I work at an office with other people on data analysis, from which only one of them has root permissions to our shared computing cluster. Some have a suspicion that the person with root permissions is going inside other people’s directories to take a look at their code and extract ideas or fragments without permission.

Is there a way in Linux to see which user was taking a look at specific files or folders? This might help to clarify the suspicions. Which way do you recommend (that can be applied by someone that is not root) in this case that the suspect about the root’s activity? Without this, nothing can be done to prove that this person is doing this, so any suggestion will help. Regards.

  • 3
    For the most part, there's nothing you as a non-root-user can do that root can't evade. – muru Jul 16 at 11:04
  • 4
    You work at a place where sharing code is not a good thing? This sounds like a HR problem (if it is an issue at all) rather than a technical one. If you have suspicions about improper behaviour, I'm assuming these suspicions are based on something. Talk to the user's manager. – Kusalananda Jul 16 at 11:05

As already mentioned, an audit service may or may not work for you. A simple thing I would try is to take the files and make them unreadable (0200), and record the "Change" timestamp from stat. Then check the same timestamp later and compare it with your records. If the admin had to change the permissions to look at the file, then the timestamps will not match.

There are probably workarounds for this, but you'll probably never find a way to prevent root from doing what it wants. In my mind, your only option is to find a gap in the admin's knowledge and exploit it.

  • I'd love to know what my answer lacks that merits a negative score. I tried this on my own machine and stand by it. – Pheric Aug 8 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.