Discover to which package a file belongs to

Related Packages and Files

Sometimes you want to know the related package of a file, before installation, or when it is already there. This is of great help during system hardening or general system cleanups. In this article we have a look at several ways to determine the relationships between files and the package they belong to. We have gathered this information for multiple Linux distributions.

CentOS, Fedora, RHEL

Show files for RPM packages

rpm -qlp /path/to/file.rpm

Show files for packages on the repository

If you use dnf, then you can query files from the packages that are in your repositories. The package itself does not have to be installed.

dnf repoquery -q -l packagename

Use the -q option with dnf to show only the relevant output.

Query related packages from repository packages with DNF

Show files per installed package

To show what files are in a package, use the rpm command.

rpm -ql package

If you have the file name, you can turn this around and find the related package.

rpm -qf /bin/ps

The output will provide the package and its version.

Screenshot of querying a file and its related package with rpm tool

To just see the package name, use the –queryformat option.

rpm -qf /bin/ps --queryformat '%{NAME}'

With yum you can do a similar request to see the related package.

yum whatprovides /bin/ps

And with DNF there is the provides argument.

dnf provides /bin/ps

This will give you possibly multiple hits, as a file can be part of packages from different repositories.

Show related packages from installed file or binary with DNF

This data is less easy to parse due to the different types of lines.

Debian and Ubuntu

Discover related package

If you want to find the related package of a binary (or file), we first have to know the full path. If you know the binary, then use the which command to discover where it is stored. Using the find command is another option, but may be less efficient. With the dpkg package management tool we can find the related package.

dpkg -S /usr/sbin/atd | awk -F: ‘{print $1}’

Without the awk command, the output will look like this.

Determine file and its related-package on Debian and Ubuntu

Show files installed by package

If you already know the package name, you can quickly look up the files that are installed by a Debian package.

dpkg -L package

Let’s do the same for the at package and see what it exactly installs (and where).

Show files installed by a Debian package


The first option is using equery, which is part of the package app-portage/gentoolkit.

equery files <installed package>

The package itself should be installed.

Next alternative is qlist, which is part of app-portage/portage-utils

qlist <installed package>


Systems running the distributions from SuSE can use the zypper tool to find the link between a file and a package.

Show related package

zypper what-provides /bin/ps



Got more useful commands to share? Let it know in the comments and we add them to the article.

Automate security audits with Lynis and Lynis Enterprise
Lynis Enterprise screenshot to help with system hardening

This blog post is part of our Linux security series to get Linux (and Unix-based) systems more secure.

Daily security checks

Want to go to the next level of security scanning and system hardening? Start with automated security scans for Linux: Lynis and Lynis Enterprise.

Automate Scanning »


Leave a Reply

Your email address will not be published. Required fields are marked *