<snip>
What I need to do is to figure out how to determine what exactly is changing the permissions on that directory's files so that I can put an end to it. Right now I have a chown -Rv 775 running on the directory every 5 minutes. But that is just going to contribute to load and can't be a permanent solution.
The directory in question is on an NFS share. However I am unsure of that being the cause.
I'm afraid that I am at a loss for troubleshooting steps here. Can someone please help me find some ways to track this down and put an end to this?
I believe auditctl could help:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Defining_Audit_Rules_and_Controls.html http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html
Barry