linux automatic change permissions in resolv.file
- by rikr
In various linux servers I see how the permissions of the /etc/resolv.conf file change automatically.
In state normal:
-r--r--r-- 1 root root 103 Jul 4 11:50 resolv.conf
In changed state:
-r--r----- 1 root root 103 Jul 4 11:50 resolv.conf
I installed auditd for monitoring it, and these are the two entries between the change:
type=PATH msg=audit(07/04/2012 12:20:02.719:303) : item=0 name=/etc/resolv.conf inode=137102 dev=fe:00 mode=file,644 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(07/04/2012 12:20:02.719:303) : cwd=/
type=SYSCALL msg=audit(07/04/2012 12:20:02.719:303) : arch=x86_64 syscall=open success=yes exit=3 a0=7feeb1405dec a1=0 a2=1b6 a3=0 items=1 ppid=1585 pid=3445 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=hostid exe=/usr/bin/hostid key=(null)
type=PATH msg=audit(07/04/2012 12:50:03.727:304) : item=0 name=/etc/resolv.conf inode=137102 dev=fe:00 mode=file,440 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(07/04/2012 12:50:03.727:304) : cwd=/
type=SYSCALL msg=audit(07/04/2012 12:50:03.727:304) : arch=x86_64 syscall=open success=yes exit=3 a0=7f2bcf7abdec a1=0 a2=1b6 a3=0 items=1 ppid=1585 pid=3610 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=4294967295 comm=hostid exe=/usr/bin/hostid key=(null)
any ideas?