Can I execute a Linux binary without the execute permission bit being set?

Question

Is there a way to run an executable binary file under Linux which does not have the execute bit set? chmod +x is not an option.

E.g. it's permissions may be r--r--r-- only.

Executing scripts is possible without setting the execute bit and putting in a shebang by passing the source to the interpreter, e.g. bash script.sh or python script.py.

So is there something like execute abinaryfile that will load the object code into memory and run it?

Answer 1

You can use /lib/ld*.so as an ELF interpreter, like so:

cp /bin/ls /tmp/ls
chmod a-x /tmp/ls
/lib/ld-linux.so.2 /tmp/ls

The actual name differs from architecture to architecture. Some names include /lib/ld-linux.so.2, /lib/ld-linux-x86-64.so.2 and /lib/ld-2.7.so. You can probably find it singularly as /lib/ld*.

Answer 2

No. At least, not in the same way. You are still executing a binary when you do the python thing. Python is +x. You would need to compile something that can load a file and execute it.

TiCL should make his/her response an answer because it is the best way to go.

Answer 3

The exec syscall of the Linux kernel fails with EACCES if the file is not executable

While you can do sh myprog.sh, trying to run the program as ./myprog.sh cannot work, since when you do that:

• Bash uses the exec system call on ./myprog.sh
• the shebangs are interpreted directly by the exec system call of the Linux kernel as explained at: https://stackoverflow.com/questions/2429511/why-do-people-write-the-usr-bin-env-python-shebang-on-the-first-line-of-a-pyt/40938801#40938801
• the Linux kernel refuses to execute files without executable permission

This can be verified with main.c:

#define _XOPEN_SOURCE 700
#include <errno.h>
#include <stdio.h>
#include <unistd.h>

int main(void) {
    char *argv[] = {"myprog", NULL};
    char *envp[] = {NULL};
    int ret;
    ret = execve("myprog.sh", argv, envp);
    perror("execve");
    printf("%d\n", errno);
    printf("%d\n", EACCES);
}

and myprog.sh:

#!/bin/sh
echo worked

If myprog.sh is not executable, main fails with:

execve: Permission denied
13
13

Tested in Ubuntu 17.10, gcc -std=c99.

POSIX 7 mentions that at:

The exec functions, except for fexecve(), shall fail if:

[EACCES] Search permission is denied for a directory listed in the new process image file's path prefix, or the new process image file denies execution permission.

Further rationale can be found at: https://security.stackexchange.com/questions/66550/unix-execute-permission-can-be-easily-bypassed-is-it-superfluous-or-whats-the