Re: /bin/sh is spawned - wtf?!?!?

[Stephane Chazelas <Stephane_Chazelas@xxxxxxxx>]

On Fri, Mar 28, 2008 at 11:59:57PM +1300, Atom Smasher wrote:
> from zshmisc:
> 	"If execution fails because the file is not in executable format, and the 
> file is not a directory, it is assumed to be a shell script. /bin/sh is 
> spawned to execute it."
>
> uummm.... for security reasons, shouldn't there be an option to disable 
> that behavior and just return an error?
[...]

That's POSIX and Unix standard behavior.

The #! is not POSIX, the way you describe is the only POSIX way
shell scripts are run.

Now, in POSIX mode (which I beleive the "emulate sh" is meant to
try and get close to), zsh should invoke a POSIX conformant
shell, on some systems like Solaris, it's not /bin/sh
(/usr/xpg4/bin/sh on Solaris). zsh could also interpret the file
in a child of his.

From the Single Unix Specification Version 3:

   If the execve() function fails due to an error equivalent
   to the [ENOEXEC] error, the shell shall execute a command
   equivalent to having a shell invoked with the command
   name as its first operand, with any remaining arguments
   passed to the new shell. If the executable file is not a
   text file, the shell may bypass this command execution.
   In this case, it shall write an error message and shall
   return an exit status of 126.

it's the same for the execvp() and execlp() libc functions.

  In the cases where the other members of the exec family of
  functions would fail and set errno to [ENOEXEC], the execlp()
  and execvp() functions shall execute a command interpreter and
  the environment of the executed command shall be as if the
  process invoked the sh utility using execl() as follows:

   execl(<shell path>, arg0, file, arg1, ..., (char *)0);

  where <shell path> is an unspecified pathname for the sh
  utility, file is the process image file, and for execvp(),
  where arg0, arg1, and so on correspond to the values passed to
  execvp() in argv[0], argv[1], and so on.

So it's the same for system(3), for the env utility, for awk's
system(), for vi/ex's :! and so on.

Basically, if the system returns ENOEXE for a file that has
execution permissions and if the file doesn't start with #!,
then it's a shell script. If the file starts with #!, the
behavior is unspecified.

-- 
Stéphane