sh: find: Execute permission denied.

[JUAN VIDAL_1]

PLATFORM DESCRIPTION:
---------------------
HP-UX B.11.11 U 9000/800 RP3410

PROBLEM DESCRIPTION:
--------------------
as root:

# find hosts
sh: find: Execute permission denied.

# /usr/bin/find
-rwxr-xr-x 1 bin bin 103836 Jul 16 17:42 /usr/bin/find

[Patrick Wallek · Accepted solution]

>># find hosts

Do a 'whence -v find' to make sure the 'find' command that should be running is the one that is actually running.

[JUAN VIDAL_1]

Hi Patrick,

# whence -v find
find is /usr/bin/find

[Mel Burslan]

did you try calling the find using the absolute path name ? as in:

/usr/bin/find ./ -name hosts

[JUAN VIDAL_1]

Hi Mel,

# /usr/bin/find ./ -name hosts
sh: /usr/bin/find: Execute permission denied.

[Mel Burslan]

what does these command say ? please port the outputs:

what /usr/bin/find
file /usr/bin/find

[Patrick Wallek]

The size of your 'find' executable does not seem correct. Here it is from one of my 11.11 servers:

HP-UX 11.11:
# ll /usr/bin/find
-r-xr-xr-x 1 bin bin 61440 Jul 30 2007 /usr/bin/find*

Also do a 'file /usr/bin/find'. The result should be:

$ file /usr/bin/find
/usr/bin/find: PA-RISC1.1 shared executable dynamically linked

If it is not, then your find executable is messed up.

[JUAN VIDAL_1]

Mel:
# what /usr/bin/find
/usr/bin/find:
nr81pl2,sys,root # file /usr/bin/find
/usr/bin/find: ELF-32 executable object file
nr81pl2,sys,root #

[JUAN VIDAL_1]

Patrick:

# file /usr/bin/find
/usr/bin/find: ELF-32 executable object file

Why/how it messed up?

replacing it by the correct one will fix?

[Patrick Wallek]

Also note the date on your '/usr/bin/find' of Jul 16 17:42. Something was done to it on July 16 at 17:42 (5:42 PM).

To see if it truly is 'find' do:

$ what /usr/bin/find
/usr/bin/find:
find.c $Date: 2005/12/21 22:37:15 $Revision: r11.11/7 PATCH_11.11 (PHCO_34241)
funcs.c $Date: 2002/02/09 04:05:22 $Revision: r11.11/2 PATCH_11.11 (PHCO_25905)
aclv_patt.c $Date: 2004/11/22 10:47:21 $Revision: r11.11/1 PATCH_11.11 (PHCO_30746)
libcpio.c $Date: 2007/06/27 12:29:49 $Revision: r11.11/2 PATCH_11.11 (PHCO_36502)
getpwd.c $Date: 2004/11/22 10:47:21 $Revision: r11.11/3 PATCH_11.11 (PHCO_30746)
$Revision: @(#) find R11.11_BL2007_0730_1 PATCH_11.11 PHCO_36502

If you don't get output similar to the above, then your find is not really find.

[Mel Burslan]

if you have a system similar to this one, with OS version hpux 11.11, you try copying the executable from that system to this one, after making sure you get the output Patrick gave, is what you see on the non-corrupted server. More than likely, it will work.

When it comes to how and why it happened: your guess is as good as mine. Someone might have copied some other executable file over find accidentally or maliciously. I'd keep a copy of corrupt file and run it under tusc to see what it actually is doing. The message you are seeing might be given by the executable, not the shell, to mislead you if it was put there with a malicious intent.

[Patrick Wallek]

If you have a backup, which I'm sure you do, then you could also try restoring the file from some date prior to July 16, 2009 at 17:42.

[JUAN VIDAL_1]

ACTIONS TAKEN:
--------------

1) Checked "find" status on other PA-RISC server:
# file find
find: PA-RISC1.1 shared executable dynamically linked
# what /usr/bin/find
/usr/bin/find:
find.c $Date: 2002/02/05 22:05:26 $Revision: r11.11/2 PATCH_11.11 (PHCO_25905)
funcs.c $Date: 2002/02/09 04:05:22 $Revision: r11.11/2 PATCH_11.11 (PHCO_25905)
$Revision: @(#) find CUP11.11_BL2002_0213_2 PATCH_11.11 PHCO_25905
Wed Feb 13 07:05:23 PST 2002 $



2) Copied file onto affected server.
3) Checked "find" file permissions/owner/group (555/bin/bin)
4) find works properly.


PROBLEM ROOT CAUSE:
-------------------

Aparently someone installed some Itanium Patch...

[Patrick Wallek]

>>Aparently someone installed some Itanium Patch...

That should not be possible on this server. There was never an 11.11 version for Itanium servers and the patch should not have allowed itself to be installed.

What did the 'what /usr/bin/find' on the "bad" find return?

[JUAN VIDAL_1]

>> What did the 'what /usr/bin/find' on the "bad" find return?

# what /usr/bin/find
/usr/bin/find:
#

no output. I checked into an Itanium box and I saw the same output for find: ELF-32...that's why I guessed someone by mistake installed a wrong patch...

[Dennis Handly]

>that's why I guessed someone by mistake installed a wrong patch

Typically if you installed a patch, the date on find would be before the patch was created, not some recent date like Jul 16.

Some sysadmin must have manually copied that file there.