6

Is it possible to detect the files in a folder that have changed their permissions? I have read about the command find and It detects files that have changed the date of last modification but changing permissions does not change this date.

Yábir Garcia
  • 197
  • 1
  • 1
  • 5

1 Answers1

8

Check out the stat command, this shows 3 times the last time the file was accessed, when it was last modified and when it's permissions were last changed.

The one which you're interested in is permissions (change), see the below output for an example file I have just chmod'ed;

prompt::11:26:45-> stat ideas.md 
  File: ‘ideas.md’
  Size: 594         Blocks: 8          IO Block: 4096   regular file
Device: 27h/39d Inode: 117         Links: 1
Access: (0770/-rwxrwx---)  Uid: (    0/    root)   Gid: (  992/  vboxsf)
Context: system_u:object_r:vmblock_t:s0
Access: 2014-12-21 19:15:29.000000000 +0000
Modify: 2014-12-21 19:15:29.000000000 +0000
Change: 2014-12-22 11:26:45.000000000 +0000
 Birth: -

Or as @0xC0000022L says you could use stat -c to show just the output you need;

prompt::11:32:46-> stat -c %z ideas.md 
2014-12-22 11:26:51.000000000 +0000
Chris Davidson
  • 1,467
  • 1
    You forgot the very useful -c/--format option to stat, which can limit the output to relevant data and make it more easily parseable. – 0xC0000022L Dec 22 '14 at 11:30
  • @0xC0000022L yeah very usefull! thank you – Yábir Garcia Dec 22 '14 at 11:34
  • NOTE: This ONLY tells you if the file permissions were changed OR the file was updated (e.g. useless on a file like /var/log/messages). Hence, I think you would need to use 'audit' or something for files being edited etc.. – Mike Q Jul 21 '20 at 18:34