I was recently browsing my Fedora's /bin folder and noticed a binary named [. I did try to search the internet for more information on that, but I couldn't find anything useful. Running it through strace doesn't seem to produce anything useful for closer inspection too.

What is that? Should I be alarmed? Could it be the result of a system compromise? Should I run it? Does it belong to any package?

  • 4
    [ -f /bin/[ ] && printf "%s\n" "Don't panic" – jasonwryan Feb 10 '14 at 0:11
  • @jasonwryan Yeah, it took me a while to figure it out. I couldn't find much information for it on the net, and Google didn't help much. Posted it here in hopes that it might help the next one who's in my shoes. – NlightNFotis Feb 10 '14 at 0:12
  • 10
    Run man [ to see what the [ command is! – Gilles 'SO- stop being evil' Feb 10 '14 at 0:23
  • @Gilles To be honest, I did and it mentioned something about bash, and figured that might be something else. It's not the first thing that comes to your mind when you see a binary with a name you've never seen before in your file system - or to put it another way, you have to find something more concrete to clear the doubts in your head. – NlightNFotis Feb 10 '14 at 0:25
  • 4
    Do arpm -qif /bin/[ to find out where it comes from... – vonbrand Feb 10 '14 at 4:09

The [ binary residing under the /bin tree in many GNU/Linux distributions is not something to be alarmed off. At least in my Fedora 19 it is a part of the coreutils package, as demonstrated below:

$ rpm -qf /bin/[

and is a synonym for test to allow for expressions like [ expression ] to be written in shell scripts or even interactive usage.

  • 16
    Note that shells like bash have a builtin test and [ and do not invoke the external binary. – jordanm Feb 10 '14 at 0:31
  • 1
    @jordanm, today most shells have them (and many other simple, common operations) as builtins. But that wasn't allways so (or is so in all shells). It might even be mandated by POSIX. – vonbrand Feb 10 '14 at 4:08
  • 2
    @vonbrand pubs.opengroup.org/onlinepubs/009695399/utilities/test.html You are right. A test command [ is required by this specification. – yegle Feb 10 '14 at 7:08
  • @vonbrand, only Bourne-like shells generally have a builtin [ command. Non-Bourne-like ones like (t)csh, rc, es generally don't (fish is an exception there). – Stéphane Chazelas Nov 4 '14 at 15:29

The [ command is the same as the test command.

It allows you to write rather terse conditional statements in shell scripts. From the SunOS manual page:

   if [ "$1" = "pear" ] || [ "$1" = "grape" ] || [ "$1" = "apple" ]

If you remove it, scripts will break!

  • Scripts written for shells that don't have [ as a built-in command will break. Most shells do. Still, I certainly wouldn't recommend removing /bin/[. – Keith Thompson Feb 13 '14 at 23:28
  • @KeithThompson, all shells have [ builtin, it's scripts that have non-shell applications execute [ that will break. Like find ... -exec [ -f {} ] \; or env LC_ALL=C [ -f bar ] – Stéphane Chazelas Feb 25 '14 at 22:05
  • @StephaneChazelas: All shells? (csh and tcsh don't, but perhaps that's beside the point.) I don't think I've seen an sh-derived shell that doesn't have [ as a builtin, but don't think [ was a builtin in the original Bourne shell. In any case, removing /bin/[ would certainly be a bad idea. – Keith Thompson Feb 25 '14 at 22:17
  • Minor quibble: test and [ are almost the same. [ requires a closing ]; test does not allow it (or rather doesn't treat an argument of ] specially). – Keith Thompson Feb 25 '14 at 22:22

The [ is always given as an equivalent to test, but I had'nt seen the ] mentioned explicitly, although it is always there. I have just now found this in http://ss64.com/bash/test.html :

When the [ form is used, the last argument to the command must be a ]

which is reassuring -- at last I have completion as they say.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.