1

Let's say someone provides you with a tarball, saying it is source code and nothing else. You want to make sure that is true, and that no virus-laden executables or libraries are tucked away in a directory. How to use the find command to do this?

Thanks.

Asker
  • 41
  • 1
  • 3
  • 2
    @ewwhite has answered this question well, but your question is a bit contrived. In the real world, I'd be more (or at least *as*) concerned about malicious code buried in the source code waiting for you to compile and run it. You either trust the source or you don't (and if you do trust the source, that just means that you *think* they wouldn't do anything to hurt your systems *on purpose*). – Rob Moir Nov 19 '12 at 15:01

2 Answers2

8

You can uncompress the file in a safe place (like a filesystem mounted noexec) and check the resulting directories for binaries. The file command can tell you whether a file is text, source code, binary, etc.

[root@xt ~]# file ./packages/Digest-MD5-2.33/t/badfile.t 
./packages/Digest-MD5-2.33/t/badfile.t: ASCII text

[root@xt ~]# file ./packages/Digest-MD5-2.33/MD5.pm 
./packages/Digest-MD5-2.33/MD5.pm: Perl5 module source text

[root@xt ~]# file ./packages/rrdtool-1.0.50/src/gdpng.o 
./packages/rrdtool-1.0.50/src/gdpng.o: ELF 64-bit LSB relocatable, AMD x86-64, version 1 (SYSV), not stripped

Something like the following, where you filter for ELF executables would work:

find . -type f -exec file {} + | grep ELF

And the output would be:

[root@xt ~]# find . -type f -exec file {} + | grep ELF
./packages/rrdtool-1.0.50/gd1.3/gdfontl.o:       ELF 64-bit LSB relocatable, AMD x86-64, version 1 (SYSV), not stripped
./packages/rrdtool-1.0.50/gd1.3/gdfontmb.o:      ELF 64-bit LSB relocatable, AMD x86-64, version 1 (SYSV), not stripped
./packages/rrdtool-1.0.50/gd1.3/gdlucidan10l2.o: ELF 64-bit LSB relocatable, AMD x86-64, version 1 (SYSV), not stripped
./packages/rrdtool-1.0.50/gd1.3/gdlucidab14.o:   ELF 64-bit LSB relocatable, AMD x86-64, version 1 (SYSV), not stripped
./packages/rrdtool-1.0.50/gd1.3/gdlucidan10.o:   ELF 64-bit LSB relocatable, AMD x86-64, version 1 (SYSV), not stripped
Community
  • 1
ewwhite
  • 194,921
  • 91
  • 434
  • 799
1

A file marked executable need not be a executable or loadable file or object.

Here is what I use:

find ./ -type f -name "*" -not -name "*.o" -exec sh -c '
    case "$(head -n 1 "$1")" in
      ?ELF*) exit 0;;
      MZ*) exit 0;;
      #!*/ocamlrun*)exit0;;
    esac
exit 1
' sh {} \; -print
AjayKumarBasuthkar
  • 111
  • 7