Skip to main content
Unix & Linux

Return to Question

edited body
Source Link
LanceBaynes
LanceBaynes
  • 41.6k
  • 101
  • 256
  • 355

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad...

How could I trace that what is chmoding the file? There is no history 1000 | fgrep -i chownchmod, I think a process is chmoding the file, but which one? dtrace can do this? it's not on AIX

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad...

How could I trace that what is chmoding the file? There is no history 1000 | fgrep -i chown, I think a process is chmoding the file, but which one? dtrace can do this? it's not on AIX

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad...

How could I trace that what is chmoding the file? There is no history 1000 | fgrep -i chmod, I think a process is chmoding the file, but which one? dtrace can do this? it's not on AIX

Tweeted twitter.com/#!/StackUnix/status/117856304239886336
formatting
Source Link
jasonwryan
jasonwryan
  • 74.9k
  • 35
  • 204
  • 230

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd/etc/passwd file to 640. That's bad... :\

How could I trace that what is chmoding the file? There is no "history 1000 | fgrep -i chown"history 1000 | fgrep -i chown, I think a process is chmoding the file, but which one?? dtracedtrace can do this? it's not on AIX :\

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad... :\

How could I trace that what is chmoding the file? There is no "history 1000 | fgrep -i chown", I think a process is chmoding the file, but which one?? dtrace can do this? it's not on AIX :\

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad...

How could I trace that what is chmoding the file? There is no history 1000 | fgrep -i chown, I think a process is chmoding the file, but which one? dtrace can do this? it's not on AIX

Source Link
LanceBaynes
LanceBaynes
  • 41.6k
  • 101
  • 256
  • 355

How to trace that what had "chmod 640"'ed the "/etc/passwd" file?

On AIX 6100-05-02-1034, something is frequently changing the permissions of the /etc/passwd file to 640. That's bad... :\

How could I trace that what is chmoding the file? There is no "history 1000 | fgrep -i chown", I think a process is chmoding the file, but which one?? dtrace can do this? it's not on AIX :\