On Sat, 9 Mar 2019 10:28:50 +0100
Didier Kryn <kryn@???> wrote:

> Le 09/03/2019 à 10:03, Didier Kryn a écrit :
> > Le 09/03/2019 à 09:34, golinux@??? a écrit :
> >> I'd recommend adding an inotify rule to record which processes
> >> look at these files, and publishing this - here.
> >
> >     Unfortunately inotify doesn't tell which process accessed the
> > file )~:
>
>     But fanotify() is perfectly suited (~:
>
>         Didier

In which case you can not only change /etc/machine-id, but also write
to a log when it was accessed, what kind of access, and who accessed
it. We can then "out" the accessors.

SteveT