[Gllug] stat'ing a file shows it was changed today and yet it has the date of a few days ago

[Nix]

On 20 Jun 2011, Oliver Howe outgrape:
> Access: 2011-06-16 17:38:43.723380000 +0000
> Modify: 2011-06-16 17:40:39.955971000 +0000
> Change: 2011-06-20 10:39:09.212814934 +0000
> #
>
> When I do ls -la of the file, it has the date of when it was last modified
>
> # ls -la /path/to/file
> -rw-r--r-- 1 username groupname 8998312448 Jun 16 17:40 /path/to/file
> #
>
> so, does "Change" above mean the last time the file mode was changed?

It's the last time the inode was changed in some way (POSIX calls it the
'last file status change timestamp'). It merely says that they shall
have 'meaningful values'. Linux, like most other Unixes, generally
implements 'meaningful' to mean that it is set to the current time when
the inode changes in a detectable fashion. For ext4 this means that it
is reset by a link(2), unlink(2), rename(2), an ACL set, a file mode
change (as you suggest), an extended attribute set, a truncate(2), an
fallocate(2) file-size-extension, an ext4 flag set via
EXT4_IOC_SETFLAGS, a version set via EXT4_IOC_SETVERSION[1], or an
rmdir(2) or mkdir(2) (which changes the ctime of the parent directory,
because this changes the visible link count).

Precisely which operations affect the ctime is nonportable, and varies
between Unix versions, between kernel releases, and between filesystems.
You can normally rely on stuff like link(), unlink(), and file-mode
changes doing it, but beyond that most bets are off.

[1] this is really obscure and something that is normally only done by
    the in-kernel NFS server (and it doesn't use the ioctl to do it).

> If so, is there a way to see who or what process changed the file
> permissions?

No, this is not recorded anywhere (except if you have utterly insane
auditing of some kind turned on).

-- 
NULL && (void)
--
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug