System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Exclude list in "find" command?

Leam Hall
Frequent Advisor

Exclude list in "find" command?

I have to run cksum on the /dev tree, so I'm using find to get everything. Of course, cksum seems to choke on some device files like /dev/tty.

Some versions of find allow an exclude list. Does the find on 11.31? I didn't see it in the man page.

Thanks!

Leam
10 REPLIES
James R. Ferguson
Acclaimed Contributor

Re: Exclude list in "find" command?

Hi:

I'm not sure why you want to checksum special files, but to your question, you could exclude by name, like:

# find /dev ! -name "*tty*" -exec ls -d {} +

Be sure to enclose the name argument in quotes to prevent the shell from expanding it.

Regards!

...JRF...
Steven Schweda
Honored Contributor

Re: Exclude list in "find" command?

> I have to run cksum on the /dev tree [...]

Because, ...? Is there some actual problem
which you are trying to solve?

man find

Look for "-type". Consider "f", unless you
can think of a good reason to "run cksum" on
anything else.

> [...] Some versions of find [...]

It's also possible to install GNU "find" on
an HP-UX system, if that's one of those "Some
versions".
Leam Hall
Frequent Advisor

Re: Exclude list in "find" command?

I'll have to concede that the requirement is...well...not mine to decide. I'm just implementing directives.

Yes, gnu find does give an exclude option. However, if it resolves to having to compile software the choice will be AIDE, which will really resolve the issue.

Can cksum or something similar operate on character special files?

Leam
Patrick Wallek
Honored Contributor

Re: Exclude list in "find" command?

>>Can cksum or something similar operate on character special files?

I don't see why you would want to. The are 'c' files. The thing to check with those would be the major/minor number combination if you are concerned about some type of corruption.

'insf' will (re)create any missing or invalid files.
Steven Schweda
Honored Contributor

Re: Exclude list in "find" command?

> Can cksum or something similar operate on
> character special files?

> I don't see why you would want to. [...]

Nor I. What's the checksum of a tape drive?

> Is there some actual problem which you are
> trying to solve?

Still wondering.

> I'm just implementing directives.

Sometimes it pays to ask why. Especially
when the "directives" make little or no
sense.
Leam Hall
Frequent Advisor

Re: Exclude list in "find" command?

Would there be an issue with running "insf -eq" on a weekly basis? For find I can use ! \( -type c -o -type b \) to exclude character and block files, and then run insf to recreate and reset permissions?

If that plan works it would meet the directives. In this case we can justify an exemption to the directive. It just needs to be a reasonable justification.

For those who haven't worked in a facility with lots of regulations made by people who don't do this stuff; you have my envy...

Leam
James R. Ferguson
Acclaimed Contributor

Re: Exclude list in "find" command?

Hi:

> Would there be an issue with running "insf -eq" on a weekly basis?

I don't believe that this is going to accomplish anything more than recreate *missing* device files.

The '/dev' directory should have permissions of 555 owned by 'bin' which means that only the root user can remove, add, or modify files within it.

I think a bit of education is a better way to "regulate". If your management is insistent of discovering any changes, you might snapshot an 'ls' of the '/dev' directory and compare its contents to the running system.

Regards!

...JRF...

Leam Hall
Frequent Advisor

Re: Exclude list in "find" command?

I did a test with changing permissions on /dev/tty and it changed them back. That solves the problem, albeit in a heavy handed manner.
Bill Hassell
Honored Contributor

Re: Exclude list in "find" command?

You need to report back to management that the 'expert' asking for the checksums is not properly trained on Unix systems. The /dev directory has no files where a checksum makes any sense. These are not files with data -- they are pointers to drivers which in turn point to hardware devices. By themselves, they have no content. If you run a checksum on a tape or a disk, the checksum will be the result of reading the contents of the device. For a tape, it may take 2 hours and the result is meaningless because another tape will produce a different result.

Tell the auditors that HP-UX is not a PC.


Bill Hassell, sysadmin
Steven Schweda
Honored Contributor

Re: Exclude list in "find" command?

> For those who haven't worked in a facility
> with lots of regulations made by people who
> don't do this stuff; you have my envy...

I've worked in places with strict
requirements, but never in a place where
(undisclosed) "directives" which make no
sense were imposed by people who knew nothing
about what they were demanding (or why).

> [...] That solves the problem, [...]

What _is_ "the problem"? (Other than lame
management, that is.)