id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
213	Report who changed a file (Linux only, use Linux Audit System)	rainer	rainer	"On Linux, it should be possible to add file watches to the kernel audit system such that it becomes possible to fetch the desired information from the audit logs and report who changed the file.

Needs a properly configured audit system (audit=1 bootparameter, pam_loginuid in relevant /etc/pam.d files, and audit daemon running).
"	enhancement	closed	major	2.8.0	main		fixed