This guide will help you identify the package that owns / provides a particular file on your Ubuntu system. All commands in this article have been tested on Ubuntu 18.04 and Ubuntu 16.04 Desktop and Server edition.
Sometimes it is necessary to know the package that adds files to your system, usually this is important for monitoring and security purposes, such as preventing rootkits and any form of intrusion on your Linux server.
Below is a list of commands that will come in handy for this task.
dpkg is a Debian package management tool used to install, remove, update and manage Debian packages. You can use the dpkg package management tool to identify the package that the file provides. The following options are possible:
-S, – search: they are used to find the filename from installed packages.
As an example, let’s try to identify the package that /etc/updatedb.conf provides.
# dpkg -S /etc/updatedb.conf mlocate: /etc/updatedb.conf
As you can see, the file was written to the file system using the mlocate package.
You can also do the same for the binary, for example
# dpkg -S /bin/sync coreutils: /bin/sync
If you don’t know the absolute path to the command, you can use the command
whichto find it on the fly.
# dpkg -S `which ping` iputils-ping: /bin/ping
# dpkg -S $(which ping) iputils-ping: /bin/ping
Apt-file is a Debian command line tool that can be used to find files in packages for the APT package management system. If you try to run a command when it is not installed, it will ask you to install it.
# apt-file search vim The program 'apt-file' is currently not installed. You can install it by typing: apt install apt-file
By default, the system cache is empty. Run the following command as root user to refresh the cache.
# apt-file update
Use the syntax:
# apt-file search <file>
for instance: To find the package that created the /etc/nginx/nginx.conf file, use the command:
# apt-file search /etc/nginx/nginx.conf nginx-common: /etc/nginx/nginx.conf
You can see from the output that the file was created by installing the package
Using the Ubuntu Packages web interface
The third way is to use the Ubuntu Packages web search interface available from the Ubuntu Packages page (https://packages.ubuntu.com/). Enter a keyword and click on the search box.
The two commands apt-file and dpkg are sufficient to find a file from a package on Ubuntu and all Debian-based Linux distributions. This can help you find a package to reinstall if it is corrupted from a file or is tracking unknown files on your file system.