0

Example, I have two files

-rw-rw----  1 1000 1000   5 Sep 28 01:25 file1
-rw-rw----  1 1000 1000  13 Sep 28 01:25 file2

After echo "asdfg" >> file1 (file1 content was modified)

-rw-rw----  1 1000 1000  11 Sep 28 01:25 file1
-rw-rw----  1 1000 1000  13 Sep 28 01:25 file2

And chmod 770 file2 (file2 meta was changed)

-rw-rw----  1 1000 1000  11 Sep 28 01:25 file1
-rwxrwx---  1 1000 1000  13 Sep 28 01:25 file2

Run find . -mmin -5 within 5mins, result as expected because only file1 was modified

./file1

Tried find . -cmin -5 then I got this

./file2
./file1

Please help me on how to use find to list the one with permissions changed only?

Huy.PhamNhu
  • 111
  • 3

1 Answers1

0

If the timestamps are correct in each case, it looks like it's still less than five minutes since you created the files, which means the ctime test would trigger for that reason. Notably the timestamp on file1 does not change when you edit it, indicating that happened within the same minute of its creation (or last edit.)

Your syntax otherwise seems correct. Here's a simple example from my system (RHEL 7.4), with timestamps to clarify:

[testuser@dc0sandbox01 ~]$ date
Thu Sep 28 10:36:53 CEST 2017
[testuser@dc0sandbox01 ~]$ touch file1
[testuser@dc0sandbox01 ~]$ touch file2
[testuser@dc0sandbox01 ~]$ find . -cmin -1
.
./file1
./file2
[testuser@dc0sandbox01 ~]$ date
Thu Sep 28 10:37:09 CEST 2017

(wait for a minute)

[testuser@dc0sandbox01 ~]$ date
Thu Sep 28 10:38:11 CEST 2017
[testuser@dc0sandbox01 ~]$ find . -cmin -1
[testuser@dc0sandbox01 ~]$ chmod 660 file1
[testuser@dc0sandbox01 ~]$ find . -cmin -1
./file1
[testuser@dc0sandbox01 ~]$ date
Thu Sep 28 10:38:26 CEST 2017

If you still have problems, try using the stat command to show detailed information about each file:

[testuser@dc0sandbox01 ~]$ stat file1
  File: ‘file1’
  Size: 0               Blocks: 0          IO Block: 4096   regular empty file
Device: fd02h/64770d    Inode: 286973      Links: 1
Access: (0660/-rw-rw----)  Uid: (10131/testuser)   Gid: (10131/testuser)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2017-09-28 10:36:56.331274189 +0200
Modify: 2017-09-28 10:36:56.331274189 +0200
Change: 2017-09-28 10:38:21.872727064 +0200
 Birth: -
anlag
  • 26
  • 2
  • Hi, let me explain what I want to achieve. For example in your test after `chmod` file1, you modify content of file2. And then by some magic `find` syntax, you able to list the one with permission changed only which is file1, is this possible? In real usercase with large data, I don't really need to see the stats, just auto filter which is which and logging. – Huy.PhamNhu Sep 28 '17 at 15:50