All the howtos that I find on the web states:

Find all SUID files:
find / -perm -4000 -print
Find all SGID files:
find / -perm -2000 -print 

But that is not true. See:

$ ls -lah test
-r-sr-xr-x  1 user  user     0B Jan 24 22:47 test
$ stat -x test | grep Mode
  Mode: (4555/-r-sr-xr-x)         Uid: ( 1000/    user)  Gid: ( 1000/    user)
$ find test -perm 4000
$ find test -perm 2000

Question: So what is the truth? How can I really list all the SUID/SGID files?

  • Uhm, so why exactly is this "not true"? You did Read The Friendly Manual, right? File's permission bits are exactly mode (octal or symbolic). Jan 24, 2015 at 21:04
  • ** test** is a file. Find searches on directories. So you should use find on the directory where test resides.
    – Nils
    Jan 24, 2015 at 21:04
  • 1
    @Nils: untrue. find (GNU find to be exact) will take directories and files alike. He/she simply misses the point of the -perm switch. Reading the manual would help. Jan 24, 2015 at 21:06
  • @0xC0000022L Interesting. My linux-manpage on CentOS 5 tells me it will only take directories. Is there much sense in running it on a file?
    – Nils
    Jan 24, 2015 at 21:11
  • @Nils: nope there is no particular sense in doing it. But it won't you prevent from that folly. Regardless, at first glance I also thought this to be the issue. Alas, it isn't for this question. You can try by checking for some any bits on a file like this find $FILE -perm /7777 to see whether your find does it or prevents it. Jan 24, 2015 at 21:12

2 Answers 2


If you want to test for any of the bits, use /. I.e. for your use case:

find "$DIRECTORY" -perm /4000


find "$DIRECTORY" -perm /2000

or combined:

find "$DIRECTORY" -perm /6000

You may use both folders and files as argument for GNU find.

Another, IMO better readable, approach is using the mnemonic shortcuts. I.e.:

find "$DIRECTORY" -perm /u=s,g=s

Caveat emptor

Keep in mind that the variants of find vary. They may also behave differently. Always read the friendly manual (RTFM).


By using the following command you can enumerate all binaries having SUID permission. The -perm -u=s flag of the find tool does the trick:

find / -perm -u=s -type f 2>/dev/null

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .