32

I was recently browsing my Fedora's /bin folder and noticed a binary named [. I did try to search the internet for more information on that, but I couldn't find anything useful. Running it through strace doesn't seem to produce anything useful for closer inspection too.

What is that? Should I be alarmed? Could it be the result of a system compromise? Should I run it? Does it belong to any package?

7
  • 4
    [ -f /bin/[ ] && printf "%s\n" "Don't panic"
    – jasonwryan
    Feb 10, 2014 at 0:11
  • @jasonwryan Yeah, it took me a while to figure it out. I couldn't find much information for it on the net, and Google didn't help much. Posted it here in hopes that it might help the next one who's in my shoes. Feb 10, 2014 at 0:12
  • 10
    Run man [ to see what the [ command is! Feb 10, 2014 at 0:23
  • @Gilles To be honest, I did and it mentioned something about bash, and figured that might be something else. It's not the first thing that comes to your mind when you see a binary with a name you've never seen before in your file system - or to put it another way, you have to find something more concrete to clear the doubts in your head. Feb 10, 2014 at 0:25
  • 4
    Do arpm -qif /bin/[ to find out where it comes from...
    – vonbrand
    Feb 10, 2014 at 4:09

3 Answers 3

37

The [ binary residing under the /bin tree in many GNU/Linux distributions is not something to be alarmed off. At least in my Fedora 19 it is a part of the coreutils package, as demonstrated below:

$ rpm -qf /bin/[
coreutils-8.21-13.fc19.x86_64

and is a synonym for test to allow for expressions like [ expression ] to be written in shell scripts or even interactive usage.

4
  • 16
    Note that shells like bash have a builtin test and [ and do not invoke the external binary.
    – jordanm
    Feb 10, 2014 at 0:31
  • 1
    @jordanm, today most shells have them (and many other simple, common operations) as builtins. But that wasn't allways so (or is so in all shells). It might even be mandated by POSIX.
    – vonbrand
    Feb 10, 2014 at 4:08
  • 2
    @vonbrand pubs.opengroup.org/onlinepubs/009695399/utilities/test.html You are right. A test command [ is required by this specification.
    – yegle
    Feb 10, 2014 at 7:08
  • @vonbrand, only Bourne-like shells generally have a builtin [ command. Non-Bourne-like ones like (t)csh, rc, es generally don't (fish is an exception there). Nov 4, 2014 at 15:29
5

The [ command is the same as the test command.

It allows you to write rather terse conditional statements in shell scripts. From the SunOS manual page:

   if [ "$1" = "pear" ] || [ "$1" = "grape" ] || [ "$1" = "apple" ]
   then
       command
   fi

If you remove it, scripts will break!

4
  • Scripts written for shells that don't have [ as a built-in command will break. Most shells do. Still, I certainly wouldn't recommend removing /bin/[. Feb 13, 2014 at 23:28
  • @KeithThompson, all shells have [ builtin, it's scripts that have non-shell applications execute [ that will break. Like find ... -exec [ -f {} ] \; or env LC_ALL=C [ -f bar ] Feb 25, 2014 at 22:05
  • @StephaneChazelas: All shells? (csh and tcsh don't, but perhaps that's beside the point.) I don't think I've seen an sh-derived shell that doesn't have [ as a builtin, but don't think [ was a builtin in the original Bourne shell. In any case, removing /bin/[ would certainly be a bad idea. Feb 25, 2014 at 22:17
  • Minor quibble: test and [ are almost the same. [ requires a closing ]; test does not allow it (or rather doesn't treat an argument of ] specially). Feb 25, 2014 at 22:22
2

The [ is always given as an equivalent to test, but I had'nt seen the ] mentioned explicitly, although it is always there. I have just now found this in http://ss64.com/bash/test.html :

When the [ form is used, the last argument to the command must be a ]

which is reassuring -- at last I have completion as they say.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.