Match Files to Packages in Red Hat-based Operating Systems

On Red Hat-derived systems (RHEL, CentOS, Fedora, Rocky, Alma), the rpm package manager tracks every installed file against its owning package. This is essential during reconnaissance for identifying what software is installed, verifying package integrity, and finding configuration files. ¹

Common queries

# List all installed packages
rpm -qa
 
# List all files installed by a package
rpm -ql $PACKAGE_NAME
 
# Find which package owns a specific file
rpm -qf /full/path/to/file

Additional useful queries

# Show package info (version, description, install date)
rpm -qi $PACKAGE_NAME
 
# List configuration files in a package
rpm -qc $PACKAGE_NAME
 
# Verify package integrity (check for modified files)
rpm -V $PACKAGE_NAME
 
# List packages sorted by install date (newest first)
rpm -qa --last

Sources

• rpm(8) — Linux manual page

Related: linux-reconnaissance-commands, aix-fileset-information, unix-permissions

Footnotes

1. rpm(8) — Linux manual page ↩