topic Re: sh: find: Execute permission denied. in Operating System - HP-UX

sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 12:25:13 GMT

PLATFORM DESCRIPTION:
---------------------
HP-UX B.11.11 U 9000/800 RP3410

PROBLEM DESCRIPTION:
--------------------
as root:

# find hosts
sh: find: Execute permission denied.

# /usr/bin/find
-rwxr-xr-x 1 bin bin 103836 Jul 16 17:42 /usr/bin/find

Re: sh: find: Execute permission denied.

Patrick Wallek — Tue, 28 Jul 2009 12:28:00 GMT

>># find hosts

Do a 'whence -v find' to make sure the 'find' command that should be running is the one that is actually running.

Re: sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 12:28:47 GMT

Hi Patrick,

# whence -v find
find is /usr/bin/find

Re: sh: find: Execute permission denied.

Mel Burslan — Tue, 28 Jul 2009 12:31:33 GMT

did you try calling the find using the absolute path name ? as in:

/usr/bin/find ./ -name hosts

Re: sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 12:34:41 GMT

Hi Mel,

# /usr/bin/find ./ -name hosts
sh: /usr/bin/find: Execute permission denied.

Re: sh: find: Execute permission denied.

Mel Burslan — Tue, 28 Jul 2009 12:35:41 GMT

what does these command say ? please port the outputs:

what /usr/bin/find
file /usr/bin/find

Re: sh: find: Execute permission denied.

Patrick Wallek — Tue, 28 Jul 2009 12:36:09 GMT

The size of your 'find' executable does not seem correct. Here it is from one of my 11.11 servers:

HP-UX 11.11:
# ll /usr/bin/find
-r-xr-xr-x 1 bin bin 61440 Jul 30 2007 /usr/bin/find*

Also do a 'file /usr/bin/find'. The result should be:

$ file /usr/bin/find
/usr/bin/find: PA-RISC1.1 shared executable dynamically linked

If it is not, then your find executable is messed up.

Re: sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 12:38:30 GMT

Mel:
# what /usr/bin/find
/usr/bin/find:
nr81pl2,sys,root # file /usr/bin/find
/usr/bin/find: ELF-32 executable object file
nr81pl2,sys,root #

Re: sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 12:38:37 GMT

Patrick:

# file /usr/bin/find
/usr/bin/find: ELF-32 executable object file

Why/how it messed up?

replacing it by the correct one will fix?

Re: sh: find: Execute permission denied.

Patrick Wallek — Tue, 28 Jul 2009 12:39:23 GMT

Also note the date on your '/usr/bin/find' of Jul 16 17:42. Something was done to it on July 16 at 17:42 (5:42 PM).

To see if it truly is 'find' do:

$ what /usr/bin/find
/usr/bin/find:
find.c $Date: 2005/12/21 22:37:15 $Revision: r11.11/7 PATCH_11.11 (PHCO_34241)
funcs.c $Date: 2002/02/09 04:05:22 $Revision: r11.11/2 PATCH_11.11 (PHCO_25905)
aclv_patt.c $Date: 2004/11/22 10:47:21 $Revision: r11.11/1 PATCH_11.11 (PHCO_30746)
libcpio.c $Date: 2007/06/27 12:29:49 $Revision: r11.11/2 PATCH_11.11 (PHCO_36502)
getpwd.c $Date: 2004/11/22 10:47:21 $Revision: r11.11/3 PATCH_11.11 (PHCO_30746)
$Revision: @(#) find R11.11_BL2007_0730_1 PATCH_11.11 PHCO_36502

If you don't get output similar to the above, then your find is not really find.

Re: sh: find: Execute permission denied.

Mel Burslan — Tue, 28 Jul 2009 12:46:21 GMT

if you have a system similar to this one, with OS version hpux 11.11, you try copying the executable from that system to this one, after making sure you get the output Patrick gave, is what you see on the non-corrupted server. More than likely, it will work.

When it comes to how and why it happened: your guess is as good as mine. Someone might have copied some other executable file over find accidentally or maliciously. I'd keep a copy of corrupt file and run it under tusc to see what it actually is doing. The message you are seeing might be given by the executable, not the shell, to mislead you if it was put there with a malicious intent.

Re: sh: find: Execute permission denied.

Patrick Wallek — Tue, 28 Jul 2009 12:52:38 GMT

If you have a backup, which I'm sure you do, then you could also try restoring the file from some date prior to July 16, 2009 at 17:42.

Re: sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 13:05:31 GMT

ACTIONS TAKEN:
--------------

1) Checked "find" status on other PA-RISC server:
# file find
find: PA-RISC1.1 shared executable dynamically linked
# what /usr/bin/find
/usr/bin/find:
find.c $Date: 2002/02/05 22:05:26 $Revision: r11.11/2 PATCH_11.11 (PHCO_25905)
funcs.c $Date: 2002/02/09 04:05:22 $Revision: r11.11/2 PATCH_11.11 (PHCO_25905)
$Revision: @(#) find CUP11.11_BL2002_0213_2 PATCH_11.11 PHCO_25905
Wed Feb 13 07:05:23 PST 2002 $

2) Copied file onto affected server.
3) Checked "find" file permissions/owner/group (555/bin/bin)
4) find works properly.

PROBLEM ROOT CAUSE:
-------------------

Aparently someone installed some Itanium Patch...

Re: sh: find: Execute permission denied.

Patrick Wallek — Tue, 28 Jul 2009 13:11:10 GMT

>>Aparently someone installed some Itanium Patch...

That should not be possible on this server. There was never an 11.11 version for Itanium servers and the patch should not have allowed itself to be installed.

What did the 'what /usr/bin/find' on the "bad" find return?

Re: sh: find: Execute permission denied.

JUAN VIDAL_1 — Tue, 28 Jul 2009 13:25:44 GMT

>> What did the 'what /usr/bin/find' on the "bad" find return?

# what /usr/bin/find
/usr/bin/find:
#

no output. I checked into an Itanium box and I saw the same output for find: ELF-32...that's why I guessed someone by mistake installed a wrong patch...

Re: sh: find: Execute permission denied.

Dennis Handly — Tue, 28 Jul 2009 15:52:49 GMT

>that's why I guessed someone by mistake installed a wrong patch

Typically if you installed a patch, the date on find would be before the patch was created, not some recent date like Jul 16.

Some sysadmin must have manually copied that file there.