Find out who has accessed a file ?

[Doncho N. Gunchev]

On Thursday 20 November 2003 00:24, Adam Bowns wrote:
> Hello all,
>
> Is it possible to find the user name's of all the people who have
> accessed a file ? Can an IDS do this, or is it done by other means ?
>
> Thanks,
> Adam
    Mostly no, If you add some library that monitors such activity
to load before glibc and intercept all file related calls you will
have the chance to see this for all dynamicaly linked programs that
do access the file. There's libtrash project - you can see how from
their docs. For staticaly linked programs you'll need kernel module
I tkink (not 101% sure).
    I don't know of such IDS currently... so... mostly no.

-- 
Regards,
  Doncho N. Gunchev