1

I want to find list of all suid binaries. I use the command

find / -perm 4000

However this does not give me any output. I understand that the SUID file may be in 4xxx permission mode. But if I issue the command

find / -perm -4000 (which all websites tell)

or the command

find / -perm +4000 

both give me the same result. As far I understand it should always be +4000 (because if it is user suid binary then the first byte should be 4, if group suid binary then the first byte should be 2 and if a sticky bit turned on directory then the first byte should be 1). Then how come -4000 also give results?

6

The use of -perm +mode seems to be deprecated. Maybe the help from man find can help to resolve your doubt:

-permmode

    File's permission bits are exactly mode (octal or symbolic). Since an exact match is required, if you want to use this form for symbolic modes, you may have to specify a rather complex mode string. For example -perm g=w will match only files which have mode 0020 (that is, ones for which group write permission is the only permission set). It is more likely that you will want to use the ‘/’ or ‘’ forms, for example -perm -g=w, which matches any file with group write permission. See the EXAMPLES section for some illustrative examples.

-perm–mode

    All of the permission bits mode are set for the file. Symbolic modes are accepted in this form, and this is usually the way in which would want to use them. You must specify ‘u’, ‘g’ or ‘o’ if you use a symbolic mode. See the EXAMPLES section for some illustrative examples.

-perm/mode

    Any of the permission bits mode are set for the file. Symbolic modes are accepted in this form. You must specify ‘u’, ‘g’ or ‘o’ if you use a symbolic mode. See the EXAMPLES section for some illustrative examples. If no permission bits in mode are set, this test matches any file (the idea here is to be consistent with the behaviour of -perm -000).

-perm+mode

    Deprecated, old way of searching for files with any of the permission bits in mode set. You should use -perm /mode instead. Trying to use the ‘+’ syntax with symbolic modes will yield surprising results. For example, ‘+u+x’ is a valid symbolic mode (equivalent to +u,+x, i.e., 0111) and will therefore not be evaluated as -perm +mode but instead as the exact mode specifier -perm mode and so it matches files with exact permissions 0111 instead of files with any execute bit set. If you found this paragraph confusing, you're not alone – just use -perm /mode. This form of the -perm test is deprecated because the POSIX specification requires the interpretation of a leading ‘+’ as being part of a symbolic mode, and so we switched to using ‘/’ instead.

Reference:

  • find (GNU findutils) 4.4.2
  • 1
    Reading manual pages and info files helps. – ikrabbe Jul 2 '15 at 6:48
  • @ikrabbe Yes, but in this case it is explicitly admitted by the author himself that it was a little confusing... We have to give him credit for the intellectual honesty :-) – Hastur Jul 2 '15 at 6:53
  • Oh, then I'm sorry. On the other hand, you can't say it too often, too read the manuals and reading manuals again and again helps too, sometimes. With having doubts, sleeping over the problem is a marvelous cure. And last but not least: The whole find command with all its options is a confusing beast. I try to avoid it (for example by du -a|grep ). – ikrabbe Jul 2 '15 at 7:00
  • No need to be sorry, what you said is holy: inside the manuals there's the answer. Unfortunately when you start to search for a solution, you know the problem consequences but often you don't precisely know its origin. While you enlarge your research your mind needs to select the proper information sources from the other ones. This helps to find the origin. Often the problem resides elsewhere from where you supposed in the beginning and you just discarded the source with the helpful information. A clean mind helps and is able to see what you are searching for and is under your nose... – Hastur Jul 2 '15 at 7:43
  • To be fair, find(1) says “Numeric arguments can be specified as +n for greater than n, -n for less than n, [or]  n for exactly n.” and it doesn’t say “… except for -perm; that’s a whole different kettle of fish.” – G-Man Says 'Reinstate Monica' Jul 3 '15 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.