so for example, i can see that UID 0 changed /etc/...
# general
c
so for example, i can see that UID 0 changed /etc/passwd, but many processes run as root