how to audit chmod syscall system wide? a wired problem of home directory group write permission got set - users - Fedora Mailing-Lists

Wednesday, 31 January 2018

my Linux laptop started to have a problem of setting my home directory with group write
permission
$ ls -ld $HOMEdrwxr-x--- 34 user users 4096 Jan 30 21:45 /home/user
to:

$ ls -ld $HOMEdrwxrwx--- 34 user users 4096 Jan 30 21:45 /home/user

This usually doesn't cause a problem but since recently it started settings group
write on servers as well which I did ssh login; and once logout, the next time it
doesn't allow re-login from server side sshd audit logs, says because of group write
permission is set it doesn't allow my account to login;
this wired problem has started settings multiple ssh servers, either at home Linux server,
or Linux server in the cloud,but it isn't always reproducible, in past 30 days it
happened 3 times to 4 different servers
I suspect current Linux laptop has a software virus or something because it has been in
use for 2 years;   I re-installed the laptop with latest Fedora 27 and all started as
fresh,  but 2 weeks later right now, the group write permission is set again to one of my
servers;

I checked all bash_history and system logs, didn't see any explicit bash call of
"chmod g+w ..."  ; so I suspect some software is calling by chmod syscall, so I
wonder anyone knows how to set a system wide chmod audit?  and if a whole hard drive
anti-virus scan is necessary, which anti-virus scan software do you recommend?

It's weird that nothing worse than a group write permission set.  No damage to system,
no malfunctioning. The newly installed Linux system just functions perfect if without
that.But I am kind of pretty sure it's this laptop, because whenever this laptop is
down time, I use another newer laptop I bought a few months ago, nothing bad happens yet
during this current 3years old laptop downtime.

Thanks;