Someone is changing file permissions, how to figure out who?

Question

linux

Hello.

An anomaly has appeared on a number of servers - something changes the permissions on files - sets -rwxr-xr-x for files, drwxr-xr-x for directories, tell me how to figure out who is doing this?
Only I have root access, and it doesn’t matter at the moment, it’s clear that they somehow broke it. But how to calculate who changes the rights?

PS
What is strange could be to enter rm -rf, but no, they only change the rights ... The truth is that it doesn’t make it easier, because when the rights are changed to / or to ssh keys or to / dev / null or / tmp, etc. significant problems arise.

Answer 1

Make chmod an alias to your script that does an action but audits the time and terminal from which the action came.

Answer 2

https://wiki.archlinux.org/index.php/Audit_framework

Answer 3

Enable auditd, then use ausearch, aureport. It can also be used in conjunction with file integrity control software, such as Efros / AIDE