find all setuid files

[dictum9]

I am running the following but it's only getting files that have these permissions. How do I find files with setuid with any permissions, ie. 4755?

---S------
------S---


find / -perm -2000 -o -perm -4000 -exec ls -l {} \;

[Patrick Wallek]

Your command looks good to me.

I ran the same thing and it returned all appropriate files.

Are you running the command as root?

[Rodney Hills]

What do you get if you leave the "-" off the perm value, example-

find / -perm 2000 -o -perm 4000 exec ls -ld {} \;

Rod Hills

[A. Clay Stephenson · Accepted solution]

Depending upon the version of find you may need to escape your or condition by enclosing it in parentheses. I would also restrict the search to regular files.

find / -type f \( -perm -2000 -o -perm -4000 \) -exec ls -l {} \;


You definitely want the -4000 as opposed to 4000 because 4000 would match only those files with mode 4000 as opposed to 4xxx (where x in this case means means "don't care" rather than execute.)

[dictum9]

The problem is, the command I am running does NOT match 4xxxx, it only matches 4000.

I need all permutations of 4xxx, e.q. 4700, 4500, and so on.

[Patrick Wallek]

I just ran the following on HP-UX versions 10.20, 11.0, 11.11 and 11.23 and got all files with SUID or SGID bits turned on:

# find / -perm -2000 -o -perm -4000 -exec ll -d {} \;

Are you absolutely SURE you put the '-' in front of the 2000 and 4000 in your original find? If you don't have the '-' it will look for exact permissions.

[James R. Ferguson]

Hi

[James R. Ferguson]

Hi:

# find . -type f -perm -u+s

...will find files in the current working directory with the setuid bit on whether or not the owner's execute bit is on ("s") or off ("S").

# find . -type f -perm -g+s

...finds those files whose setgid bit is on regarless of group execution rights.

...and:

# find . -type f -perm -ug+s

...finds files where both bits are on.

Regards!

...JRF...

[dictum9]

Here are 2 files I am trying to match. The first command matches none of them, the second just one. How can I fix it to match both of them?

# ll ?
-rwsr-xr-x 1 root sys 5 Mar 29 11:03 a
-rw---Srw- 1 root sys 4 Mar 29 11:41 b

# find . -type f -perm -ug+s
#
# find /data -perm -2000 -o -perm -4000 -exec ls -l {} \;
-rwsr-xr-x 1 root sys 5 Mar 29 11:03 /data/a
#

[James R. Ferguson]

Hi (again):

If you re-read my first post, then for:

-rwsr-xr-x 1 root sys 5 Mar 29 11:03 a
-rw---Srw- 1 root sys 4 Mar 29 11:41 b

For file "a" to match use:

# find . -type f -perm -u+s

For file "b" to match, use:

# find . -type f -perm -g+s

Regards!

...JRF...

[dictum9]

This worked, thank you.



find / -type f \( -perm -2000 -o -perm -4000 \) -exec ls -l {} \;

[A. Clay Stephenson]

It's also time to confess. What OS are you running and if HP-UX XX.xx have you looked for and applied the latest find cumulative patch?

[dictum9]

It's 11.0

What's the latest "find" patch?

[A. Clay Stephenson]

I think you can search the patch database as easily as I. I absolutely, positively do not reward laziness.

[dictum9]

PHCO_2564 for those who are interested.

I do not have it installed.

It doesn't seem to affect anything in the context of this discussion.