How to know all files in Ubuntu having stickybits?

Question

I now understand sticky bits and why I should use them based on my question: What is the "t" letter in the output of "ls -ld /tmp"?

Now I have a new question.

How could I list all files that have stickybits in my Ubuntu Linux?

Answer 1

This command should serve you (-perm flag used to be +1000)

find / -perm /1000 

Details:

To add a stickybit Numerical/octal way you have to add "1" to the beginning of the directory. example:

chmod 1757 ~/Desktop/test

so know to search for a stickybit you have to search for all files having "this one" which means having permissions +1000 (1 here goes for stickybit and "000" for whatever the initial permissions are)

So this command will search the whole filesystem for every file that have permission "+1000".

Now if you have test this command then you can notice that many errors raise here which make the output unclear, and this errors happen because you are trying to search in some places and you don't have a read access on it.

So to get rid of these errors you can redirect those errors to /dev/null

 find / -perm +1000 2> /dev/null

Moreover you can redirect the output to a file"output.txt" rather than keep output in the "terminal stdout"

find / -perm +1000 >output.txt 2>/dev/null

Answer 2

I'd just like to make a couple of points, expanding on Hadi's very good answer. First of all, the sticky bit has no effect on files in Linux. As explained in man chmod:

STICKY FILES

On older Unix systems, the sticky bit caused executable files to be hoarded in swap space. This feature is not useful on modern VM systems, and the Linux kernel ignores the sticky bit on files. Other kernels may use the sticky bit on files for system-defined purposes. On some systems, only the superuser can set the sticky bit on files.

Therefore, there's no point in looking for files with the sticky bit set so we may as well limit the search to directories only, which will speed things up enormously. This can be done using find:

find / -type d -perm /1000 2>/dev/null

Also, note that I'm using the -perm /mode syntax instead of -perm +mode. This is because +mode is deprecated and can return in unexpected results. From man find:

   -perm /mode
          Any of the permission bits mode are set for the file.  

   -perm +mode
          Deprecated,  old way of searching for files with any of the per‐
          mission bits in mode set.  You should use -perm  /mode  instead.
          Trying to use the `+' syntax with symbolic modes will yield sur‐
          prising results.  For example, `+u+x' is a valid  symbolic  mode
          (equivalent to +u,+x, i.e. 0111) and will therefore not be eval‐
          uated as -perm +mode but instead as  the  exact  mode  specifier
          -perm  mode  and so it matches files with exact permissions 0111
          instead of files with any execute bit set.  If  you  found  this
          paragraph  confusing,  you're  not alone - just use -perm /mode.
          This form of the -perm test  is  deprecated  because  the  POSIX
          specification  requires  the  interpretation of a leading `+' as
          being part of a symbolic mode, and so we switched to  using  `/'
          instead.

Finally, you can also use symbolic instead of octal modes which might be easier to read if you're not used to it:

find / -type d -perm +'+t' 2>/dev/null