Is there a log file which keeps track of things users try to do and are denied due to regular unix file permissions. I know selinux does things, but a lot of the time the good ole' file permissions stop them first. When this happens, is there a log that gets printed to.



How to set up and use auditd in Linux:


| improve this answer | |

No, that's not logged.

| improve this answer | |

Auditctl allows you to log access to files, including access denied.

From the manpage:

To see unsuccessful open call's:

auditctl -a exit,always -S open -F success!=0
| improve this answer | |

You might want to check out AppArmor (download info at the end).

By default most distros don't log that.

| improve this answer | |
  • more specifically, aa-logprof – LiraNuna Aug 1 '09 at 10:08

I was trying to solve this problem myself recently. I found the answer within the audit.rules manpage:


The following rule shows how to audit failed access to files due permission problems. Note that it takes two rules for each arch ABI to audit this since file access can fail with two different failure codes indicating permission problems.

-a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access
-a always,exit -F arch=b32 -S open -S openat -F exit=-EPERM -k access
-a always,exit -F arch=b64 -S open -S openat -F exit=-EACCES -k access
-a always,exit -F arch=b64 -S open -S openat -F exit=-EPERM -k access

My unabashed answer to my own question.

| improve this answer | |

No, in stock configurations there isn't anything that directly shows "user bibby was denied access to /root"

You might be able to find auditing software that may have enhanced auditing or maybe software (like SeLinux) that uses more complex ACL access to files and it may log things, but even Windows doesn't log such permission errors (there are utilities with Sysinternals that show on-the-fly access denied errors for Windows, though).

I don't think I've even run across any utilities similar that that functionality in Unix systems.

You can try looking for "incidental" things in logs, like mail or web server programs that log errors trying to access particular file paths that as an administrator you know should be there.

If you're interested in security on your system to keep pesky users from acting pesky, you can try some of the utilities listed here and see if they will help you.

| improve this answer | |

if user can not login due to permissions, user would get "permission denied" on his screen and will be in / nothing goes in the log, but its visible to user

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy