I was recently browsing my Fedora's /bin folder and noticed a binary named [.
I did try to search the internet for more information on that, but I couldn't find anything useful. Running it through strace doesn't seem to produce anything useful for closer inspection too.
What is that? Should I be alarmed? Could it be the result of a system compromise? Should I run it? Does it belong to any package?
The [ binary residing under the /bin tree in many GNU/Linux distributions is not something to be alarmed off. At least in my Fedora 19 it is a part of the coreutils package, as demonstrated below:
$ rpm -qf /bin/[
coreutils-8.21-13.fc19.x86_64
and is a synonym for test to allow for expressions like [ expression ] to be written in shell scripts or even interactive usage.
bash have a builtin test and [ and do not invoke the external binary.
– jordanm
Feb 10 '14 at 0:31
[ is required by this specification.
– yegle
Feb 10 '14 at 7:08
[ command. Non-Bourne-like ones like (t)csh, rc, es generally don't (fish is an exception there).
– Stéphane Chazelas
Nov 4 '14 at 15:29
The [ command is the same as the test command.
It allows you to write rather terse conditional statements in shell scripts. From the SunOS manual page:
if [ "$1" = "pear" ] || [ "$1" = "grape" ] || [ "$1" = "apple" ]
then
command
fi
If you remove it, scripts will break!
[ as a built-in command will break. Most shells do. Still, I certainly wouldn't recommend removing /bin/[.
– Keith Thompson
Feb 13 '14 at 23:28
[ builtin, it's scripts that have non-shell applications execute [ that will break. Like find ... -exec [ -f {} ] \; or env LC_ALL=C [ -f bar ]
– Stéphane Chazelas
Feb 25 '14 at 22:05
[ as a builtin, but don't think [ was a builtin in the original Bourne shell. In any case, removing /bin/[ would certainly be a bad idea.
– Keith Thompson
Feb 25 '14 at 22:17
test and [ are almost the same. [ requires a closing ]; test does not allow it (or rather doesn't treat an argument of ] specially).
– Keith Thompson
Feb 25 '14 at 22:22
The [ is always given as an equivalent to test, but I had'nt seen the ] mentioned explicitly, although it is always there. I have just now found this in http://ss64.com/bash/test.html :
When the [ form is used, the last argument to the command must be a ]
which is reassuring -- at last I have completion as they say.
[ -f /bin/[ ] && printf "%s\n" "Don't panic"– jasonwryan Feb 10 '14 at 0:11man [to see what the[command is! – Gilles 'SO- stop being evil' Feb 10 '14 at 0:23bash, and figured that might be something else. It's not the first thing that comes to your mind when you see a binary with a name you've never seen before in your file system - or to put it another way, you have to find something more concrete to clear the doubts in your head. – NlightNFotis Feb 10 '14 at 0:25rpm -qif /bin/[to find out where it comes from... – vonbrand Feb 10 '14 at 4:09