patchThe GNU Bourne-Again SHell - Patches: patch #10445, do not interpret scripts with...


You are not allowed to post comments on this tracker with your current authentication level.

patch #10445: do not interpret scripts with valid shebang executable

Submitter:  Ivan Trubach <tie>
Submitted:  Mon 25 Mar 2024 10:04:08 AM UTC
Category:  None Priority:  5 - Normal
Status:  Wont Do Privacy:  Public
Assigned to:  None Open/Closed:  Open

Tue 26 Mar 2024 01:23:28 PM UTC, comment #3: 

With the current version, yes.

In the next version, bash will look past the first line when checking whether or not a script file is a binary file. That may help your issue; it may not.

Chet Ramey <chet>
Group administrator
Mon 25 Mar 2024 09:47:00 PM UTC, comment #2: 

Thanks for clarifying that. If I understand this correctly, the only way to bypass this behavior is to exec via env or any other equivalent external command?

FWIW reference to the section of the standard that mandates such behavior:

Ivan Trubach <tie>
Mon 25 Mar 2024 08:50:00 PM UTC, comment #1: 

POSIX requires the bash behavior:

"If the execl() function fails due to an error equivalent to the
[ENOEXEC] error, the shell shall execute a command equivalent to
having a shell invoked with the command name as its first
operand, with any remaining arguments passed to the new shell. If
the executable file is not a text file, the shell may bypass this
command execution. In this case, it shall write an error message
and shall return an exit status of 126."

See for changes I made
post-bash-5.2 in this area.

Chet Ramey <chet>
Group administrator
Mon 25 Mar 2024 10:04:08 AM UTC, original submission:  

If a script interperter in hash bang is an executable and executing the
script returns ENOEXEC error, then the error applies to the interpreter
executable and we should not be interpreting script in a subshell.
Instead, return an error indicating bad interpreter.

That is, before this change, Bash attempted to interpret scripts that
declared an interpreter that exists and has executable bit set, but
built for a different platform (that is, host cannot execute it). This
is not consistent with OS implementation of hash bangs and breaks
assumptions that such scripts make (i.e. in most cases there is a reason
script has #!/bin/bash-for-aarch64 instead of #!/usr/bin/env bash). In
particular, this affects NixOS/nixpkgs when build ≠ host and some script
for the build platform accidentally leaks to the host configuration.
See also

Ivan Trubach <tie>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by tie (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-03-25 chet StatusNone Wont Do
    2024-03-25 tie Attached File- Added 0001-do-not-interpret-scripts-with-valid-shebang-executab.patch, #55886

    Back to the top

    Powered by Savane 3.13-c54d.
    Corresponding source code