I know about rpm's -V option that tells me if files installed via RPMs have not been modified, but is there a simple way to get rpm to tell me if any files in a given directory were not installed by RPM? I figure I can use --whatprovides on each file, but is there a faster way?
why not use the opensource tripwire?
http://sourceforge.net/projects/tripwire/
Regardless of the feasibility of this I don't think it would be a good idea. The reason is that anyone who could modify a critical file (presumably only writeable by root) could alter the RPM database as well.