Re: [opensuse] Who and why removes permissions to /dev/null ?

6 Mar 2009

      -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Friday, 2009-03-06 at 12:04 -0300, Cristian Rodríguez wrote:
...
...
The timestamp of /dev/null is also changed.  Since chmod don't change
the timestamp, this means the file is removed and recreated.
try this:
# auditctl -w /dev/null -p a
# auditctl -e 1
and then watch the logs...
if auditctl is not found, when you execute it as root, install package
"audit"
Wow! You are a bag full of surprises. I'm storing this trick right away 
into my recipe file ;-)

- -- 
Cheers,
        Carlos E. R.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkmxZIQACgkQtTMYHG2NR9XsXgCeJNPhMsEKWVFPSxkIsp4+NXcY
lBUAoJfUj5OZ2nk8KWtlMcubKPG1PBVS
=5nPV
-----END PGP SIGNATURE-----