/dev/null permissions

[Elan Ruusamäe]

something funny is happening on one of my machine

/dev/null permissions get reset to 660 (which is common for root umask 7 
i'm using)
i have not found pattern in how or when it gets changed
i have stopped crond and still /dev/null premissions get reset to 660 
opposed to sane 666 permission

i've added auditd rule to track this, but unfortunately it's not giving 
any useful information how the permissions get reset to 660

my /etc/audit/audit.rules:
-D
-b 320
-w /dev/null -p a


any ideas:
1) wtf causes this?
2) how to try to audit system to figure it out?

i'm thinking something running as root is "fixing" it's own permissions 
via fchmod which is "accidentally" linked to /dev/fd/2 => /dev/null
i've tried to mv /dev/null /dev/null1; mknod /dev/null, but that did not 
stop the activities in that system


-- 
glen