Find Files by Their Mode Bits

The teacher wants to audit reports whose mode matches a policy. find can test permission bits while it walks a directory tree. The useful question is whether you want an exact pattern, all selected bits, or at least one selected bit. Those are three different searches.

We will use GNU find's permission syntax and a known practice file. Do not equate a bit search with proof that a particular user can perform an operation: ACLs, identity, directories and other system rules still affect actual access.

Prepare the example

Use the practice Linux environment with GNU find for the documented prefix forms. In a new directory, the first two lines prepare a report whose ordinary mode is exactly 640. That gives the initial search a predictable match instead of depending on existing system files.

Bash · Linux terminal

touch marks.txt
chmod 640 marks.txt
find . -type f -perm 0640

Expected behavior; machine-dependent details

./marks.txt

find . -type f -perm 0640 starts at the current directory, selects regular files and tests the exact mode pattern. The leading zero makes the octal notation explicit. The prepared file matches the intended ordinary pattern.

Now compare prefixes. -perm -0002 asks whether all selected bits are set; with one selected bit, it finds the others-write bit even when additional bits are present. GNU find's / form asks whether any selected bit is set, so -perm /0022 can match group write or others write. Plain -perm 0002 instead asks for that exact pattern, which is much narrower than searching for a write bit among other permissions.

The find command can filter files by permission bits. This is useful for audits such as locating files with an exact mode or discovering files that are writable by everyone.

The Command We'll Use

The tool for this is the find command. It lets us search the filesystem for files that match given conditions—including permission bits.

Example Scenario

Let’s say you want to find all files in your current directory and its subdirectories that have the permission 777 — which means read, write, and execute access for everyone (owner, group, and others). That’s risky!

find -perm syntax for permission searches

find [path] -type f -perm [mode]

Here's how it works:

• path: where to start searching (e.g., . for current directory)
• -type f: only look for files
• -perm: match specific permission mode

Example: Find Files with 777 Permissions

find . -type f -perm 0777

Expected output for this example:

./public/test.sh
./scripts/dev_tool.sh

Whoa! These files are accessible by anyone. You might want to fix that.

Example: Find Files Writable by Others

You can also search for files that are writable by others (world-writable), even if they don’t have full 777 permissions.

find . -type f -perm -0002

This matches any file that has the others write bit set.

Expected output for this example:

./logs/debug.log
./uploads/tmp_file.txt

Find Files with Exact Permissions Only

If you want to find files that match exactly the permission bits (no more, no less), use:

find . -type f -perm 0644

Only files with permissions -rw-r--r-- will be listed. Files with extra bits (like execute) will be skipped.

Optional: Ignore Permission Errors

If you're running into “Permission denied” errors, add 2>/dev/null to suppress them:

find / -type f -perm 0777 2>/dev/null

Search for files by exact or partial permission modes

• Use find . -type f -perm 0777 to locate risky files.
• Use perm -0002 to find world-writable files.
• Add 2>/dev/null to hide permission errors.

Your task: In GNU find, which tests for the world-write bit being set?

Use the practice Linux environment with GNU find for the documented prefix forms. In a new directory, the first two lines prepare a report whose ordinary mode is exactly 640. That gives the initial search a predictable match instead of depending on existing system files.

Bash · complete example for this question

touch marks.txt
chmod 640 marks.txt
find . -type f -perm 0640

Expected behavior; machine-dependent details

./marks.txt

Worked answer

find . -type f -perm -0002

Use the all-selected-bits form -perm -0002 for the world-write bit being set. The plain form asks for an exact pattern. The value 0020 selects group write, so changing the digit position changes which class the search examines.

State the audit question before choosing a permission test. Exact, all-bits and any-bit searches produce different result sets. Inspect matched paths before taking action, and keep a permission-bit audit separate from a complete assessment of who can access each report.

Command reference: GNU find permission tests.