How To Tell From Which RPM Package Does A File Comes From

Identifying which rpm package a file comes from is necessary to determine the rpm package belonging to. In other times, if a new file just suddenly comes up from a suspicious server folder, you can initiate a rpm query to identify the source rpm package that file belongs to or part of.

Basically, rpm package manage features a lot of parameters to hold and expand package description, files, rpm package version, and further rpm details.

Here's how to tell which rpm package source a file belongs to or part of.

Rpm Query To Tell RPM Package Source of a File

For example, we want to query which rpm package does /etc/mstab is part of or belongs to?

Simply issue

# rpm -qf /etc/mstab

Result:

setup-2.6.14-1.fc9.noarch

The above display setup-2.6.14-1.fc9.noarch as the source rpm package of the /etc/mstab file.

File Verification from RPM Package Source

Now, to confirm and verify if /etc/mstab file is part of setup-2.6.14-1.fc9.noarch rpm package, simply

# rpm -ql setup-2.6.14-1.fc9.noarch | grep mtab

The above command should give you the full file path location since /etc/mtab file is part of setup-2.6.14-1.fc9.noarch rpm package.

All is done.