We have an Ubuntu 12.04/apache server and a directory in the /var/www/foo and root permission. Something is repeatedly changes the permission of this directory. Question: How can we investigate, what is changing the permission? 
How to investigate what is modifying a directories permission on Linux?
permissions
You could investigate using auditing to find this. In ubuntu the package is called auditd.Use that command to start a investigation if a file or folder:auditctl -w /var/www/foo -p a-w means watch the file/folder-p a means watch for changes in file attributesNow start tail -f /var/log/audit/audit.log. When the attributes change you will see something like this in the log file:type=SYSCALL msg=audit(1429279282.410:59): arch=c000003e syscall=268 success=yes exit=0  a0=ffffffffffffff9c a1=23f20f0 a2=1c0 a3=7fff90dd96e0 items=1 ppid=26951 pid=32041  auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5  ses=4294967295 comm=chmod exe=/bin/chmodtype=CWD msg=audit(1429279282.410:59):  cwd=/roottype=PATH msg=audit(1429279282.410:59): item=0 name=/var/www/foo inode=18284 dev=00:13  mode=040700 ouid=0 ogid=0 rdev=00:00I executed chmod 700 /var/www/foo to trigger it.In the 1st line, you see which executable did it: exe=/bin/chmod the pid of the process: pid=32041 You could also find out which user it was: uid=0, root in my case.In the 3rd line, you see the changed mode: mode=040700