During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that?
LPIC-1 Exam 102-500, objective 110. Security medium
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Not correct find /usr -perm 4000
Wrong. Without a leading - or /, -perm requires the mode to match exactly. This finds only files whose permissions are precisely 4000 (---S------), so an ordinary setuid binary at 4755 is missed.
Not correct find /usr -perm -755
Wrong. This matches files that have at least rwxr-xr-x. It says nothing about the setuid bit, and it will match huge numbers of ordinary executables.
Correct find /usr -perm -4000
Correct. A leading minus means 'all of these bits are set, others do not matter', so 4755, 4711 and 4111 all match. `find /usr -perm -u+s` is the symbolic equivalent.
Not correct find /usr -type s
Wrong. -type selects a file type, and type s is a Unix domain socket. The setuid bit is a permission bit, not a file type.
Why
find's -perm test has three forms. A bare mode (-perm 4000) is an exact match on all twelve permission bits. A leading minus (-perm -4000) means every listed bit must be set and extra bits are ignored, which is the form you want when hunting setuid files. A leading slash (-perm /4000) means at least one of the listed bits is set, which is useful for -perm /6000 to catch setuid or setgid in one pass. Symbolic forms work too: -perm -u+s for setuid, -perm -g+s for setgid.
Where this comes from
- Cited
- LPI exam objective 110.1
- What it says
- Locate files with the setuid and setgid bits set as part of routine security auditing.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 110 and space the ones you get wrong.