A way to monitor your files

[Barry Margolin]

In article <4125 at buengc.BU.EDU> bph at buengc.bu.edu (Blair P. Houghton) writes:
>I recall mentioning that at the start of this thread I wasn't a superuser
>and didn't even read it.  Thanks for the recap.  I am now a superuser,
>and am interested in all forms of security.

Here's most of the text of the original posting:

 I am really new to unix and was just wondering if there is a program/file 
 or something ( for lack of better word) that allows me to know when and
 by whom my files have been accessed. I have tried to change the mode of
 the files to limit access to only myself ( at least certain personal files)
 but this measure seems utterly useless with superusers. Encrypting is out
 of the question.

>There is _no_ way to keep the SU from looking in your files.  That
>is a feature, not a bug.
>I tell users that if they really want me not to see their stuff
>they should use encrypt(1) or move it off the machine.

Note that he didn't actually ask for a way to prevent the SU from
reading his file; he'd managed to discover on his own that it is
impossible.  He asked for a way to keep track of their snooping.  The
answer is that it is impossible in traditional Unix, and may be
possible to a limited extent in "secure" Unix systems.

Barry Margolin
Thinking Machines Corp.

barmar at think.com
{uunet,harvard}!think!barmar