# fexecve

## NAME



           fexecve - execute program specified via file descriptor
    


## LIBRARY



           Standard C library (_libc_ , _-lc_)
    


## SYNOPSIS



           **#include <unistd.h>**
    
           **int fexecve(int** _fd_**, char *const** _argv_**[], char *const** _envp_**[]);**
    
       Feature Test Macro Requirements for glibc (see
       feature_test_macros(7)):
    
           **fexecve**():
               Since glibc 2.10:
                   _POSIX_C_SOURCE >= 200809L
               Before glibc 2.10:
                   _GNU_SOURCE
    


## DESCRIPTION



           **fexecve**() performs the same task as execve(2), with the difference
           that the file to be executed is specified via a file descriptor,
           _fd_ , rather than via a pathname.  The file descriptor _fd_ must be
           opened read-only (**O_RDONLY**) or with the **O_PATH** flag and the caller
           must have permission to execute the file that it refers to.
    


## RETURN VALUE



           A successful call to **fexecve**() never returns.  On error, the
           function does return, with a result value of -1, and _errno_ is set
           to indicate the error.
    


## ERRORS



           Errors are as for execve(2), with the following additions:
    
           **EINVAL** _fd_ is not a valid file descriptor, or _argv_ is NULL, or _envp_
                  is NULL.
    
           **ENOENT** The close-on-exec flag is set on _fd_ , and _fd_ refers to a
                  script.  See BUGS.
    
           **ENOSYS** The kernel does not provide the execveat(2) system call,
                  and the _/proc_ filesystem could not be accessed.
    


## ATTRIBUTES



           For an explanation of the terms used in this section, see
           attributes(7).
           ┌──────────────────────────────────────┬───────────────┬─────────┐
           │ **Interface** │ **Attribute** │ **Value** │
           ├──────────────────────────────────────┼───────────────┼─────────┤
           │ **fexecve**()                            │ Thread safety │ MT-Safe │
           └──────────────────────────────────────┴───────────────┴─────────┘
    


## STANDARDS



           POSIX.1-2008.
    


## NOTES



           The idea behind **fexecve**() is to allow the caller to verify
           (checksum) the contents of an executable before executing it.
           Simply opening the file, checksumming the contents, and then doing
           an execve(2) would not suffice, since, between the two steps, the
           filename, or a directory prefix of the pathname, could have been
           exchanged (by, for example, modifying the target of a symbolic
           link).  **fexecve**() does not mitigate the problem that the _contents_
           of a file could be changed between the checksumming and the call
           to **fexecve**(); for that, the solution is to ensure that the
           permissions on the file prevent it from being modified by
           malicious users.
    
           The natural idiom when using **fexecve**() is to set the close-on-exec
           flag on _fd_ , so that the file descriptor does not leak through to
           the program that is executed.  This approach is natural for two
           reasons.  First, it prevents file descriptors being consumed
           unnecessarily.  (The executed program normally has no need of a
           file descriptor that refers to the program itself.)  Second, if
           **fexecve**() is used recursively, employing the close-on-exec flag
           prevents the file descriptor exhaustion that would result from the
           fact that each step in the recursion would cause one more file
           descriptor to be passed to the new program.  (But see BUGS.)
    


## BUGS



           If _fd_ refers to a script (i.e., it is an executable text file that
           names a script interpreter with a first line that begins with the
           characters _#!_)  and the close-on-exec flag has been set for _fd_ ,
           then **fexecve**() fails with the error **ENOENT**.  This error occurs
           because, by the time the script interpreter is executed, _fd_ has
           already been closed because of the close-on-exec flag.  Thus, the
           close-on-exec flag can't be set on _fd_ if it refers to a script,
           leading to the problems described in NOTES.
    


* * *