man3/system.3

   1 .\" Copyright (c) 1993 by Thomas Koenig (ig25@rz.uni-karlsruhe.de)
   2 .\" and Copyright (c) 2014 by Michael Kerrisk <mtk.manpages@gmail.com>
   3 .\"
   4 .\" %%%LICENSE_START(VERBATIM)
   5 .\" Permission is granted to make and distribute verbatim copies of this
   6 .\" manual provided the copyright notice and this permission notice are
   7 .\" preserved on all copies.
   8 .\"
   9 .\" Permission is granted to copy and distribute modified versions of this
  10 .\" manual under the conditions for verbatim copying, provided that the
  11 .\" entire resulting derived work is distributed under the terms of a
  12 .\" permission notice identical to this one.
  13 .\"
  14 .\" Since the Linux kernel and libraries are constantly changing, this
  15 .\" manual page may be incorrect or out-of-date.  The author(s) assume no
  16 .\" responsibility for errors or omissions, or for damages resulting from
  17 .\" the use of the information contained herein.  The author(s) may not
  18 .\" have taken the same level of care in the production of this manual,
  19 .\" which is licensed free of charge, as they might when working
  20 .\" professionally.
  21 .\"
  22 .\" Formatted or processed versions of this manual, if unaccompanied by
  23 .\" the source, must acknowledge the copyright and authors of this work.
  24 .\" %%%LICENSE_END
  25 .\"
  26 .\" Modified Sat Jul 24 17:51:15 1993 by Rik Faith (faith@cs.unc.edu)
  27 .\" Modified 11 May 1998 by Joseph S. Myers (jsm28@cam.ac.uk)
  28 .\" Modified 14 May 2001, 23 Sep 2001 by aeb
  29 .\" 2004-12-20, mtk
  30 .\"
  31 .TH SYSTEM 3  2019-03-06 "" "Linux Programmer's Manual"
  32 .SH NAME
  33 system \- execute a shell command
  34 .SH SYNOPSIS
  35 .nf
  36 .B #include <stdlib.h>
  37 .PP
  38 .BI "int system(const char *" "command" );
  39 .fi
  40 .SH DESCRIPTION
  41 The
  42 .BR system ()
  43 library function uses
  44 .BR fork (2)
  45 to create a child process that executes the shell command specified in
  46 .I command
  47 using
  48 .BR execl (3)
  49 as follows:
  50 .PP
  51 .in +4n
  52 .EX
  53 execl("/bin/sh", "sh", "-c", command, (char *) NULL);
  54 .EE
  55 .in
  56 .PP
  57 .BR system ()
  58 returns after the command has been completed.
  59 .PP
  60 During execution of the command,
  61 .B SIGCHLD
  62 will be blocked, and
  63 .B SIGINT
  64 and
  65 .B SIGQUIT
  66 will be ignored, in the process that calls
  67 .BR system ().
  68 (These signals will be handled according to their defaults inside
  69 the child process that executes
  70 .IR command .)
  71 .PP
  72 If
  73 .I command
  74 is NULL, then
  75 .BR system ()
  76 returns a status indicating whether a shell is available on the system.
  77 .SH RETURN VALUE
  78 The return value of
  79 .BR system ()
  80 is one of the following:
  81 .IP * 3
  82 If
  83 .I command
  84 is NULL, then a nonzero value if a shell is available,
  85 or 0 if no shell is available.
  86 .IP *
  87 If a child process could not be created,
  88 or its status could not be retrieved,
  89 the return value is \-1 and
  90 .I errno
  91 is set to indicate the error.
  92 .IP *
  93 If a shell could not be executed in the child process,
  94 then the return value is as though the child shell terminated by calling
  95 .BR _exit (2)
  96 with the status 127.
  97 .IP *
  98 If all system calls succeed,
  99 then the return value is the termination status of the child shell
 100 used to execute
 101 .IR command .
 102 (The termination status of a shell is the termination status of
 103 the last command it executes.)
 104 .PP
 105 In the last two cases,
 106 the return value is a "wait status" that can be examined using
 107 the macros described in
 108 .BR waitpid (2).
 109 (i.e.,
 110 .BR WIFEXITED (),
 111 .BR WEXITSTATUS (),
 112 and so on).
 113 .PP
 114 .BR system ()
 115 does not affect the wait status of any other children.
 116 .SH ERRORS
 117 .BR system ()
 118 can fail with any of the same errors as
 119 .BR fork (2).
 120 .SH ATTRIBUTES
 121 For an explanation of the terms used in this section, see
 122 .BR attributes (7).
 123 .TS
 124 allbox;
 125 lb lb lb
 126 l l l.
 127 Interface       Attribute       Value
 128 T{
 129 .BR system ()
 130 T}      Thread safety   MT-Safe
 131 .TE
 132 .SH CONFORMING TO
 133 POSIX.1-2001, POSIX.1-2008, C89, C99.
 134 .SH NOTES
 135 .BR system ()
 136 provides simplicity and convenience:
 137 it handles all of the details of calling
 138 .BR fork (2),
 139 .BR execl (3),
 140 and
 141 .BR waitpid (2),
 142 as well as the necessary manipulations of signals;
 143 in addition,
 144 the shell performs the usual substitutions and I/O redirections for
 145 .IR command .
 146 The main cost of
 147 .BR system ()
 148 is inefficiency:
 149 additional system calls are required to create the process that
 150 runs the shell and to execute the shell.
 151 .PP
 152 If the
 153 .B _XOPEN_SOURCE
 154 feature test macro is defined
 155 (before including
 156 .I any
 157 header files),
 158 then the macros described in
 159 .BR waitpid (2)
 160 .RB ( WEXITSTATUS (),
 161 etc.) are made available when including
 162 .IR <stdlib.h> .
 163 .PP
 164 As mentioned,
 165 .BR system ()
 166 ignores
 167 .B SIGINT
 168 and
 169 .BR SIGQUIT .
 170 This may make programs that call it
 171 from a loop uninterruptible, unless they take care themselves
 172 to check the exit status of the child.
 173 For example:
 174 .PP
 175 .in +4n
 176 .EX
 177 while (something) {
 178     int ret = system("foo");
 179
 180     if (WIFSIGNALED(ret) &&
 181         (WTERMSIG(ret) == SIGINT || WTERMSIG(ret) == SIGQUIT))
 182             break;
 183 }
 184 .EE
 185 .in
 186 .PP
 187 According to POSIX.1, it is unspecified whether handlers registered using
 188 .BR pthread_atfork (3)
 189 are called during the execution of
 190 .BR system ().
 191 In the glibc implementation, such handlers are not called.
 192 .PP
 193 In versions of glibc before 2.1.3, the check for the availability of
 194 .I /bin/sh
 195 was not actually performed if
 196 .I command
 197 was NULL; instead it was always assumed to be available, and
 198 .BR system ()
 199 always returned 1 in this case.
 200 Since glibc 2.1.3, this check is performed because, even though
 201 POSIX.1-2001 requires a conforming implementation to provide
 202 a shell, that shell may not be available or executable if
 203 the calling program has previously called
 204 .BR chroot (2)
 205 (which is not specified by POSIX.1-2001).
 206 .PP
 207 It is possible for the shell command to terminate with a status of 127,
 208 which yields a
 209 .BR system ()
 210 return value that is indistinguishable from the case
 211 where a shell could not be executed in the child process.
 212 .\"
 213 .SS Caveats
 214 .PP
 215 Do not use
 216 .BR system ()
 217 from a privileged program
 218 (a set-user-ID or set-group-ID program, or a program with capabilities)
 219 because strange values for some environment variables
 220 might be used to subvert system integrity.
 221 For example,
 222 .BR PATH
 223 could be manipulated so that an arbitrary program
 224 is executed with privilege.
 225 Use the
 226 .BR exec (3)
 227 family of functions instead, but not
 228 .BR execlp (3)
 229 or
 230 .BR execvp (3)
 231 (which also use the
 232 .B PATH
 233 environment variable to search for an executable).
 234 .PP
 235 .BR system ()
 236 will not, in fact, work properly from programs with set-user-ID or
 237 set-group-ID privileges on systems on which
 238 .I /bin/sh
 239 is bash version 2: as a security measure, bash 2 drops privileges on startup.
 240 (Debian uses a different shell,
 241 .BR dash (1),
 242 which does not do this when invoked as
 243 .BR sh .)
 244 .PP
 245 Any user input that is employed as part of
 246 .I command
 247 should be
 248 .I carefully
 249 sanitized, to ensure that unexpected shell commands or command options
 250 are not executed.
 251 Such risks are especially grave when using
 252 .BR system ()
 253 from a privileged program.
 254 .SH SEE ALSO
 255 .BR sh (1),
 256 .BR execve (2),
 257 .BR fork (2),
 258 .BR sigaction (2),
 259 .BR sigprocmask (2),
 260 .BR wait (2),
 261 .BR exec (3),
 262 .BR signal (7)