Bash – List all php files inside a folder with modification date and permissions

bashfind

I did write a script which checks all php files within a given folder for changes every hour, so I can detect possible code injections and their integrity. It's working so far, but my approach seems a little slow and forks too many ls processes. Here's the code:

/usr/bin/find /home/www -name "*.php" -exec ls -l \{} \;

Is there a better way?

Please note I need, at a minimum, full path, permissions, owner, group and modification time for each of the files.

Thanks!

Best Answer

Find has a built-in action "-ls" that should do what you need (see below). If that isn't quite the info you're after, you can also use -printf and format directives to control exactly what gets printed.

james@Brindle:/tmp/blah$ time /usr/bin/find . -name "*.php" -exec ls -l \{} \;
-rw-r--r--  1 james  wheel  0  8 Jul 08:50 ./other.php
-rw-r--r--  1 james  wheel  0  8 Jul 08:50 ./thing.php

real    0m0.015s
user    0m0.005s
sys     0m0.008s
james@Brindle:/tmp/blah$ time find . -ls
1631212        0 drwxr-xr-x    4 james            wheel                 136  8 Jul 08:50 .
1631215        0 -rw-r--r--    1 james            wheel                   0  8 Jul 08:50 ./other.php
1631213        0 -rw-r--r--    1 james            wheel                   0  8 Jul 08:50 ./thing.php

real    0m0.006s
user    0m0.002s
sys     0m0.003s

Related Solutions

List all files without 775 or 777 permissions

find <some dirs> \! \( -perm 0777 -o -perm 0775 \)

Find all files recursively by a certain date

You can:

touch -m -t 201104052138.08 /tmp/timestamp

find /dir -newer /tmp/timestamp

The initial touch creates a file with an mtime of one second before your required timestamp, and the find then uses that to find files modified (in terms of content) after that time.

You will also want to check permissions and group ownership. You can't use the above technique to do that, since touch can only change the atime and the mtime. So, you're better off determining what the correct permissions are, and just resetting them. For example, if typically your web files are owned by root with group www-pub, and have permissions 0755 for directories and 0644 for files, you can use

find /dir \! -user root

to find files and directories not owned by root and

find /dir \! -group www-pub

to find files and directories not owned by www-pub

the -perm flag to find can be used to find files based on permissions, too, but you're better off just setting things to what they should be.

find /dir -exec chown root:www-pub {} \;
find /dir -type f -exec chmod 0644 {} \;
find /dir -type d -exec chmod 0755 {} \;

Best Answer

Related Solutions

List all files without 775 or 777 permissions

Find all files recursively by a certain date

Related Topic