1

I was wondering if there is any way to view the changes history of commands chmod and chown in the whole system (folders and files in /). Is there any record log or any other way to get that information?

  • 3
    No, there's no log of these changes AFAIK. – Barmar Mar 20 '17 at 23:44
  • notwithstanding {/root,/home/*}/.*history, which can be tampered with. – DopeGhoti Mar 20 '17 at 23:48
  • @DopeGhoti, there is possibility to use chmod in script or just to call chmod system call from program. But history files won't show even first case. – ValeriyKr Mar 20 '17 at 23:59
  • Hence the 'notwithstanding', as in "with the exception of". – DopeGhoti Mar 21 '17 at 15:58
3

There is no way to get that information unless some mechanism is already in place to record it.

If your OS supports auditing, that would be a right tool to do it.

For example on Solaris, logging chmod usage would be done by enabling the fm audit flag.

On Linux, auditd should do the trick, e.g.:

auditctl -a entry,always -S chmod

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.