When a particular user logs in to a Linux machine, certain files are sourced, like perhaps .bashrc, .bash_profile, etc… Sometimes different shells mean different files are sourced. And of course the user might have something setup to source certain custom files of their own.
My question: Is there a way for root/su to determine a list of every file that is sourced for any given user when they login?
Best Answer
inotifywatch may help. Packaged in inotify-tools. Use as the user of files/dir for home dir being watched, not sudo, or you'll get errors on .gvfs if running a newer gnome.
inotify will only tell you which files get accessed/created/modified/deleted.
in another terminal
in inotifywatch terminal ctrl-c to end
For your specific request, all files accessed during login.
in another terminal
in inotifywatch terminal ctrl-c to end
You may want to redirect the inotifywatch to a file if using a fat desktop like gnome or kde. Or increase your scrollback in the inotifywatch terminal. In gnome 3, thousands of homedir files are accessed during login. You'll probably want to either exclude directories or make a specific dir/file list to watch.