On Thu, 1 Feb 2018 01:41:43 +0000 (UTC) "mr.cheng" <crquan@xxxxxxxxx> wrote: > On Wednesday, January 31, 2018, 4:37:02 PM PST, stan > <stanl-fedorauser@xxxxxxxxxxx> wrote: > > I checked all bash_history and system logs, didn't see any explicit > > bash call of "chmod g+w ..." ; so I suspect some software is > > calling by chmod syscall, > > > What is your umask set as? That determines what permissions new > > files > > I did search of umask in bash_history log or any system wide logs, > didn't see any manual changes of umask, and checking its value now, > is still the default 0022 as I understand, umask applies for new > files creation only, while my home directory existed for a long time, > since the system installation > > > for those Linux servers, fortunately I still have other accounts can > login to check, and run sudo chmod g-w /home/user; it looks like only > the most often used account is affected; many other user accounts > under /home have no impact. Sorry I misunderstood. It is really strange that existing directories would have their permissions changed without any action on your part. Like you, I can't see any reason for a virus to do this. Is there any new user attached to your group in /etc/group? I think it is more likely that a process is doing it because of a bug. Maybe write a shell script that checks permissions on your home directory every 5 minutes, writes it to a file if there is no change. If there is a change, it notifies you. Then you can examine what you are doing and look at the programs that are running. Maybe someone else here will be able to give you better guidance. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
