I've been reading some information about configuration of auditd and I just can't figure this out, what I know how to doLog specific system calls by a userLog access to a specific file by all usersWhat I can't figure out is however: how to set up audit daemon so that it logs access (read/write) to ALL files within a folder structure (for example /home and all subfolders and files within) ONLY for a given user id.So that if I had a user bob with user ID 2053 I would know every file they ever attempted to open or read on filesystem. I am not interested about access to these files by system services or any other user.Extra question: Is it somehow possible to set up this kind of audit for whole filesystem hierarchy? AFAIK audit doesn't allow that for some reasons
How to audit access to any file or folder within a given path for specific user
linux;audit