Cybersecurity Triage
Read-only, can be slowFind SUID, SGID, and Sticky Bits in an App Tree
You need a compact inventory of files and directories with SUID, SGID, or sticky bits set.
Command
find /srv/www/example -perm /7000 -printf '%M %m %u:%g %p\n' 2>/dev/null | sortBefore you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not remove special bits until you know whether the program depends on them.
Expected output
A sorted list of paths with any SUID, SGID, or sticky bit set.
System impact
Read-only, can be slow. Nothing changes. The command inventories special permission bits.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use during hardening reviews, after vendor installs, or before approving a deployment image.
When not to use it
Do not remove special bits until you know whether the program depends on them.
next steps
Related commands
Find Writable Directories Missing the Sticky Bit
A writable log directory is not the same thing as a safe shared directory.
find /srv/www/example -type d -perm -0002 ! -perm -1000 -printf '%m %u:%g %p\n' 2>/dev/null | sort
Find Config Files with Execute Bits
Config files do not usually need to be executable.
find /srv/www/example -type f -perm /111 \( -path '*/config/*' -o -name '*.env' -o -name '*.conf' \) -printf '%M %u:%g %p\n' 2>/dev/null | sort
Find Upload Files Writable Outside the Owner
Uploads are supposed to be writable at the edge, not writable forever by everyone.
find /srv/www/example/shared/uploads -type f -perm /0022 -printf '%M %u:%g %p\n' 2>/dev/null | sort
Find World-Readable Secret-Looking Files
The fastest secret audit starts with readable files that look like secrets.
find /srv/www/example -type f -perm -0004 \( -iname '*secret*' -o -iname '*.env' -o -iname '*token*' -o -iname '*key*' \) -printf '%M %u:%g %p\n' 2>/dev/null | sort
Find Release Files Writable Outside the Owner
A release file that someone besides the owner can modify deserves a second look.
find /srv/www/example/releases/current -type f -perm /0022 -printf '%M %u:%g %p\n' 2>/dev/null | sort
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.