Which of the following commands finds all files owned by root that have the SetUID bit set?

Question

Options

• Afind / -user root -perm -4000
• Bfind / -user 0 -mode +s
• Cfind / -owner root -setuid
• Dfind / -owner 0 -permbits 0x100000000
• Efind / --filter uid=1 --filter pers=u+s

• A
  76% (31)
• B
  7% (3)
• C
  2% (1)
• D
  2% (1)
• E
  12% (5)

Explanation

Option A is correct because find / -user root properly filters files by owner using the -user flag (accepting either a username or numeric UID), and -perm -4000 correctly tests for the SetUID bit - the leading - means "at least these bits are set," and 4000 is the octal representation of the SetUID bit.

Why the distractors fail:

• B (-mode +s): -mode is not a valid find predicate; the correct flag is -perm. The +mode syntax for find was also deprecated and removed in modern versions.
• C (-owner root -setuid): -owner does not exist in find; the correct flag is -user. -setuid is also fabricated - no such predicate exists.
• D (-owner 0 -permbits 0x100000000): Same -owner error, and -permbits with a hex argument is entirely invented syntax.
• E (--filter uid=1 --filter pers=u+s): find uses single-dash predicates, not --filter flags; this syntax belongs to no real tool.

Memory tip: Think of -perm -4000 as "4 is for SetUID" - the leading 4 in the octal permission string always signals the SetUID bit, just as you see in chmod 4755. The - prefix on -4000 means "this bit must be at minimum set," which handles files with additional permissions too.

No community discussion yet for this question.