): argc=2 a0="/usr/bin/id" a1="-u" +type=CWD msg=audit(1481077334.341:559): cwd="/home/some_user" +type=PATH msg=audit(1481077334.341:559): item=0 name="/usr/bin/id" inode=4717 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077334.341:559): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077336.705:560): arch=c000003e syscall=59 success=yes exit=0 a0=1715420 a1=17182e0 a2=172ced0 a3=7ffcb1170ad0 items=1 ppid=1446 pid=1457 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="go-audit" exe="/home/some_user/go-audit" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077336.705:560): argc=2 a0="./go-audit" a1="-h" +type=CWD msg=audit(1481077336.705:560): cwd="/home/some_user" +type=PATH msg=audit(1481077336.705:560): item=0 name="./go-audit" inode=33600792 dev=08:01 mode=0100755 ouid=1000 ogid=1001 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077352.504:561): arch=c000003e syscall=59 success=no exit=-2 a0=11eb200 a1=11d6480 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077352.504:561): cwd="/" +type=PATH msg=audit(1481077352.504:561): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077352.504:562): arch=c000003e syscall=59 success=no exit=-2 a0=11eb200 a1=f76340 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077352.504:562): cwd="/" +type=PATH msg=audit(1481077352.504:562): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077352.504:563): arch=c000003e syscall=59 success=yes exit=0 a0=11eb200 a1=132e110 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1460 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077352.504:563): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077352.504:563): cwd="/" +type=PATH msg=audit(1481077352.504:563): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077352.504:563): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077356.580:564): arch=c000003e syscall=59 success=yes exit=0 a0=1e7e880 a1=1e97ef0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1461 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077356.580:564): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077356.580:564): cwd="/" +type=PATH msg=audit(1481077356.580:564): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077356.580:564): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077356.585:565): arch=c000003e syscall=59 success=yes exit=0 a0=1e7e880 a1=1e97ef0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1462 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077356.585:565): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077356.585:565): cwd="/" +type=PATH msg=audit(1481077356.585:565): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077356.585:565): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077356.590:566): arch=c000003e syscall=59 success=yes exit=0 a0=1e7e880 a1=1e9c500 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1463 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077356.590:566): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077356.590:566): cwd="/" +type=PATH msg=audit(1481077356.590:566): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077356.590:566): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077356.593:567): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e9f8a0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077356.593:567): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077356.593:567): cwd="/" +type=PATH msg=audit(1481077356.593:567): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077356.593:567): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077412.521:568): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=13361a0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077412.521:568): cwd="/" +type=PATH msg=audit(1481077412.521:568): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077412.521:569): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=13361a0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077412.521:569): cwd="/" +type=PATH msg=audit(1481077412.521:569): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077412.521:570): arch=c000003e syscall=59 success=yes exit=0 a0=12c6d90 a1=13361a0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1465 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077412.521:570): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077412.521:570): cwd="/" +type=PATH msg=audit(1481077412.521:570): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077412.521:570): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077445.611:571): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b330 a1=1e7e880 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1466 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077445.611:571): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077445.611:571): cwd="/" +type=PATH msg=audit(1481077445.611:571): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077445.611:571): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077445.615:572): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b330 a1=1e7e880 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1467 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077445.615:572): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077445.615:572): cwd="/" +type=PATH msg=audit(1481077445.615:572): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077445.615:572): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077445.619:573): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e9b330 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1468 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077445.619:573): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077445.619:573): cwd="/" +type=PATH msg=audit(1481077445.619:573): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077445.619:573): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077445.622:574): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b330 a1=1e7e880 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1469 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077445.622:574): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077445.622:574): cwd="/" +type=PATH msg=audit(1481077445.622:574): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077445.622:574): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077472.536:575): arch=c000003e syscall=59 success=no exit=-2 a0=1054ab0 a1=13bb240 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077472.536:575): cwd="/" +type=PATH msg=audit(1481077472.536:575): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077472.536:576): arch=c000003e syscall=59 success=no exit=-2 a0=1054ab0 a1=13bb240 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077472.536:576): cwd="/" +type=PATH msg=audit(1481077472.536:576): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077472.536:577): arch=c000003e syscall=59 success=yes exit=0 a0=1054ab0 a1=13bb240 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1470 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077472.536:577): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077472.536:577): cwd="/" +type=PATH msg=audit(1481077472.536:577): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077472.536:577): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077532.552:578): arch=c000003e syscall=59 success=no exit=-2 a0=1184a10 a1=13934c0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077532.552:578): cwd="/" +type=PATH msg=audit(1481077532.552:578): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077532.552:579): arch=c000003e syscall=59 success=no exit=-2 a0=1184a10 a1=13934c0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077532.552:579): cwd="/" +type=PATH msg=audit(1481077532.552:579): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077532.552:580): arch=c000003e syscall=59 success=yes exit=0 a0=1184a10 a1=13934c0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077532.552:580): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077532.552:580): cwd="/" +type=PATH msg=audit(1481077532.552:580): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077532.552:580): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077534.641:581): arch=c000003e syscall=59 success=yes exit=0 a0=1e9ed80 a1=1e9b330 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1472 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077534.641:581): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077534.641:581): cwd="/" +type=PATH msg=audit(1481077534.641:581): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077534.641:581): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077534.645:582): arch=c000003e syscall=59 success=yes exit=0 a0=1e9ed80 a1=1e9b330 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1473 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077534.645:582): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077534.645:582): cwd="/" +type=PATH msg=audit(1481077534.645:582): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077534.645:582): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077534.648:583): arch=c000003e syscall=59 success=yes exit=0 a0=1e9a3c0 a1=1cfad80 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1474 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077534.648:583): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077534.648:583): cwd="/" +type=PATH msg=audit(1481077534.648:583): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077534.648:583): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077534.652:584): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e9ed80 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1475 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077534.652:584): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077534.652:584): cwd="/" +type=PATH msg=audit(1481077534.652:584): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077534.652:584): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077592.568:585): arch=c000003e syscall=59 success=no exit=-2 a0=1330170 a1=1259340 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077592.568:585): cwd="/" +type=PATH msg=audit(1481077592.568:585): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077592.568:586): arch=c000003e syscall=59 success=no exit=-2 a0=1330170 a1=1259340 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077592.568:586): cwd="/" +type=PATH msg=audit(1481077592.568:586): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077592.568:587): arch=c000003e syscall=59 success=yes exit=0 a0=1330170 a1=1259340 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1476 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077592.568:587): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077592.568:587): cwd="/" +type=PATH msg=audit(1481077592.568:587): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077592.568:587): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077623.670:588): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b330 a1=1e9a3c0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077623.670:588): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077623.670:588): cwd="/" +type=PATH msg=audit(1481077623.670:588): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077623.670:588): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077623.674:589): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b330 a1=1e9a3c0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1478 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077623.674:589): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077623.674:589): cwd="/" +type=PATH msg=audit(1481077623.674:589): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077623.674:589): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077623.678:590): arch=c000003e syscall=59 success=yes exit=0 a0=1ea1660 a1=1e9b1f0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1479 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077623.678:590): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077623.678:590): cwd="/" +type=PATH msg=audit(1481077623.678:590): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077623.678:590): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077623.681:591): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b1f0 a1=1d54cd0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077623.681:591): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077623.681:591): cwd="/" +type=PATH msg=audit(1481077623.681:591): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077623.681:591): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481077652.584:592): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=12c9cb0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077652.584:592): cwd="/" +type=PATH msg=audit(1481077652.584:592): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077652.585:593): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=12c9cb0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077652.585:593): cwd="/" +type=PATH msg=audit(1481077652.585:593): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077652.585:594): arch=c000003e syscall=59 success=yes exit=0 a0=12c6d90 a1=12c9cb0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1481 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077652.585:594): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077652.585:594): cwd="/" +type=PATH msg=audit(1481077652.585:594): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077652.585:594): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=USER_END msg=audit(1481077706.089:595): pid=1427 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481077706.089:596): pid=1427 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481077708.279:597): arch=c000003e syscall=59 success=yes exit=0 a0=a35a40 a1=a35ad0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1482 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="vim" exe="/usr/bin/vim" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481077708.279:597): argc=2 a0="vim" a1="audit.yaml" +type=CWD msg=audit(1481077708.279:597): cwd="/home/some_user" +type=PATH msg=audit(1481077708.279:597): item=0 name="/usr/bin/vim" inode=196663 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077708.279:597): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077712.602:598): arch=c000003e syscall=59 success=no exit=-2 a0=13a3350 a1=133b250 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077712.602:598): cwd="/" +type=PATH msg=audit(1481077712.602:598): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077712.602:599): arch=c000003e syscall=59 success=no exit=-2 a0=13a3350 a1=133b250 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077712.602:599): cwd="/" +type=PATH msg=audit(1481077712.602:599): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077712.602:600): arch=c000003e syscall=59 success=yes exit=0 a0=13a3350 a1=133b250 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077712.602:600): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077712.602:600): cwd="/" +type=PATH msg=audit(1481077712.602:600): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077712.602:600): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077712.699:601): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b1f0 a1=1ea39a0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1484 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077712.699:601): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077712.699:601): cwd="/" +type=PATH msg=audit(1481077712.699:601): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077712.699:601): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077712.703:602): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b1f0 a1=1ea39a0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1485 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077712.703:602): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077712.703:602): cwd="/" +type=PATH msg=audit(1481077712.703:602): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077712.703:602): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077712.707:603): arch=c000003e syscall=59 success=yes exit=0 a0=1ce5cc0 a1=1e9b330 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1486 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077712.707:603): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077712.707:603): cwd="/" +type=PATH msg=audit(1481077712.707:603): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077712.707:603): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077712.710:604): arch=c000003e syscall=59 success=yes exit=0 a0=1e9b330 a1=1ce24c0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077712.710:604): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077712.710:604): cwd="/" +type=PATH msg=audit(1481077712.710:604): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077712.710:604): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077772.619:605): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=11849b0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077772.619:605): cwd="/" +type=PATH msg=audit(1481077772.619:605): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077772.619:606): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=11849b0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077772.619:606): cwd="/" +type=PATH msg=audit(1481077772.619:606): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077772.619:607): arch=c000003e syscall=59 success=yes exit=0 a0=12c6d90 a1=11849b0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1488 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077772.619:607): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077772.619:607): cwd="/" +type=PATH msg=audit(1481077772.619:607): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077772.619:607): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077801.729:608): arch=c000003e syscall=59 success=yes exit=0 a0=1e22b30 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1489 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077801.729:608): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077801.729:608): cwd="/" +type=PATH msg=audit(1481077801.729:608): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077801.729:608): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077801.733:609): arch=c000003e syscall=59 success=yes exit=0 a0=1e22b30 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1490 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077801.733:609): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077801.733:609): cwd="/" +type=PATH msg=audit(1481077801.733:609): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077801.733:609): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077801.737:610): arch=c000003e syscall=59 success=yes exit=0 a0=1d65350 a1=1d50010 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1491 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077801.737:610): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077801.737:610): cwd="/" +type=PATH msg=audit(1481077801.737:610): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077801.737:610): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077801.740:611): arch=c000003e syscall=59 success=yes exit=0 a0=1d50010 a1=1d53010 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1492 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077801.740:611): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077801.740:611): cwd="/" +type=PATH msg=audit(1481077801.740:611): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077801.740:611): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077832.635:612): arch=c000003e syscall=59 success=no exit=-2 a0=10dae20 a1=1338d40 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077832.635:612): cwd="/" +type=PATH msg=audit(1481077832.635:612): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077832.635:613): arch=c000003e syscall=59 success=no exit=-2 a0=10dae20 a1=1338d40 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077832.635:613): cwd="/" +type=PATH msg=audit(1481077832.635:613): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077832.635:614): arch=c000003e syscall=59 success=yes exit=0 a0=10dae20 a1=1338d40 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1493 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077832.635:614): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077832.635:614): cwd="/" +type=PATH msg=audit(1481077832.635:614): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077832.635:614): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077889.545:615): arch=c000003e syscall=59 success=yes exit=0 a0=7f9dcde12c60 a1=7f9dcddc50e0 a2=7f9dcddc21c0 a3=2 items=2 ppid=1 pid=1494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-tmpfile" exe="/usr/bin/systemd-tmpfiles" subj=system_u:system_r:systemd_tmpfiles_t:s0 key=(null) +type=EXECVE msg=audit(1481077889.545:615): argc=2 a0="/usr/bin/systemd-tmpfiles" a1="--clean" +type=CWD msg=audit(1481077889.545:615): cwd="/" +type=PATH msg=audit(1481077889.545:615): item=0 name="/usr/bin/systemd-tmpfiles" inode=11160 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_tmpfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077889.545:615): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SERVICE_START msg=audit(1481077889.581:616): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-tmpfiles-clean comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SERVICE_STOP msg=audit(1481077889.581:617): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-tmpfiles-clean comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' +type=SYSCALL msg=audit(1481077890.759:618): arch=c000003e syscall=59 success=yes exit=0 a0=1d074b0 a1=1cfad80 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1496 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077890.759:618): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077890.759:618): cwd="/" +type=PATH msg=audit(1481077890.759:618): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077890.759:618): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077890.765:619): arch=c000003e syscall=59 success=yes exit=0 a0=1d074b0 a1=1cfad80 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1497 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077890.765:619): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077890.765:619): cwd="/" +type=PATH msg=audit(1481077890.765:619): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077890.765:619): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077890.769:620): arch=c000003e syscall=59 success=yes exit=0 a0=1d65350 a1=1e79ef0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1498 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077890.769:620): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077890.769:620): cwd="/" +type=PATH msg=audit(1481077890.769:620): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077890.769:620): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077890.772:621): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1d50010 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1499 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077890.772:621): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077890.772:621): cwd="/" +type=PATH msg=audit(1481077890.772:621): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077890.772:621): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077892.652:622): arch=c000003e syscall=59 success=no exit=-2 a0=11eb1c0 a1=13bd560 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077892.652:622): cwd="/" +type=PATH msg=audit(1481077892.652:622): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077892.652:623): arch=c000003e syscall=59 success=no exit=-2 a0=11eb1c0 a1=13bd560 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077892.652:623): cwd="/" +type=PATH msg=audit(1481077892.652:623): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077892.652:624): arch=c000003e syscall=59 success=yes exit=0 a0=11eb1c0 a1=13bd560 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1500 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077892.652:624): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077892.652:624): cwd="/" +type=PATH msg=audit(1481077892.652:624): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077892.652:624): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077952.668:625): arch=c000003e syscall=59 success=no exit=-2 a0=10dae20 a1=125b320 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077952.668:625): cwd="/" +type=PATH msg=audit(1481077952.668:625): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077952.668:626): arch=c000003e syscall=59 success=no exit=-2 a0=10dae20 a1=125b320 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481077952.668:626): cwd="/" +type=PATH msg=audit(1481077952.668:626): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481077952.668:627): arch=c000003e syscall=59 success=yes exit=0 a0=10dae20 a1=125b320 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1501 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077952.668:627): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481077952.668:627): cwd="/" +type=PATH msg=audit(1481077952.668:627): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077952.668:627): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077979.791:628): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1ea39a0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1502 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077979.791:628): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481077979.791:628): cwd="/" +type=PATH msg=audit(1481077979.791:628): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077979.791:628): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077979.795:629): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1ea39a0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077979.795:629): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481077979.795:629): cwd="/" +type=PATH msg=audit(1481077979.795:629): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077979.795:629): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077979.799:630): arch=c000003e syscall=59 success=yes exit=0 a0=1d65350 a1=1e79ef0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077979.799:630): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481077979.799:630): cwd="/" +type=PATH msg=audit(1481077979.799:630): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077979.799:630): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481077979.802:631): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1ea7f60 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1505 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481077979.802:631): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481077979.802:631): cwd="/" +type=PATH msg=audit(1481077979.802:631): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481077979.802:631): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078012.684:632): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=134dc40 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078012.684:632): cwd="/" +type=PATH msg=audit(1481078012.684:632): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078012.684:633): arch=c000003e syscall=59 success=no exit=-2 a0=12c6d90 a1=134dc40 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078012.684:633): cwd="/" +type=PATH msg=audit(1481078012.684:633): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078012.684:634): arch=c000003e syscall=59 success=yes exit=0 a0=12c6d90 a1=134dc40 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1506 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078012.684:634): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078012.684:634): cwd="/" +type=PATH msg=audit(1481078012.684:634): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078012.684:634): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078068.821:635): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e938e0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1507 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078068.821:635): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078068.821:635): cwd="/" +type=PATH msg=audit(1481078068.821:635): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078068.821:635): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078068.825:636): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e938e0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1508 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078068.825:636): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078068.825:636): cwd="/" +type=PATH msg=audit(1481078068.825:636): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078068.825:636): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078068.829:637): arch=c000003e syscall=59 success=yes exit=0 a0=1ea39a0 a1=1ce5cc0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1509 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078068.829:637): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078068.829:637): cwd="/" +type=PATH msg=audit(1481078068.829:637): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078068.829:637): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078068.832:638): arch=c000003e syscall=59 success=yes exit=0 a0=1ce5cc0 a1=1d65350 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1510 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078068.832:638): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078068.832:638): cwd="/" +type=PATH msg=audit(1481078068.832:638): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078068.832:638): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078072.700:639): arch=c000003e syscall=59 success=no exit=-2 a0=13a3350 a1=13bd560 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078072.700:639): cwd="/" +type=PATH msg=audit(1481078072.700:639): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078072.700:640): arch=c000003e syscall=59 success=no exit=-2 a0=13a3350 a1=13bd560 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078072.700:640): cwd="/" +type=PATH msg=audit(1481078072.700:640): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078072.700:641): arch=c000003e syscall=59 success=yes exit=0 a0=13a3350 a1=13bd560 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1511 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078072.700:641): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078072.700:641): cwd="/" +type=PATH msg=audit(1481078072.700:641): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078072.700:641): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078132.715:642): arch=c000003e syscall=59 success=no exit=-2 a0=134a2c0 a1=125b320 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078132.715:642): cwd="/" +type=PATH msg=audit(1481078132.715:642): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078132.715:643): arch=c000003e syscall=59 success=no exit=-2 a0=134a2c0 a1=125b320 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078132.715:643): cwd="/" +type=PATH msg=audit(1481078132.715:643): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078132.715:644): arch=c000003e syscall=59 success=yes exit=0 a0=134a2c0 a1=125b320 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1512 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078132.715:644): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078132.715:644): cwd="/" +type=PATH msg=audit(1481078132.715:644): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078132.715:644): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078157.850:645): arch=c000003e syscall=59 success=yes exit=0 a0=1e22b30 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1513 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078157.850:645): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078157.850:645): cwd="/" +type=PATH msg=audit(1481078157.850:645): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078157.850:645): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078157.854:646): arch=c000003e syscall=59 success=yes exit=0 a0=1e22b30 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1514 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078157.854:646): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078157.854:646): cwd="/" +type=PATH msg=audit(1481078157.854:646): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078157.854:646): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078157.858:647): arch=c000003e syscall=59 success=yes exit=0 a0=1e9a580 a1=1cfad80 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1515 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078157.858:647): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078157.858:647): cwd="/" +type=PATH msg=audit(1481078157.858:647): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078157.858:647): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078157.862:648): arch=c000003e syscall=59 success=yes exit=0 a0=1cfad80 a1=1e938e0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1516 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078157.862:648): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078157.862:648): cwd="/" +type=PATH msg=audit(1481078157.862:648): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078157.862:648): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078192.730:649): arch=c000003e syscall=59 success=no exit=-2 a0=134a930 a1=13c8730 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078192.730:649): cwd="/" +type=PATH msg=audit(1481078192.730:649): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078192.730:650): arch=c000003e syscall=59 success=no exit=-2 a0=134a930 a1=13c8730 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078192.730:650): cwd="/" +type=PATH msg=audit(1481078192.730:650): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078192.730:651): arch=c000003e syscall=59 success=yes exit=0 a0=134a930 a1=13c8730 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1517 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078192.730:651): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078192.730:651): cwd="/" +type=PATH msg=audit(1481078192.730:651): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078192.730:651): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078246.880:652): arch=c000003e syscall=59 success=yes exit=0 a0=1ea39a0 a1=1e95970 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1518 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078246.880:652): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078246.880:652): cwd="/" +type=PATH msg=audit(1481078246.880:652): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078246.880:652): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078246.884:653): arch=c000003e syscall=59 success=yes exit=0 a0=1ea39a0 a1=1e95970 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078246.884:653): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078246.884:653): cwd="/" +type=PATH msg=audit(1481078246.884:653): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078246.884:653): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078246.888:654): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1e22b30 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078246.888:654): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078246.888:654): cwd="/" +type=PATH msg=audit(1481078246.888:654): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078246.888:654): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078246.891:655): arch=c000003e syscall=59 success=yes exit=0 a0=1e22b30 a1=1d074b0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1521 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078246.891:655): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078246.891:655): cwd="/" +type=PATH msg=audit(1481078246.891:655): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078246.891:655): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078252.745:656): arch=c000003e syscall=59 success=no exit=-2 a0=126cbc0 a1=13c8730 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078252.745:656): cwd="/" +type=PATH msg=audit(1481078252.745:656): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078252.745:657): arch=c000003e syscall=59 success=no exit=-2 a0=126cbc0 a1=13c8730 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078252.745:657): cwd="/" +type=PATH msg=audit(1481078252.745:657): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078252.745:658): arch=c000003e syscall=59 success=yes exit=0 a0=126cbc0 a1=13c8730 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1522 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078252.745:658): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078252.745:658): cwd="/" +type=PATH msg=audit(1481078252.745:658): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078252.745:658): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078312.761:659): arch=c000003e syscall=59 success=no exit=-2 a0=134dca0 a1=12cddf0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078312.761:659): cwd="/" +type=PATH msg=audit(1481078312.761:659): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078312.761:660): arch=c000003e syscall=59 success=no exit=-2 a0=134dca0 a1=12cddf0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078312.761:660): cwd="/" +type=PATH msg=audit(1481078312.761:660): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078312.761:661): arch=c000003e syscall=59 success=yes exit=0 a0=134dca0 a1=12cddf0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1523 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078312.761:661): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078312.761:661): cwd="/" +type=PATH msg=audit(1481078312.761:661): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078312.761:661): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078335.910:662): arch=c000003e syscall=59 success=yes exit=0 a0=1ce5cc0 a1=1e96d00 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1524 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078335.910:662): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078335.910:662): cwd="/" +type=PATH msg=audit(1481078335.910:662): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078335.910:662): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078335.914:663): arch=c000003e syscall=59 success=yes exit=0 a0=1ce5cc0 a1=1e96d00 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1525 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078335.914:663): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078335.914:663): cwd="/" +type=PATH msg=audit(1481078335.914:663): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078335.914:663): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078335.917:664): arch=c000003e syscall=59 success=yes exit=0 a0=1ea39a0 a1=1e95970 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1526 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078335.917:664): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078335.917:664): cwd="/" +type=PATH msg=audit(1481078335.917:664): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078335.917:664): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078335.921:665): arch=c000003e syscall=59 success=yes exit=0 a0=1e95970 a1=1cfad80 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1527 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078335.921:665): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078335.921:665): cwd="/" +type=PATH msg=audit(1481078335.921:665): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078335.921:665): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078372.776:666): arch=c000003e syscall=59 success=no exit=-2 a0=1394bf0 a1=13977b0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078372.776:666): cwd="/" +type=PATH msg=audit(1481078372.776:666): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078372.776:667): arch=c000003e syscall=59 success=no exit=-2 a0=1394bf0 a1=13977b0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078372.776:667): cwd="/" +type=PATH msg=audit(1481078372.776:667): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078372.776:668): arch=c000003e syscall=59 success=yes exit=0 a0=1394bf0 a1=13977b0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1528 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078372.776:668): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078372.776:668): cwd="/" +type=PATH msg=audit(1481078372.776:668): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078372.776:668): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078413.210:669): arch=c000003e syscall=59 success=yes exit=0 a0=a2ee20 a1=a340b0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1529 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078413.210:669): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078413.210:669): argc=4 a0="sudo" a1="./go-audit" a2="-config" a3="audit.yaml" +type=CWD msg=audit(1481078413.210:669): cwd="/home/some_user" +type=PATH msg=audit(1481078413.210:669): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078413.210:669): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078413.216:670): pid=1529 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=2E2F676F2D6175646974202D636F6E6669672061756469742E79616D6C terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078413.216:671): pid=1529 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078413.217:672): pid=1529 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078413.219:673): arch=c000003e syscall=59 success=yes exit=0 a0=7f80c28925d8 a1=7f80c2897d38 a2=7f80c289bad0 a3=6 items=1 ppid=1529 pid=1530 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="go-audit" exe="/home/some_user/go-audit" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078413.219:673): argc=3 a0="./go-audit" a1="-config" a2="audit.yaml" +type=CWD msg=audit(1481078413.219:673): cwd="/home/some_user" +type=PATH msg=audit(1481078413.219:673): item=0 name="./go-audit" inode=33600792 dev=08:01 mode=0100755 ouid=1000 ogid=1001 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078413.223:674): arch=c000003e syscall=59 success=yes exit=0 a0=c42011e5c0 a1=c4200a7ae0 a2=c420064240 a3=0 items=2 ppid=1530 pid=1533 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078413.223:674): argc=2 a0="auditctl" a1="-D" +type=CWD msg=audit(1481078413.223:674): cwd="/home/some_user" +type=PATH msg=audit(1481078413.223:674): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078413.223:674): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481078413.223:675): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="remove_rule" key=(null) list=4 res=1 +type=CONFIG_CHANGE msg=audit(1481078413.223:676): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="remove_rule" key=(null) list=4 res=1 +type=CONFIG_CHANGE msg=audit(1481078413.224:677): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481078413.224:678): arch=c000003e syscall=59 success=yes exit=0 a0=c42011e8d0 a1=c42003cb80 a2=c420064480 a3=0 items=2 ppid=1530 pid=1538 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078413.224:678): argc=7 a0="auditctl" a1="-a" a2="exit,always" a3="-F" a4="arch=b32" a5="-S" a6="execve" +type=CWD msg=audit(1481078413.224:678): cwd="/home/some_user" +type=PATH msg=audit(1481078413.224:678): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078413.224:678): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481078413.225:679): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481078413.225:680): arch=c000003e syscall=59 success=yes exit=0 a0=c42011ea50 a1=c420120930 a2=c4200645a0 a3=0 items=2 ppid=1530 pid=1540 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078413.225:680): argc=5 a0="auditctl" a1="-a" a2="exit,always" a3="-S" a4="connect" +type=CWD msg=audit(1481078413.225:680): cwd="/home/some_user" +type=PATH msg=audit(1481078413.225:680): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078413.225:680): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481078413.226:681): auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op="add_rule" key=(null) list=4 res=1 +type=SYSCALL msg=audit(1481078413.226:682): arch=c000003e syscall=59 success=yes exit=0 a0=c42011ebc0 a1=c4201261e0 a2=c4200646c0 a3=0 items=2 ppid=1530 pid=1542 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="auditctl" exe="/usr/sbin/auditctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078413.226:682): argc=3 a0="auditctl" a1="-e" a2="1" +type=CWD msg=audit(1481078413.226:682): cwd="/home/some_user" +type=PATH msg=audit(1481078413.226:682): item=0 name="/sbin/auditctl" inode=17367907 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:auditctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078413.226:682): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=CONFIG_CHANGE msg=audit(1481078413.227:683): audit_enabled=1 old=1 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 res=1 +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078424.939:684): arch=c000003e syscall=59 success=yes exit=0 a0=1e98040 a1=1e215c0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1546 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078424.939:684): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078424.939:684): cwd="/" +type=PATH msg=audit(1481078424.939:684): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078424.939:684): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078424.943:685): arch=c000003e syscall=59 success=yes exit=0 a0=1e98040 a1=1e215c0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1547 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078424.943:685): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078424.943:685): cwd="/" +type=PATH msg=audit(1481078424.943:685): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078424.943:685): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078424.947:686): arch=c000003e syscall=59 success=yes exit=0 a0=1ce5cc0 a1=1e96d00 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1548 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078424.947:686): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078424.947:686): cwd="/" +type=PATH msg=audit(1481078424.947:686): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078424.947:686): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078424.950:687): arch=c000003e syscall=59 success=yes exit=0 a0=1e96d00 a1=1e9a580 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078424.950:687): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078424.950:687): cwd="/" +type=PATH msg=audit(1481078424.950:687): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078424.950:687): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078424.953:688): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffeb9b2b770 a2=10 a3=fe items=0 ppid=1 pid=1222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_accounts" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078424.953:688): saddr=02000050A9FEA9FE0000000000000000 +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078430.028:689): arch=c000003e syscall=59 success=yes exit=0 a0=1718db0 a1=1714870 a2=172ced0 a3=7ffcb1170ad0 items=2 ppid=1446 pid=1550 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078430.028:689): argc=2 a0="curl" a1="elastic.co" +type=CWD msg=audit(1481078430.028:689): cwd="/home/some_user" +type=PATH msg=audit(1481078430.028:689): item=0 name="/bin/curl" inode=3961 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078430.028:689): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078430.068:690): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7efe1aab7610 a2=6e a3=7efe1aab7b20 items=1 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.068:690): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078430.068:690): cwd="/home/some_user" +type=PATH msg=audit(1481078430.068:690): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078430.068:691): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7efe1aab77a0 a2=6e a3=7efe1aab7b20 items=1 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.068:691): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078430.068:691): cwd="/home/some_user" +type=PATH msg=audit(1481078430.068:691): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078430.068:692): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe14000ac0 a2=10 a3=7efe1aab5ae0 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.068:692): saddr=02000035A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078430.127:693): arch=c000003e syscall=42 success=no exit=-101 a0=3 a1=7efe14001ec0 a2=1c a3=7efe1aab680c items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:693): saddr=0A000050000000002406DA00FF00000000000000171569CC00000000 +type=SYSCALL msg=audit(1481078430.127:694): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:694): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:695): arch=c000003e syscall=42 success=no exit=-101 a0=3 a1=7efe14001f20 a2=1c a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:695): saddr=0A000050000000002406DA00FF00000000000000B849AB0E00000000 +type=SYSCALL msg=audit(1481078430.127:696): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:696): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:697): arch=c000003e syscall=42 success=no exit=-101 a0=3 a1=7efe14001f80 a2=1c a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:697): saddr=0A000050000000002406DA00FF000000000000006B16F08600000000 +type=SYSCALL msg=audit(1481078430.127:698): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:698): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:699): arch=c000003e syscall=42 success=no exit=-101 a0=3 a1=7efe14001fe0 a2=1c a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:699): saddr=0A000050000000002406DA00FF00000000000000CCECD96C00000000 +type=SYSCALL msg=audit(1481078430.127:700): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:700): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:701): arch=c000003e syscall=42 success=no exit=-101 a0=3 a1=7efe14002040 a2=1c a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:701): saddr=0A000050000000002406DA00FF00000000000000171569C100000000 +type=SYSCALL msg=audit(1481078430.127:702): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:702): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:703): arch=c000003e syscall=42 success=no exit=-101 a0=3 a1=7efe140020a0 a2=1c a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:703): saddr=0A000050000000002406DA00FF00000000000000B848DAB200000000 +type=SYSCALL msg=audit(1481078430.127:704): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:704): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:705): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe14002100 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:705): saddr=020000503418E8030000000000000000 +type=SYSCALL msg=audit(1481078430.127:706): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:706): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:707): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe14002150 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:707): saddr=0200005023A0FE0E0000000000000000 +type=SYSCALL msg=audit(1481078430.127:708): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:708): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:709): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe140021a0 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:709): saddr=02000050342844160000000000000000 +type=SYSCALL msg=audit(1481078430.127:710): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe1aab7c80 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:710): saddr=00000000000000000000000000000000 +type=SYSCALL msg=audit(1481078430.127:711): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7efe140021f0 a2=10 a3=10 items=0 ppid=1446 pid=1551 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.127:711): saddr=020000503646B34B0000000000000000 +type=SYSCALL msg=audit(1481078430.128:712): arch=c000003e syscall=42 success=no exit=-115 a0=3 a1=7ffc2ebe3e70 a2=10 a3=7ffc2ebe3a90 items=0 ppid=1446 pid=1550 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4 comm="curl" exe="/usr/bin/curl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078430.128:712): saddr=020000503418E8030000000000000000 +type=SYSCALL msg=audit(1481078432.792:713): arch=c000003e syscall=59 success=no exit=-2 a0=12593a0 a1=13ca3c0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078432.792:713): cwd="/" +type=PATH msg=audit(1481078432.792:713): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078432.792:714): arch=c000003e syscall=59 success=no exit=-2 a0=12593a0 a1=13ca3c0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078432.792:714): cwd="/" +type=PATH msg=audit(1481078432.792:714): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078432.792:715): arch=c000003e syscall=59 success=yes exit=0 a0=12593a0 a1=13ca3c0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1552 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078432.792:715): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078432.792:715): cwd="/" +type=PATH msg=audit(1481078432.792:715): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078432.792:715): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078432.794:716): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc08f67860 a2=10 a3=fe items=0 ppid=1 pid=1220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078432.794:716): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078432.896:717): arch=c000003e syscall=42 success=yes exit=0 a0=15 a1=7ffc4d9dc980 a2=6e a3=ea60 items=1 ppid=1 pid=1276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078432.896:717): saddr=01007075626C69632F7069636B75700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078432.896:717): cwd="/var/spool/postfix" +type=PATH msg=audit(1481078432.896:717): item=0 name="public/pickup" inode=34151428 dev=08:01 mode=0140666 ouid=89 ogid=89 rdev=00:00 obj=system_u:object_r:postfix_public_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078433.320:718): arch=c000003e syscall=42 success=no exit=-115 a0=5 a1=7ffc6ea4e240 a2=10 a3=fe items=0 ppid=1 pid=1224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_clock_sk" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078433.320:718): saddr=02000050A9FEA9FE0000000000000000 +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078492.523:719): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7ff9fe0b9408 a2=10 a3=0 items=0 ppid=1 pid=1135 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078492.523:719): saddr=0200007BA9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078492.807:720): arch=c000003e syscall=59 success=no exit=-2 a0=134dca0 a1=13cb9a0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078492.807:720): cwd="/" +type=PATH msg=audit(1481078492.807:720): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078492.807:721): arch=c000003e syscall=59 success=no exit=-2 a0=134dca0 a1=13cb9a0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078492.807:721): cwd="/" +type=PATH msg=audit(1481078492.807:721): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078492.807:722): arch=c000003e syscall=59 success=yes exit=0 a0=134dca0 a1=13cb9a0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1553 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078492.807:722): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078492.807:722): cwd="/" +type=PATH msg=audit(1481078492.807:722): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078492.807:722): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078492.809:723): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc08f67860 a2=10 a3=fe items=0 ppid=1 pid=1220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078492.809:723): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078492.956:724): arch=c000003e syscall=42 success=yes exit=0 a0=15 a1=7ffc4d9dc980 a2=6e a3=ea60 items=1 ppid=1 pid=1276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078492.956:724): saddr=01007075626C69632F716D677200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078492.956:724): cwd="/var/spool/postfix" +type=PATH msg=audit(1481078492.956:724): item=0 name="public/qmgr" inode=34151432 dev=08:01 mode=0140666 ouid=89 ogid=89 rdev=00:00 obj=system_u:object_r:postfix_public_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078492.956:725): arch=c000003e syscall=42 success=yes exit=0 a0=1c a1=7ffc4d9dc980 a2=6e a3=7ffc4d9dc9f0 items=1 ppid=1 pid=1276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078492.956:725): saddr=01007075626C69632F7069636B75700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078492.956:725): cwd="/var/spool/postfix" +type=PATH msg=audit(1481078492.956:725): item=0 name="public/pickup" inode=34151428 dev=08:01 mode=0140666 ouid=89 ogid=89 rdev=00:00 obj=system_u:object_r:postfix_public_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078493.333:726): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc6ea4e240 a2=10 a3=fe items=0 ppid=1 pid=1224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_clock_sk" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078493.333:726): saddr=02000050A9FEA9FE0000000000000000 +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078513.968:727): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1e98040 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1554 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078513.968:727): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078513.968:727): cwd="/" +type=PATH msg=audit(1481078513.968:727): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078513.968:727): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078513.972:728): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1e98040 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1555 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078513.972:728): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078513.972:728): cwd="/" +type=PATH msg=audit(1481078513.972:728): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078513.972:728): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078513.976:729): arch=c000003e syscall=59 success=yes exit=0 a0=1e215c0 a1=1e9ffb0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1556 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078513.976:729): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078513.976:729): cwd="/" +type=PATH msg=audit(1481078513.976:729): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078513.976:729): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078513.980:730): arch=c000003e syscall=59 success=yes exit=0 a0=1e9ffb0 a1=1e96d00 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1557 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078513.980:730): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078513.980:730): cwd="/" +type=PATH msg=audit(1481078513.980:730): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078513.980:730): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078513.983:731): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffeb9b2b770 a2=10 a3=fe items=0 ppid=1 pid=1222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_accounts" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078513.983:731): saddr=02000050A9FEA9FE0000000000000000 +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078552.823:732): arch=c000003e syscall=59 success=no exit=-2 a0=13c5290 a1=12d12f0 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078552.823:732): cwd="/" +type=PATH msg=audit(1481078552.823:732): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078552.823:733): arch=c000003e syscall=59 success=no exit=-2 a0=13c5290 a1=12d12f0 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078552.823:733): cwd="/" +type=PATH msg=audit(1481078552.823:733): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078552.823:734): arch=c000003e syscall=59 success=yes exit=0 a0=13c5290 a1=12d12f0 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1558 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078552.823:734): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078552.823:734): cwd="/" +type=PATH msg=audit(1481078552.823:734): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078552.823:734): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078552.825:735): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc08f67860 a2=10 a3=fe items=0 ppid=1 pid=1220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078552.825:735): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078552.966:736): arch=c000003e syscall=42 success=yes exit=0 a0=15 a1=7ffc4d9dc980 a2=6e a3=ea60 items=1 ppid=1 pid=1276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078552.966:736): saddr=01007075626C69632F7069636B75700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078552.966:736): cwd="/var/spool/postfix" +type=PATH msg=audit(1481078552.966:736): item=0 name="public/pickup" inode=34151428 dev=08:01 mode=0140666 ouid=89 ogid=89 rdev=00:00 obj=system_u:object_r:postfix_public_t:s0 objtype=NORMAL +type=UNKNOWN[1329] msg=� +type=SYSCALL msg=audit(1481078553.346:737): arch=c000003e syscall=42 success=no exit=-115 a0=5 a1=7ffc6ea4e240 a2=10 a3=fe items=0 ppid=1 pid=1224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_clock_sk" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078553.346:737): saddr=02000050A9FEA9FE0000000000000000 +type=UNKNOWN[1329] msg=� +type=USER_END msg=audit(1481078562.609:738): pid=1529 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481078562.609:739): pid=1529 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078565.928:740): arch=c000003e syscall=59 success=yes exit=0 a0=a33280 a1=a30250 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1559 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078565.928:740): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078565.928:740): argc=4 a0="sudo" a1="systemctl" a2="stop" a3="auditd.service" +type=CWD msg=audit(1481078565.928:740): cwd="/home/some_user" +type=PATH msg=audit(1481078565.928:740): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078565.928:740): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078565.929:741): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffcda014d50 a2=6e a3=40 items=1 ppid=1343 pid=1559 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.929:741): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078565.929:741): cwd="/home/some_user" +type=PATH msg=audit(1481078565.929:741): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078565.929:742): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffcda014ee0 a2=6e a3=40 items=1 ppid=1343 pid=1559 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.929:742): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078565.929:742): cwd="/home/some_user" +type=PATH msg=audit(1481078565.929:742): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078565.931:743): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffcda015870 a2=6e a3=22 items=1 ppid=1343 pid=1559 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.931:743): saddr=01002F7661722F72756E2F6E7363642F736F636B657400001000000000000000605A01DAFC7F0000205C01DAFC7F0000E09F240A8D7F00002F00000000000000D05E01DAFC7F00001000000000000000805C01DAFC7F0000F05801DAFC7F00000003000000000000E09F240A8D7F +type=CWD msg=audit(1481078565.931:743): cwd="/home/some_user" +type=PATH msg=audit(1481078565.931:743): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078565.931:744): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffcda015a00 a2=6e a3=22 items=1 ppid=1343 pid=1559 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.931:744): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000EDA7240A8D7F0000FEA7240A8D7F000007A8240A8D7F000018A8240A8D7F000022A8240A8D7F000033A8240A8D7F00003DA8240A8D7F00004EA8240A8D7F000056A8240A8D7F00001800000030000000106101DAFC7F +type=CWD msg=audit(1481078565.931:744): cwd="/home/some_user" +type=PATH msg=audit(1481078565.931:744): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078565.932:745): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=7f8d08cf7740 a2=6e a3=68 items=1 ppid=1343 pid=1559 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.932:745): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078565.932:745): cwd="/home/some_user" +type=PATH msg=audit(1481078565.932:745): item=0 name="/dev/log" inode=6529 dev=00:05 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078565.932:746): pid=1559 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=73797374656D63746C2073746F70206175646974642E73657276696365 terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078565.932:747): pid=1559 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078565.933:748): pid=1559 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078565.934:749): arch=c000003e syscall=59 success=yes exit=0 a0=7f8d0a2505d8 a1=7f8d0a255d38 a2=7f8d0a259ad0 a3=6 items=2 ppid=1559 pid=1560 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078565.934:749): argc=3 a0="systemctl" a1="stop" a2="auditd.service" +type=CWD msg=audit(1481078565.934:749): cwd="/home/some_user" +type=PATH msg=audit(1481078565.934:749): item=0 name="/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078565.934:749): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078565.937:750): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7f0fe5855118 a2=16 a3=7fffb6ad3580 items=1 ppid=1559 pid=1560 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.937:750): saddr=01002F72756E2F73797374656D642F70726976617465 +type=CWD msg=audit(1481078565.937:750): cwd="/home/some_user" +type=PATH msg=audit(1481078565.937:750): item=0 name="/run/systemd/private" inode=10228 dev=00:13 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078565.940:751): arch=c000003e syscall=59 success=yes exit=0 a0=7f0fe447cbd8 a1=7fffb6ad34e0 a2=7fffb6ad3b68 a3=7fffb6ad36b0 items=2 ppid=1560 pid=1561 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemd-tty-ask" exe="/usr/bin/systemd-tty-ask-password-agent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078565.940:751): argc=2 a0="/usr/bin/systemd-tty-ask-password-agent" a1="--watch" +type=CWD msg=audit(1481078565.940:751): cwd="/home/some_user" +type=PATH msg=audit(1481078565.940:751): item=0 name="/usr/bin/systemd-tty-ask-password-agent" inode=11161 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_passwd_agent_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078565.940:751): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078565.940:752): arch=c000003e syscall=59 success=yes exit=0 a0=7f0fe4472bee a1=7fffb6ad3460 a2=7fffb6ad3b68 a3=7fffb6ad3640 items=2 ppid=1560 pid=1562 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078565.940:752): argc=4 a0="/usr/bin/pkttyagent" a1="--notify-fd" a2="5" a3="--fallback" +type=CWD msg=audit(1481078565.940:752): cwd="/home/some_user" +type=PATH msg=audit(1481078565.940:752): item=0 name="/usr/bin/pkttyagent" inode=11479 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078565.940:752): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078565.948:753): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7ffe4bae1fa0 a2=6e a3=7ffe4bae1d20 items=1 ppid=1560 pid=1562 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078565.948:753): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078565.948:753): cwd="/home/some_user" +type=PATH msg=audit(1481078565.948:753): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=USER_END msg=audit(1481078565.960:754): pid=1559 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481078565.960:755): pid=1559 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078569.392:756): arch=c000003e syscall=59 success=yes exit=0 a0=a302b0 a1=a37210 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1565 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078569.392:756): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078569.392:756): argc=5 a0="sudo" a1="sudo" a2="systemctl" a3="stop" a4="auditd.service" +type=CWD msg=audit(1481078569.392:756): cwd="/home/some_user" +type=PATH msg=audit(1481078569.392:756): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078569.392:756): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078569.392:757): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffdf3190210 a2=6e a3=40 items=1 ppid=1343 pid=1565 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.392:757): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.392:757): cwd="/home/some_user" +type=PATH msg=audit(1481078569.392:757): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.392:758): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffdf31903a0 a2=6e a3=40 items=1 ppid=1343 pid=1565 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.392:758): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.392:758): cwd="/home/some_user" +type=PATH msg=audit(1481078569.392:758): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.394:759): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffdf3190d30 a2=6e a3=22 items=1 ppid=1343 pid=1565 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.394:759): saddr=01002F7661722F72756E2F6E7363642F736F636B657400001000000000000000200F19F3FD7F0000E01019F3FD7F0000E0CFAD7E3A7F00002F00000000000000901319F3FD7F00001000000000000000401119F3FD7F0000B00D19F3FD7F00000003000000000000E0CFAD7E3A7F +type=CWD msg=audit(1481078569.394:759): cwd="/home/some_user" +type=PATH msg=audit(1481078569.394:759): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.394:760): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffdf3190ec0 a2=6e a3=22 items=1 ppid=1343 pid=1565 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.394:760): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000EDD7AD7E3A7F0000FED7AD7E3A7F000007D8AD7E3A7F000018D8AD7E3A7F000022D8AD7E3A7F000033D8AD7E3A7F00003DD8AD7E3A7F00004ED8AD7E3A7F000056D8AD7E3A7F00001800000030000000D01519F3FD7F +type=CWD msg=audit(1481078569.394:760): cwd="/home/some_user" +type=PATH msg=audit(1481078569.394:760): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.395:761): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=7f3a7c1d5740 a2=6e a3=6d items=1 ppid=1343 pid=1565 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.395:761): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.395:761): cwd="/home/some_user" +type=PATH msg=audit(1481078569.395:761): item=0 name="/dev/log" inode=6529 dev=00:05 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078569.395:762): pid=1565 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=7375646F2073797374656D63746C2073746F70206175646974642E73657276696365 terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078569.396:763): pid=1565 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078569.396:764): pid=1565 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078569.397:765): arch=c000003e syscall=59 success=yes exit=0 a0=7f3a7eae35d8 a1=7f3a7eae8d38 a2=7f3a7eaecb40 a3=6 items=2 ppid=1565 pid=1566 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078569.397:765): argc=4 a0="sudo" a1="systemctl" a2="stop" a3="auditd.service" +type=CWD msg=audit(1481078569.397:765): cwd="/home/some_user" +type=PATH msg=audit(1481078569.397:765): item=0 name="/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078569.397:765): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078569.398:766): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffed9c9eb10 a2=6e a3=40 items=1 ppid=1565 pid=1566 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.398:766): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.398:766): cwd="/home/some_user" +type=PATH msg=audit(1481078569.398:766): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.398:767): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffed9c9eca0 a2=6e a3=40 items=1 ppid=1565 pid=1566 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.398:767): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.398:767): cwd="/home/some_user" +type=PATH msg=audit(1481078569.398:767): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.400:768): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffed9c9f920 a2=6e a3=40 items=1 ppid=1565 pid=1566 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.400:768): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000D064DA2C297F000000FAC9D9FE7F0000F42C6836297F0000A000CAD9FE7F00001067DA2C297F0000F43DDB2C297F000000E8E265D57DBF3B482B6836297F0000050000000000000080F9FB2C297F0000F42C6836297F +type=CWD msg=audit(1481078569.400:768): cwd="/home/some_user" +type=PATH msg=audit(1481078569.400:768): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.400:769): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffed9c9fab0 a2=6e a3=ffffffffffffffff items=1 ppid=1565 pid=1566 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.400:769): saddr=01002F7661722F72756E2F6E7363642F736F636B6574000000000000297F0000000000000000000000000000297F0000000000000000000000000000000000005E96931C000000008BAB9B34297F0000FFFFFFFF0000000040FBC9D9FE7F0000E8FAD933297F0000E8BFDA33297F +type=CWD msg=audit(1481078569.400:769): cwd="/home/some_user" +type=PATH msg=audit(1481078569.400:769): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078569.401:770): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=7f293415a740 a2=6e a3=65 items=1 ppid=1565 pid=1566 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.401:770): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.401:770): cwd="/home/some_user" +type=PATH msg=audit(1481078569.401:770): item=0 name="/dev/log" inode=6529 dev=00:05 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078569.401:771): pid=1566 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=73797374656D63746C2073746F70206175646974642E73657276696365 terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078569.401:772): pid=1566 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078569.401:773): pid=1566 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078569.402:774): arch=c000003e syscall=59 success=yes exit=0 a0=7f293667d488 a1=7f2936682be8 a2=7f2936686880 a3=6 items=2 ppid=1566 pid=1567 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078569.402:774): argc=3 a0="systemctl" a1="stop" a2="auditd.service" +type=CWD msg=audit(1481078569.402:774): cwd="/home/some_user" +type=PATH msg=audit(1481078569.402:774): item=0 name="/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078569.402:774): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078569.403:775): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7feab5a24118 a2=16 a3=7ffd87294b00 items=1 ppid=1566 pid=1567 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.403:775): saddr=01002F72756E2F73797374656D642F70726976617465 +type=CWD msg=audit(1481078569.403:775): cwd="/home/some_user" +type=PATH msg=audit(1481078569.403:775): item=0 name="/run/systemd/private" inode=10228 dev=00:13 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078569.404:776): arch=c000003e syscall=59 success=yes exit=0 a0=7feab407dbd8 a1=7ffd87294a60 a2=7ffd872950e8 a3=7ffd87294c30 items=2 ppid=1567 pid=1568 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemd-tty-ask" exe="/usr/bin/systemd-tty-ask-password-agent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078569.404:776): argc=2 a0="/usr/bin/systemd-tty-ask-password-agent" a1="--watch" +type=CWD msg=audit(1481078569.404:776): cwd="/home/some_user" +type=PATH msg=audit(1481078569.404:776): item=0 name="/usr/bin/systemd-tty-ask-password-agent" inode=11161 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_passwd_agent_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078569.404:776): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078569.405:777): arch=c000003e syscall=59 success=yes exit=0 a0=7feab4073bee a1=7ffd872949e0 a2=7ffd872950e8 a3=7ffd87294bc0 items=2 ppid=1567 pid=1569 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078569.405:777): argc=4 a0="/usr/bin/pkttyagent" a1="--notify-fd" a2="5" a3="--fallback" +type=CWD msg=audit(1481078569.405:777): cwd="/home/some_user" +type=PATH msg=audit(1481078569.405:777): item=0 name="/usr/bin/pkttyagent" inode=11479 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078569.405:777): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078569.407:778): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7ffc2bf2d1c0 a2=6e a3=7ffc2bf2cf40 items=1 ppid=1567 pid=1569 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078569.407:778): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078569.407:778): cwd="/home/some_user" +type=PATH msg=audit(1481078569.407:778): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=USER_END msg=audit(1481078569.413:779): pid=1566 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481078569.413:780): pid=1566 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_END msg=audit(1481078569.414:781): pid=1565 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481078569.414:782): pid=1565 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078575.368:783): arch=c000003e syscall=59 success=yes exit=0 a0=a302b0 a1=a35de0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1572 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078575.368:783): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078575.368:783): argc=4 a0="sudo" a1="systemctl" a2="stop" a3="auditd.service" +type=CWD msg=audit(1481078575.368:783): cwd="/home/some_user" +type=PATH msg=audit(1481078575.368:783): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078575.368:783): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078575.368:784): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffdc4c2a690 a2=6e a3=40 items=1 ppid=1343 pid=1572 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.368:784): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078575.368:784): cwd="/home/some_user" +type=PATH msg=audit(1481078575.368:784): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078575.368:785): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffdc4c2a820 a2=6e a3=40 items=1 ppid=1343 pid=1572 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.368:785): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078575.368:785): cwd="/home/some_user" +type=PATH msg=audit(1481078575.368:785): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078575.370:786): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffdc4c2b1b0 a2=6e a3=22 items=1 ppid=1343 pid=1572 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.370:786): saddr=01002F7661722F72756E2F6E7363642F736F636B657400001000000000000000A0B3C2C4FD7F000060B5C2C4FD7F0000E09FFE27197F00002F0000000000000010B8C2C4FD7F00001000000000000000C0B5C2C4FD7F000030B2C2C4FD7F00000003000000000000E09FFE27197F +type=CWD msg=audit(1481078575.370:786): cwd="/home/some_user" +type=PATH msg=audit(1481078575.370:786): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078575.370:787): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffdc4c2b340 a2=6e a3=22 items=1 ppid=1343 pid=1572 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.370:787): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000EDA7FE27197F0000FEA7FE27197F000007A8FE27197F000018A8FE27197F000022A8FE27197F000033A8FE27197F00003DA8FE27197F00004EA8FE27197F000056A8FE27197F0000180000003000000050BAC2C4FD7F +type=CWD msg=audit(1481078575.370:787): cwd="/home/some_user" +type=PATH msg=audit(1481078575.370:787): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078575.371:788): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=7f19257c9740 a2=6e a3=68 items=1 ppid=1343 pid=1572 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.371:788): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078575.371:788): cwd="/home/some_user" +type=PATH msg=audit(1481078575.371:788): item=0 name="/dev/log" inode=6529 dev=00:05 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078575.372:789): pid=1572 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=73797374656D63746C2073746F70206175646974642E73657276696365 terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078575.372:790): pid=1572 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078575.372:791): pid=1572 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078575.373:792): arch=c000003e syscall=59 success=yes exit=0 a0=7f1927ff05d8 a1=7f1927ff5d38 a2=7f1927ff9ad0 a3=6 items=2 ppid=1572 pid=1573 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078575.373:792): argc=3 a0="systemctl" a1="stop" a2="auditd.service" +type=CWD msg=audit(1481078575.373:792): cwd="/home/some_user" +type=PATH msg=audit(1481078575.373:792): item=0 name="/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078575.373:792): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078575.374:793): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7f8e5463b118 a2=16 a3=7ffe8d0b1a90 items=1 ppid=1572 pid=1573 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.374:793): saddr=01002F72756E2F73797374656D642F70726976617465 +type=CWD msg=audit(1481078575.374:793): cwd="/home/some_user" +type=PATH msg=audit(1481078575.374:793): item=0 name="/run/systemd/private" inode=10228 dev=00:13 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078575.375:794): arch=c000003e syscall=59 success=yes exit=0 a0=7f8e52829bd8 a1=7ffe8d0b19f0 a2=7ffe8d0b2078 a3=7ffe8d0b1bc0 items=2 ppid=1573 pid=1574 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemd-tty-ask" exe="/usr/bin/systemd-tty-ask-password-agent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078575.375:794): argc=2 a0="/usr/bin/systemd-tty-ask-password-agent" a1="--watch" +type=CWD msg=audit(1481078575.375:794): cwd="/home/some_user" +type=PATH msg=audit(1481078575.375:794): item=0 name="/usr/bin/systemd-tty-ask-password-agent" inode=11161 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_passwd_agent_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078575.375:794): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078575.376:795): arch=c000003e syscall=59 success=yes exit=0 a0=7f8e5281fbee a1=7ffe8d0b1970 a2=7ffe8d0b2078 a3=7ffe8d0b1b50 items=2 ppid=1573 pid=1575 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078575.376:795): argc=4 a0="/usr/bin/pkttyagent" a1="--notify-fd" a2="5" a3="--fallback" +type=CWD msg=audit(1481078575.376:795): cwd="/home/some_user" +type=PATH msg=audit(1481078575.376:795): item=0 name="/usr/bin/pkttyagent" inode=11479 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078575.376:795): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078575.378:796): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7fff31c7c520 a2=6e a3=7fff31c7c2a0 items=1 ppid=1573 pid=1575 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078575.378:796): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078575.378:796): cwd="/home/some_user" +type=PATH msg=audit(1481078575.378:796): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=USER_END msg=audit(1481078575.384:797): pid=1572 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481078575.384:798): pid=1572 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078582.640:799): arch=c000003e syscall=59 success=yes exit=0 a0=a30aa0 a1=a377f0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1578 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078582.640:799): argc=2 a0="systemctl" a1="list" +type=CWD msg=audit(1481078582.640:799): cwd="/home/some_user" +type=PATH msg=audit(1481078582.640:799): item=0 name="/usr/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078582.640:799): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078582.640:800): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7f73106aa118 a2=21 a3=7fffb6b46b20 items=1 ppid=1343 pid=1578 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078582.640:800): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 +type=CWD msg=audit(1481078582.640:800): cwd="/home/some_user" +type=PATH msg=audit(1481078582.640:800): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078588.360:801): arch=c000003e syscall=59 success=yes exit=0 a0=a2db40 a1=a341f0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1579 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078588.360:801): argc=2 a0="systemctl" a1="-l" +type=CWD msg=audit(1481078588.360:801): cwd="/home/some_user" +type=PATH msg=audit(1481078588.360:801): item=0 name="/usr/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078588.360:801): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078588.360:802): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7f40d16ea118 a2=21 a3=7ffc6fa17270 items=1 ppid=1343 pid=1579 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078588.360:802): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 +type=CWD msg=audit(1481078588.360:802): cwd="/home/some_user" +type=PATH msg=audit(1481078588.360:802): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078588.365:803): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa15296 a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:803): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:803): item=0 name="/usr/local/bin/pager" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.365:804): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa1529c a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:804): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:804): item=0 name="/usr/bin/pager" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.365:805): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa15295 a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:805): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:805): item=0 name="/usr/local/sbin/pager" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.365:806): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa1529b a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:806): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:806): item=0 name="/usr/sbin/pager" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.365:807): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa15288 a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:807): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:807): item=0 name="/home/some_user/.local/bin/pager" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.365:808): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa1528f a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:808): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:808): item=0 name="/home/some_user/bin/pager" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.365:809): arch=c000003e syscall=59 success=no exit=-2 a0=7ffc6fa15296 a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=1 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=CWD msg=audit(1481078588.365:809): cwd="/home/some_user" +type=PATH msg=audit(1481078588.365:809): item=0 name="/usr/local/bin/less" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078588.366:810): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc6fa1529c a1=7ffc6fa15380 a2=7f40d16ebe70 a3=0 items=2 ppid=1579 pid=1580 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="less" exe="/usr/bin/less" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078588.366:810): argc=1 a0="less" +type=CWD msg=audit(1481078588.366:810): cwd="/home/some_user" +type=PATH msg=audit(1481078588.366:810): item=0 name="/usr/bin/less" inode=345679 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078588.366:810): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078597.785:811): arch=c000003e syscall=59 success=yes exit=0 a0=a2eea0 a1=a30040 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1581 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078597.785:811): argc=3 a0="systemctl" a1="-l" a2="audit" +type=CWD msg=audit(1481078597.785:811): cwd="/home/some_user" +type=PATH msg=audit(1481078597.785:811): item=0 name="/usr/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078597.785:811): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078597.786:812): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7f1ddecf2118 a2=21 a3=7ffc3f53d430 items=1 ppid=1343 pid=1581 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078597.786:812): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 +type=CWD msg=audit(1481078597.786:812): cwd="/home/some_user" +type=PATH msg=audit(1481078597.786:812): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078602.208:813): arch=c000003e syscall=59 success=yes exit=0 a0=a377f0 a1=a30110 a2=a34fd0 a3=7ffdde1f23c0 items=2 ppid=1343 pid=1583 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078602.208:813): argc=3 a0="grep" a1="--color=auto" a2="audit" +type=CWD msg=audit(1481078602.208:813): cwd="/home/some_user" +type=PATH msg=audit(1481078602.208:813): item=0 name="/usr/bin/grep" inode=2512 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078602.208:813): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078602.209:814): arch=c000003e syscall=59 success=yes exit=0 a0=a2ee00 a1=a377d0 a2=a34fd0 a3=7ffdde1f23c0 items=2 ppid=1343 pid=1582 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078602.209:814): argc=2 a0="systemctl" a1="-l" +type=CWD msg=audit(1481078602.209:814): cwd="/home/some_user" +type=PATH msg=audit(1481078602.209:814): item=0 name="/usr/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078602.209:814): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078602.210:815): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7f35a8e1d118 a2=21 a3=7ffeecb75320 items=1 ppid=1343 pid=1582 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078602.210:815): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 +type=CWD msg=audit(1481078602.210:815): cwd="/home/some_user" +type=PATH msg=audit(1481078602.210:815): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078602.998:816): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1e98040 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1584 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078602.998:816): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078602.998:816): cwd="/" +type=PATH msg=audit(1481078602.998:816): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078602.998:816): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078603.002:817): arch=c000003e syscall=59 success=yes exit=0 a0=1e79ef0 a1=1e98040 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078603.002:817): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078603.002:817): cwd="/" +type=PATH msg=audit(1481078603.002:817): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078603.002:817): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078603.006:818): arch=c000003e syscall=59 success=yes exit=0 a0=1e95970 a1=1e215c0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078603.006:818): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078603.006:818): cwd="/" +type=PATH msg=audit(1481078603.006:818): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078603.006:818): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078603.009:819): arch=c000003e syscall=59 success=yes exit=0 a0=1e215c0 a1=1ea90d0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078603.009:819): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078603.009:819): cwd="/" +type=PATH msg=audit(1481078603.009:819): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078603.009:819): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078603.012:820): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffeb9b2b770 a2=10 a3=fe items=0 ppid=1 pid=1222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_accounts" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078603.012:820): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078612.837:821): arch=c000003e syscall=59 success=no exit=-2 a0=13934c0 a1=12e0e10 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078612.837:821): cwd="/" +type=PATH msg=audit(1481078612.837:821): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078612.837:822): arch=c000003e syscall=59 success=no exit=-2 a0=13934c0 a1=12e0e10 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078612.837:822): cwd="/" +type=PATH msg=audit(1481078612.837:822): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078612.837:823): arch=c000003e syscall=59 success=yes exit=0 a0=13934c0 a1=12e0e10 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1588 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078612.837:823): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078612.837:823): cwd="/" +type=PATH msg=audit(1481078612.837:823): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078612.837:823): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078612.839:824): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc08f67860 a2=10 a3=fe items=0 ppid=1 pid=1220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078612.839:824): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078612.976:825): arch=c000003e syscall=42 success=yes exit=0 a0=15 a1=7ffc4d9dc980 a2=6e a3=ea60 items=1 ppid=1 pid=1276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078612.976:825): saddr=01007075626C69632F7069636B75700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078612.976:825): cwd="/var/spool/postfix" +type=PATH msg=audit(1481078612.976:825): item=0 name="public/pickup" inode=34151428 dev=08:01 mode=0140666 ouid=89 ogid=89 rdev=00:00 obj=system_u:object_r:postfix_public_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078613.359:826): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc6ea4e240 a2=10 a3=fe items=0 ppid=1 pid=1224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_clock_sk" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078613.359:826): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078619.593:827): arch=c000003e syscall=59 success=yes exit=0 a0=a3e1a0 a1=a35ce0 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1589 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078619.593:827): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078619.593:827): argc=4 a0="sudo" a1="systemctl" a2="stop" a3="auditd.service" +type=CWD msg=audit(1481078619.593:827): cwd="/home/some_user" +type=PATH msg=audit(1481078619.593:827): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078619.593:827): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078619.594:828): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffbda957a0 a2=6e a3=40 items=1 ppid=1343 pid=1589 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.594:828): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078619.594:828): cwd="/home/some_user" +type=PATH msg=audit(1481078619.594:828): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078619.594:829): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fffbda95930 a2=6e a3=40 items=1 ppid=1343 pid=1589 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.594:829): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078619.594:829): cwd="/home/some_user" +type=PATH msg=audit(1481078619.594:829): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078619.596:830): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7fffbda962c0 a2=6e a3=22 items=1 ppid=1343 pid=1589 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.596:830): saddr=01002F7661722F72756E2F6E7363642F736F636B657400001000000000000000B064A9BDFF7F00007066A9BDFF7F0000E05FB2C6507F00002F000000000000002069A9BDFF7F00001000000000000000D066A9BDFF7F00004063A9BDFF7F00000003000000000000E05FB2C6507F +type=CWD msg=audit(1481078619.596:830): cwd="/home/some_user" +type=PATH msg=audit(1481078619.596:830): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078619.596:831): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7fffbda96450 a2=6e a3=22 items=1 ppid=1343 pid=1589 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.596:831): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000ED67B2C6507F0000FE67B2C6507F00000768B2C6507F00001868B2C6507F00002268B2C6507F00003368B2C6507F00003D68B2C6507F00004E68B2C6507F00005668B2C6507F00001800000030000000606BA9BDFF7F +type=CWD msg=audit(1481078619.596:831): cwd="/home/some_user" +type=PATH msg=audit(1481078619.596:831): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078619.597:832): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=7f50c4ffc740 a2=6e a3=68 items=1 ppid=1343 pid=1589 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.597:832): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078619.597:832): cwd="/home/some_user" +type=PATH msg=audit(1481078619.597:832): item=0 name="/dev/log" inode=6529 dev=00:05 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078619.597:833): pid=1589 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=73797374656D63746C2073746F70206175646974642E73657276696365 terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078619.597:834): pid=1589 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078619.597:835): pid=1589 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078619.598:836): arch=c000003e syscall=59 success=yes exit=0 a0=7f50c6b2c5d8 a1=7f50c6b31d38 a2=7f50c6b35ad0 a3=6 items=2 ppid=1589 pid=1590 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078619.598:836): argc=3 a0="systemctl" a1="stop" a2="auditd.service" +type=CWD msg=audit(1481078619.598:836): cwd="/home/some_user" +type=PATH msg=audit(1481078619.598:836): item=0 name="/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078619.598:836): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078619.599:837): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fac5f739118 a2=16 a3=7ffde628df80 items=1 ppid=1589 pid=1590 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.599:837): saddr=01002F72756E2F73797374656D642F70726976617465 +type=CWD msg=audit(1481078619.599:837): cwd="/home/some_user" +type=PATH msg=audit(1481078619.599:837): item=0 name="/run/systemd/private" inode=10228 dev=00:13 mode=0140777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:init_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078619.600:838): arch=c000003e syscall=59 success=yes exit=0 a0=7fac5f30dbd8 a1=7ffde628dee0 a2=7ffde628e568 a3=7ffde628e0b0 items=2 ppid=1590 pid=1591 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="systemd-tty-ask" exe="/usr/bin/systemd-tty-ask-password-agent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078619.600:838): argc=2 a0="/usr/bin/systemd-tty-ask-password-agent" a1="--watch" +type=CWD msg=audit(1481078619.600:838): cwd="/home/some_user" +type=PATH msg=audit(1481078619.600:838): item=0 name="/usr/bin/systemd-tty-ask-password-agent" inode=11161 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_passwd_agent_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078619.600:838): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078619.601:839): arch=c000003e syscall=59 success=yes exit=0 a0=7fac5f303bee a1=7ffde628de60 a2=7ffde628e568 a3=7ffde628e040 items=2 ppid=1590 pid=1592 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078619.601:839): argc=4 a0="/usr/bin/pkttyagent" a1="--notify-fd" a2="5" a3="--fallback" +type=CWD msg=audit(1481078619.601:839): cwd="/home/some_user" +type=PATH msg=audit(1481078619.601:839): item=0 name="/usr/bin/pkttyagent" inode=11479 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078619.601:839): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078619.603:840): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7fff1b79e450 a2=6e a3=7fff1b79e1d0 items=1 ppid=1590 pid=1592 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078619.603:840): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078619.603:840): cwd="/home/some_user" +type=PATH msg=audit(1481078619.603:840): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=USER_END msg=audit(1481078619.609:841): pid=1589 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=CRED_DISP msg=audit(1481078619.610:842): pid=1589 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078672.853:843): arch=c000003e syscall=59 success=no exit=-2 a0=1255f40 a1=13cd530 a2=7ffc08f6aa80 a3=7ffc08f687a0 items=1 ppid=1220 pid=1595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078672.853:843): cwd="/" +type=PATH msg=audit(1481078672.853:843): item=0 name="/usr/local/sbin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078672.853:844): arch=c000003e syscall=59 success=no exit=-2 a0=1255f40 a1=13cd530 a2=7ffc08f6aa80 a3=0 items=1 ppid=1220 pid=1595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=CWD msg=audit(1481078672.853:844): cwd="/" +type=PATH msg=audit(1481078672.853:844): item=0 name="/usr/local/bin/ip" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078672.853:845): arch=c000003e syscall=59 success=yes exit=0 a0=1255f40 a1=13cd530 a2=7ffc08f6aa80 a3=0 items=2 ppid=1220 pid=1595 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip" exe="/usr/sbin/ip" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078672.853:845): argc=13 a0="ip" a1="route" a2="ls" a3="table" a4="local" a5="type" a6="local" a7="scope" a8="host" a9="dev" a10="eth0" a11="proto" a12="66" +type=CWD msg=audit(1481078672.853:845): cwd="/" +type=PATH msg=audit(1481078672.853:845): item=0 name="/usr/sbin/ip" inode=16779846 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ifconfig_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078672.853:845): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078672.855:846): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffc08f67860 a2=10 a3=fe items=0 ppid=1 pid=1220 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_ip_forwa" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078672.855:846): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078672.986:847): arch=c000003e syscall=42 success=yes exit=0 a0=15 a1=7ffc4d9dc980 a2=6e a3=ea60 items=1 ppid=1 pid=1276 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078672.986:847): saddr=01007075626C69632F7069636B75700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078672.986:847): cwd="/var/spool/postfix" +type=PATH msg=audit(1481078672.986:847): item=0 name="public/pickup" inode=34151428 dev=08:01 mode=0140666 ouid=89 ogid=89 rdev=00:00 obj=system_u:object_r:postfix_public_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078673.373:848): arch=c000003e syscall=42 success=no exit=-115 a0=5 a1=7ffc6ea4e240 a2=10 a3=fe items=0 ppid=1 pid=1224 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_clock_sk" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078673.373:848): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078692.027:849): arch=c000003e syscall=59 success=yes exit=0 a0=1e98040 a1=1ce5cc0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078692.027:849): argc=2 a0="/sbin/restorecon" a1="/home/some_user" +type=CWD msg=audit(1481078692.027:849): cwd="/" +type=PATH msg=audit(1481078692.027:849): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078692.027:849): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078692.031:850): arch=c000003e syscall=59 success=yes exit=0 a0=1e98040 a1=1ce5cc0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1597 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078692.031:850): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh" +type=CWD msg=audit(1481078692.031:850): cwd="/" +type=PATH msg=audit(1481078692.031:850): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078692.031:850): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078692.035:851): arch=c000003e syscall=59 success=yes exit=0 a0=1e95970 a1=1e9ffb0 a2=7ffeb9b2e990 a3=7ffeb9b2c1f0 items=2 ppid=1222 pid=1598 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078692.035:851): argc=2 a0="/sbin/restorecon" a1="/home/some_user/.ssh/authorized_keys" +type=CWD msg=audit(1481078692.035:851): cwd="/" +type=PATH msg=audit(1481078692.035:851): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078692.035:851): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078692.038:852): arch=c000003e syscall=59 success=yes exit=0 a0=1e9ffb0 a1=1e215c0 a2=7ffeb9b2e990 a3=7ffeb9b2c4b0 items=2 ppid=1222 pid=1599 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="restorecon" exe="/usr/sbin/setfiles" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=EXECVE msg=audit(1481078692.038:852): argc=2 a0="/sbin/restorecon" a1="/var/lib/google/google_users" +type=CWD msg=audit(1481078692.038:852): cwd="/" +type=PATH msg=audit(1481078692.038:852): item=0 name="/sbin/restorecon" inode=16782036 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:setfiles_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078692.038:852): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078692.042:853): arch=c000003e syscall=42 success=no exit=-115 a0=6 a1=7ffeb9b2b770 a2=10 a3=fe items=0 ppid=1 pid=1222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="google_accounts" exe="/usr/bin/python2.7" subj=system_u:system_r:unconfined_service_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078692.042:853): saddr=02000050A9FEA9FE0000000000000000 +type=SYSCALL msg=audit(1481078693.422:854): arch=c000003e syscall=59 success=yes exit=0 a0=a30aa0 a1=a340e0 a2=a34fd0 a3=7ffdde1f2620 items=3 ppid=1343 pid=1600 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="service" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.422:854): argc=4 a0="/bin/sh" a1="/usr/sbin/service" a2="auditd" a3="stop" +type=CWD msg=audit(1481078693.422:854): cwd="/home/some_user" +type=PATH msg=audit(1481078693.422:854): item=0 name="/usr/sbin/service" inode=16784574 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.422:854): item=1 name="/bin/sh" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.422:854): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.430:855): arch=c000003e syscall=59 success=yes exit=0 a0=26f61a0 a1=26f5450 a2=26eeb80 a3=7ffe13340100 items=2 ppid=1601 pid=1602 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="mountpoint" exe="/usr/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.430:855): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" +type=CWD msg=audit(1481078693.430:855): cwd="/home/some_user" +type=PATH msg=audit(1481078693.430:855): item=0 name="/bin/mountpoint" inode=11077 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.430:855): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.431:856): arch=c000003e syscall=59 success=yes exit=0 a0=26f57c0 a1=26f5420 a2=26eeb80 a3=7ffe13340100 items=2 ppid=1601 pid=1603 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="mountpoint" exe="/usr/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.431:856): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" +type=CWD msg=audit(1481078693.431:856): cwd="/home/some_user" +type=PATH msg=audit(1481078693.431:856): item=0 name="/bin/mountpoint" inode=11077 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.431:856): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.433:857): arch=c000003e syscall=59 success=yes exit=0 a0=26f5e30 a1=26ee660 a2=26fa130 a3=7ffe1333fb80 items=2 ppid=1604 pid=1605 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="consoletype" exe="/usr/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.433:857): argc=1 a0="/sbin/consoletype" +type=CWD msg=audit(1481078693.433:857): cwd="/home/some_user" +type=PATH msg=audit(1481078693.433:857): item=0 name="/sbin/consoletype" inode=16784566 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.433:857): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.437:858): arch=c000003e syscall=59 success=yes exit=0 a0=271c010 a1=271c750 a2=26fa130 a3=7ffe13340230 items=2 ppid=1600 pid=1606 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="basename" exe="/usr/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.437:858): argc=2 a0="basename" a1="/usr/sbin/service" +type=CWD msg=audit(1481078693.437:858): cwd="/home/some_user" +type=PATH msg=audit(1481078693.437:858): item=0 name="/bin/basename" inode=3839 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.437:858): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.438:859): arch=c000003e syscall=59 success=yes exit=0 a0=271c410 a1=271cc00 a2=26fa130 a3=7ffe13340230 items=2 ppid=1600 pid=1607 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="basename" exe="/usr/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.438:859): argc=2 a0="basename" a1="/usr/sbin/service" +type=CWD msg=audit(1481078693.438:859): cwd="/home/some_user" +type=PATH msg=audit(1481078693.438:859): item=0 name="/bin/basename" inode=3839 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.438:859): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.440:860): arch=c000003e syscall=59 success=yes exit=0 a0=271d2a0 a1=271bca0 a2=26fa130 a3=7ffe1333fff0 items=3 ppid=1608 pid=1610 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="egrep" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.440:860): argc=4 a0="/bin/sh" a1="/bin/egrep" a2="-qw" a3="start|stop|restart|try-restart|reload|force-reload|status|condrestart" +type=CWD msg=audit(1481078693.440:860): cwd="/" +type=PATH msg=audit(1481078693.440:860): item=0 name="/bin/egrep" inode=8006 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.440:860): item=1 name="/bin/sh" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.440:860): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.441:861): arch=c000003e syscall=59 success=yes exit=0 a0=1490100 a1=148a460 a2=148db00 a3=7ffe92eb47e0 items=2 ppid=1608 pid=1610 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="grep" exe="/usr/bin/grep" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.441:861): argc=4 a0="grep" a1="-E" a2="-qw" a3="start|stop|restart|try-restart|reload|force-reload|status|condrestart" +type=CWD msg=audit(1481078693.441:861): cwd="/" +type=PATH msg=audit(1481078693.441:861): item=0 name="/bin/grep" inode=2512 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.441:861): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.442:862): arch=c000003e syscall=59 success=yes exit=0 a0=26f4e30 a1=271cb50 a2=26f12f0 a3=7ffe13340570 items=2 ppid=1343 pid=1600 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.442:862): argc=3 a0="/bin/systemctl" a1="stop" a2="auditd.service" +type=CWD msg=audit(1481078693.442:862): cwd="/" +type=PATH msg=audit(1481078693.442:862): item=0 name="/bin/systemctl" inode=5203 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_systemctl_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.442:862): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.443:863): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7ff47b483118 a2=21 a3=7ffc86257c80 items=1 ppid=1343 pid=1600 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemctl" exe="/usr/bin/systemctl" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.443:863): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B6574 +type=CWD msg=audit(1481078693.443:863): cwd="/" +type=PATH msg=audit(1481078693.443:863): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.443:864): arch=c000003e syscall=59 success=yes exit=0 a0=7ff479545bd8 a1=7ffc86257c20 a2=7ffc862582a8 a3=7ffc86257df0 items=2 ppid=1600 pid=1611 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="systemd-tty-ask" exe="/usr/bin/systemd-tty-ask-password-agent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.443:864): argc=2 a0="/usr/bin/systemd-tty-ask-password-agent" a1="--watch" +type=CWD msg=audit(1481078693.443:864): cwd="/" +type=PATH msg=audit(1481078693.443:864): item=0 name="/usr/bin/systemd-tty-ask-password-agent" inode=11161 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_passwd_agent_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.443:864): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.444:865): arch=c000003e syscall=59 success=yes exit=0 a0=7ff47953bbee a1=7ffc86257ba0 a2=7ffc862582a8 a3=7ffc86257d80 items=2 ppid=1600 pid=1612 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.444:865): argc=4 a0="/usr/bin/pkttyagent" a1="--notify-fd" a2="5" a3="--fallback" +type=CWD msg=audit(1481078693.444:865): cwd="/" +type=PATH msg=audit(1481078693.444:865): item=0 name="/usr/bin/pkttyagent" inode=11479 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.444:865): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.447:866): arch=c000003e syscall=42 success=yes exit=0 a0=4 a1=7ffd6d46d650 a2=6e a3=7ffd6d46d3d0 items=1 ppid=1600 pid=1612 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.447:866): saddr=01002F7661722F72756E2F646275732F73797374656D5F6275735F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078693.447:866): cwd="/" +type=PATH msg=audit(1481078693.447:866): item=0 name="/var/run/dbus/system_bus_socket" inode=11914 dev=00:13 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:system_dbusd_var_run_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.459:867): arch=c000003e syscall=59 success=yes exit=0 a0=7f618eb3edd0 a1=7f618eb85cd0 a2=7ffe19235950 a3=7ffe19234560 items=2 ppid=547 pid=1615 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-check-auth" exe="/usr/bin/pkla-check-authorization" subj=system_u:system_r:policykit_auth_t:s0 key=(null) +type=EXECVE msg=audit(1481078693.459:867): argc=5 a0="/usr/bin/pkla-check-authorization" a1="some_user" a2="false" a3="true" a4="org.freedesktop.systemd1.manage-units" +type=CWD msg=audit(1481078693.459:867): cwd="/" +type=PATH msg=audit(1481078693.459:867): item=0 name="/usr/bin/pkla-check-authorization" inode=11484 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:policykit_auth_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.459:867): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.472:868): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffd2df48a60 a2=6e a3=7ffd2df48c30 items=1 ppid=547 pid=1615 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-check-auth" exe="/usr/bin/pkla-check-authorization" subj=system_u:system_r:policykit_auth_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078693.472:868): saddr=01002F7661722F72756E2F6E7363642F736F636B6574000054A47F31747F0000000000000000000018CD6F30747F000006000000000000001B00000000000000BB95931C0000000089A37F31747F0000000000000000000070A3CD30747F000004000000000000001B0000000000 +type=CWD msg=audit(1481078693.472:868): cwd="/" +type=PATH msg=audit(1481078693.472:868): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.472:869): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffd2df48bf0 a2=6e a3=7ffd2df48c30 items=1 ppid=547 pid=1615 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-check-auth" exe="/usr/bin/pkla-check-authorization" subj=system_u:system_r:policykit_auth_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078693.472:869): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000F82B7030747F0000408DF42DFD7F0000308DF42DFD7F00003F000000747F00002C000000747F0000000000000000000050BB9D31747F000000A0A031747F000034BFCE30747F0000089D7030747F000038A8CD30747F +type=CWD msg=audit(1481078693.472:869): cwd="/" +type=PATH msg=audit(1481078693.472:869): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.472:870): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffd2df48820 a2=6e a3=50 items=1 ppid=547 pid=1615 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-check-auth" exe="/usr/bin/pkla-check-authorization" subj=system_u:system_r:policykit_auth_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078693.472:870): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000D35C2731747F0000704ECE30747F0000F8532631747F0000000000000500000089A37F31747F00000000000000000000E0EE0031747F000003000000000000001B00000000000000338D2C9E000000008BAB7F31747F +type=CWD msg=audit(1481078693.472:870): cwd="/" +type=PATH msg=audit(1481078693.472:870): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.473:871): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7ffd2df489b0 a2=6e a3=50 items=1 ppid=547 pid=1615 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-check-auth" exe="/usr/bin/pkla-check-authorization" subj=system_u:system_r:policykit_auth_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078693.473:871): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000000000000000000000000000000000000000000000000000003DB632747F00000A000000000000000000000000000000C5187730747F0000003DB632747F000077F97630747F00008036AB30747F0000C0097730747F +type=CWD msg=audit(1481078693.473:871): cwd="/" +type=PATH msg=audit(1481078693.473:871): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.488:872): arch=c000003e syscall=59 success=yes exit=0 a0=7f618eaf1f90 a1=7f618eb2cdd0 a2=7ffe19235950 a3=7ffe19234660 items=2 ppid=547 pid=1617 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-admin-iden" exe="/usr/bin/pkla-admin-identities" subj=system_u:system_r:policykit_t:s0 key=(null) +type=EXECVE msg=audit(1481078693.488:872): argc=1 a0="/usr/bin/pkla-admin-identities" +type=CWD msg=audit(1481078693.488:872): cwd="/" +type=PATH msg=audit(1481078693.488:872): item=0 name="/usr/bin/pkla-admin-identities" inode=11483 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.488:872): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.491:873): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffdf74b3db0 a2=6e a3=7ffdf74b3f80 items=1 ppid=547 pid=1617 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-admin-iden" exe="/usr/bin/pkla-admin-identities" subj=system_u:system_r:policykit_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078693.491:873): saddr=01002F7661722F72756E2F6E7363642F736F636B657400008983B330BE7F0000000000000000000070830130BE7F000004000000000000001B00000000000000D128B7ED000000008B8BB330BE7F00003B00000000000000403E4BF7FD7F0000447F0130BE7F000080150230BE7F +type=CWD msg=audit(1481078693.491:873): cwd="/" +type=PATH msg=audit(1481078693.491:873): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.491:874): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffdf74b3f40 a2=6e a3=7ffdf74b3f80 items=1 ppid=547 pid=1617 auid=4294967295 uid=999 gid=998 euid=999 suid=999 fsuid=999 egid=998 sgid=998 fsgid=998 tty=(none) ses=4294967295 comm="pkla-admin-iden" exe="/usr/bin/pkla-admin-identities" subj=system_u:system_r:policykit_t:s0 key=(null) +type=SOCKADDR msg=audit(1481078693.491:874): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000F80BA42FBE7F000090404BF7FD7F000080404BF7FD7F00003F000000000000001B000000000000000000000000000000389BD130BE7F00000080D430BE7F0000349F0230BE7F0000087DA42FBE7F000038880130BE7F +type=CWD msg=audit(1481078693.491:874): cwd="/" +type=PATH msg=audit(1481078693.491:874): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.504:875): arch=c000003e syscall=42 success=no exit=-2 a0=5 a1=7f4dc96cdde0 a2=6e a3=7f4dbc002cf0 items=1 ppid=1600 pid=1614 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.504:875): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078693.504:875): cwd="/" +type=PATH msg=audit(1481078693.504:875): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.504:876): arch=c000003e syscall=42 success=no exit=-2 a0=5 a1=7f4dc96cdf70 a2=6e a3=7f4dbc002cf0 items=1 ppid=1600 pid=1614 auid=1000 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="pkttyagent" exe="/usr/bin/pkttyagent" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.504:876): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078693.504:876): cwd="/" +type=PATH msg=audit(1481078693.504:876): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.504:877): arch=c000003e syscall=59 success=yes exit=0 a0=7f4dcd6e5270 a1=7f4dc96cea50 a2=7ffd6d46dea0 a3=7f4dc96ce520 items=2 ppid=1612 pid=1619 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="polkit-agent-he" exe="/usr/lib/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078693.504:877): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078693.504:877): argc=3 a0="/usr/lib/polkit-1/polkit-agent-helper-1" a1="root" a2="cookie0" +type=CWD msg=audit(1481078693.504:877): cwd="/" +type=PATH msg=audit(1481078693.504:877): item=0 name="/usr/lib/polkit-1/polkit-agent-helper-1" inode=33602468 dev=08:01 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:policykit_auth_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.504:877): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.511:878): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffc4c3bafd0 a2=6e a3=7ffc4c3bb190 items=1 ppid=1612 pid=1619 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="polkit-agent-he" exe="/usr/lib/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.511:878): saddr=01002F7661722F72756E2F6E7363642F736F636B6574000010EE687BD77F000050B03B4CFC7F000000000000FC7F000000000000D77F000040B03B4CFC7F0000000000000000000001000000000000004F191179D77F00003CB03B4CFC7F00000000000000000000000000000000 +type=CWD msg=audit(1481078693.511:878): cwd="/" +type=PATH msg=audit(1481078693.511:878): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.511:879): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffc4c3bb160 a2=6e a3=7ffc4c3bb190 items=1 ppid=1612 pid=1619 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="polkit-agent-he" exe="/usr/lib/polkit-1/polkit-agent-helper-1" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.511:879): saddr=01002F7661722F72756E2F6E7363642F736F636B6574000090B23B4CFC7F0000390000000000000000000000000000000000000000000000700E5079D77F000000F05279D77F0000AF811079D77F0000085D3978D77F000048781079D77F00000000000001000000B50500000100 +type=CWD msg=audit(1481078693.511:879): cwd="/" +type=PATH msg=audit(1481078693.511:879): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.512:880): arch=c000003e syscall=59 success=yes exit=0 a0=7fd7752cc3ed a1=7ffc4c3bb340 a2=7fd7754d33c0 a3=2 items=2 ppid=1619 pid=1620 auid=1000 uid=0 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="unix_chkpwd" exe="/usr/sbin/unix_chkpwd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078693.512:880): argc=3 a0="/usr/sbin/unix_chkpwd" a1="root" a2="nullok" +type=CWD msg=audit(1481078693.512:880): cwd="/" +type=PATH msg=audit(1481078693.512:880): item=0 name="/usr/sbin/unix_chkpwd" inode=16781526 dev=08:01 mode=0104755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:chkpwd_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078693.512:880): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078693.512:881): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffcccb57610 a2=6e a3=40 items=1 ppid=1619 pid=1620 auid=1000 uid=0 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="unix_chkpwd" exe="/usr/sbin/unix_chkpwd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.512:881): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000000000000000000002000000060000000000000000000000E50100005600000060AD02A15A7F0000000020F96A99F9FF01000000000000002077B5CCFC7F000000A051A25A7F00002381E1A05A7F00000000E0EB6A99 +type=CWD msg=audit(1481078693.512:881): cwd="/" +type=PATH msg=audit(1481078693.512:881): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078693.512:882): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7ffcccb577a0 a2=6e a3=40 items=1 ppid=1619 pid=1620 auid=1000 uid=0 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="unix_chkpwd" exe="/usr/sbin/unix_chkpwd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078693.512:882): saddr=01002F7661722F72756E2F6E7363642F736F636B657400FE00000000000000007079B5CCFC7F000000B051A25A7F00003C9C45A15A7F00000000A0EE6A99F9FF000030236244B5FE04000000000000007079B5CCFC7F0000202B52A25A7F000069A2EAA15A7F0000000000EF6A99 +type=CWD msg=audit(1481078693.512:882): cwd="/" +type=PATH msg=audit(1481078693.512:882): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.852:883): arch=c000003e syscall=59 success=yes exit=0 a0=a3e2b0 a1=a35a20 a2=a34fd0 a3=7ffdde1f2620 items=2 ppid=1343 pid=1621 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=BPRM_FCAPS msg=audit(1481078697.852:883): fver=0 fp=0000000000000000 fi=0000000000000000 fe=0 old_pp=0000000000000000 old_pi=0000000000000000 old_pe=0000000000000000 new_pp=0000001fffffffff new_pi=0000000000000000 new_pe=0000001fffffffff +type=EXECVE msg=audit(1481078697.852:883): argc=4 a0="sudo" a1="service" a2="auditd" a3="stop" +type=CWD msg=audit(1481078697.852:883): cwd="/home/some_user" +type=PATH msg=audit(1481078697.852:883): item=0 name="/usr/bin/sudo" inode=345659 dev=08:01 mode=0104111 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sudo_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.852:883): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.853:884): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff4080ee70 a2=6e a3=40 items=1 ppid=1343 pid=1621 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.853:884): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078697.853:884): cwd="/home/some_user" +type=PATH msg=audit(1481078697.853:884): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.853:885): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff4080f000 a2=6e a3=40 items=1 ppid=1343 pid=1621 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.853:885): saddr=01002F7661722F72756E2F6E7363642F736F636B657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078697.853:885): cwd="/home/some_user" +type=PATH msg=audit(1481078697.853:885): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.855:886): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7fff4080f990 a2=6e a3=22 items=1 ppid=1343 pid=1621 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.855:886): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000100000000000000080FB8040FF7F000040FD8040FF7F0000E05FFA9D917F00002F00000000000000F0FF8040FF7F00001000000000000000A0FD8040FF7F000010FA8040FF7F00000003000000000000E05FFA9D917F +type=CWD msg=audit(1481078697.855:886): cwd="/home/some_user" +type=PATH msg=audit(1481078697.855:886): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.856:887): arch=c000003e syscall=42 success=no exit=-2 a0=6 a1=7fff4080fb20 a2=6e a3=22 items=1 ppid=1343 pid=1621 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=0 sgid=1001 fsgid=0 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.856:887): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000ED67FA9D917F0000FE67FA9D917F00000768FA9D917F00001868FA9D917F00002268FA9D917F00003368FA9D917F00003D68FA9D917F00004E68FA9D917F00005668FA9D917F0000180000003000000030028140FF7F +type=CWD msg=audit(1481078697.856:887): cwd="/home/some_user" +type=PATH msg=audit(1481078697.856:887): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.857:888): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=7f919ca33740 a2=6e a3=5f items=1 ppid=1343 pid=1621 auid=1000 uid=1000 gid=1001 euid=0 suid=0 fsuid=0 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.857:888): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +type=CWD msg=audit(1481078697.857:888): cwd="/home/some_user" +type=PATH msg=audit(1481078697.857:888): item=0 name="/dev/log" inode=6529 dev=00:05 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1481078697.857:889): pid=1621 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=73657276696365206175646974642073746F70 terminal=pts/0 res=success' +type=CRED_ACQ msg=audit(1481078697.857:890): pid=1621 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=USER_START msg=audit(1481078697.857:891): pid=1621 uid=0 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' +type=SYSCALL msg=audit(1481078697.858:892): arch=c000003e syscall=59 success=yes exit=0 a0=7f919dfac5d8 a1=7f919dfb1d38 a2=7f919dfb5ad0 a3=6 items=3 ppid=1621 pid=1622 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="service" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.858:892): argc=4 a0="/bin/sh" a1="/sbin/service" a2="auditd" a3="stop" +type=CWD msg=audit(1481078697.858:892): cwd="/home/some_user" +type=PATH msg=audit(1481078697.858:892): item=0 name="/sbin/service" inode=16784574 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.858:892): item=1 name="/bin/sh" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.858:892): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.860:893): arch=c000003e syscall=59 success=yes exit=0 a0=18e7a40 a1=18dfe10 a2=18e0420 a3=7ffcf56f3000 items=2 ppid=1623 pid=1624 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="mountpoint" exe="/usr/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.860:893): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" +type=CWD msg=audit(1481078697.860:893): cwd="/home/some_user" +type=PATH msg=audit(1481078697.860:893): item=0 name="/bin/mountpoint" inode=11077 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.860:893): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.861:894): arch=c000003e syscall=59 success=yes exit=0 a0=18e6cb0 a1=18e7020 a2=18e0420 a3=7ffcf56f3000 items=2 ppid=1623 pid=1625 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="mountpoint" exe="/usr/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.861:894): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" +type=CWD msg=audit(1481078697.861:894): cwd="/home/some_user" +type=PATH msg=audit(1481078697.861:894): item=0 name="/bin/mountpoint" inode=11077 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.861:894): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.863:895): arch=c000003e syscall=59 success=yes exit=0 a0=18e0000 a1=18eb7e0 a2=18eba50 a3=7ffcf56f2a80 items=2 ppid=1626 pid=1627 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="consoletype" exe="/usr/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.863:895): argc=1 a0="/sbin/consoletype" +type=CWD msg=audit(1481078697.863:895): cwd="/home/some_user" +type=PATH msg=audit(1481078697.863:895): item=0 name="/sbin/consoletype" inode=16784566 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.863:895): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.866:896): arch=c000003e syscall=59 success=yes exit=0 a0=190d9c0 a1=190e100 a2=18eba50 a3=7ffcf56f3130 items=2 ppid=1622 pid=1628 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="basename" exe="/usr/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.866:896): argc=2 a0="basename" a1="/sbin/service" +type=CWD msg=audit(1481078697.866:896): cwd="/home/some_user" +type=PATH msg=audit(1481078697.866:896): item=0 name="/bin/basename" inode=3839 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.866:896): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.867:897): arch=c000003e syscall=59 success=yes exit=0 a0=190ddc0 a1=190e5b0 a2=18eba50 a3=7ffcf56f3130 items=2 ppid=1622 pid=1629 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="basename" exe="/usr/bin/basename" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.867:897): argc=2 a0="basename" a1="/sbin/service" +type=CWD msg=audit(1481078697.867:897): cwd="/home/some_user" +type=PATH msg=audit(1481078697.867:897): item=0 name="/bin/basename" inode=3839 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.867:897): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.868:898): arch=c000003e syscall=59 success=yes exit=0 a0=18e66f0 a1=18e52f0 a2=18eba50 a3=7ffcf56f3700 items=2 ppid=1622 pid=1630 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="env" exe="/usr/bin/env" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.868:898): argc=7 a0="env" a1="-i" a2="PATH=/sbin:/usr/sbin:/bin:/usr/bin" a3="TERM=xterm-256color" a4="SYSTEMCTL_IGNORE_DEPENDENCIES=" a5="SYSTEMCTL_SKIP_REDIRECT=" a6="/usr/libexec/initscripts/legacy-actions/auditd/stop" +type=CWD msg=audit(1481078697.868:898): cwd="/" +type=PATH msg=audit(1481078697.868:898): item=0 name="/bin/env" inode=4707 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.868:898): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.875:899): arch=c000003e syscall=59 success=yes exit=0 a0=7ffc89bc37ab a1=7ffc89bc1858 a2=c11030 a3=7ffc89bc1480 items=3 ppid=1622 pid=1630 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="stop" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.875:899): argc=2 a0="/bin/sh" a1="/usr/libexec/initscripts/legacy-actions/auditd/stop" +type=CWD msg=audit(1481078697.875:899): cwd="/" +type=PATH msg=audit(1481078697.875:899): item=0 name="/usr/libexec/initscripts/legacy-actions/auditd/stop" inode=33670350 dev=08:01 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.875:899): item=1 name="/bin/sh" inode=1429 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.875:899): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.881:900): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff8361b770 a2=6e a3=40 items=1 ppid=1622 pid=1630 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="stop" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.881:900): saddr=01002F7661722F72756E2F6E7363642F736F636B657400006FBE14B03B7F00000000000000000000C0C535B03B7F00000100000000000000000000000000000001000000FF7F0000085236B03B7F000020C06183FF7F000040030000000000007F454C4602010103000000000000 +type=CWD msg=audit(1481078697.881:900): cwd="/" +type=PATH msg=audit(1481078697.881:900): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.881:901): arch=c000003e syscall=42 success=no exit=-2 a0=3 a1=7fff8361b900 a2=6e a3=40 items=1 ppid=1622 pid=1630 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="stop" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SOCKADDR msg=audit(1481078697.881:901): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000185D95AF3B7F000003000000000000000500000000000000CE4AAEFF000000008BBB14B03B7F00003C4695AF3B7F000080B96183FF7F0000543F95AF3B7F0000707A95AF3B7F000090BA6183FF7F000080BA6183FF7F +type=CWD msg=audit(1481078697.881:901): cwd="/" +type=PATH msg=audit(1481078697.881:901): item=0 name="/var/run/nscd/socket" objtype=UNKNOWN +type=SYSCALL msg=audit(1481078697.881:902): arch=c000003e syscall=59 success=yes exit=0 a0=1c7b2f0 a1=1c7a320 a2=1c7b7c0 a3=7fff8361afa0 items=2 ppid=1631 pid=1632 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="mountpoint" exe="/usr/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.881:902): argc=3 a0="/bin/mountpoint" a1="-q" a2="/cgroup/systemd" +type=CWD msg=audit(1481078697.881:902): cwd="/" +type=PATH msg=audit(1481078697.881:902): item=0 name="/bin/mountpoint" inode=11077 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.881:902): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.882:903): arch=c000003e syscall=59 success=yes exit=0 a0=1c7b220 a1=1c75a80 a2=1c7b7c0 a3=7fff8361afa0 items=2 ppid=1631 pid=1633 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="mountpoint" exe="/usr/bin/mountpoint" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.882:903): argc=3 a0="/bin/mountpoint" a1="-q" a2="/sys/fs/cgroup/systemd" +type=CWD msg=audit(1481078697.882:903): cwd="/" +type=PATH msg=audit(1481078697.882:903): item=0 name="/bin/mountpoint" inode=11077 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL +type=PATH msg=audit(1481078697.882:903): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=16778495 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL +type=SYSCALL msg=audit(1481078697.884:904): arch=c000003e syscall=59 success=yes exit=0 a0=1c7b080 a1=1c7aee0 a2=1c7df40 a3=7fff8361aa20 items=2 ppid=1634 pid=1635 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="consoletype" exe="/usr/sbin/consoletype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=EXECVE msg=audit(1481078697.884:904): argc=1 a0="/sbin/consoletype" +type=DAEMON_END msg=audit(1481078697.892:7799): auditd normal halt, sending auid=? pid=? subj=? res=success +type=CWD msg=audit(1489639811.480:451): cwd="/home/some_user" +type=PATH msg=audit(1489639811.480:451): item=0 name="/etc/ssh/sshd_config" inode=34485109 dev=08:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 objtype=NORMAL +type=USER_CMD msg=audit(1489639825.595:452): pid=1325 uid=1000 auid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/some_user" cmd=7461696C202D3230202F7661722F6C6F672F61756469742F61756469742E6C6F67 terminal=pts/0 res=success' diff --git a/filebeat/module/system/audit/test/test.log b/filebeat/module/system/audit/test/test.log new file mode 100644 index 000000000000..6ee88f1a1a41 --- /dev/null +++ b/filebeat/module/system/audit/test/test.log @@ -0,0 +1,2 @@ +type=MAC_IPSEC_EVENT msg=audit(1485893834.891:18877201): op=SPD-delete auid=4294967295 ses=4294967295 res=1 src=192.168.2.0 src_prefixlen=24 dst=192.168.0.0 dst_prefixlen=16 +type=SYSCALL msg=audit(1485893834.891:18877199): arch=c000003e syscall=44 success=yes exit=184 a0=9 a1=7f564b2672a0 a2=b8 a3=0 items=0 ppid=1240 pid=1281 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="charon" exe=2F7573722F6C6962657865632F7374726F6E677377616E2F636861726F6E202864656C6574656429 key=(null) diff --git a/filebeat/module/system/audit/test/test.log-expected.json b/filebeat/module/system/audit/test/test.log-expected.json new file mode 100644 index 000000000000..0223a88afdb5 --- /dev/null +++ b/filebeat/module/system/audit/test/test.log-expected.json @@ -0,0 +1,94 @@ +[ + { + "_index": "test-filebeat-modules", + "_type": "log", + "_id": "AVrNfcrUJruQA3hgXR1I", + "_version": 1, + "_score": null, + "_source": { + "offset": 172, + "input_type": "log", + "source": "/Users/me/go/src/github.com/elastic/beats/filebeat/module/system/audit/test/test.log", + "fileset": { + "module": "system", + "name": "audit" + }, + "type": "log", + "error": "", + "@timestamp": "2017-01-31T20:18:46.912Z", + "system": { + "audit": { + "ses": "4294967295", + "op": "SPD-delete", + "res": "1", + "auid": "4294967295", + "dst": "192.168.0.0", + "src": "192.168.2.0", + "sequence": 18877201, + "src_prefixlen": "24", + "record_type": "MAC_IPSEC_EVENT", + "dst_prefixlen": "16" + } + }, + "beat": { + "hostname": "macbook.local", + "name": "macbook.local", + "version": "6.0.0-alpha1" + } + } + }, + { + "_index": "test-filebeat-modules", + "_type": "log", + "_id": "AVrNfcrUJruQA3hgXR1J", + "_version": 1, + "_score": null, + "_source": { + "offset": 534, + "input_type": "log", + "source": "/Users/me/go/src/github.com/elastic/beats/filebeat/module/system/audit/test/test.log", + "fileset": { + "module": "system", + "name": "audit" + }, + "type": "log", + "error": "", + "@timestamp": "2017-01-31T20:18:46.912Z", + "system": { + "audit": { + "syscall": "44", + "gid": "0", + "fsgid": "0", + "pid": 1281, + "suid": "0", + "record_type": "SYSCALL", + "uid": "0", + "egid": "0", + "exe": "/usr/libexec/strongswan/charon (deleted)", + "sgid": "0", + "ses": "4294967295", + "auid": "4294967295", + "comm": "charon", + "euid": "0", + "sequence": 18877199, + "a0": "9", + "ppid": 1240, + "a1": "7f564b2672a0", + "fsuid": "0", + "exit": "184", + "a2": "b8", + "a3": "0", + "success": "yes", + "tty": "(none)", + "arch": "x86_64", + "items": 0 + } + }, + "beat": { + "hostname": "macbook.local", + "name": "macbook.local", + "version": "6.0.0-alpha1" + } + } + } +] diff --git a/filebeat/tests/system/test_modules.py b/filebeat/tests/system/test_modules.py index 53314bb9d652..3dd4b35bb0a5 100644 --- a/filebeat/tests/system/test_modules.py +++ b/filebeat/tests/system/test_modules.py @@ -74,6 +74,8 @@ def run_on_file(self, module, fileset, test_file, cfgfile): "-e", "-d", "*", "-once", "-c", cfgfile, "-modules={}".format(module), + "-M", "{module}.*.enabled=false".format(module=module), + "-M", "{module}.{fileset}.enabled=true".format(module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.prospector.close_eof=true", @@ -95,14 +97,21 @@ def run_on_file(self, module, fileset, test_file, cfgfile): objects = [o["_source"] for o in res["hits"]["hits"]] assert len(objects) > 0 for obj in objects: - self.assert_fields_are_documented(obj) - # assert "error" not in obj # no parsing errors - assert obj["fileset"]["module"] == module + assert obj["fileset"]["module"] == module, "expected fileset.module={} but got {}".format( + module, obj["fileset"]["module"]) + + if not (module == "mysql" and fileset == "slowlog") and not (module == "system" and fileset == "auth"): + # TODO: There are errors parsing the test logs from these modules. + assert "error" not in obj + + if module != "system" and fileset != "audit": + # There are dynamic fields in audit logs that are not documented. + self.assert_fields_are_documented(obj) if os.path.exists(test_file + "-expected.json"): with open(test_file + "-expected.json", "r") as f: expected = json.load(f) - assert len(expected) == len(objects) + assert len(expected) == len(objects), "expected {} but got {}".format(len(expected), len(objects)) for ev in expected: found = False for obj in objects: