Demystifying the (Shebang): Kernel Adventures

Summary

From my first experience creating a shell script, I learned about the shebang (#!), the special first line used to specify the interpreter for executing the script: #! /usr/bin/sh echo "Hello, World!" So that you can just invoke it with ./hello.sh and it will run with the specified interpreter, assuming the file has execute permissions. Of course, the shebang isn’t limited to shell scripts; you can use it for any script type: #! /usr/bin/python3 print("Hello, World!") This is particularly useful because many bundled Linux utilities are actually scripts. Thanks to the shebang, you don’t need to explicitly invoke their interpreters. For example, there are two (very confusing) programs to create a user on Linux: useradd and adduser. One of them is the actual program that will create the user in the system, the other one is a utility that will create the user, the home directory and configure the user for you. Since I never remember which one is which, a good way to check is using the utility file: $ file $(which useradd) /usr/sbin/useradd: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2 (...) $ file $(which adduser) /usr/sbin/adduser: Perl script text executable Ok, we know that addser is the tool we want to use, because it’s more user-friendly and generally does what you’d expect when adding a user. And yes, if you check how it starts: $ head -n 1 /usr/sbin/adduser #! /usr/bin/perl I had always assumed the shell used the shebang as a hint, but that’s incorrect! This functionality is actually handled directly by the Linux Kernel. Tracking the kernel execution One good way to track any executable in Linux is using strace, which traces all the system calls made by a process: $ strace ./test.sh execve("./test.sh", ["./test.sh"], 0x7ffed15d9828 /* 33 vars */) = 0 brk(NULL) = 0x59aea5a28000 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x78ee2be49000 access("/etc/ld.so.preload"...