GNU Findutils

https://www.gnu.org/software/findutils/manual/
Admin
GNU Findutils is a collection of utilities for finding files that match certain criteria and...
Tokens:150,668
Snippets:1,127
Trust Score:10
Update:6 days ago
Show doc for...
Tokens:
Raw
### PATH security examples for -execdir

Source: https://www.gnu.org/software/findutils/manual/find.txt

Examples of PATH settings for -execdir. Insecure settings include empty elements (start, end, or consecutive colons), relative entries like '.' or 'sbin', while a path with only absolute directories is considered secure.

```text
'/bin:/usr/bin:'
```

```text
':/bin:/usr/bin:/usr/local/bin'
```

```text
'/bin:/usr/bin::/usr/local/bin'
```

```text
'/bin:/usr/bin:.:/usr/local/bin'
```

```text
'/bin:/usr/bin:sbin:/usr/local/bin'
```

```text
'/bin:/usr/bin:/sbin:/usr/local/bin'
```

--------------------------------

### Example of /bin/rm command issued by -exec after cd

Source: https://www.gnu.org/software/findutils/manual/html_node/Deleting-Files.html

This shows the actual command that the previous -exec example might issue, using relative paths from /var/tmp, including the attacker-controlled stuff/passwd.

```shell
/bin/rm stuff/A stuff/B stuff/passwd

```

--------------------------------

### Process NUL-separated starting points from standard input with -files0-from

Source: https://www.gnu.org/software/findutils/manual/html_node/Starting-points.html

Pipe a NUL-separated list of starting points into find using -files0-from - and -maxdepth 0 to examine only those entries without recursing. The -maxdepth 0 prevents recursion into directories that are starting points.

```shell
$ proggy | find -files0-from - -maxdepth 0 -type f -empty

```

--------------------------------

### Example of /bin/rm command issued by -exec

Source: https://www.gnu.org/software/findutils/manual/html_node/Deleting-Files.html

This shows the actual command that the vulnerable -exec example might issue, including the relative paths to the files being deleted, including the attacker-controlled /var/tmp/stuff/passwd.

```shell
/bin/rm /var/tmp/stuff/A /var/tmp/stuff/B /var/tmp/stuff/passwd

```

--------------------------------

### Example xargs commands

Source: https://www.gnu.org/software/findutils/manual/html_node/Deleting-Files.html

Shows how xargs might split the file list into multiple /bin/rm commands when the command line length is limited.

```shell
/bin/rm /var/tmp/stuff/A /var/tmp/stuff/B
/bin/rm /var/tmp/stuff/C

```

--------------------------------

### Restore archive with tar

Source: https://www.gnu.org/software/findutils/manual/find.txt

Restores an archive created with the 'tar --create' example. Uses null-delimited names and preserves permissions and ownership.

```shell
tar --extract --null --preserve-perm --same-owner \
  --file=/dev/nrst0
```

--------------------------------

### Example output of find --version | grep Features

Source: https://www.gnu.org/software/findutils/manual/html_node/O_005fNOFOLLOW.html

Example output showing the features enabled in a development build of find prior to findutils-4.5.12. O_NOFOLLOW is qualified with 'enabled', meaning the current system seems to support it.

```text
Features enabled: D_TYPE O_NOFOLLOW(enabled) LEAF_OPTIMISATION \
FTS(FTS_CWDFD) CBO(level=2)

```

--------------------------------

### Symbolic mode: o+g

Source: https://www.gnu.org/software/findutils/manual/html_node/Copying-Permissions.html

The mode 'o+g' adds the permissions for users in the file's group to the permissions that other users have. For example, a file starting as mode 664 becomes 666, and a file starting as 741 becomes 745.

```plaintext
o+g
```

--------------------------------

### Relative date string examples

Source: https://www.gnu.org/software/findutils/manual/html_node/Relative-items-in-date-strings.html

Examples of relative date strings that adjust dates by years or days. These can be used with date parsing utilities.

```text
1 year
1 year ago
3 years
2 days
```

--------------------------------

### Handle file names safely with find -print0 and xargs --null --arg-file

Source: https://www.gnu.org/software/findutils/manual/find.txt

Both examples run the 'munge' program on all files named 'xyzzy', using null-separated file names from 'find -print0'. The first writes the list to a file before passing it via '--arg-file'; the second uses process substitution so only one step is needed. In both cases, 'munge'''s input remains the terminal. The second requires a shell with the '<(...)' feature.

```shell
find / -name xyzzy -print0 > list
xargs --null --arg-file=list munge

```

```shell
xargs --null --arg-file=<(find / -name xyzzy -print0) munge

```

--------------------------------

### Adjusting parallelism at runtime with SIGUSR2

Source: https://www.gnu.org/software/findutils/manual/html_node/Controlling-Parallelism.html

Starts xargs with -P 4 in the background, then sends SIGUSR2 to reduce parallelism by one.

```shell
shell$ xargs <allimages -L 1 -P 4 makeallsizes &
[4] 27643
   ... at some later point ...
shell$ kill -USR2 27643
shell$ kill -USR2 %4
```

--------------------------------

### Equivalent modes: og+rX and og-w

Source: https://www.gnu.org/software/findutils/manual/html_node/Multiple-Changes.html

These two modes are equivalent to the combined mode 'og+rX-w'. They are shown as separate simple symbolic modes.

```text
og+rX
```

```text
og-w
```

--------------------------------

### Parallel xargs with -L 1 -P 2

Source: https://www.gnu.org/software/findutils/manual/html_node/Controlling-Parallelism.html

Runs makeallsizes in parallel with up to 2 processes, starting a new one as each finishes.

```shell
find originals -name '*.jpg' | xargs -L 1 -P 2 makeallsizes
```

--------------------------------

### Find and delete old files: -print0, -exec, -execdir, -delete

Source: https://www.gnu.org/software/findutils/manual/find.txt

These commands delete files modified more than 90 days ago in /var/tmp/stuff. The first uses -print0 with xargs -0, which is efficient but not portable until POSIX Issue 8. The -exec ... + variant builds a long command line and is portable but has a race condition. The -execdir variant is more secure by changing directory before invoking the command老的. The final -delete action is the most efficient and secure. The second and third commands are identical in display but appear in different contexts: the first as the initial example and the second as a repeated command to illustrate the potential issued command. The fifth and sixth commands show the result of using cd /var/tmp before find, respectively. The -execdir example is accompanied by a step list but the code itself is the command shown.

```shell
find /var/tmp/stuff -mtime +90 -print0 | xargs -0 /bin/rm
```

```shell
find /var/tmp/stuff -mtime +90 -exec /bin/rm {} \+
```

```shell
find /var/tmp/stuff -mtime +90 -exec /bin/rm {} \+
```

```shell
/bin/rm /var/tmp/stuff/A /var/tmp/stuff/B /var/tmp/stuff/passwd
```

```shell
cd /var/tmp && find stuff -mtime +90 -exec /bin/rm {} \+
```

```shell
/bin/rm stuff/A stuff/B stuff/passwd
```

```shell
find /var/tmp/stuff -mtime +90 -execdir /bin/rm {} \+
```

```shell
find /var/tmp/stuff -mtime +90 -delete
```

--------------------------------

### find -perm with symbolic mode

Source: https://www.gnu.org/software/findutils/manual/html_node/Mode-Bits.html

Example of using -perm with symbolic modes to select files readable by all, writable by anyone, and not executable by anyone.

```shell
-perm -a+r -perm /a+w ! -perm /a+x
```

--------------------------------

### Create cpio archive from find output

Source: https://www.gnu.org/software/findutils/manual/html_node/Archiving.html

Use find with -depth and -print0 to pipe a null-delimited file list to cpio for creating an archive. The -depth option ensures directory contents are archived before the directory itself, which is important for restoring permissions correctly.

```shell
find . -depth -print0 |
  cpio --create --null --format=crc --file=/dev/nrst0

```

--------------------------------

### Set ext2 file attributes with chattr on GNU/Linux

Source: https://www.gnu.org/software/findutils/manual/find.txt

Use chattr to set file permissions (

```text
chattr
```

--------------------------------

### Get inode number with ls -i

Source: https://www.gnu.org/software/findutils/manual/find.txt

Lists files with inode numbers, useful to uniquely identify a problem file for later removal or renaming.

```shell
ls -i
```

--------------------------------

### find -maxdepth and -mindepth examples

Source: https://www.gnu.org/software/findutils/manual/html_node/Directories.html

Shows how -maxdepth and -mindepth limit traversal. The first command creates a directory tree; the second lists only the top level; the third lists files at depth 5 or more; the fourth lists files between depths 2 and 4.

```shell
$ mkdir -p dir/d1/d2/d3/d4/d5/d6

$ find dir -maxdepth 1
dir
dir/d1

$ find dir -mindepth 5
dir/d1/d2/d3/d4/d5
dir/d1/d2/d3/d4/d5/d6

$ find dir -mindepth 2 -maxdepth 4
dir/d1/d2
dir/d1/d2/d3
dir/d1/d2/d3/d4

```

--------------------------------

### Archive files with tar

Source: https://www.gnu.org/software/findutils/manual/find.txt

Archives a directory tree with 'tar' using null-delimited names read from standard input. The '-depth' option is used for the same reason as in the cpio example.

```shell
find . -depth -print0 |
  tar --create --null --files-from=- --file=/dev/nrst0
```
Tokens:
Raw