In find -perm, what’s the difference between “+6000” and “/6000”

command linefindpermissions

I'm trying to find all the setuid/setgid binaries on my system. I've found two different ways to do this online.

What's the difference between

find / -perm +6000 -type f

and

find / -perm /6000 -type f

The latter is mentioned more often, and their results are the same. I want to make absolutely sure I don't miss any files. Are they the same?

I'm running this on an Ubuntu trusty box, but that could change in the future.

Best Answer

The find manual page explains:

   -perm +mode
          Deprecated,  old way of searching for files with any of the per‐
          mission bits in mode set.  You should use -perm  /mode  instead.
          Trying to use the `+' syntax with symbolic modes will yield sur‐
          prising results. […]

So yes, they're the same thing, but you should use -perm /mode.

Related Solutions

Find and differences between -perm /6000 and -perm /u+s

Most people aren't aware but the Unix permissions are actually not just User, Group, and Others (rwx). These 3 triads are the typical permissions that allow users, groups, and other users access to files & directories. However there is also a group of bits that precede the User bits. These bits are referred to as "Special Modes".

It's more of a shorthand notation that you don't have to explicitly set them when dealing with a tool such as chmod.

$ chmod 644

Is actually equivalent to:

$ chmod 0644

Here's the list of bits:

excerpt wikipedia article titled: chmod

Flag                Octal value     Purpose
----                -----------     -------
S_ISUID             04000           Set user ID on execution
S_ISGID             02000           Set group ID on execution
S_ISVTX             01000           Sticky bit
S_IRUSR, S_IREAD    00400           Read by owner
S_IWUSR, S_IWRITE   00200           Write by owner
S_IXUSR, S_IEXEC    00100           Execute/search by owner
S_IRGRP             00040           Read by group
S_IWGRP             00020           Write by group
S_IXGRP             00010           Execute/search by group
S_IROTH             00004           Read by others
S_IWOTH             00002           Write by others
S_IXOTH             00001           Execute/search by others

Your Question

So in your first command you're looking for u+s, which would work out to be bit 04000. When you use the numeric notation you're asking for bits 04000 AND 02000. This would give you files with user or group setuid bits set.

References

chmod Tutorial

command-line – Difference Between find . and find . -print

From the findutils find manpage:

If no expression is given, the expression -print is used (but you should probably consider using -print0 instead, anyway).

(-print is a find expression.)

The POSIX documentation confirms this:

If no expression is present, -print shall be used as the expression.

So find . is exactly equivalent to find . -print; the first has no expression so -print is added internally.

The explanation of what -print does comes further down in the manpage:

-print

True; print the full file name on the standard output, followed by a newline. If you are piping the output of find into another program and there is the faintest possibility that the files which you are searching for might contain a newline, then you should seriously consider using the -print0 option instead of -print. See the UNUSUAL FILENAMES section for information about how unusual characters in filenames are handled.