setuid files

sulekha · 10-11-2008, 04:28 AM

Hi all,

I have read that

To check for a possible Trojan horse, examine the filesystem periodically for files with setuid permission. The following command lists these files:
Listing setuid files $ sudo find / -perm -4000 -exec ls -lh {} \; 2> /dev/null

can any one explain,why the permission is given as 4000 in this command
AFAIK i haven't seen any files with premission 4000

jlliagre · 10-11-2008, 05:04 AM

You overlook the "-" preceeding 4000. That means the permissions need not to be exactly 04000 but only the bits set in 04000 need to be set too in the tested file.

04000 means precisely the setuid bit.