From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michal Nazarewicz <mina86@tlen.pl>
Subject: Re: What changes my device permissions
Date: Tue, 08 Jun 2010 13:50:30 +0200
Message-ID: <87eighg2ux.fsf@erwin.mina86.com>
References: <20100608122037.175176ca.Christoph.Pleger@cs.tu-dortmund.de>
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Return-path: <linux-admin-owner@vger.kernel.org>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:received:received:sender:from:to:cc:subject
         :in-reply-to:references:user-agent:x-face:face:x-url:x-pgp-fp:x-pgp
         :date:message-id:mime-version:content-type;
        bh=9YlUlYR6P7ZmYQzdbtSxTyumUP+NEAxmVjF5DJNmoLY=;
        b=IWvtRxJxxJ4yjj1hqpkWeQV/o6NbZ/jMxY9R9dHPbeoZYC0xrYO6RYmlEAVSikBhpa
         755mud07+TYQFaLM+1XAjIc709aUbXJIJV1LzMSKH8uhhTC6seAGqHxb7jbyIn8R2o8m
         tIy81Fx4nw9MYMifTgYAH11hAibftwYOkqVVY=
In-Reply-To: <20100608122037.175176ca.Christoph.Pleger@cs.tu-dortmund.de>
	(Christoph Pleger's message of "Tue, 8 Jun 2010 12:20:37 +0200")
Sender: linux-admin-owner@vger.kernel.org
List-ID: <linux-admin.vger.kernel.org>
To: Christoph Pleger <Christoph.Pleger@cs.tu-dortmund.de>
Cc: linux-admin@vger.kernel.org

--=-=-=
Content-Transfer-Encoding: quoted-printable

Christoph Pleger <Christoph.Pleger@cs.tu-dortmund.de> writes:

> Hello,
>
> I have been using pam_devperm for a long time. If pam_devperm is
> configured like I did, it causes that, when a user logs in on :0, the
> permissions and ownerships of some device nodes in /dev are changed so
> that the device file belongs to the user on :0 and has permissions
> 600. Now, I upgraded to a new OS version and found, that after logging
> in on :0, some of the device file have permissions 660, not 600. It
> seems that, after pam_devperm has changed the permissions to 600, some
> other process resets them to 660.
>
> How can I find out what is changing the device permissions?

There's the hard way: use process accounting.

There's also easier way which *might* work: provide a shell wrapper for
chmod, like so:

$ : >/tmp/chmod-log && chmod 666 /tmp/chmod-log
$ cd /usr/bin
$ mv chmod chmod-
$ cat >chmod <<EOF
#!/bin/sh
echo "$@" >>/tmp/log
/usr/bin/chmod- "$@"
EOD

=2D-=20
Best regards,                                         _     _
 .o. | Liege of Serenly Enlightened Majesty of      o' \,=3D./ `o
 ..o | Computer Science,  Michal "mina86" Nazarewicz   (o o)
 ooo +--<mina86-tlen.pl>--<jid:mina86-jabber.org>--ooO--(_)--Ooo--

--=-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEARECAAYFAkwOLo0ACgkQUyzLALfG3x5YVQCgppQzJomgCNOaakA4Qhh4MbXu
/DUAoI6nnBpag35IDfRknz2qNTog/Dt8
=CTDf
-----END PGP SIGNATURE-----
--=-=-=--