Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad...

How could I trace that what is chmoding the file? There is no history 1000 | fgrep -i chmod, I think a process is chmoding the file, but which one? dtrace can do this? it's not on AIX

share|improve this question
Shouldn't you be grepping for chmod, not chown? – cjm Sep 25 '11 at 20:29
:D no. CHMOD is the right. – LanceBaynes Sep 27 '11 at 18:10
up vote 7 down vote accepted

Dtrace would be nice but it's not ported on AIX.

You should be able to trace what is chmoding the file with auditing: http://www.ibm.com/developerworks/aix/library/au-audit/

share|improve this answer
I can see S_PASSWD_READ and S_PASSWD_WRITE, but what should I set to trace the chown-ing? so are there any "S_PERMISSION"? :D - ty! – LanceBaynes Sep 25 '11 at 14:09
I have no AIX system to check but I guess FILE_Mode should be a good clue. – jlliagre Sep 25 '11 at 18:15

At first I'd open a problem record with IBM as that sounds like broken code and should be fixed. I personally only had similar issues with /etc/resolv.conf also not readable by others, and when it belongs to root:system that might be a problem.

The pointer to audit subsystem is correct, although the famous developerworks URL-randomizer struck, and the above link is not working anymore. Check e.g. http://www-01.ibm.com/support/knowledgecenter/ssw_aix_61/com.ibm.aix.security/monitor_file_access_realtime.htm or the archived page: https://web.archive.org/web/20080328022606/http://www.ibm.com/developerworks/aix/library/au-audit/

For the event selection, you should try with FILE_Write and maybe in addition FILE_Mode, FILE_Privilege and/or FILE_Acl

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.