In Linux, is there a way of seeing which user updated a file?
See who made changes to a file
Install the audit package using the package manager for your distribution and start the service.
Set a watch for a file you're interested in, such as /etc/passwd
# auditctl -w /etc/passwd -p war -k password-file
See the audit records for that file
# ausearch -f /etc/passwd | less
Generally, no. I've never tried it, but if you want to track users accessing particular file, you can take a look at audit