Traverse the filesystem just once, listing set‐user‐ID files and directories into /root/suid.txt and large files into /root/big.txt.
$ find / \
\( -perm -4000 -fprintf /root/suid.txt '%#m %u %p\n' \) , \
\( -size +100M -fprintf /root/big.txt '%-10s %p\n' \)
This example uses the line‐continuation character '\' on the first two lines to instruct the shell to continue reading the command on the next line.
Searching files by age
• Search for files in your home directory which have been modified in the last twenty‐four hours.
$ find $HOME -mtime 0
This command works this way because the time since each file was last modified is divided by 24 hours and any remainder is discarded. That means that to match -mtime 0, a file will have to have a modification
in the past which is less than 24 hours ago.
Searching files by permissions
• Search for files which are executable but not readable.
$ find /sbin /usr/sbin -executable \! -readable -print
• Search for files which have read and write permission for their owner, and group, but which other users can read but not write to.
$ find . -perm 664
Files which meet these criteria but have other permissions bits set (for example if someone can execute the file) will not be matched.
• Search for files which have read and write permission for their owner and group, and which other users can read, without regard to the presence of any extra permission bits (for example the executable bit).
$ find . -perm -664
This will match a file which has mode 0777, for example.
• Search for files which are writable by somebody (their owner, or their group, or anybody else).
$ find . -perm /222
• Search for files which are writable by either their owner or their group.
$ find . -perm /220
$ find . -perm /u+w,g+w
$ find . -perm /u=w,g=w
All three of these commands do the same thing, but the first one uses the octal representation of the file mode, and the other two use the symbolic form. The files don’t have to be writable by both the owner
and group to be matched; either will do.
• Search for files which are writable by both their owner and their group.
$ find . -perm -220
$ find . -perm -g+w,u+w
Both these commands do the same thing.
• A more elaborate search on permissions.
$ find . -perm -444 -perm /222 \! -perm /111
$ find . -perm -a+r -perm /a+w \! -perm /a+x
These two commands both search for files that are readable for everybody (-perm -444 or -perm -a+r), have at least one write bit set (-perm /222 or -perm /a+w) but are not executable for anybody (! -perm /111
or ! -perm /a+x respectively).
Pruning ‐ omitting files and subdirectories
• Copy the contents of /source‐dir to /dest‐dir, but omit files and directories named .snapshot (and anything in them). It also omits files or directories whose name ends in ‘~’, but not their contents.
$ cd /source‐dir
$ find . -name .snapshot -prune -o \( \! -name '*~' -print0 \) \
| cpio -pmd0 /dest‐dir
The construct -prune -o \( ... -print0 \) is quite common. The idea here is that the expression before -prune matches things which are to be pruned. However, the -prune action itself returns true, so the fol‐
lowing -o ensures that the right hand side is evaluated only for those directories which didn’t get pruned (the contents of the pruned directories are not even visited, so their contents are irrelevant). The