Which command locates all files with the setuid bit set on a Linux system?

• A. find / -perm 4000 -type f
• B. find / -perm 2000 -type f
• C. find / -perm -4000 -type f 2>/dev/null
• D. ls -l /bin/su /usr/bin/passwd

Answer: (C)

The setuid bit is indicated by the 4000 flag in the permission bits, and to locate every file that has that bit on, you want to test for at least that bit being set rather than requiring an exact combination of bits. Using a leading dash with -perm, as in -perm -4000, tells find to match any file whose permissions include the setuid bit, no matter what the other bits are. Adding -type f restricts the results to regular files, and redirecting 2>/dev/null silences "Permission denied" messages when traversing directories from the root.

So the best approach is to run: find / -perm -4000 -type f 2>/dev/null

The other options are off for this purpose: matching 4000 exactly would miss many setuid files that have additional bits set, using 2000 would target the setgid bit, and listing specific files doesn’t search the filesystem for all setuid entries.