How can I audit all chmod and chgrp commands?

Question

Corporate security policies are starting to require low level event logging. For example, file access permission changes. One solution is to use SELinux but our knowledge of this is sparse at best. Another is to replace the command with a proxy which performs auditing (this sucks though).

Any ideas?

Answer 1

I think you can look at auditd: http://linux.die.net/man/8/auditd

Also check this thread please: http://www.linuxforums.org/forum/linux-security/109864-auditing-logging-all-commands-arguments.html