Finding Files By Owner, Type, and Permissions

You can find objects on the system owned by particular users and groups. To find all of the objects owned by user "news" on the system, we would use the following command:

 #  find / -user news -print  /etc/rc.d/rc.news /etc/news /etc/news/cleanfeed.conf /etc/news/actsync.cfg /etc/news/actsync.ign /etc/news/control.ctl /etc/news/cycbuff.conf /etc/news/distrib.pats /etc/news/expire.ctl /etc/news/incoming.conf /etc/news/inn.conf /etc/news/innfeed.conf /etc/news/innreport.conf /etc/news/innwatch.ctl /etc/news/moderators /etc/news/motd.news /etc/news/news2mail.cf /etc/news/newsfeeds /etc/news/nnrp.access /etc/news/nnrpd.track /etc/news/nntpsend.ctl /etc/news/overview.ctl /etc/news/overview.fmt /etc/news/passwd.nntp /etc/news/storage.conf              .              .              . /usr/man/man8/tally.control.8 /usr/man/man8/tally.unwanted.8 /usr/man/man8/writelog.8 

Using the -user operator we can specify either the name of the user, in this case "news", or the user identification number. The following example shows performing the same find operation using the user identification number of "news," in this case "9," instead of the name "news":

 #  find / -user 9 -print  /etc/rc.d/rc.news /etc/news /etc/news/cleanfeed.conf /etc/news/actsync.cfg /etc/news/actsync.ign /etc/news/control.ctl /etc/news/cycbuff.conf /etc/news/distrib.pats /etc/news/expire.ctl /etc/news/incoming.conf /etc/news/inn.conf /etc/news/innfeed.conf /etc/news/innreport.conf /etc/news/innwatch.ctl /etc/news/moderators /etc/news/motd.news /etc/news/news2mail.cf /etc/news/newsfeeds /etc/news/nnrp.access /etc/news/nnrpd.track /etc/news/nntpsend.ctl /etc/news/overview.ctl /etc/news/overview.fmt /etc/news/passwd.nntp /etc/news/storage.conf              .              .              . /usr/man/man8/tally.control.8 /usr/man/man8/tally.unwanted.8 /usr/man/man8/writelog.8 

This find operation produced exactly the same results using the name "news" and the user idenfication number "9."

You can search for a variety of different types such as f for a file, as shown in the example, b for a block special file, l for a symbolic link, and so on. We could add type -d to find only directories belonging to "news," as in the following command:

 #  find / -user news -type d -perm 775 -print  /etc/news /var/lib/news /var/log/news /var/log/news/OLD /var/spool/news /var/spool/news/archive /var/spool/news/articles /var/spool/news/incoming /var/spool/news/incoming/bad /var/spool/news/innfeed /var/spool/news/outgoing /var/spool/news/overview /var/spool/news/uniover /var/spool/slrnpull /usr/bin/auth /usr/bin/control /usr/bin/filter /usr/bin/rnews.libexec 

This is another example of using the implied and of find meaning that the find will print items that are both owned by "news" and are directories only.

Let's now add a specific permission for the directories to our implied and . We'll find only objects belonging to "news" that are directories with a permission of 775 in the following example:

 #  find / -user news -type d -perm 775 -print  /etc/news /var/lib/news /var/log/news /var/log/news/OLD /var/spool/news /var/spool/news/archive /var/spool/news/articles /var/spool/news/incoming /var/spool/news/incoming/bad /var/spool/news/innfeed /var/spool/news/outgoing /var/spool/news/overview /var/spool/news/uniover /var/spool/slrnpull /usr/bin/auth /usr/bin/control /usr/bin/filter /usr/bin/rnews.libexec 

We searched for directories belonging to "news" in which both the owner and those in the group have read-write-execute permission, and others having read-execute access. This is a common type of find operation for system administrators to perform - looking for files and directories belonging to a specific user and having specific permissions.