I work at an office with other people on data analysis, from which only one of them has root permissions to our shared computing cluster. Some have a suspicion that the person with root permissions is going inside other people’s directories to take a look at their code and extract ideas or fragments without permission.

Is there a way in Linux to see which user was taking a look at specific files or folders? This might help to clarify the suspicions. Which way do you recommend (that can be applied by someone that is not root) in this case that the suspect about the root’s activity? Without this, nothing can be done to prove that this person is doing this, so any suggestion will help. Regards.

  • 3
    For the most part, there's nothing you as a non-root-user can do that root can't evade.
    – muru
    Commented Jul 16, 2019 at 11:04
  • 4
    You work at a place where sharing code is not a good thing? This sounds like a HR problem (if it is an issue at all) rather than a technical one. If you have suspicions about improper behaviour, I'm assuming these suspicions are based on something. Talk to the user's manager.
    – Kusalananda
    Commented Jul 16, 2019 at 11:05

1 Answer 1


As already mentioned, an audit service may or may not work for you. A simple thing I would try is to take the files and make them unreadable (0200), and record the "Change" timestamp from stat. Then check the same timestamp later and compare it with your records. If the admin had to change the permissions to look at the file, then the timestamps will not match.

There are probably workarounds for this, but you'll probably never find a way to prevent root from doing what it wants. In my mind, your only option is to find a gap in the admin's knowledge and exploit it.

  • I'd love to know what my answer lacks that merits a negative score. I tried this on my own machine and stand by it.
    – Pheric
    Commented Aug 8, 2019 at 6:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .