How to cp or rm files based on ownership / permission

Question

After a problem with spam, I stopped postfix

postfix stop

and checked through the mailq manually to find hundreds of thousands of unsent spam.

The spam was sent from one of the sites hosted locally, and I know that user has not tried to send any emails since I stopped outgoing mail.

Therefore all the messages in /var/spool/postfix/maildrop that originate from that user on my machine are known to be spam, and I'd like to delete or move them to another dir for later investigation.

I would like to move all the files with a given owner (in this case the user 'web2') from

/var/spool/postfix/maildrop

to

/var/spool/postfix/temp-spam

How can I do this?

Answer 1

You can use find and xargs, e.g.:

find /var/spool/postfix/maildrop -user web2 -print0 -type f | xargs -0 -I{} mv {} /var/spool/postfix/temp-spam

You can test it by inserting echo:

find /var/spool/postfix/maildrop -user web2 -print0 -type f | xargs -0 -I{} echo mv {} /var/spool/postfix/temp-spam

Answer 2

you can also do it without spawning the xargs using find's -exec.

find /var/spool/postfix/maildrop -user THEUSER -type f -exec mv {} /var/spool/postfix/temp-spam \;

If you want to see the files being moved, you can add an additional -exec to the command:

find /var/spool/postfix/maildrop -user THEUSER -type f -exec ls -lah {} \; -exec mv {} /var/spool/postfix/temp-spam \;

Answer 3

The standard command find lets you match files based on metadata (name, permissions, etc.) and act on them. It traverses a directory recursively. The basic syntax is find followed by the directory(s) to traverse, followed by match criteria, optionally followed by a command to execute (if you don't specify a command, find prints the matching names).

find /var/spool/postfix/maildrop -user web2 -exec mv -t /var/spool/postfix/temp-spam {} +

This executes the command mv -t /var/spool/postfix/temp-spam … for the matching files: {} is replaced by the list of all matching files (if the list is too long, find will execute mv as many times at it takes).

The -t option to mv is a GNU (Linux/Cygwin) extension. On systems that don't have it, you need to pass the file names to move first, and then the destination. The -exec … + action only allows passing the file names at the end of the command line, so you need to resort to other methods.

find /var/spool/postfix/maildrop -user web2 -exec mv {} /var/spool/postfix/temp-spam \;

(calls mv separately for each file)

find /var/spool/postfix/maildrop -user web2 -exec sh -c 'mv "$@" "$0"' /var/spool/postfix/temp-spam {} +

(uses an intermediate shell to get the arguments in the desired order)

If you are using zsh, you can use its glob qualifiers to perform the same job as find. Here, the u flag to match files owned by a user.

mv /var/spool/postfix/maildrop/*(u:web2:) /var/spool/postfix/temp-spam

(Unlike the find commands above, this doesn't recurse into subdirectories. It isn't needed here, but if you need it, insert **/ in the path to say “zero or more subdirectories”, e.g. /var/spool/postfix/maildrop/**/*(u:web2:).)