What changes my device permissions

Hello,

I have been using pam_devperm for a long time. If pam_devperm is
configured like I did, it causes that, when a user logs in on :0, the
permissions and ownerships of some device nodes in /dev are changed so
that the device file belongs to the user on :0 and has permissions
600. Now, I upgraded to a new OS version and found, that after logging
in on :0, some of the device file have permissions 660, not 600. It
seems that, after pam_devperm has changed the permissions to 600, some
other process resets them to 660.

How can I find out what is changing the device permissions?

Regards
  Christoph