I am currently having a hard time understanding the following find command:

find / -o -group `id -g` -perm \ 
 -g=w -perm -u=s -o -perm -o=w\
 -perm -u=s -o -perm -o=w \
 -perm -g=s -ls 

Specifically this portion:

find / -o -group `id -g` -perm -g=w -perm -u=s

I understand that -o works just like an or operator. If that were the case would not that particular line mean find all files in / or files with group write permission and with suid set that are the same group as mine. Which still basically means all files in / directory. Can someone explain to me what I am missing?


From the find(1) manpage:

The -H, -L and -P options control the treatment of symbolic links. Command-line arguments following these are taken to be names of files or directories to be examined, up to the first argument that begins with -, or the argument ( or !. That argument and any following arguments are taken to be the expression describing what is to be searched for. If no paths are given, the current directory is used. If no expression is given, the expression -print is used (but you should probably consider using -print0 instead, anyway).

The starting point, / in your case, isn't processed in the same way as expressions. The latter,

-o -group `id -g` -perm \ 
-g=w -perm -u=s -o -perm -o=w\
-perm -u=s -o -perm -o=w \
-perm -g=s -ls

in your case, are applied to all the files found from the starting point. -o is a binary operator which requires expressions on both sides, so this command actually fails:

find: invalid expression; you have used a binary operator '-o' with nothing before it.

If you remove the first -o, it becomes equivalent to

   ( -group `id -g` -perm -g=w -perm -u=s )
-o ( -perm -o=w -perm -u=s )
-o ( -perm -o=w -perm -g=s -ls )

which only lists files which are setgid and writable by others. The first two groups of expressions have no action so they are applied but don't have any visible effect.

|improve this answer|||||
  • Can I ask why the first two group of expressions have no visible effect? Do they not filter the results as well? – MykelXIII May 7 '16 at 13:24
  • They filter the results, but they don't have any action. Because there is an action (-ls) specified in one of the groups, the default (-print) disappears; so the first two groups don't act on their results. – Stephen Kitt May 7 '16 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.