Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a log file which keeps track of things users try to do and are denied due to regular unix file permissions. I know selinux does things, but a lot of the time the good ole' file permissions stop them first. When this happens, is there a log that gets printed to.

Thanks

share|improve this question
add comment

migrated from stackoverflow.com Jul 31 '09 at 15:55

This question came from our site for professional and enthusiast programmers.

6 Answers

No, that's not logged.

share|improve this answer
add comment

Auditctl allows you to log access to files, including access denied.

From the manpage:

To see unsuccessful open call's:

auditctl -a exit,always -S open -F success!=0
share|improve this answer
add comment

You might want to check out AppArmor (download info at the end).

By default most distros don't log that.

share|improve this answer
    
more specifically, aa-logprof –  LiraNuna Aug 1 '09 at 10:08
add comment

No, in stock configurations there isn't anything that directly shows "user bibby was denied access to /root"

You might be able to find auditing software that may have enhanced auditing or maybe software (like SeLinux) that uses more complex ACL access to files and it may log things, but even Windows doesn't log such permission errors (there are utilities with Sysinternals that show on-the-fly access denied errors for Windows, though).

I don't think I've even run across any utilities similar that that functionality in Unix systems.

You can try looking for "incidental" things in logs, like mail or web server programs that log errors trying to access particular file paths that as an administrator you know should be there.

If you're interested in security on your system to keep pesky users from acting pesky, you can try some of the utilities listed here and see if they will help you.

share|improve this answer
add comment

if user can not login due to permissions, user would get "permission denied" on his screen and will be in / nothing goes in the log, but its visible to user

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.