On Debian and other systems using dpkg,
sort -u /var/lib/dpkg/info will give you a list of all the files provided by a package. A comparison with the list of files actually present on the system reveals a large number of files that aren't provided by any package. This list is from a quick glance at one Debian squeeze machine and is by no means exhaustive.
- The obvious suspects:
/srv, mount points of all kinds.
- A number of symbolic links that are created by package installation scripts. Often this is because the file used to be in a package and has now been replaced by an alternative: first the new package is unpacked, then the old package it replaces is removed, and finally the new package's postinst script creates the link.
- A few uses of
initrd-* (automatically regenerated from the installed kernel and extra modules), and bootloader files (
/lib/modules/*, module dependency files and symbol maps, and automatically-compiled modules (from dkms).
- Various non-redistribuable content that is downloaded from its only authorized source when you install the package. Most of it is documentation, there are also a few fonts.
- X11 font incides in
- CUPS backends copied from
- Various files that are compiled on installation:
*.dll (Mono), …
- Generated documentation indices in
/usr/share/doc/HTML (from dhelp).
If you want to account for every file, you'll have to track their history. To put it another way, to pass an audit, you can't just show the files you have, it's also up to you as the audited to show proof of validity for each file.
The classical approach is to use a tool like tripwire, which alerts you when a file changes. If you're after something more powerful, that lets you keep track of changes, this is exactly version control. Debian provides turnkey version control for
/etc via etckeeper. It's not part of the default installation (unfortunately). Install the package, select your favorite version control system in
/etc/etckeeper/etckeeper.conf, and run
etckeeper init. All changes under
/etc will be committed automatically every night and before and after running
apt-get or other APT front-ends; you can disable these auto-commits to force the administrator to run
etckeeper commit manually (and enter a log message).