CentOS - May 2014 - files automatically changing permissionssdsds

hello,

I'm running apache 2.2.24 and php 5.2.17. The web site that it's service
turns into a 403 Forbidden error every 5 minutes literally. I've found that
doing a chmod -Rv 775 on the web root restores the site. However this is a
band-aid and no real solution.

I've combed through all the cron jobs in /var/spool/cron both on this
machine and the one it was recently transferred from. And I can find
absolutely NO evidence of any rsync jobs or chowns or anything similar that
could be affecting that directory.

What I need to do is to figure out how to determine what exactly is
changing the permissions on that directory's files so that I can put an end
to it. Right now I have a chown -Rv 775 running on the directory every 5
minutes. But that is just going to contribute to load and can't be a
permanent solution.

The directory in question is on an NFS share. However I am unsure of that
being the cause.

I'm afraid that I am at a loss for troubleshooting steps here. Can someone
please help me find some ways to track this down and put an end to this?

Thanks
Tim

-- 
GPG me!!

gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

<snip>
> What I need to do is to figure out how to determine what exactly is
> changing the permissions on that directory's files so that I can put an
end
> to it. Right now I have a chown -Rv 775 running on the directory every 5
> minutes. But that is just going to contribute to load and can't be a
> permanent solution.
>
> The directory in question is on an NFS share. However I am unsure of that
> being the cause.
>
> I'm afraid that I am at a loss for troubleshooting steps here. Can
someone
> please help me find some ways to track this down and put an end to this?
I believe auditctl could help:

<https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Defining_Audit_Rules_and_Controls.html>
<http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html>

Barry