32

I was recently browsing my Fedora's /bin folder and noticed a binary named [. I did try to search the internet for more information on that, but I couldn't find anything useful. Running it through strace doesn't seem to produce anything useful for closer inspection too.

What is that? Should I be alarmed? Could it be the result of a system compromise? Should I run it? Does it belong to any package?

NlightNFotis
  • 7,525
  • 7
  • 32
  • 38
  • 4
    `[ -f /bin/[ ] && printf "%s\n" "Don't panic"` – jasonwryan Feb 10 '14 at 00:11
  • @jasonwryan Yeah, it took me a while to figure it out. I couldn't find much information for it on the net, and Google didn't help much. Posted it here in hopes that it might help the next one who's in my shoes. – NlightNFotis Feb 10 '14 at 00:12
  • 10
    Run `man [` to see what the `[` command is! – Gilles 'SO- stop being evil' Feb 10 '14 at 00:23
  • @Gilles To be honest, I did and it mentioned something about `bash`, and figured that might be something else. It's not the first thing that comes to your mind when you see a binary with a name you've never seen before in your file system - or to put it another way, you have to find something more concrete to clear the doubts in your head. – NlightNFotis Feb 10 '14 at 00:25
  • Related: [Confusing use of && and || operators](http://unix.stackexchange.com/questions/24684/confusing-use-of-and-operators/24685#24685) – slm Feb 10 '14 at 01:06
  • 4
    Do a`rpm -qif /bin/[` to find out where it comes from... – vonbrand Feb 10 '14 at 04:09
  • @Gilles `$ man [` -- `No manual entry for [` – heinrich5991 Feb 10 '14 at 13:21

3 Answers3

37

The [ binary residing under the /bin tree in many GNU/Linux distributions is not something to be alarmed off. At least in my Fedora 19 it is a part of the coreutils package, as demonstrated below:

$ rpm -qf /bin/[
coreutils-8.21-13.fc19.x86_64

and is a synonym for test to allow for expressions like [ expression ] to be written in shell scripts or even interactive usage.

NlightNFotis
  • 7,525
  • 7
  • 32
  • 38
  • 16
    Note that shells like `bash` have a builtin `test` and `[` and do not invoke the external binary. – jordanm Feb 10 '14 at 00:31
  • 1
    @jordanm, today most shells have them (and many other simple, common operations) as builtins. But that wasn't allways so (or is so in all shells). It might even be mandated by POSIX. – vonbrand Feb 10 '14 at 04:08
  • 2
    @vonbrand http://pubs.opengroup.org/onlinepubs/009695399/utilities/test.html You are right. A test command `[` is required by this specification. – yegle Feb 10 '14 at 07:08
  • @vonbrand, only Bourne-like shells generally have a builtin `[` command. Non-Bourne-like ones like `(t)csh`, `rc`, `es` generally don't (`fish` is an exception there). – Stéphane Chazelas Nov 04 '14 at 15:29
5

The [ command is the same as the test command.

It allows you to write rather terse conditional statements in shell scripts. From the SunOS manual page:

   if [ "$1" = "pear" ] || [ "$1" = "grape" ] || [ "$1" = "apple" ]
   then
       command
   fi

If you remove it, scripts will break!

Thorbjørn Ravn Andersen
  • 1,031
  • 11
  • 19
  • Scripts written for shells that don't have `[` as a built-in command will break. Most shells do. Still, I certainly wouldn't recommend removing `/bin/[`. – Keith Thompson Feb 13 '14 at 23:28
  • @KeithThompson, all shells have `[` builtin, it's scripts that have non-shell applications execute `[` that will break. Like `find ... -exec [ -f {} ] \;` or `env LC_ALL=C [ -f bar ]` – Stéphane Chazelas Feb 25 '14 at 22:05
  • @StephaneChazelas: *All* shells? (csh and tcsh don't, but perhaps that's beside the point.) I don't think I've seen an sh-derived shell that doesn't have `[` as a builtin, but don't think `[` was a builtin in the original Bourne shell. In any case, removing `/bin/[` would certainly be a bad idea. – Keith Thompson Feb 25 '14 at 22:17
  • Minor quibble: `test` and `[` are *almost* the same. `[` requires a closing `]`; `test` does not allow it (or rather doesn't treat an argument of `]` specially). – Keith Thompson Feb 25 '14 at 22:22
2

The [ is always given as an equivalent to test, but I had'nt seen the ] mentioned explicitly, although it is always there. I have just now found this in http://ss64.com/bash/test.html :

When the [ form is used, the last argument to the command must be a ]

which is reassuring -- at last I have completion as they say.

Harry Weston
  • 1,319
  • 5
  • 21
  • 35