find -perm: Match Files by Permission Bits
find -perm matches files whose permission bits meet a given mode.
Permission audits catch scripts that lost their +x bit or files that became world writable. -perm expresses exact, any, and all-of-these matches.
What it does
find -perm MODE matches files whose permission bits exactly equal MODE. A leading slash, -perm /MODE, matches files with any of those bits set; a leading minus, -perm -MODE, matches files with all of those bits set. Modes can be octal (644) or symbolic (u+x).
Common usage
find . -type f -perm -u+x # any file the owner can execute
find . -type f -perm /o+w # world-writable files
find . -type f -perm 600Options
| Form | What it does |
|---|---|
| -perm MODE | Permission bits exactly equal MODE |
| -perm -MODE | All of the MODE bits are set |
| -perm /MODE | Any of the MODE bits are set (GNU) |
| -perm +MODE | Any of the MODE bits set (BSD/older GNU) |
In CI
Use -perm -u+x to confirm scripts kept their executable bit after a checkout, and -perm /o+w to flag world-writable files a security gate should reject. Symbolic modes like u+x are clearer than raw octal in pipeline output.
Common errors in CI
The "any of these bits" syntax differs: GNU find uses -perm /MODE while older GNU and BSD/macOS find use -perm +MODE. GNU removed +MODE, so a script using -perm +o+w may fail with "find: invalid mode" on new GNU; switch to /o+w. An exact -perm 644 match is stricter than people expect, missing files with extra bits set.