is it possible to search file in the linux OS that have particular file attribute as this: ---S--l---

---S--l---  1  root    root          0 Mar  1004:25/opt/csTuner/iba/wys/tuer_lolk

What is S in the permissions:

S - the changes are written synchronously on the disk; this is equivalent to the `sync' mount option applied to a subset of the files.

My goal is to search a files that are written synchronously on the disk.

  • Might be a chattr attribute? – Sobrique Jun 11 '15 at 14:41
  • 1
    What command is that the output of? That doesn't match was lsattr displays here. – Stéphane Chazelas Jun 11 '15 at 15:03

The example in your question looks like the ls -l output, not the lsattr output. In the ls -l output, the first field is the mode, that is the type (regular, directory, symlink...) and permissions.

The S bit at that position means setuid but without execute permission for the user. Here given that none of user/group/other have execute permissions, that makes little sense. The l means the setgid bit is set but not execute. For a regular file, that means a file with mandatory locking enabled.

More likely here, the file was created with wrong permissions, like chmod 6000 instead of chmod 600.

Now, the "sync" S bit you're refering to is for the output of lsattr.

If you do chattr +S file on Linux, then the lsattr file output will look like:

--S----------e-- file

To find the files that have such a flag:

If the file names don't contain newline characters, you could do:

find . ! -type l -exec lsattr -d {} + | sed -n 's/^[^ ]*S[^ ]* //p'

Note that the position of the S on the line or the length of the ------- part is not guaranteed to be the same from one version of e2fsprogs to the next.

If you can't guarantee file names won't contain newline characters, you could make it instead:

(find .//. ! -type l -exec lsattr -d {} +; echo //) |
  sed -ne '/\/\//!{H;d;}' -e 'x; s|^[^ ]*S[^ ]* .//.|./|p'

(the start of each file name will be identified by .//).

  • Is there a particular advantage of find vs lsattr -R? – Sobrique Jun 11 '15 at 15:11
  • @Sobrique, lsattr -R doesn't give you the path on each line. – Stéphane Chazelas Jun 11 '15 at 16:42
find -perm

Is what you want - it'll allow you to specify an octal mode for 'find' to ... well, find.

You can find which perm to look for with 'stat' which will give you what it currently is.

So e.g.

find . -perm 4750

I don't recognise your bit flags well enough to tell you the octal mode of them, so you'll have to look for yourself.

Edit: As pointed out, these aren't 'normal' file permissions, but chattr attributes. So you have to do something a little bit different. I would approach it like this:


use strict;
use warnings;

open ( my $attrs, "|-", "lsattr -R /path" );

while ( <$attrs> ) {
   my ( $attrs, $filename ) = split; 
   if ( $attrs =~ m/S/ ) { 
        print $filename;

close ( $attrs );

Although you could probably instead:

lsattr -R | grep '^[-A-Za-z]*S[-A-Za-z]* '
  • Hmm, I recognised the 'S' as setuid with no execute. I didn't see a matching chattr flag for l. I'll come up with something else. – Sobrique Jun 11 '15 at 15:00
  • Yes, sorry, I think the OP's confused. It is ls -l output, nothing to do with file attributes. – Stéphane Chazelas Jun 11 '15 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.