[H-GEN] Changing permissions on /dev files

[David Wood]

Hi all,

Gee, I'm looking forward to Brad getting back from Sydney :)  Then I
won't have to post here so often.

We're running tripwire on a few machines, and it occaisionally reports
changing ownership and permissions on files in /dev.  For example, one
report might read:

changed: crw------- pppuser         0 Oct 12 15:56:10 1998 /dev/ttyS1

and the next day's report might read:

changed: crw------- root            0 Oct 12 15:56:10 1998 /dev/ttyS1

Can anyone please tell me,

a)  Is this expected behavior?
b)  What process is changing the ownership and permissions? and
c)  Why??

Could this have something to do with a device being locked while it is
in use (e.g. for a modem)?

Thanks,
Dave
------------------------------------------------------------------
David Wood                   | Telephone:  +61 7 3876 7140
mailto:dwood at plugged.net.au  | Facsimile:  +61 7 3876 7142
http://www.plugged.net.au    | PGP Key available via finger
------------------------------------------------------------------
Those who do not understand Unix are condemned to reinvent it, poorly.
- Henry Spencer, University of Toronto Unix hack