Why can the execve system call run "/bin/sh" without any argv arguments, but not "/bin/ls"?

c linux system-calls glibc shellcode
Arvin Hsu picture Arvin Hsu · Apr 17, 2016 · Viewed 7.2k times · Source

I am confused with the syscall of __NR_execve. When I learn linux system call. The correct way that I know to use execve is like this:

char *sc[2]; 
sc[0]="/bin/sh"; 
sc[1]= NULL; 
execve(sc[0],sc,NULL);

Then the function execve will call syscall() to get into system kernel with putting the arguments on Registers EAX, EBX, ECX and EDX. However, It still succeed if I use 

execve("/bin/sh",NULL,NULL);

But if I replace "/bin/sh" with "/bin/ls"，it fail with:

A NULL argv[0] was passed through an exec system call.

I wonder why "/bin/sh" can be executed successfully without enough parameters while "/bin/ls" fail?

Answer

fluter picture fluter · Apr 17, 2016

This is not a kernel issues, kernel will run filename arg of execve regardless of argv and envp are NULL or not, it is just a unix convention that argv[0] points to the program name.

And what's you saw is just normal, nothing is wrong. Because ls is part of GNU's coreutils, and all programs in the coreutils package call set_program_name to do some setup work, you can see in the source, it checks whether argv[0] if NULL, and it will call abort when it is. On the other hand, /bin/sh is apparently a program that does not belong to coreutils, and does not check against argv[0], that's why it run without the problem.

Refer to the source code:

http://git.savannah.gnu.org/cgit/coreutils.git/tree/src/ls.c#n1285

http://git.savannah.gnu.org/cgit/gnulib.git/tree/lib/progname.c#n51

Related questions

How to write a signal handler to catch SIGSEGV?

I want to write a signal handler to catch SIGSEGV. I protect a block of memory for read or write using char *buffer; char *p; char a; int pagesize = 4096; mprotect(buffer,pagesize,PROT_NONE) This protects pagesize bytes of memory …

Read More
How do I get a thread ID from an arbitrary pthread_t?

I have a pthread_t, and I'd like to change its CPU affinity. The problem is that I'm using glibc 2.3.2, which doesn't have pthread_setaffinity_np(). That's OK, though, because pthread_setaffinity_np() is itself a wrapper of sched_setaffinity(), …

Read More
How can I make the system call write() print to the screen?

For my OS class I'm supposed to implement Linux's cat using only system calls (no printf) Reading this reference I found it being used to print to a file. I guess I should manipulate ofstream. In the example appears: ofstream …

Read More