Find out what messes with devnode permissions

[roarinelk]

Hello,

For a few weeks now I have the following problem:
All device nodes create by/for VirtualBox have their group-writable attributes missing, although the
shell script provided by VirtualBox does mknod them with permissions "0660" (i.e. user/group read-writable).
This is most visible with USB devices, where Virtualbox creates a "shadow" tree at /dev/vboxusb/<id>/<id> when a device is hotplugged.

If I run the script manually (e.g. "/usr/lib/udev/VBoxCreateUSBNode.sh 189 260 00") the node is created with correct
permissions, so I think something else later on removes the g-w attribute.

On another machine with identical userland (use flags, ...) this does NOT happen.

I tried "udevadm monitor" but could not find out who/what modifies these nodes after they're created.
Can anyone suggest another tool to monitor udev and it's script invocations or how to trace when a devnode is modified?