Audit SUID/SGID binaries with find -perm
Enumerate every binary that runs with elevated privileges — unexpected entries here are the classic local privilege-escalation vector.
Run `sudo find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} +` to list all SUID and SGID binaries.
01Command
Command
$ sudo find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} +02What it does
`-perm -4000` matches files with the setuid bit and `-perm -2000` the setgid bit; combining them in `-o` catches both classes in one pass. `-xdev` keeps find on one filesystem, which avoids descending into /proc and mounted shares — drop it and add `2>/dev/null` if you truly want everything. A known-good baseline (passwd, sudo, ping, mount) is normal; anything else — an editor, a shell, a copy of bash — is a red flag worth investigating.
03Risk
!Warning: Never blindly remove SUID bits from what you find: stripping /usr/bin/sudo or /usr/bin/passwd breaks the system. Compare against a package manager's file list (e.g. rpm -Va / debsums) to spot tampered binaries.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- find(1) — search for files in a directory hierarchyEvidence: Documents -perm -mode (all permission bits set) matching for SUID (-4000) and SGID (-2000) checks.
Last verified: 2026-09-17 · Category: Security & Privacy