First steps / Stage 5 of 15 · step 7 of 8

Navigation: find a file in a tree

~10 min

Not running Starting usually ~20 s

Situation

The team dumps everything into /srv/data: projects, an archive, people's own files. A colleague put the file flag.txt somewhere in there and cannot remember which directory. They need the full path to the file.

Task

Write the absolute path to flag.txt into ~/answer.txt as a single line, for example /srv/data/a/b/flag.txt. The file holds the path only, nothing else.

Lab goals

0 of 2

File ~/answer.txt exists and is not empty — not checked yet
~/answer.txt holds the absolute path to flag.txt on one line — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Files and directories · picked for this lab

find — searching for files

Cheat sheet

$_ — insert into the terminal

find /etc -name nginx.conf exact name, search from /etc
find ~ -type f -name site.conf files only, no directories
find . -name "*.log" by pattern (quote the pattern!)
find . -type f -size +100M large files
find . -mtime -1 modified in the last day
find . -name "*.tmp" -delete delete (test without -delete first!)
find . -type f -exec chmod 644 {} + mode 644 for every file found
find . -printf '%s %p\n' | sort -rn | head top by size
find . -path './node_modules' -prune -o -name '*.js' -print excluding a directory

Below are the main conditions and actions of find; the full list is in man find.

Conditions

bash

find . -name "*.conf"             # by name (case-sensitive)
find . -iname "*.JPG"             # case-insensitive
find . -regex '.*/.*\.(log|tmp)'  # by a regex on the full path
find . -type f                    # files only (d for directories, l for links)
find . -size +100M                # larger than 100 MB (-100k smaller than 100 KB)
find . -mtime -1                  # modified in the last day (-mmin -10 for 10 minutes)
find . -newer /tmp/marker         # newer than a marker file
find . -user alice -group devs    # owner/group
find . -perm -4000                # SUID files (security audit)
find . -empty                     # empty files/directories
find /home -xdev -name '*.iso'    # don't cross mount points
find . -path './node_modules' -prune -o -name '*.js' -print   # skip a directory

Actions

bash

find . -name "*.tmp" -delete                      # delete the matches
find . -name "*.log" -mtime +30 -delete           # logs older than 30 days
find . -type f -name "*.sh" -exec chmod +x {} +   # make them executable (+ = batched)
find . -type d -exec chmod 755 {} +               # permissions on directories
find . -name "*.conf" -exec grep -l TODO {} +     # grep across the matches
find . -name "*.bak" -ok rm {} \;                 # -ok = ask for confirmation
find . -name "*.bak" -print0 | xargs -0 rm        # via xargs (names with spaces)
find . -type f -printf '%s %p\n' | sort -rn | head # the largest files (-printf)

{} + batches arguments (faster), {} \; runs one at a time. -print0/xargs -0 are safe for names with spaces (see xargs).

"Permission denied" clutters the output

Drop the errors: find / -name foo 2>/dev/null.

It searches too deep / across other filesystems

-maxdepth N limits the depth (put it BEFORE other conditions); -xdev avoids crossing mount points (see mount).

Accidentally deleted the wrong thing with `-delete`

Always run it without an action first (just the listing), confirm the list, then add -delete/-exec rm. -delete implies -depth — the order of conditions matters.

find with -name finds nothing

The pattern must be quoted ("*.log"), otherwise the shell expands it before find sees it. For case-insensitivity, use -iname.

-exec is slow

{} \; runs the command once per file. Switch to {} + (batched) or xargs.