How Can I Tell Who Changed Permissions in Linux?

How do you check who changed file permissions in Linux?

2 Answers

1. In the 1st line, you see. which executable did it: exe=”/bin/chmod” the pid of the process: pid=32041. You could also find out which user it was: uid=0 , root in my case.
2. In the 3rd line, you see the changed mode: mode=040700.

17 апр. 2015 г.

How do you see who changed folder permissions?

How to find out who changed the Folder permissions

1. Select the file you want to audit and go to Properties. Select the Security tab → Advanced → Auditing → Add.
2. Select Principal: Everyone; Type: All; Applies to: This folder, sub-folders, and files.
3. Click Show Advanced Permissions, select Change permissions and Take ownership.