I'm trying to put together a command to find SUID System Executables, which are not the default ones in RHEL.

To do this, I'm pulling a list of the local File System (df --local -P), piping it over to grep to remove the header (grep -v ^Filesystem), and then trying to use awk to grab the 6th column, and run a search based on that folder to see if there are any SUID System Executables (awk '{ find $6 -xdev -type f -perm -4000 -print }).

The problem I'm running into is that I get a syntax error when I have -print on the find command, but I get no output when I leave it out. I'm not sure if I really understand what is going on, and therefore how to fix the failure. This is where I need help :-).

Once I have this finished, my next step is to take a pre-defined array of executables that I know by default should have the SUID set, and remove them from the output.

df --local -P | grep -v ^Filesystem | awk '{ find $6 -xdev -type f -perm -4000 -print }'
awk: { find $6 -xdev -type f -perm -4000 -print }
awk:                                      ^ syntax error

find is an executable not an awk function. S, if you want to call an executable within awk, you have to do that with the system() function.

cmd | awk '{system("find " $6 " -xdev -type f -perm -4000 -print")}'
  • Thank-you! I can't believe how many stupid errors I make with this stuff, being new to Linux scripting. I should have caught that one, but thank you for saving me more time banging my head. That makes perfect sense.
    – Doug
    Apr 17 '15 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.