☰

\(-perm -4000 -o -perm -2000 \) 是什么意思？

tag-icon • tag-icon find
\(-perm -4000 -o -perm -2000 \) 是什么意思？

我想知道\( -perm -4000 -o -perm -2000 \)是什么原因。我认为是权限级别，但我在任何文档中都找不到 -perm 命令。

在完整上下文中它用于sudo find / -type f \( -perm -4000 -o -perm -2000 \) -print

答案1

这看起来像是尝试查找 suid (4000：set userid) sgid (2000：set groupid) 文件。

这是二进制文件，运行时会获取一个新的用户 ID 或新的组 ID。这些主要用于

  • 系统相关任务
  • 数据库（例如属于 oracle 或 mysql 的文件）
  • 黑客系统...

答案2

man find非常清楚：

   -perm mode

       File's permission bits are exactly  mode  (octal  or  symbolic).
          Since  an  exact match is required, if you want to use this form
          for symbolic modes, you may have to  specify  a  rather  complex
          mode  string.  For example -perm g=w will only match files which
          have mode 0020 (that is, ones for which group  write  permission
          is  the  only  permission set).  It is more likely that you will
          want to use the `/' or `-' forms, for example -perm -g=w,  which
          matches  any file with group write permission.  See the EXAMPLES
          section for some illustrative examples.

   -perm -mode

          All of the permission bits mode are set for the file.   Symbolic
          modes  are accepted in this form, and this is usually the way in
          which would want to use them.  You must specify `u', `g' or  `o'
          if  you use a symbolic mode.   See the EXAMPLES section for some
          illustrative examples.

   -perm /mode

          Any of the permission bits mode are set for the file.   Symbolic
          modes  are  accepted in this form.  You must specify `u', `g' or
          `o' if you use a symbolic mode.  See the  EXAMPLES  section  for
          some  illustrative  examples.  If no permission bits in mode are
          set, this test matches any file (the idea here is to be  consis‐
          tent with the behaviour of -perm -000).

   -perm +mode

          Deprecated,  old way of searching for files with any of the per‐
          mission bits in mode set.  You should use -perm  /mode  instead.
          Trying to use the `+' syntax with symbolic modes will yield sur‐
          prising results.  For example, `+u+x' is a valid  symbolic  mode
          (equivalent to +u,+x, i.e. 0111) and will therefore not be eval‐
          uated as -perm +mode but instead as  the  exact  mode  specifier
          -perm  mode  and so it matches files with exact permissions 0111
          instead of files with any execute bit set.  If  you  found  this
          paragraph  confusing,  you're  not alone - just use -perm /mode.
          This form of the -perm test  is  deprecated  because  the  POSIX
          specification  requires  the  interpretation of a leading `+' as
          being part of a symbolic mode, and so we switched to  using  `/'
          instead.

答案3

此命令列出设置了 SETUID 或 SETGID 位的文件：

# find / -type f \( -perm -4000 -o -perm -2000 \) -print
/sbin/unix_chkpwd
/bin/su
...
# stat /bin/su
Access: (4755/-rwsr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
...
# stat /sbin/pam_extrausers_chkpwd
Access: (2755/-rwxr-sr-x)  Uid: (    0/    root)   Gid: (   42/  shadow)
...

有关的：

相关内容