How to Find All SUID/SGID Files on a Linux System Using the find Command

In the Linux file permission system, SUID (Set User ID) and SGID (Set Group ID) are special bits that can be applied to an executable file. Normally, when you run a program, it executes with your user privileges. However, if a file has the SUID bit set, it will execute with the privileges of the file’s owner (which is very often the root user).

A classic example is the passwd command; it must be able to write to the highly secure /etc/shadow file, so it runs as root even when a standard user executes it. While necessary for system operation, SUID/SGID binaries are massive security risks. If a hacker finds an SUID binary that has a vulnerability, they can exploit it to instantly gain root access to your entire server (a privilege escalation attack).

As a Linux administrator, it is critical that you routinely audit your system for unauthorized SUID and SGID files. You can find them all instantly using the find command.

The SUID/SGID Permission Numbers

When searching by octal permissions, SUID is represented by a 4 in the thousands place, and SGID is represented by a 2.

• Standard executable: 0755
• Executable with SUID: 4755
• Executable with SGID: 2755
• Executable with BOTH: 6755

How to Find SUID Files

We will use the find command starting at the root directory (/), specifically targeting the permission block (-perm).

1. Open your terminal and log in as root, or use sudo.
2. Run the following command:

   sudo find / -perm /4000 -type f -exec ls -l {} \; 2>/dev/null

Breaking down the command:

• / tells it to search the entire hard drive.
• -perm /4000 tells it to look for any file where the SUID bit (4000) is set, regardless of the other read/write permissions.
• -type f ensures it only looks for files, ignoring directories.
• -exec ls -l {} \; takes the results and formats them into a clean, detailed list showing ownership.
• 2>/dev/null is a crucial hack that hides all the “Permission denied” errors generated when searching protected system folders.

How to Find SGID Files

To find files that execute with the group’s permissions, simply change the 4000 to a 2000.

sudo find / -perm /2000 -type f -exec ls -l {} \; 2>/dev/null

How to Find Both SUID and SGID Simultaneously

If you are conducting a rapid security audit and want a master list of every elevated binary on the system, you can combine the search criteria. SUID (4) + SGID (2) = 6.

sudo find / -perm /6000 -type f -exec ls -l {} \; 2>/dev/null

Review the output carefully. You will see standard binaries like /usr/bin/sudo and /usr/bin/su, which are perfectly normal. However, if you see an obscure script or a custom compiled binary in a user’s home directory (e.g., /home/user/my_secret_script) with an SUID bit, it is highly likely that your system has been compromised or misconfigured.