4

I'm trying to find files with permissions that exceed 755. Using the solution from another post here I have been able to get mostly what I want:

find /bin -type f -perm -755 ! -perm 755

This does ignore anything at 755 or below, but it returns files with the SUID and SGID bits set. I would like to ignore these. Is it possible to do this in one command? I've tried multiple ! -perm arguments with both 2000 and 4000 but that didn't do anything.

I have also used 2755 and 4755 in sequential commands, but again, I would prefer covering both in one command.

I was thinking the -o operator would help, but I'm not sure how to do that with an argument that contains a negated pattern like I'm using. I tried it as

find . -type f \(-perm -2755 ! -perm 2755 -o -perm -4755 ! -perm 4755\)

but that just threw the paths must precede expression error.

Improve this question
1
  • Note that 760 is greater than 755 but has narrower permissions, while 77 is smaller but has wider permissions. ITYM you want to find files that have some bits among 0777 (the lowest 9 bits) set in addition to the 0755 ones (which the accepted answer covers).
    – Stéphane Chazelas
    Aug 19, 2015 at 22:12

2 Answers 2

Reset to default
5

The solution that works with any POSIX compatible find is the following:

find DIR -type f -perm -0755 ! -perm 0755 ! -perm -04000 ! -perm -02000 -print

As previously noted, with GNU find you can collapse the setuid and setgid tests into ! -perm /06000.

Improve this answer
1
  • 1
    Thanks for providing that.  BTW, there's a newer edition (Issue 7) of the POSIX standard; the new find specification is here.  The wording for -perm is changed there, but it's just clarification, with no difference in the meaning (as far as I can tell).
    – Scott - Слава Україні
    Aug 15, 2015 at 17:25
3

I'm not sure I understand what you want, but, based on my best guess,

find  (starting_directory)  -type f  -perm -755  ! -perm 755  ! -perm /6000

would seem to do it.  -perm /mode means "Any of the permission bits mode are set for the file."  So -perm /6000 should match only files that are SUID or SGID (or both), and ! -perm /6000 should exclude those files.

BTW, I assume that the -type -f in your question is a typo, since you got it right (-type f, without the second -) in your second example.

P.S. It still doesn't do what you want, but you can get your second example to do something (i.e., list some files, and not say paths must precede expression) simply by changing it to

find . -type f \( -perm -2755 ! -perm 2755 -o -perm -4755 ! -perm 4755 \)

i.e., separate the \( and \) from the adjacent arguments (with spaces).

Improve this answer
3
  • The slash used in front of the octal permissions will cause a syntax error from find.
    – schily
    Sep 4, 2015 at 14:10
  • The slash used in front of permissions will likely be rejected by any strictly POSIX-compliant version of find, as pointed out in user3188445's answer, posted three weeks ago.  My answer works in the widely-available GNU version of find.
    – Scott - Слава Україні
    Sep 4, 2015 at 20:08
  • Do you like to use a find implementation that needs the option -noleaf in order to work correctly? Do you know that this is required to make gfind to work correctly?
    – schily
    Sep 4, 2015 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .