11

All the howtos that I find on the web states:

Find all SUID files:
find / -perm -4000 -print
Find all SGID files:
find / -perm -2000 -print 

But that is not true. See:

$ ls -lah test
-r-sr-xr-x  1 user  user     0B Jan 24 22:47 test
$ 
$ 
$ stat -x test | grep Mode
  Mode: (4555/-r-sr-xr-x)         Uid: ( 1000/    user)  Gid: ( 1000/    user)
$ 
$ 
$ find test -perm 4000
$ find test -perm 2000
$

Question: So what is the truth? How can I really list all the SUID/SGID files?

  • Uhm, so why exactly is this "not true"? You did Read The Friendly Manual, right? File's permission bits are exactly mode (octal or symbolic). – 0xC0000022L Jan 24 '15 at 21:04
  • ** test** is a file. Find searches on directories. So you should use find on the directory where test resides. – Nils Jan 24 '15 at 21:04
  • 1
    @Nils: untrue. find (GNU find to be exact) will take directories and files alike. He/she simply misses the point of the -perm switch. Reading the manual would help. – 0xC0000022L Jan 24 '15 at 21:06
  • @0xC0000022L Interesting. My linux-manpage on CentOS 5 tells me it will only take directories. Is there much sense in running it on a file? – Nils Jan 24 '15 at 21:11
  • @Nils: nope there is no particular sense in doing it. But it won't you prevent from that folly. Regardless, at first glance I also thought this to be the issue. Alas, it isn't for this question. You can try by checking for some any bits on a file like this find $FILE -perm /7777 to see whether your find does it or prevents it. – 0xC0000022L Jan 24 '15 at 21:12
14

If you want to test for any of the bits, use /. I.e. for your use case:

find "$DIRECTORY" -perm /4000

and:

find "$DIRECTORY" -perm /2000

or combined:

find "$DIRECTORY" -perm /6000

You may use both folders and files as argument for GNU find.

Another, IMO better readable, approach is using the mnemonic shortcuts. I.e.:

find "$DIRECTORY" -perm /u=s,g=s

Caveat emptor

Keep in mind that the variants of find vary. They may also behave differently. Always read the friendly manual (RTFM).

6

By using the following command you can enumerate all binaries having SUID permission. The -perm -u=s flag of the find tool does the trick:

find / -perm -u=s -type f 2>/dev/null

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.