Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad...

How could I trace that what is chmoding the file? There is no history 1000 | fgrep -i chmod, I think a process is chmoding the file, but which one? dtrace can do this? it's not on AIX

share|improve this question
    
Shouldn't you be grepping for chmod, not chown? –  cjm Sep 25 '11 at 20:29
    
    
:D no. CHMOD is the right. –  LanceBaynes Sep 27 '11 at 18:10

1 Answer 1

up vote 6 down vote accepted

Dtrace would be nice but it's not ported on AIX.

You should be able to trace what is chmoding the file with auditing: http://www.ibm.com/developerworks/aix/library/au-audit/

share|improve this answer
    
I can see S_PASSWD_READ and S_PASSWD_WRITE, but what should I set to trace the chown-ing? so are there any "S_PERMISSION"? :D - ty! –  LanceBaynes Sep 25 '11 at 14:09
    
I have no AIX system to check but I guess FILE_Mode should be a good clue. –  jlliagre Sep 25 '11 at 18:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.