From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Kirkwood, David A." Subject: (no subject) Date: Thu, 15 Mar 2007 15:42:11 -0400 Message-ID: <954E3479CC27224785179CA04904214D054852F3@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0028012528==" Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l2FJgcLS014232 for ; Thu, 15 Mar 2007 15:42:39 -0400 Received: from mclmx.mail.saic.com (mclmx.mail.saic.com [149.8.64.10]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l2FJgT0j030447 for ; Thu, 15 Mar 2007 15:42:29 -0400 Received: from 0015-its-ieg02.mail.saic.com ([149.8.64.21] [149.8.64.21]) by mclmx.mail.saic.com for linux-audit@redhat.com; Thu, 15 Mar 2007 15:42:12 -0400 Received: from 0015-ITS-EXBH01.us.saic.com ([10.43.229.18]) by 0015-its-ieg02.mail.saic.com (SMSSMTP 4.0.5.66) with SMTP id M2007031514421221754 for ; Thu, 15 Mar 2007 14:42:12 -0500 Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============0028012528== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C7673A.06FFD3D4" This is a multi-part message in MIME format. ------_=_NextPart_001_01C7673A.06FFD3D4 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable When I view the events related to xscreensaver for a locked screen I get 2 separate audit entries, one for a failure and 1 as a success. Both have the same uid, euid, etc. Actually, the entries are exactly the same except for the event number and the success outcome. I have the xscreensaver executable set -rwsr-xr-x.=20 =20 Thanks, =20 David A. Kirkwood =20 ------_=_NextPart_001_01C7673A.06FFD3D4 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

When I view the events related to xscreensaver for a = locked screen  I get 2 separate audit entries, one for a failure and 1 as = a success. Both have the same uid, euid, etc. Actually, the entries are = exactly the same except for the event number and the success outcome. I  = have the xscreensaver executable set -rwsr-xr-x.

 

Thanks,

 

David A. Kirkwood

 

------_=_NextPart_001_01C7673A.06FFD3D4-- --===============0028012528== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0028012528==--