1

I'm trying to put together a command to find SUID System Executables, which are not the default ones in RHEL.

To do this, I'm pulling a list of the local File System (df --local -P), piping it over to grep to remove the header (grep -v ^Filesystem), and then trying to use awk to grab the 6th column, and run a search based on that folder to see if there are any SUID System Executables (awk '{ find $6 -xdev -type f -perm -4000 -print }).

The problem I'm running into is that I get a syntax error when I have -print on the find command, but I get no output when I leave it out. I'm not sure if I really understand what is going on, and therefore how to fix the failure. This is where I need help :-).

Once I have this finished, my next step is to take a pre-defined array of executables that I know by default should have the SUID set, and remove them from the output.

df --local -P | grep -v ^Filesystem | awk '{ find $6 -xdev -type f -perm -4000 -print }'
awk: { find $6 -xdev -type f -perm -4000 -print }
awk:                                      ^ syntax error

1 Answer 1

4

find is an executable not an awk function. S, if you want to call an executable within awk, you have to do that with the system() function.

cmd | awk '{system("find " $6 " -xdev -type f -perm -4000 -print")}'
1
  • Thank-you! I can't believe how many stupid errors I make with this stuff, being new to Linux scripting. I should have caught that one, but thank you for saving me more time banging my head. That makes perfect sense.
    – Doug
    Commented Apr 17, 2015 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .