Find and differences between -perm /6000 and -perm /u+s

Question

I have been trying to find setuid executables using a `one liner'.

The line I first tried was:

find / -perm /u+s -type f

Then I found a line which is similar but gives different results:

find / -perm /6000 -type f

These look identical as far as I can tell, but the first one doesn't show as many results as the second one (mostly ones with weird groups are missing). Why, what is different?

Answer 1

Most people aren't aware but the Unix permissions are actually not just User, Group, and Others (rwx). These 3 triads are the typical permissions that allow users, groups, and other users access to files & directories. However there is also a group of bits that precede the User bits. These bits are referred to as "Special Modes".

It's more of a shorthand notation that you don't have to explicitly set them when dealing with a tool such as chmod.

$ chmod 644

Is actually equivalent to:

$ chmod 0644

Here's the list of bits:

excerpt wikipedia article titled: chmod

Flag                Octal value     Purpose
----                -----------     -------
S_ISUID             04000           Set user ID on execution
S_ISGID             02000           Set group ID on execution
S_ISVTX             01000           Sticky bit
S_IRUSR, S_IREAD    00400           Read by owner
S_IWUSR, S_IWRITE   00200           Write by owner
S_IXUSR, S_IEXEC    00100           Execute/search by owner
S_IRGRP             00040           Read by group
S_IWGRP             00020           Write by group
S_IXGRP             00010           Execute/search by group
S_IROTH             00004           Read by others
S_IWOTH             00002           Write by others
S_IXOTH             00001           Execute/search by others

Your Question

So in your first command you're looking for u+s, which would work out to be bit 04000. When you use the numeric notation you're asking for bits 04000 AND 02000. This would give you files with user or group setuid bits set.

Further Reading

I highly suggest anyone that wants to understand the permissions better in Unix, to read the Wikipedia page about chmod. It breaks it down very simply and is a excellent reference when you forget.

References

• chmod Tutorial

Answer 2

Mode 6000 is u+s,g+s, not just u+s (that would be 4000).

find / -perm /u+s or find / -perm /4000 only finds files that have the setuid bit set. find / -perm /u+s or find / -perm /6000 finds files that have the setuid bit set or the setgid bit set.