32

I was recently browsing my Fedora's /bin folder and noticed a binary named [. I did try to search the internet for more information on that, but I couldn't find anything useful. Running it through strace doesn't seem to produce anything useful for closer inspection too.

What is that? Should I be alarmed? Could it be the result of a system compromise? Should I run it? Does it belong to any package?

NlightNFotis
  • 7,575

3 Answers3

37

The [ binary residing under the /bin tree in many GNU/Linux distributions is not something to be alarmed off. At least in my Fedora 19 it is a part of the coreutils package, as demonstrated below:

$ rpm -qf /bin/[
coreutils-8.21-13.fc19.x86_64

and is a synonym for test to allow for expressions like [ expression ] to be written in shell scripts or even interactive usage.

NlightNFotis
  • 7,575
  • 16
    Note that shells like bash have a builtin test and [ and do not invoke the external binary. – jordanm Feb 10 '14 at 00:31
  • 1
    @jordanm, today most shells have them (and many other simple, common operations) as builtins. But that wasn't allways so (or is so in all shells). It might even be mandated by POSIX. – vonbrand Feb 10 '14 at 04:08
  • 2
    @vonbrand http://pubs.opengroup.org/onlinepubs/009695399/utilities/test.html You are right. A test command [ is required by this specification. – yegle Feb 10 '14 at 07:08
  • @vonbrand, only Bourne-like shells generally have a builtin [ command. Non-Bourne-like ones like (t)csh, rc, es generally don't (fish is an exception there). – Stéphane Chazelas Nov 04 '14 at 15:29
5

The [ command is the same as the test command.

It allows you to write rather terse conditional statements in shell scripts. From the SunOS manual page:

   if [ "$1" = "pear" ] || [ "$1" = "grape" ] || [ "$1" = "apple" ]
   then
       command
   fi

If you remove it, scripts will break!

Thorbjørn Ravn Andersen
  • 1,043
  • 11
  • 20
  • Scripts written for shells that don't have [ as a built-in command will break. Most shells do. Still, I certainly wouldn't recommend removing /bin/[. – Keith Thompson Feb 13 '14 at 23:28
  • @KeithThompson, all shells have [ builtin, it's scripts that have non-shell applications execute [ that will break. Like find ... -exec [ -f {} ] \; or env LC_ALL=C [ -f bar ] – Stéphane Chazelas Feb 25 '14 at 22:05
  • @StephaneChazelas: All shells? (csh and tcsh don't, but perhaps that's beside the point.) I don't think I've seen an sh-derived shell that doesn't have [ as a builtin, but don't think [ was a builtin in the original Bourne shell. In any case, removing /bin/[ would certainly be a bad idea. – Keith Thompson Feb 25 '14 at 22:17
  • Minor quibble: test and [ are almost the same. [ requires a closing ]; test does not allow it (or rather doesn't treat an argument of ] specially). – Keith Thompson Feb 25 '14 at 22:22
2

The [ is always given as an equivalent to test, but I had'nt seen the ] mentioned explicitly, although it is always there. I have just now found this in http://ss64.com/bash/test.html :

When the [ form is used, the last argument to the command must be a ]

which is reassuring -- at last I have completion as they say.

Harry Weston
  • 1,329