What is a way to see all files in a current directory that got recently permissions changed?

Or, another approach to my problem is, what is a way to see how many times a file got permissions changed?

  • Check out auditd - a Red Hat developed tool for monitoring system changes. This isn't ubiquitous to all unixes, however. – einonm May 28 '17 at 21:15
  • 1
    Some version control systems will track permission changes. I think mercurial does. Some more information about what you trying to do would probably be relevant. – Faheem Mitha May 28 '17 at 21:21
  • Shell history?­­­ – John Militer May 28 '17 at 22:06
  • 1
    There is none unless you set something up before the permission changes. What problem are you trying to solve? – Gilles May 28 '17 at 22:36

If you are doing forensics (to late to plan for things to be recorded better), then
Use find to find files that were changed after a certain time.

find «directory_name» -newerct "1 hour ago"

This uses -newerXY command of find. X=c to compare ctime (change of mode/permission and any other meta data) against Y=t time on command line. Use info page of date to get help on time strings.

There is no way to know how many times changes were made, or if it was other meta data that changed, unless you plan ahead, so that more is recorded.

  • 1
    Your answer is misleading. Whenever a files metadata, and that is much more than just permissions is changed, ctime is updated. – fpmurphy May 28 '17 at 22:23
  • @fpmurphy1 Improved answer – ctrl-alt-delor May 28 '17 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.