Exclude list in "find" command?

[Leam Hall]

I have to run cksum on the /dev tree, so I'm using find to get everything. Of course, cksum seems to choke on some device files like /dev/tty.

Some versions of find allow an exclude list. Does the find on 11.31? I didn't see it in the man page.

Thanks!

Leam

[James R. Ferguson]

Hi:

I'm not sure why you want to checksum special files, but to your question, you could exclude by name, like:

# find /dev ! -name "*tty*" -exec ls -d {} +

Be sure to enclose the name argument in quotes to prevent the shell from expanding it.

Regards!

...JRF...

[Steven Schweda]

> I have to run cksum on the /dev tree [...]

Because, ...? Is there some actual problem
which you are trying to solve?

man find

Look for "-type". Consider "f", unless you
can think of a good reason to "run cksum" on
anything else.

> [...] Some versions of find [...]

It's also possible to install GNU "find" on
an HP-UX system, if that's one of those "Some
versions".

[Leam Hall]

I'll have to concede that the requirement is...well...not mine to decide. I'm just implementing directives.

Yes, gnu find does give an exclude option. However, if it resolves to having to compile software the choice will be AIDE, which will really resolve the issue.

Can cksum or something similar operate on character special files?

Leam

[Patrick Wallek]

>>Can cksum or something similar operate on character special files?

I don't see why you would want to. The are 'c' files. The thing to check with those would be the major/minor number combination if you are concerned about some type of corruption.

'insf' will (re)create any missing or invalid files.

[Steven Schweda]

> Can cksum or something similar operate on
> character special files?

> I don't see why you would want to. [...]

Nor I. What's the checksum of a tape drive?

> Is there some actual problem which you are
> trying to solve?

Still wondering.

> I'm just implementing directives.

Sometimes it pays to ask why. Especially
when the "directives" make little or no
sense.

[Leam Hall]

Would there be an issue with running "insf -eq" on a weekly basis? For find I can use ! \( -type c -o -type b \) to exclude character and block files, and then run insf to recreate and reset permissions?

If that plan works it would meet the directives. In this case we can justify an exemption to the directive. It just needs to be a reasonable justification.

For those who haven't worked in a facility with lots of regulations made by people who don't do this stuff; you have my envy...

Leam

[James R. Ferguson]

Hi:

> Would there be an issue with running "insf -eq" on a weekly basis?

I don't believe that this is going to accomplish anything more than recreate *missing* device files.

The '/dev' directory should have permissions of 555 owned by 'bin' which means that only the root user can remove, add, or modify files within it.

I think a bit of education is a better way to "regulate". If your management is insistent of discovering any changes, you might snapshot an 'ls' of the '/dev' directory and compare its contents to the running system.

Regards!

...JRF...

[Leam Hall]

I did a test with changing permissions on /dev/tty and it changed them back. That solves the problem, albeit in a heavy handed manner.

[Bill Hassell]

You need to report back to management that the 'expert' asking for the checksums is not properly trained on Unix systems. The /dev directory has no files where a checksum makes any sense. These are not files with data -- they are pointers to drivers which in turn point to hardware devices. By themselves, they have no content. If you run a checksum on a tape or a disk, the checksum will be the result of reading the contents of the device. For a tape, it may take 2 hours and the result is meaningless because another tape will produce a different result.

Tell the auditors that HP-UX is not a PC.