I'm working on a Cent 6 Cpanel machine, and some mystery script is changing the permissions of home directories (!) to 777. I've ruled out all the easy fixes, so I just need to set up a watch on the directory and wait until it happens again.
The trouble is, my current rule:
`auditctl -w /home -pa -k homedir_perm_changes`
is watching the entire home directory recursively, and this partition stores emails and documentroots, so there's entirely too much information.
How can I pare down my rule such that it watches only the directories directly under /home, and not the entire (huge) directory tree beneath it?