1

I wonder what \( -perm -4000 -o -perm -2000 \) does. I think it is permission levels but i have trouble finding the -perm command in any documentations.

In full context it used in sudo find / -type f \( -perm -4000 -o -perm -2000 \) -print

1
  • The -perm is not a command in itself, it's an argument (option) to the find command - so you would need to look in the documentation for find (e.g. man find - look in the section TESTS). Oct 6, 2014 at 19:44

3 Answers 3

2

man find is pretty clear about it:

   -perm mode

       File's permission bits are exactly  mode  (octal  or  symbolic).
          Since  an  exact match is required, if you want to use this form
          for symbolic modes, you may have to  specify  a  rather  complex
          mode  string.  For example -perm g=w will only match files which
          have mode 0020 (that is, ones for which group  write  permission
          is  the  only  permission set).  It is more likely that you will
          want to use the `/' or `-' forms, for example -perm -g=w,  which
          matches  any file with group write permission.  See the EXAMPLES
          section for some illustrative examples.

   -perm -mode

          All of the permission bits mode are set for the file.   Symbolic
          modes  are accepted in this form, and this is usually the way in
          which would want to use them.  You must specify `u', `g' or  `o'
          if  you use a symbolic mode.   See the EXAMPLES section for some
          illustrative examples.

   -perm /mode

          Any of the permission bits mode are set for the file.   Symbolic
          modes  are  accepted in this form.  You must specify `u', `g' or
          `o' if you use a symbolic mode.  See the  EXAMPLES  section  for
          some  illustrative  examples.  If no permission bits in mode are
          set, this test matches any file (the idea here is to be  consis‐
          tent with the behaviour of -perm -000).

   -perm +mode

          Deprecated,  old way of searching for files with any of the per‐
          mission bits in mode set.  You should use -perm  /mode  instead.
          Trying to use the `+' syntax with symbolic modes will yield sur‐
          prising results.  For example, `+u+x' is a valid  symbolic  mode
          (equivalent to +u,+x, i.e. 0111) and will therefore not be eval‐
          uated as -perm +mode but instead as  the  exact  mode  specifier
          -perm  mode  and so it matches files with exact permissions 0111
          instead of files with any execute bit set.  If  you  found  this
          paragraph  confusing,  you're  not alone - just use -perm /mode.
          This form of the -perm test  is  deprecated  because  the  POSIX
          specification  requires  the  interpretation of a leading `+' as
          being part of a symbolic mode, and so we switched to  using  `/'
          instead.
1

This looks like trying to find suid (4000:set userid) sgid (2000:set groupid) file.

that is binary that, when run get a new userid, or a new groupid. those are use mostly for

  • system related task
  • database (e.g. file belong to oracle or mysql)
  • hacking system ...
1
  • is 4000 the octal notation of the file perm ... what would be the symbolic notation Feb 12, 2017 at 9:49
1

This command lists files which have the SETUID or SETGID bits set:

# find / -type f \( -perm -4000 -o -perm -2000 \) -print
/sbin/unix_chkpwd
/bin/su
...
# stat /bin/su
Access: (4755/-rwsr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
...
# stat /sbin/pam_extrausers_chkpwd
Access: (2755/-rwxr-sr-x)  Uid: (    0/    root)   Gid: (   42/  shadow)
...

Related:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.