Take the 2-minute tour ×

On a linux box that there is some process regularly changing permissions on directories and files, roughly daily. This is not a process that I set up and I have no idea what it is.

I have root access and I can easily change permissions manually to get access back but it is a bit annoying.

Is there an way to see a list of processes that have last touched a file? Or alternatively how would I go about logging process activity on the file.

share|improve this question
Would lsof help? It lists all opened files and the processes that opened them. –  wreckgar23 Dec 29 '11 at 18:51
add comment

3 Answers

up vote 8 down vote accepted

On a Fedora system, you can use:

sudo auditctl -p a -w /some/file  # monitor attribute changes to /some/file

It's in the audit package, if you don't have that installed, then sudo yum install audit

The output goes into /var/log/audit/audit.log in the form:

  type=SYSCALL msg=audit(1325185116.524:1133): arch=c000003e syscall=2 success=yes exit=3 a0=671600 a1=241 a2=1b6 a3=9 items=1 ppid=26641 pid=26643 auid=501 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="jmacs" exe="/usr/bin/joe" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
  type=CWD msg=audit(1325185116.524:1133):  cwd="/tmp"
  type=PATH msg=audit(1325185116.524:1133): item=0 name="/etc/passwd" inode=531545 dev=fd:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0

It's a bit dense, but note the msg=audit(###) strings line up across multiple lines.

  • Now that I actually read the manpage for the first time ever, I see some cautions about using -Farch=b32/-Farch=b64, so it seems that there is some possible weirdness about 32-bit-vs-64-bit syscalls, so if you don't get an audit hit, that might be why. I've never really seen this bit before, but I haven't really run any 32-bit processes since the Athlon era, so I can't speak to it very well.
share|improve this answer
On Debian/Ubuntu the required package is named auditd. –  A.H. Dec 29 '11 at 19:25
Yes - I played around with this for a while. It certainly answers my question above. auditctl seems like a pretty useful tool –  evolution Dec 29 '11 at 20:45
add comment

If you need to monitor changes to some file or directory, inotify might be helpful.

In bash there's inotifywait (you can find a nice example about how to use it here), and in python (just in case you consider using it) there's a library called pyinotify.

share|improve this answer
Going to go with the first answer as auditctl seems like a tool written to do this already. –  evolution Dec 29 '11 at 20:49
add comment

interesting question. I'm not sure that this information is recorded by the system. So you will likely have to do something "clever".

One (I'm sure there are others) approach would be to write a kernel module which hooks the open system call. And records the PID and executable file into the dmesg log (printk will output to dmesg):

struct task_struct contains a member called comm, it contains 'executable name excluding path'.

The current macro from this file will get you current process.

Using above info you can use get the name info.

share|improve this answer
add comment

Your Answer


