execve(2) System Calls Manual execve(2) execve - (libc -lc) #include int execve(const char *path, char *const _Nullable argv[], char *const _Nullable envp[]); execve() path. ( ) . path : #!interpreter [optional-arg] " " . argv . ( argv[0]) . argv . ( argv[argc] .) envp key=value . envp . Linux libc PATH exec(3). main : int main(int argc, char *argv[], char *envp[]) main POSIX.1 POSIX.1 environ(7). execve() (bss) . (ptraced) SIGTRAP execve(). set-user-ID path . set-group-ID . ( set-user-ID set-group-ID) : o no_new_privs ( prctl(2)); o (mounted) nosuid ( MS_NOSUID mount(2)); o (ptraced). ( capabilities(7)) . set-user-ID set-group-ID . set-user-ID set-group-ID. UID GID execve(). a.out ld.so(8) . ELF PT_INTERP . /lib/ld-linux.so.2 glibc ( ld-linux.so(8)). execve() : o (signal(7)). o (sigaltstack(2)). o (mmap(2)). o System V (shmat(2)). o POSIX (shm_open(3)). o POSIX (mq_overview(7)). o POSIX (sem_overview(7)). o POSIX (timer_create(2)). o (opendir(3)). o (mlock(2), mlockall(2)). o (atexit(3), on_exit(3)). o ( fenv(3)). POSIX.1. execve(): o "dumpable" 1 set-user-ID set-group-ID dumpable /proc/sys/fs/suid_dumpable PR_SET_DUMPABLE prctl(2). "dumpable" /proc/pid root:root proc(5). o prctl(2) PR_SET_KEEPCAPS . o ( 2.4.36 / 2.6.23) set-user-ID set-group-ID prctl(2) PR_SET_PDEATHSIG . o prctl(2) PR_SET_NAME ( ps -o comm) . o SECBIT_KEEP_CAPS securebits . capabilities(7). o SIGCHLD ( clone(2)). o CLONE_FILES clone(2). : o execve(). pthreads . o setlocale(LC_ALL, "C") . o POSIX.1 . POSIX.1 : SIGCHLD . o / (aio_read(3), aio_write(3)). o execve() capabilities(7). o execve(). close-on-exec FD_CLOEXEC fcntl(2). ( . fcntl(2) .) POSIX.1 0 1 2 execve() set-user-ID set-group-ID . execve(). : #!interpreter [optional-arg] interpreter . interpreter : interpreter [optional-arg] path arg... arg... argv execve() argv[1]. argv[0] execve(). optional-arg ( ) . 2.6.28 . . UNIX (argv) (envp) . POSIX.1 ARG_MAX ( sysconf(_SC_ARG_MAX)). 2.6.23 32 ( MAX_ARG_PAGES). 4 128 . 2.6.23 RLIMIT_STACK ( getrlimit(2)) execve(). ( : 2.6.23.) / . 1/4 . ( 1/4 .) 3/4 _STK_LIM (8 ). 2.6.25 32 RLIMIT_STACK 2.6.22 . ( 2.6.23 2.6.24.) 32 ( MAX_ARG_STRLEN) 0x7FFFFFFF. execve() -1 errno . E2BIG (envp) (argv) path . . EACCES path . ( path_resolution(7).) EACCES . EACCES ELF. EACCES noexec. EAGAIN ( 3.1) UID set*uid() -- -- RLIMIT_NPROC ( setrlimit(2)). . EFAULT path argv envp . EINVAL ELF PT_INTERP ( ). EIO /. EISDIR ELF . ELIBBAD ELF . ELOOP path ELF. ELOOP ( " " ). 3.8 ENOEXEC. EMFILE . ENAMETOOLONG path . ENFILE . ENOENT path ELF . ENOEXEC . ENOMEM . ENOTDIR path ELF . EPERM nosuid set-user-ID set-group-ID . EPERM set-user-ID set-group-ID . EPERM "capability-dumb" . capabilities(7). ETXTBSY . POSIX #! ( ) UNIX . argv envp NULL. . ! UNIX argv NULL (EFAULT). UNIX envp==NULL . POSIX.1 sysconf(3) . 2.6.23 RLIMIT_STACK _SC_ARG_MAX . "#!" . 5.1 127 . 5.1 255 . optional-arg . interpreter . . optional-arg. optional-arg . ( UNIX ) set-user-ID set-group-ID . POSIX.1-2024. 4.3BSD SVr4 POSIX.1-1988. UNIX V6 exec() 0 main -1. exec() . UNIX V7 NULL. execve() ( exec(3)) " " ( ). : ( PID ). execve() ( ) . set-user-ID set-group-ID ptrace(2). nosuid : ( EPERM) exec() . execve() execve() . () ( ) : . SIGSEGV (SIGKILL 3.17). execve() EAGAIN EAGAIN ( 3.1) execve(). EAGAIN setuid(2) setreuid(2) setresuid(2) RLIMIT_NPROC ( ). 2.6.0 3.0 set*uid(). ( 2.6 .) 3.1 set*uid() -- -- . set*uid() PF_NPROC_EXCEEDED RLIMIT_NPROC. PF_NPROC_EXCEEDED execve() EAGAIN. RLIMIT_NPROC -- fork(2) + set*uid() + execve(). execve() ( set*uid() execve()) execve() PF_NPROC_EXCEEDED. fork(2) . . . /* myecho.c */ #include #include int main(int argc, char *argv[]) { for (size_t j = 0; j < argc; j++) printf("argv[%zu]: %s\n", j, argv[j]); exit(EXIT_SUCCESS); } : /* execve.c */ #include #include #include int main(int argc, char *argv[]) { static char *newargv[] = { NULL, "hello", "world", NULL }; static char *newenviron[] = { NULL }; if (argc != 2) { fprintf(stderr, "Usage: %s \n", argv[0]); exit(EXIT_FAILURE); } newargv[0] = argv[1]; execve(argv[1], newargv, newenviron); perror("execve"); /* execve() returns only on error */ exit(EXIT_FAILURE); } : $ cc myecho.c -o myecho $ cc execve.c -o execve $ ./execve ./myecho argv[0]: ./myecho argv[1]: hello argv[2]: world . "" myecho: $ cat > script #!./myecho script-arg ^D $ chmod +x script : $ ./execve ./script argv[0]: ./myecho argv[1]: script-arg argv[2]: ./script argv[3]: hello argv[4]: world chmod(2), execveat(2), fork(2), get_robust_list(2), ptrace(2), exec(3), fexecve(3), getauxval(3), getopt(3), system(3), capabilities(7), credentials(7), environ(7), path_resolution(7), ld.so(8) 3 . . : . 6.18 8 2026 execve(2)