Re: '/bin/sh -c' with multiple args

> Date: Thu, 4 Dec 2025 16:52:12 -0500
> From: Jan Schaumann <[email protected]>
> 
> How does '/bin/sh -c' with multiple args actually
> work?
> 
> The manual page says
> 
> sh -c command_string [command_name [argument ...]]
> 
> is valid, and should behave as such:
> 
> "Read commands from the command_string operand instead
> of, or in addition to, from the standard input.
> Special parameter 0 will be set from the command_name
> operand if given, and the positional parameters (1, 2,
> etc.)  set from the remaining argument operands, if
> any."

The important point is that command_string is interpreted as a shell
script, not an arbitrary path to a program to execute.

So try this:

$ sh -c 'echo 0=$0 1=$1 2=$2' foo bar baz quux

Exercise: Without running it, what is it going to print?

> So I would expect
> 
> sh -c /bin/sleep whatever 30
> 
> to lead to "/bin/sleep 30" being invoked with an argv0
> set to "whatever".
> 
> However:
> 
> $ sh -c /bin/sleep whatever 30
> usage: sleep seconds

ktrace it!

$ ktrace -t ac /bin/sh -c sleep whatever 30
usage: sleep seconds
$ kdump -t ac | grep -e ARG -e 'CALL.*execve'  
  1308   1308 ktrace   CALL  execve(0x7f7ffff10d7c,0x7f7ffff10750,0x7f7ffff10780) 
  1308   1308 ktrace   ARG   "/bin/sh"
  1308   1308 ktrace   ARG   "-c"
  1308   1308 ktrace   ARG   "sleep"
  1308   1308 ktrace   ARG   "whatever"
  1308   1308 ktrace   ARG   "30"
  1308   1308 sh       CALL  execve(0x7e2e838,0x7e2e730,0x7e2e740)
  1308   1308 sh       ARG   "sleep"
$ 

(The ARG lines represent argv[0], argv[1], &c.)

> Now I know that I can do
> 
> $ sh -c "/bin/sleep 30"
> 
> but the manual page suggests I should be able to set
> argv0 of the command as described above, but I don't
> see a way of actually doing that.

I don't think sh has a way to do that.  It only has a way to set $0 in
a shell script you run.

There is only one call to execve in /bin/sh (under two #if branches):

226#ifdef SYSV
227	do {
228		execve(cmd, argv, envp);
229	} while (errno == EINTR);
230#else
231	execve(cmd, argv, envp);
232#endif

https://nxr.netbsd.org/xref/src/bin/sh/exec.c?r=1.59#226

The surrounding function tryexec has two callers:

1. When you write a path with a slash as a command name:

133	if (strchr(argv[0], '/') != NULL) {
134		tryexec(argv[0], argv, envp, vforked);

https://nxr.netbsd.org/xref/src/bin/sh/exec.c?r=1.59#133

2. When you don't write any slash in the command name:

140		while ((cmdname = padvance(&path, argv[0], 1)) != NULL) {
141			if (--idx < 0 && pathopt == NULL) {
142				/*
143				 * tryexec() does not return if it works.
144				 */
145				tryexec(cmdname, argv, envp, vforked);

https://nxr.netbsd.org/xref/src/bin/sh/exec.c?r=1.59#140

Both of these paths pass the command name as written in the shell
script verbatim, so it has to be the same path by which the shell
script found the command.

(There's also a call to execl, but it is only for /bin/pwd:
https://nxr.netbsd.org/xref/src/bin/sh/cd.c?r=1.56#522)