How to Extract RPM Package Files Without Installing in Linux Using rpm2cpio

Red Hat Enterprise Linux, Fedora, CentOS, Rocky Linux, and openSUSE rely on RPM (RPM Package Manager) archives to distribute compiled binaries, system libraries, configuration files, and documentation. Frequently, system administrators, security auditors, and developers need to inspect a package’s internal binary contents, retrieve an individual missing shared library, or extract configuration templates without running dnf or rpm -i with root privileges. Using the standard Unix utilities rpm2cpio and cpio, you can unpack and extract any RPM file safely into a local directory.

Understanding How RPM Extraction Works

An RPM file is an archive containing a lead header, cryptographic signatures, metadata payloads, and a compressed archive representing the filesystem payload. The rpm2cpio utility strips away the RPM metadata headers and converts the underlying compressed archive into a standard cpio stream. Piping this stream into the Unix cpio extraction command allows you to unpack the directory tree anywhere on your filesystem without modifying system directories or touching the system RPM database.

Installing rpm2cpio Across Linux Distributions

The rpm2cpio utility is typically bundled with core RPM tooling, but can also be installed on Debian-based distributions to inspect Red Hat packages:

• RHEL, Rocky Linux, AlmaLinux, and Fedora:
  sudo dnf install -y rpm rpm2cpio cpio
• Ubuntu, Debian, and Linux Mint:
  sudo apt update && sudo apt install -y rpm2cpio cpio
• Arch Linux:
  sudo pacman -S rpm-tools cpio

Extracting an Entire RPM Package into a Target Directory

Because RPM packages contain absolute path hierarchies (such as /usr/bin/, /etc/, and /var/), cpio will recreate those exact directory structures. Always create an isolated workspace directory before extracting an archive to prevent cluttering your current working directory:

1. Create and navigate into a clean extraction folder:
   mkdir /tmp/rpm_inspect && cd /tmp/rpm_inspect
2. Run the extraction command by piping rpm2cpio into cpio:
   rpm2cpio /path/to/package-name.rpm | cpio -idmv

Here is what the flags passed to cpio accomplish:

• -i: Restore/extract files from standard input.
• -d: Create leading directories where needed (recreates subfolders such as usr/bin/).
• -m: Preserve original file modification timestamps.
• -v: Verbose output (prints each extracted filename to the terminal in real time).

Once complete, use ls -la or tree to browse the extracted directory structure. You can examine binaries, inspect scripts, and read config templates with standard unprivileged user accounts.

Extracting a Single File from an RPM Archive

If you only need to extract a specific binary or library without unpacking hundreds of megabytes of documentation, pass the specific relative file path as an argument to cpio:

1. First, list the contents of the RPM archive to identify the exact path:
   rpm2cpio package.rpm | cpio -it | grep "nginx.conf"
   (The -t flag lists table of contents without extracting).
2. Extract only that identified file:
   rpm2cpio package.rpm | cpio -idmv "./etc/nginx/nginx.conf"

Alternative Extraction with 7-Zip or bsdtar

Modern universal archive tools can also handle RPM payloads directly without needing the RPM toolchain:

• Using bsdtar (libarchive):
  bsdtar -xf package.rpm
• Using 7-Zip (7z):
  RPM files contain an inner .cpio or .cpio.xz archive. Running 7z x package.rpm extracts the inner cpio payload, followed by 7z x package.cpio to unpack the actual filesystem contents.

Security Best Practices When Inspecting Untrusted RPMs

Extracting packages with rpm2cpio does not execute %pre, %post, or %preun installation shell scripts defined in the RPM spec. This makes rpm2cpio significantly safer for malware analysis and auditing than running rpm -i --nodeps or dnf install, which execute package lifecycle scripts with root permissions during installation.