LX0-104 · Question #263
Which of the following find commands will print out a list of suid root files in /usr?
The correct answer is A. find /usr -uid 0 -perm +4000. To locate SUID root files, the find command can be used to search for files owned by user ID 0 (root) with the SUID bit set, which is represented by the +4000 permission.
Question
Options
- Afind /usr -uid 0 -perm +4000
- Bfind -user root +mode +s /usr
- Cfind -type suid -username root -d /usr
- Dfind /usr -ls *s* -u root
- Efind /usr -suid -perm +4000
How the community answered
(26 responses)- A73% (19)
- C15% (4)
- D4% (1)
- E8% (2)
Why each option
To locate SUID root files, the `find` command can be used to search for files owned by user ID 0 (root) with the SUID bit set, which is represented by the `+4000` permission.
The `find` command searches in `/usr` for files owned by user ID 0 (`-uid 0`, which is typically root) and with the SUID bit set (`-perm +4000`), which correctly identifies SUID root files.
The `+mode +s` syntax is not a valid `find` predicate for identifying SUID permissions; `-perm +4000` or `-perm /4000` should be used.
`-type suid`, `-username root`, and `-d /usr` are not valid `find` predicates; `suid` is a permission, not a type, and `-username` is incorrect.
`-ls *s*` is incorrect for searching SUID files; `-ls` prints file details, but `*s*` is a pattern, and `-u root` is an invalid flag.
`-suid` is not a standard `find` predicate; while `-perm +4000` is correct for SUID, it needs `-uid 0` or `-user root` to specify root ownership.
Concept tested: find command SUID search
Source: https://www.man7.org/linux/man-pages/man1/find.1.html
Topics
Community Discussion
No community discussion yet for this question.