how to audit chmod syscall system wide? a wired problem of home directory group write permission got set

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




my Linux laptop started to have a problem of setting my home directory with group write permission

$ ls -ld $HOME
drwxr-x--- 34 user users 4096 Jan 30 21:45 /home/user

to:

$ ls -ld $HOME
drwxrwx--- 34 user users 4096 Jan 30 21:45 /home/user


This usually doesn't cause a problem but since recently it started settings group write on servers as well which I did ssh login; and once logout, the next time it doesn't allow re-login from server side sshd audit logs, says because of group write permission is set it doesn't allow my account to login;

this wired problem has started settings multiple ssh servers, either at home Linux server, or Linux server in the cloud,
but it isn't always reproducible, in past 30 days it happened 3 times to 4 different servers

I suspect current Linux laptop has a software virus or something because it has been in use for 2 years;   I re-installed the laptop with latest Fedora 27 and all started as fresh,  but 2 weeks later right now, the group write permission is set again to one of my servers;


I checked all bash_history and system logs, didn't see any explicit bash call of "chmod g+w ..."  ; so I suspect some software is calling by chmod syscall, so I wonder anyone knows how to set a system wide chmod audit?  and if a whole hard drive anti-virus scan is necessary, which anti-virus scan software do you recommend?


It's weird that nothing worse than a group write permission set.  No damage to system, no malfunctioning. The newly installed Linux system just functions perfect if without that.
But I am kind of pretty sure it's this laptop, because whenever this laptop is down time, I use another newer laptop I bought a few months ago, nothing bad happens yet during this current 3years old laptop downtime.


Thanks;
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux