-.\" Hey Emacs! This file is -*- nroff -*- source.
-.\"
.\" Copyright (c) 1992 Drew Eckhardt (drew@cs.colorado.edu), March 28, 1992
.\" and Copyright (c) 2006 Michael Kerrisk <mtk.manpages@gmail.com>
.\"
+.\" %%%LICENSE_START(VERBATIM)
.\" Permission is granted to make and distribute verbatim copies of this
.\" manual provided the copyright notice and this permission notice are
.\" preserved on all copies.
.\"
.\" Formatted or processed versions of this manual, if unaccompanied by
.\" the source, must acknowledge the copyright and authors of this work.
+.\" %%%LICENSE_END
.\"
.\" Modified by Michael Haardt <michael@moria.de>
.\" Modified 1993-07-21 by Rik Faith <faith@cs.unc.edu>
.\" 2007-09-14 Ollie Wild <aaw@google.com>, mtk
.\" Add text describing limits on command-line arguments + environment
.\"
-.TH EXECVE 2 2010-01-06 "Linux" "Linux Programmer's Manual"
+.TH EXECVE 2 2015-01-22 "Linux" "Linux Programmer's Manual"
.SH NAME
execve \- execute program
.SH SYNOPSIS
For details of the latter case, see "Interpreter scripts" below.
\fIargv\fP is an array of argument strings passed to the new program.
+By convention, the first of these strings should contain the filename
+associated with the file being executed.
\fIenvp\fP is an array of strings, conventionally of the form
\fBkey=value\fP, which are passed as environment to the new program.
Both \fIargv\fP and \fIenvp\fP must be terminated by a null pointer.
If the set-user-ID bit is set on the program file pointed to by
\fIfilename\fP,
-and the underlying file system is not mounted
+and the underlying filesystem is not mounted
.I nosuid
(the
.B MS_NOSUID
interpreter named in the PT_INTERP segment is used to load the needed
shared libraries.
This interpreter is typically
-\fI/lib/ld-linux.so.1\fP for binaries linked with the
-Linux libc 5, or \fI/lib/ld-linux.so.2\fP for binaries linked with the
-glibc 2.
+.I /lib/ld-linux.so.2
+for binaries linked with glibc.
All process attributes are preserved during an
.BR execve (),
except the following:
-.IP *
+.IP * 3
The dispositions of any signals that are being caught are
reset to the default
.RB ( signal (7)).
Memory mappings are not preserved
.RB ( mmap (2)).
.IP *
-Attached System V shared memory segments are detached
+Attached System\ V shared memory segments are detached
.RB ( shmat (2)).
.IP *
POSIX shared memory regions are unmapped
.B PR_SET_KEEPCAPS
flag is cleared.
.IP *
+(Since Linux 2.4.36 / 2.6.23)
+If a set-user-ID or set-group-ID program is being executed,
+then the parent death signal set by
+.BR prctl (2)
+.B PR_SET_PDEATHSIG
+flag is cleared.
+.IP *
The process name, as set by
.BR prctl (2)
.B PR_SET_NAME
.IR "ps\ \-o comm" ),
is reset to the name of the new executable file.
.IP *
+The
+.B SECBIT_KEEP_CAPS
+.I securebits
+flag is cleared.
+See
+.BR capabilities (7).
+.IP *
The termination signal is reset to
.B SIGCHLD
(see
is the series of words pointed to by the
.I argv
argument of
-.BR execve ().
+.BR execve (),
+starting at
+.IR argv [1].
For portable use,
.I optional-arg
should either be absent, or be specified as a single word (i.e., it
should not contain white space); see NOTES below.
-.SS "Limits on size of arguments and environment"
-Most Unix implementations impose some limit on the total size
+.SS Limits on size of arguments and environment
+Most UNIX implementations impose some limit on the total size
of the command-line argument
.RI ( argv )
and environment
Additionally, the limit per string is 32 pages (the kernel constant
.BR MAX_ARG_STRLEN ),
and the maximum number of strings is 0x7FFFFFFF.
-.SH "RETURN VALUE"
+.SH RETURN VALUE
On success,
.BR execve ()
does not return, on error \-1 is returned, and
Execute permission is denied for the file or a script or ELF interpreter.
.TP
.B EACCES
-The file system is mounted
+The filesystem is mounted
.IR noexec .
.TP
+.BR EAGAIN " (since Linux 3.1)"
+.\" commit 72fa59970f8698023045ab0713d66f3f4f96945c
+Having changed its real UID using one of the
+.BR set*uid ()
+calls, the caller was\(emand is now still\(emabove its
+.BR RLIMIT_NPROC
+resource limit (see
+.BR setrlimit (2)).
+For a more detailed explanation of this error, see NOTES.
+.TP
.B EFAULT
.I filename
+or one of the pointers in the vectors
+.I argv
+or
+.I envp
points outside your accessible address space.
.TP
.B EINVAL
or a script or ELF interpreter is not a directory.
.TP
.B EPERM
-The file system is mounted
+The filesystem is mounted
.IR nosuid ,
the user is not the superuser,
and the file has the set-user-ID or set-group-ID bit set.
.TP
.B ETXTBSY
Executable was open for writing by one or more processes.
-.SH "CONFORMING TO"
+.SH CONFORMING TO
SVr4, 4.3BSD, POSIX.1-2001.
POSIX.1-2001 does not document the #! behavior
but is otherwise compatible.
Set-user-ID and set-group-ID processes can not be
.BR ptrace (2)d.
-Linux ignores the set-user-ID and set-group-ID bits on scripts.
-
-The result of mounting a file system
+The result of mounting a filesystem
.I nosuid
varies across Linux kernel versions:
some will refuse execution of set-user-ID and set-group-ID
some will just ignore the set-user-ID and set-group-ID bits and
.BR exec ()
successfully.
-
-A maximum line length of 127 characters is allowed for the first line in
-a #! executable shell script.
-
-The semantics of the
-.I optional-arg
-argument of an interpreter script vary across implementations.
-On Linux, the entire string following the
-.I interpreter
-name is passed as a single argument to the interpreter,
-and this string can include white space.
-However, behavior differs on some other systems.
-Some systems
-.\" e.g., Solaris 8
-use the first white space to terminate
-.IR optional-arg .
-On some systems,
-.\" e.g., FreeBSD before 6.0, but not FreeBSD 6.0 onwards
-an interpreter script can have multiple arguments,
-and white spaces in
-.I optional-arg
-are used to delimit the arguments.
-
On Linux,
.I argv
-can be specified as NULL,
-which has the same effect as specifying this argument
-as a pointer to a list containing a single NULL pointer.
+and
+.I envp
+can be specified as NULL.
+In both cases, this has the same effect as specifying the argument
+as a pointer to a list containing a single null pointer.
.B "Do not take advantage of this misfeature!"
It is nonstandard and nonportable:
-on most other Unix systems doing this will result in an error
+on most other UNIX systems doing this will result in an error
.RB ( EFAULT ).
.\" e.g., EFAULT on Solaris 8 and FreeBSD 6.1; but
.\" HP-UX 11 is like Linux -- mtk, Apr 2007
will also change,
to reflect the fact that the limit on space for holding
command-line arguments and environment variables has changed.
+
+In most cases where
+.BR execve ()
+fails, control returns to the original executable image,
+and the caller of
+.BR execve ()
+can then handle the error.
+However, in (rare) cases (typically caused by resource exhaustion),
+failure may occur past the point of no return:
+the original executable image has been torn down,
+but the new image could not be completely built.
+In such cases, the kernel kills the process with a
+.BR SIGKILL
+signal.
+.\"
+.SS Interpreter scripts
+A maximum line length of 127 characters is allowed for the first line in
+an interpreter scripts.
+
+The semantics of the
+.I optional-arg
+argument of an interpreter script vary across implementations.
+On Linux, the entire string following the
+.I interpreter
+name is passed as a single argument to the interpreter,
+and this string can include white space.
+However, behavior differs on some other systems.
+Some systems
+.\" e.g., Solaris 8
+use the first white space to terminate
+.IR optional-arg .
+On some systems,
+.\" e.g., FreeBSD before 6.0, but not FreeBSD 6.0 onward
+an interpreter script can have multiple arguments,
+and white spaces in
+.I optional-arg
+are used to delimit the arguments.
+
+Linux ignores the set-user-ID and set-group-ID bits on scripts.
.\"
.\" .SH BUGS
.\" Some Linux versions have failed to check permissions on ELF
.\" .BR execve ()
.\" that could be exploited for denial of service by a suitably crafted
.\" ELF binary. There are no known problems with 2.0.34 or 2.2.15.
+.SS execve() and EAGAIN
+A more detailed explanation of the
+.BR EAGAIN
+error that can occur (since Linux 3.1) when calling
+.BR execve ()
+is as follows.
+
+The
+.BR EAGAIN
+error can occur when a
+.I preceding
+call to
+.BR setuid (2),
+.BR setreuid (2),
+or
+.BR setresuid (2)
+caused the real user ID of the process to change,
+and that change caused the process to exceed its
+.BR RLIMIT_NPROC
+resource limit (i.e., the number of processes belonging
+to the new real UID exceeds the resource limit).
+From Linux 2.6.0 to 3.0, this caused the
+.BR set*uid ()
+call to fail.
+(Prior to 2.6,
+.\" commit 909cc4ae86f3380152a18e2a3c44523893ee11c4
+the resource limit was not imposed on processes that
+changed their user IDs.)
+
+Since Linux 3.1, the scenario just described no longer causes the
+.BR set*uid ()
+call to fail,
+because it too often led to security holes where buggy applications
+didn't check the return status and assumed
+that\(emif the caller had root privileges\(emthe call would always succeed.
+Instead, the
+.BR set*uid ()
+calls now successfully change the real UID,
+but the kernel sets an internal flag, named
+.BR PF_NPROC_EXCEEDED ,
+to note that the
+.BR RLIMIT_NPROC
+resource limit has been exceeded.
+If the
+.BR PF_NPROC_EXCEEDED
+flag is set and the resource limit is still
+exceeded at the time of a subsequent
+.BR execve ()
+call, that call fails with the error
+.BR EAGAIN .
+This kernel logic ensures that the
+.BR RLIMIT_NPROC
+resource limit is still enforced for the
+common privileged daemon workflow\(emnamely,
+.BR fork (2)
++
+.BR set*uid ()
++
+.BR execve ().
+
+If the resource limit was not still exceeded at the time of the
+.BR execve ()
+call
+(because other processes belonging to this real UID terminated between the
+.BR set*uid ()
+call and the
+.BR execve ()
+call), then the
+.BR execve ()
+call succeeds and the kernel clears the
+.BR PF_NPROC_EXCEEDED
+process flag.
+The flag is also cleared if a subsequent call to
+.BR fork (2)
+by this process succeeds.
.SS Historical
-With Unix V6 the argument list of an
+With UNIX\ V6, the argument list of an
.BR exec ()
call was ended by 0,
while the argument list of
Thus, this argument list was not directly usable in a further
.BR exec ()
call.
-Since Unix V7 both are NULL.
+Since UNIX\ V7, both are NULL.
+.\"
+.\" .SH BUGS
+.\" Some Linux versions have failed to check permissions on ELF
+.\" interpreters. This is a security hole, because it allows users to
+.\" open any file, such as a rewinding tape device, for reading. Some
+.\" Linux versions have also had other security holes in
+.\" .BR execve ()
+.\" that could be exploited for denial of service by a suitably crafted
+.\" ELF binary. There are no known problems with 2.0.34 or 2.2.15.
.SH EXAMPLE
The following program is designed to be execed by the second program below.
-It just echoes its command-line one per line.
+It just echoes its command-line arguments, one per line.
.in +4n
.nf
char *newenviron[] = { NULL };
if (argc != 2) {
- fprintf(stderr, "Usage: %s <file-to-exec>\\n", argv[0]);
- exit(EXIT_FAILURE);
+ fprintf(stderr, "Usage: %s <file\-to\-exec>\\n", argv[0]);
+ exit(EXIT_FAILURE);
}
newargv[0] = argv[1];
execve(argv[1], newargv, newenviron);
- perror("execve"); /* execve() only returns on error */
+ perror("execve"); /* execve() returns only on error */
exit(EXIT_FAILURE);
}
.fi
.in +4n
.nf
-.RB "$" " cat > script.sh"
-.B #! ./myecho script-arg
+.RB "$" " cat > script"
+.B #!./myecho script-arg
.B ^D
-.RB "$" " chmod +x script.sh"
+.RB "$" " chmod +x script"
.fi
.in
.in +4n
.nf
-.RB "$" " ./execve ./script.sh"
+.RB "$" " ./execve ./script"
argv[0]: ./myecho
argv[1]: script-arg
-argv[2]: ./script.sh
+argv[2]: ./script
argv[3]: hello
argv[4]: world
.fi
.in
-.SH "SEE ALSO"
+.SH SEE ALSO
.BR chmod (2),
+.BR execveat (2),
.BR fork (2),
.BR ptrace (2),
.BR execl (3),
.BR environ (7),
.BR path_resolution (7),
.BR ld.so (8)
+.SH COLOPHON
+This page is part of release 3.79 of the Linux
+.I man-pages
+project.
+A description of the project,
+information about reporting bugs,
+and the latest version of this page,
+can be found at
+\%http://www.kernel.org/doc/man\-pages/.
OSDN Git Service
