linux - 查找已设置 UID 位的所有文件

Question

我试图找到所有具有“SUID”权限的文件并将其写入文本文件，但是当我运行以下命令时，文本文件为空:

sudo find / -perm 4000 > suid.txt

我的命令有问题吗？

Answer 1

正确的语法是:

sudo find / -perm -4000 > suid.txt

或

sudo find / -perm -u+s > suid.txt

例如:

sudo find / -perm -4000 -exec ls -l {} +

给出这个输出:

-rwsr-xr-x 1 root    root        30800 May 15  2015 /bin/fusermount
-rwsr-xr-x 1 root    root        94792 Sep  2  2015 /bin/mount
-rwsr-xr-x 1 root    root        44168 May  7  2014 /bin/ping
-rwsr-xr-x 1 root    root        44680 May  7  2014 /bin/ping6
-rwsr-xr-x 1 root    root        36936 Jan 27  2016 /bin/su
<truncated>

您的命令的问题在于，它正在寻找已设置 set uid 位且未设置其他 的模式位。添加 - 前缀将查找设​​置了 set uid 的所有模式，而不管其他位。

来自 man find:

-perm mode

File's permission bits are exactly mode (octal or symbolic). Since an exact match is required, if you want to use this form for symbolic modes, you may have to specify a rather complex mode string. For example -perm g=w will only match files which have mode 0020 (that is, ones for which group write permission is the only permission set). It is more likely that you will want to use the /' or-' forms, for example -perm -g=w, which matches any file with group write permission.

-perm -mode

All of the permission bits mode are set for the file. Symbolic modes are accepted in this form, and this is usually the way in which would want to use them. You must specify u',g' or `o' if you use a symbolic mode.