Christopher Negus - Linux Bible

The first example in the preceding code finds files larger than 10MB. The second finds files less than 1MB. In the third example, I'm searching for files that are between 500MB and 5GB. This includes an example of the -execoption (which I describe later) to run the ducommand on each file to see its size.

You can search for a particular owner ( -user) or group ( -group) when you try to find files. By using -notand -or, you can refine your search for files associated with specific users and groups, as you can see in the following examples:

$ find /home -user chris -ls 131077 4 -rw-r--r-- 1 chris chris 379 Jun 29 2014 ./.bashrc # find /home \( -user chris -or -user joe \) -ls 131077 4 -rw-r--r-- 1 chris chris 379 Jun 29 2014 ./.bashrc 181022 4 -rw-r--r-- 1 joe joe 379 Jun 15 2014 ./.bashrc # find /etc -group ntp -ls 131438 4 drwxrwsr-x 3 root ntp 4096 Mar 9 22:16 /etc/ntp # find /var/spool -not -user root -ls 262100 0 -rw-rw---- 1 rpc mail 0 Jan 27 2014 /var/spool/mail/rpc 278504 0 -rw-rw---- 1 joe mail 0 Apr 3 2014 /var/spool/mail/joe 261230 0 -rw-rw---- 1 bill mail 0 Dec 18 14:17 /var/spool/mail/bill 277373 2848 -rw-rw---- 1 chris mail 8284 Mar 15 2014 /var/spool/mail/chris

The first example outputs a long listing of all of the files under the /homedirectory that are owned by the user chris. The next lists files owned by chrisor joe. The findcommand of /etcturns up all files that have ntpas their primary group assignment. The last example shows all files under /var/spoolthat are not owned by root. You can see files owned by other users in the sample output.

Searching for files by permission is an excellent way to turn up security issues on your system or uncover access issues. Just as you changed permissions on files using numbers or letters (with the chmodcommand), you can likewise find files based on number or letter permissions along with the -permoptions. (Refer to Chapter 4, “Moving Around the Filesystem,” to see how to use numbers and letters with chmodto reflect file permissions.)

If you use numbers for permission, as I do below, remember that the three numbers represent permissions for the user, group, and other. Each of those three numbers varies from no permission (0) to full read/write/execute permission (7) by adding read (4), write (2), and execute (1) bits together. With a hyphen ( -) in front of the number, all three of the bits indicated must match; with a forward slash (/) in front of it, any of the numbers can match for the search to find a file. The full, exact numbers must match if neither a hyphen nor a forward slash is used.

Consider the following examples:

$ find /usr/bin -perm 755 -ls 788884 28 -rwxr-xr-x 1 root root 28176 Mar 10 2014 /bin/echo $ find /home/chris/ -perm -222 -type d -ls 144503 4 drwxrwxrwx 8 chris chris 4096 Jun 23 2014 /home/chris/OPENDIR

By searching for -perm 755, any files or directories with exactly rwxr-xr-xpermission are matched. By using -perm -222, only files that have write permission for user, group, and other are matched. Notice that, in this case, the -type dis added to match only directories.

$ find /myreadonly -perm /222 -type f 685035 0 -rw-rw-r-- 1 chris chris 0 Dec 30 16:34 /myreadonly/abc $ find . -perm -002 -type f -ls 266230 0 -rw-rw-rw- 1 chris chris 0 Dec 30 16:28 ./LINUX_BIBLE/abc

Using -perm /222, you can find any file ( -type f) that has write permission turned on for the user, group, or other. You might do that to make sure that all files are read-only in a particular part of the filesystem (in this case, beneath the /myreadonlydirectory). The last example, -perm /002, is very useful for finding files that have open write permission for “other,” regardless of how the other permission bits are set.

Date and time stamps are stored for each file when it is created, when it is accessed, when its content is modified, or when its metadata is changed. Metadata includes owner, group, time stamp, file size, permissions, and other information stored in the file's inode. You might want to search for file data or metadata changes for any of the following reasons:

You just changed the contents of a configuration file, and you can't remember which one. So, you search /etc to see what has changed in the past 10 minutes: $ find /etc/ -mmin -10

You suspect that someone hacked your system three days ago. So, you search the system to see if any commands have had their ownership or permissions changed in the past three days: $ find /bin /usr/bin /sbin /usr/sbin -ctime -3

You want to find files in your FTP server (/var/ftp) and web server (/var/www) that have not been accessed in more than 300 days so that you can see if any need to be deleted: $ find /var/ftp /var/www -atime +300

As you can glean from the examples, you can search for content or metadata changes over a certain number of days or minutes. The time options ( -atime, -ctime, and -mtime) enable you to search based on the number of days since each file was accessed, changed, or had its metadata changed. The minoptions ( -amin, -cmin, and -mmin) do the same in minutes.

Numbers that you give as arguments to the minand timeoptions are preceded by a hyphen (to indicate a time from the current time to that number of minutes or days ago) or a plus (to indicate time from the number of minutes or days ago and older). With no hyphen or plus, the exact number is matched.

With the -notand -oroptions, you can further refine your searches. There may be times when you want to find files owned by a particular user but not assigned to a particular group. You may want files larger than a certain size but smaller than another size. Or you might want to find files owned by any of several users. The -notand -oroptions can help you do that. Consider the following examples:

There is a shared directory called /var/allusers. This command line enables you to find files that are owned by either joe or chris. $ find /var/allusers \( -user joe -o -user chris \) -ls 679967 0 -rw-r--r-- 1 chris chris 0 Dec 31 12:57 /var/allusers/myjoe 679977 1812 -rw-r--r-- 1 joe joe 4379 Dec 31 13:09 /var/allusers/dict.dat 679972 0 -rw-r--r-- 1 joe sales 0 Dec 31 13:02 /var/allusers/one

This command line searches for files owned by the user joe, but only those that are not assigned to the group joe: $ find /var/allusers/ -user joe -not -group joe -ls 679972 0 -rw-r--r-- 1 joe sales 0 Dec 31 13:02 /var/allusers/one

You can also add multiple requirements on your searches. Here, a file must be owned by the user joe and must also be more than 1MB in size: $ find /var/allusers/ -user joe -and -size +1M -ls 679977 1812 -rw-r--r-- 1 joe root 1854379 Dec 31 13:09 /var/allusers/dict.dat

One of the most powerful features of the findcommand is the capability to execute commands on any files that you find. With the -execoption, the command you use is executed on every file found, without stopping to ask if that's okay. The -okoption stops at each matched file and asks whether you want to run the command on it.

The advantage of using -okis that, if you are doing something destructive, you can make sure that you okay each file individually before the command is run on it. The syntax for using -execand -okis the same: