Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1846

"USER_LOGIN" messages not logged in audit post gdm-40

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-10.1
    • rhel-8.6.0, rhel-8.7.0, rhel-8.8.0, rhel-9.5, rhel-9.6, rhel-10.0, rhel-9.7
    • gdm
    • gdm-47.0-8.el10
    • None
    • Moderate
    • ZStream
    • 1
    • rhel-display-window-mgmt
    • ssg_display
    • 11
    • 13
    • 2
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • Red Hat Enterprise Linux
    • Display WM #1/2025
    • Approved Blocker
    • Unspecified Release Note Type - Unknown
    • x86_64
    • None

      What were you trying to do that didn't work?

      Post RHEL-8.6 and with gdm-40, following USER_LOGIN messages not seen in audit when loggin in via GUI :

      type=USER_LOGIN msg=audit(1690426947.800:126): pid=3091 uid=0 auid=0 ses=4 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=0 exe="/usr/libexec/gdm-session-worker" hostname=? addr=? terminal=? res=success'

      Please provide the package NVR for which bug is seen:

      gdm-40.0-27.el8

      How reproducible:

      Always when logging in via GUI

      Steps to reproduce

      1. Install RHEL-8.6 with gdm-40 or later
      2. Try logging in via GUI ( not ssh )
      3.  Check audit logs ( /var/log/audit/audit.log ) for USER_LOGIN messages

      Expected results

      USER_LOGIN messages should be logged

      Actual results

      USER_LOGIN messages are not logged

              rh-ee-joatorre Joan Torres Lopez
              rhn-support-jraising Jigar Raisinghani
              Joan Torres Lopez Joan Torres Lopez
              Michal Odehnal Michal Odehnal
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: