Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to find file types that are executable from the kernel's point of view. As far as I know all the executable files on Linux are ELF files. Thus I tried the following:

find * | file | grep ELF

However that doesn't work; does anybody have other ideas?

share|improve this question
How did it not work? – Levon Jun 5 '12 at 14:25
@Levon It shows me the usage help of file. Probably file can't handle the input of find. – Ian Jun 5 '12 at 15:19
3  
Just a small side node, with binfmt_misc you can run arbitrary files like classes, exes etc. en.wikipedia.org/wiki/Binfmt_misc – Ulrich Dangel Jun 5 '12 at 15:35
@UlrichDangel: +1 for mentioning binfmt_misc. Binary formats are as flexible as filesystems on Linux. By all means, find ELFs, but (a) you're not finding all executable files, (b) the ELFs you find aren't necessarily executable in practice. For instance, a SPARC64 ELF won't run on an x86. – Alexios Jun 5 '12 at 16:25
No. The a.out files are executable as well, and files marked executable like bashscripts with appropriate shebang. – user unknown Jun 5 '12 at 16:42
show 5 more comments

3 Answers

up vote 3 down vote accepted

Later edit: only this one does what jan needs: thank you huygens;

find . -exec file {} \; | grep -i elf

share|improve this answer
find . -exec file {} \; | grep -i elf is what I was looking for, thanks! – Ian Jun 5 '12 at 15:24
I think your first command doesn't work. It is searching for files with a name like "*elf *" (without taking into account the case). You want to grep the output just likeyou did in the second proposal. – Huygens Jun 5 '12 at 15:26
@huygens I tested it before I posted and it works. touch elf 1elf 1ELF2 elf2</code> ; my command will find all the elf related files; – fromnaboo Jun 5 '12 at 15:28
@huygens I tested it before I posted and it works. touch elf 1elf 1ELF2 elf2 ; my command will find all the elf related files (just like the grep); you got that error because you have copy pasted it (i think) and it has a blank space not needed, in the " " . but if I write "asteriskELFasterisk" in <code>, the html eats my asterisks!!! – fromnaboo Jun 5 '12 at 15:35
If you do cd /sbin; find . -iname "*elf*" -exec file {} \; it will report no files :) however cd /sbin; find . -exec file {} \; | grep -i elf will report several. Hence my point is correct. The -iname option of find just check if the filename match the pattern. So if a ELF executable is called mkswap, you won't find it. PS: I've tried both "*elf*" and *elf *" and as I would expect no binaries are found in /sbin which is incorrect. – Huygens Jun 5 '12 at 15:36
show 3 more comments
up vote 2 down vote

I would look for regular files first as binary executable are belonging to that type of files.

Then I would request for each regular file the mime type and if it matches application/x-executable then it is a binary executable files (that should match Linux executable files, Windows one for instance match application/x-dosexec).

find . -type f -print0 | xargs -0 -n 10 file -i | grep "application/x-executable"

Trying this command I found a discrepency with find . -type f -print0 | xargs -0 -n 10 file | grep -w ELF. It seems that the command file is buggy and detects ELF executable as ELF shared object. So even though the command is theoricaly correct, in practice it is incomplete.

So we have to look for ELF executables and shared objects but exclude all files with a name of *.so and .so.

find . -type f ! \( -name "*.so.*" -o -name "*.so" \) -print0 | xargs -0 -n 10 file -i | egrep "application\/x-sharedlib|application\/x-executable"

It is not probably perfect, but that's the pretty close.

share|improve this answer
Actually my first answer is not fully correct, as some binary executable files are detected by file -i as application/x-sharedlib and not application/x-executable. – Huygens Jun 5 '12 at 15:50
up vote 1 down vote

Take a look on -executable flag of find.

share|improve this answer
That's not quite what I want, I don't want files that are tagged as executable files but I want to find ELF files, files that are recognized as executable by the kernel. – Ian Jun 5 '12 at 15:21
The flag executable match permissions (so directories too), see the man page: Matches files which are executable and directories which are searchable (in a file name resolution sense). – Huygens Jun 5 '12 at 15:24
@Huygens: So directories are files (everything is a file on Unix), but to exclude them, just use find -type f -executable. – user unknown Jun 5 '12 at 16:48
1  
@Ian: But Shellscripts are executable by the kernel. Executable flag + appropriate shebang means executable file. Or flag + binary-elf, or flag + a.out, or flag + binfmt-patch. – user unknown Jun 5 '12 at 16:49
1  
@Huygens: No, you can execute shell scripts with exec-calls, see: en.wikipedia.org/wiki/Shebang_%28Unix%29 . If there is a shebang, only the rest of the script is executed by the interpreter. Since 1980. – user unknown Jun 5 '12 at 17:19
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.