2

I am doing an online course and could do with some help please. Please see the image below. I am using find to locate a file with the SUID bit set. The question asks "What is the contents of the file named ‘immersive’, which is owned by user 'linux', with SUID and user execute permissions set? There are multiple files named 'immersive' find the correct one!" From the question I used the command

find . -perm /4100

I hope that is the correct octal permissions? In the image you will see two directories returned but when i run ls -la I am not seeing any file with the SUID set. Any ideas what I am doing wrong?

$ find . -perm /4100
.
./immersive
$ ls .
immersive
$ ls -la ./immersive
lrwxrwxrwx  1   root    root   23 Aug 20 14:25 ./immersive -> /lib/firmware/immersive
linux@find-command:~$ find . -perm /4100 . ./immersive 
linux@find-command:~$ ls -la 
total 24 
drwxr-xr-x 1  linux linux   4096 Oct 13 13:00 . 
drwxr-xr-x 1  root  root    4096 Oct 11 18:56 .. 
-rw------- 1  linux linux   134  Oct 13 13:00 .bash_history 
-rw-r--r-- 17 linux linux   220  Apr  4 2018 .bash_logout 
-rw-r--r-- 17 linux linux   3771 Apr  4 2018 .bashrc
-rw-r--r-- 17 linux linux   807  Apr  4 2018 .profile
lrwxrwxrwx 1  root  root    23   Aug 20 14:25 immersive -> /lib/firmware/immersive
  • Hi George I dont have a sudo account available to me so I am just running find. The above command gives me a different answer showing me just a . or period. If i then run ls -la I still do not see the file with the SUID bit set. I see linux@find-command:~$ find -user linux -perm /4100 . – user278930 Oct 13 '18 at 13:22
  • I think that you want -perm /4000 (iirc /4100 will also find any files with the owner's executable bit set) – steeldriver Oct 13 '18 at 13:44
  • 1
    @steeldriver The questions says "…, with SUID and user execute permissions set" so 4100 seems correct. – PerlDuck Oct 13 '18 at 13:46
  • 1
    Should the-user linux option not be included? – George Udosen Oct 13 '18 at 13:48
  • 1
    @PerlDuck but the /perm form matches any of the permission bits, no (i.e. logical OR of SUID and user-executable)? – steeldriver Oct 13 '18 at 13:51
3

See this question for an explanation of -perm /mode vs. -perm -mode. I admit, it's not very intuitive, but:

find . -type f -name immersive -user linux -perm -u=sx -ls
# or
find . -type f -name immersive -user linux -perm -4100 -ls

will do as you ask.

The -perm -4100 means: find any file that has 4 (=setuid) set AND 1 (=x) set for the user while ignoring the remaining bits (group and other).

The -perm /4100 on the other hand means: find any file that has EITHER 4 (=setuid) set OR 1 (=x) set for the user (or both) while ignoring the remaining bits.

So /mode will find more files than -mode.


In case it isn't obvious (because I focussed on the -perm flag): the others mean: find a file (-type f) with name immersive owned by user linux. All these conditions are ANDed.


To view the contents of the found files you can either cat them one by one, i.e. issue

cat .../immersive

for each found file or let the find command do that for you:

find . -type f -name immersive -user linux -perm -4100 -exec cat {} \;

This will find the files according to the conditions above but instead of printing their names and attributes (-ls) will execute the cat command for each found file.

  • Thanks for the explanation of the difference between -perm and /perm. I have tried both of the above commands but still don't find the file I need. The one with -u=sx gives an error of "unknown predicate -u=sx" – user278930 Oct 13 '18 at 14:35
  • @user278930 Then you forgot the -perm. It must read find … -perm -u=sx … where -u=sx is a parameter to the -perm switch. It looks weird, but is correct. When you drop the -perm then find thinks -u=sx is a switch for find and complains but it is actually the parameter for the -perm switch. Just like linux is the parameter for the -user switch. – PerlDuck Oct 13 '18 at 14:39
  • Hi PerlDuck just tried both of the above commands, and neither of them finds anything? Am i right in saying the commands are searching the current working directory, which is /home/linux this would seem to fit in with the user in question being linux as well. If I could find this file with the SUID set, how would I view it please? – user278930 Oct 14 '18 at 14:33
  • @user278930 The proposed commands are correct. And yes, find . will find files in the current directory (and below). Are you sure you have a file named immersive owned by user linux and with the expected permissions? While in /home/linux please issue mkdir -p sampledir; touch sampledir/immersive; chmod 4744 sampledir/immersive and then run the find command again. It should print the name of the file. – PerlDuck Oct 14 '18 at 14:53
  • According to the question "The question asks "What is the contents of the file named ‘immersive’, which is owned by user 'linux', with SUID and user execute permissions set? There are multiple files named 'immersive' find the correct one!" It would appear there should be a file. – user278930 Oct 14 '18 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.