The exec() Family of System Calls

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

#include <stdio.h>
#include <unistd.h>
 
int main() {
    printf("Before exec: PID = %d
", getpid());
    
    // This replaces the entire process image with /bin/ls
    // If exec succeeds, the following line NEVER executes
    execl("/bin/ls", "ls", "-l", NULL);
    
    // Only reached if exec fails
    perror("exec failed");
    return 1;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

#include <unistd.h>
#include <stdio.h>
 
void using_list_variant() {
    // Known at compile time: exactly 3 arguments
    // execl(path, arg0, arg1, arg2, NULL)
    execl("/bin/ls", "ls", "-l", "-a", NULL);
    // arg0 is conventionally the program name
}
 
void using_vector_variant(int argc, char *argv[]) {
    // Runtime-determined arguments
    // Useful when forwarding arguments from another program
    
    // Build argument vector dynamically
    char *my_args[argc + 1];  // +1 for NULL terminator
    
    my_args[0] = "myprogram";  // arg0 = program name
    for (int i = 1; i < argc; i++) {
        my_args[i] = argv[i];  // Copy arguments
    }
    my_args[argc] = NULL;  // NULL terminator required
    
    execv("/path/to/myprogram", my_args);
}
 
void shell_command_example() {
    // Real-world example: building a grep command dynamically
    char *pattern = "error";  // Could come from user input
    char *file = "/var/log/syslog";  // Could be dynamic
    
    // With list variant - awkward for dynamic arguments:
    execl("/bin/grep", "grep", pattern, file, NULL);
    
    // With vector variant - natural for dynamic arguments:
    char *grep_args[] = {"grep", pattern, file, NULL};
    execv("/bin/grep", grep_args);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
 
int main() {
    // WITHOUT path search - must specify full path
    execl("/usr/bin/python3", "python3", "--version", NULL);
    
    // Error: if python3 isn't at exactly /usr/bin/python3, this fails
    
    // WITH path search - searches PATH automatically
    execlp("python3", "python3", "--version", NULL);
    
    // This checks each directory in PATH:
    // 1. /usr/local/bin/python3?  No
    // 2. /usr/bin/python3?        Yes! Execute it.
    
    perror("exec failed");
    return 1;
}
 
// Demonstrating the search behavior explicitly
void show_path_search() {
    // Assume PATH=/usr/local/bin:/usr/bin:/bin
    
    // execlp("ls", ...) searches:
    //   /usr/local/bin/ls - not found
    //   /usr/bin/ls       - not found  
    //   /bin/ls           - FOUND! Execute.
    
    // execlp("/bin/ls", ...) does NOT search
    //   because the filename contains '/'
    //   It tries /bin/ls directly (same as execl)
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
 
// The global environ variable holds current environment
extern char **environ;
 
int main() {
    // Non-'e' variant: child inherits parent's environment
    execl("/usr/bin/env", "env", NULL);
    // Child sees all of parent's environment variables
    
    // 'e' variant: specify environment explicitly
    char *custom_env[] = {
        "PATH=/usr/bin:/bin",
        "HOME=/tmp",
        "MY_APP_MODE=production",
        "DATABASE_URL=postgres://localhost/mydb",
        NULL  // NULL terminator required
    };
    
    execle("/usr/bin/env", "env", NULL, custom_env);
    // Child sees ONLY the four variables we specified
    // Parent's other variables are NOT inherited
    
    perror("exec failed");
    return 1;
}
 
// Security: creating a clean environment
void secure_exec() {
    // For setuid programs or security-sensitive operations,
    // never inherit the untrusted environment
    
    char *safe_env[] = {
        "PATH=/usr/bin:/bin",  // Known-safe PATH
        "IFS= \t
",           // Safe IFS
        "HOME=/tmp",           // Neutral home
        NULL
    };
    
    // Execute with controlled environment only
    execve("/path/to/secure/program", argv, safe_env);
}
 
// Augmenting the environment
void add_to_environment() {
    // Sometimes you want parent's environment PLUS some additions
    // This requires constructing a new array
    
    int env_count = 0;
    for (char **e = environ; *e != NULL; e++) {
        env_count++;
    }
    
    // Create new array: original + 2 new + NULL terminator
    char *new_env[env_count + 3];
    
    // Copy existing environment
    for (int i = 0; i < env_count; i++) {
        new_env[i] = environ[i];
    }
    
    // Add new variables
    new_env[env_count] = "MY_NEW_VAR=value";
    new_env[env_count + 1] = "ANOTHER_VAR=other";
    new_env[env_count + 2] = NULL;
    
    execve("/path/to/program", argv, new_env);
}

1
2
3
4
5
6
7
8
9

#include <unistd.h>
 
// The actual system call signature
int execve(const char *pathname,  // Full path to executable
           char *const argv[],     // Argument vector (NULL-terminated)
           char *const envp[]);    // Environment vector (NULL-terminated)
 
// Returns: -1 on error (only return case), sets errno
// On success: does not return (process image replaced)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

#include <unistd.h>
#include <stdio.h>
#include <errno.h>
#include <string.h>
 
// MISTAKE 1: Forgetting the NULL terminator
void mistake_no_null() {
    // WRONG: No NULL terminator - undefined behavior!
    execl("/bin/ls", "ls", "-l");  // Missing NULL
    
    // CORRECT:
    execl("/bin/ls", "ls", "-l", NULL);
}
 
// MISTAKE 2: Using wrong pathname vs filename
void mistake_path_type() {
    // WRONG with non-'p' variant:
    execl("ls", "ls", "-l", NULL);  // "ls" is not a path!
    // This looks for "./ls" or fails
    
    // CORRECT: Use 'p' variant for name-only
    execlp("ls", "ls", "-l", NULL);
    
    // Or specify full path for non-'p':
    execl("/bin/ls", "ls", "-l", NULL);
}
 
// MISTAKE 3: Ignoring exec failure
void mistake_no_error_check() {
    // WRONG: No error handling
    execl("/bin/nonexistent", "nonexistent", NULL);
    // If we reach here, exec failed, but we don't know why
    printf("continuing normally...
");  // Bad!
    
    // CORRECT: Always check for failure
    execl("/bin/nonexistent", "nonexistent", NULL);
    // If we reach here, exec definitely failed
    fprintf(stderr, "exec failed: %s
", strerror(errno));
    exit(1);  // Or handle error appropriately
}
 
// MISTAKE 4: Expecting exec to return on success
void mistake_expect_return() {
    execl("/bin/ls", "ls", NULL);
    
    // WRONG EXPECTATION: This code never runs on success!
    printf("ls finished
");  // Never printed if exec succeeds
}
 
// MISTAKE 5: Wrong arg0 convention
void mistake_arg0() {
    // UNUSUAL (but valid): arg0 doesn't match program name
    execl("/bin/busybox", "ls", "-l", NULL);
    // This actually runs busybox, which uses arg0 to decide behavior
    // Works for busybox, but confusing for regular programs
    
    // CONVENTION: arg0 should be the program name
    execl("/bin/ls", "ls", "-l", NULL);
}
 
// MISTAKE 6: Modifying strings in argv (they should be const-ish)
void mistake_modify_argv() {
    char *args[] = {"prog", "arg1", NULL};
    
    // Some programs might try to modify argv for ps display
    // But exec copies these strings, so modifications after
    // exec setup are lost anyway
}