watching a file for ownership change

[Charles Sprickman]

Hi,

I've run into a brick wall on this one, so I thought perhaps someone might 
point me in a new direction.

I have a mailserver that uses Maildir++, which means there's built-in 
(non-system) quotas.  The one problem that I'm having is that the file 
that stores the current quota information ($HOME/Maildir/maildirsize) 
occasionally gets flipped from the virtual user being the owner to root.

This is odd since I've not yet found anything that runs as root or runs 
setuid.  There are two delivery agents, maildrop and vdelivermail. 
Neither is setuid, and neither should ever be called by root.  Qmail is 
the MTA.  Additionally, courier-imap and courier-popd work on that file 
when messages are moved/deleted.  These do start as root, but should run 
as the virtual user like so:

vpopmail 92091  0.0  0.1   944  592  ??  I    Fri04AM   0:00.32 
/usr/local/bin/pop3d Maildir

vpopmail 18142  0.0  0.1  2416 1492  ??  I    10:34PM   0:00.04 
/usr/local/bin/imapd Maildir

Both the courier mailing list and the vpopmail mailing list devs agree 
that it must be the other piece of software's fault. :)

I'd like to find a way to watch one of the user's maildirsize files that 
seems to flip ownerships at least once a day and try to determine what 
process is changing the ownership.

How can I do that without dropping a bunch of daemons on a production 
machine into heavy-debug mode?  OS is 4.8 with all current patches.

Thanks,

Charles