I just discovered a mistake in the permissions setting of our system. It's kind of serious because it allows normal users to access something they shouldn't see. Currently the mistake has been fixed, but I wonder how many users have ever accessed these files. By "accessing", I mean reading from it, for example, vi (without saving), less, cat, cp, scp, ...

One strategy I can think of is greping through users' ~/.history files, but they could have deleted the relevant commands.

  • May I ask why the downvote?
    – nalzok
    Commented Dec 6, 2018 at 19:04

1 Answer 1


If you didn't have some sort of auditing mechanism in place at the time the file's permissions were wrong, it's pretty much impossible.  While your idea of searching the users' history files is not a terrible one (if you don't have concerns over the ethical and privacy issues), a simple grep won't find things like

cd (directory_where_file_is)
ls -l
less *
or cases where the user said vi (some_random_file), and then did :e (the_sensitive_file) from within vi.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .