Take the 2-minute tour ×

My linux CentOS server has been compromised lately (rootkit). Some files attributes have been changed, for example the command :

lsattr /bin/ls


s---ia------- /bin/ls

How cand I use find command to list all files on system that have attributes set to s---ia------- instead of -------------?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Find doesn't have any way of obtaining this information directly but you don't need to use it as lsattr has a -R switch so

lsattr -R /path/you/care/about 2>/dev/null | grep -- 's---ia-------'

should do what you want.

Note the -- to grep isn't required for your specific set of attributes but if for example you wanted to search for '----ia-------' then you would definitely need it.

share|improve this answer
Works, thanks!!! –  Danijel Oct 7 '12 at 16:08

Because you have mentioned about find, I am suggesting you to try following command

find / -type f -exec lsattr {} + | grep -v '\-\-\-\-\-\-\-\-\-\-\-\-\-'

Ideally, I'd prefer to use AIDE or tripwire

share|improve this answer
Doesn't work: "missing argument to -exec". –  Danijel Oct 5 '12 at 10:13
I have verified and it works on CentOS 5. I forgot to mention escape character for grep though. it should be | grep -v '\-\-......' –  Nehal Dattani Oct 5 '12 at 10:19
Could you edit the answer, thanks. –  Danijel Oct 5 '12 at 10:27
You can use -- to indicate that there are no more options –  Iain Oct 5 '12 at 10:28

Your Answer


