echo 'main(){}' | gcc -xc - -o /dev/stdout | ???

Is there a way to run the output binary on a unix-like system?

EDIT: I needed it to run the output of g++ in a sandboxed environment where I can't write any file (nothing malicious, I promise).

  • I believe that basic security mechanisms must prevent this. But if your intension is to run C code on-the-fly, just use csh. – rozcietrzewiacz Oct 7 '11 at 15:02

I don't believe this is possible. The exec(2) system call always requires a filename or absolute path (the filename is always a char*). posix_spawn also has similar requirements for a filename.

The closest you could do is pipe the output into a named pipe and try executing from the pipe. That may work, although the shell may refuse to execute any file that does not have the --x--x--x bits set. Create the pipe with mkfifo(1) and see if you can get it to work.

Another approach would be to write something that reads standard input, writes a file out to a temporay area, sets the --x bits on it, forks and execs then deletes the file. The inode and contents will remain until the program finishes executing but it won't be accessible through the file system. When the process terminates the inode will be released and storage will be returned to the free list.

EDIT: As Mat points out, the first approach won't work as the loader will attempt to demand-page in the executable, which will generate random seek traffic on the file, and this isn't possible on a pipe. This leaves some sort of approach like the second.

  • 2
    I'd be really surprised if the pipe trick worked - you can't do random seeks on a pipe, and can't mmap them - I'm pretty sure that will annoy the runtime loader/linker :) Your second suggestion seems good though, can't come up with anything without a temporary file. – Mat Oct 7 '11 at 14:05
  • @Mat - I think you're right. Demand paging in the executable would cause random access traffic which won't work on the pipe. Ironically it might have actually worked on SVR2.0 (the last version that didn't use demand paging) - Just to show my age I actually used to have an AT&T 3B2/400 once with SVR2.0 as the O/S. – ConcernedOfTunbridgeWells Oct 7 '11 at 15:49
  • Thinking about it some more, I'm pretty sure exe packers like UPX can do the decompression and execution on read-only media. Modify whatever stub they tack on to packed executables to read from a pipe rather than decompress, and ... might work. – Mat Oct 7 '11 at 16:05
  • @Mat packers already have an image loaded they don't start a new process. To do the similar I need to have one of processes to make an arbitrary jump into input data (which would be considered a security vulnerability). – Alex B Oct 8 '11 at 1:16
  • @Alex B: You are specifically asking how to make an arbitrary jump into input data. Why would you complain when it's suggested that you do exactly that? Is the purpose of the sandbox specifically to prevent what you're trying to do? – David Schwartz Oct 8 '11 at 5:10

A solution using memfd syscall: https://github.com/abbat/elfexec

It creates a named file descriptor in memory which could be used in exec. A pseudo-code:

#include <linux/memfd.h>
int memfd = syscall(SYS_memfd_create, "someName", 0);
write(memfd,... elf-content...);
fexecve(memfd, argv, environ);
  • 1
    You don't need the memfd.h header unless you want to use MFD_CLOEXEC (which will break #! /bin/sh scripts because of bugs in linux' fexecve()). That's not too complicated, you can include a 20-line working sample in your answer (eg. this git gist -- though that's not a drop-in replacement for your elfexec, since that will also allow you to specify argv[0], and will run a binary only from a pipe (UUoC mandated ;-)) – mosvy Jan 6 '19 at 13:36
  • So I don't get how this expected to work at all. gcc will write .o files to /tmp and die if it can't. – Joshua Jul 8 '19 at 18:06

You could try tcc, which will compile and execute a program in one step, without writing any intermediate files. It's not gcc, which may be a problem for you, but it is spectacularly fast, so it may even bet better than gcc for your purposes.


This will automatically run the compilation of your code, but creates a file (temparaily) on the filesystem in order to do it.

echo 'main(){}' | gcc -xc -o /tmp/a.out && chmod u+x /tmp/a.out && /tmp/a.out && rm -f /tmp/a.out

(I'm currently testing this now, but I'm pretty sure this, or something close to it will work for you)

EDIT: If the goal of your piping is to cut physical disks out of the equation for speed, consider creating a ram disk to hold the intermediate file.

  • This will work of course, but it misses the main point of the question - to execute a binary code that is never written to disk. – rozcietrzewiacz Oct 7 '11 at 14:47
  • @rozcietrzewiacz My hope was the it would be useful if the goal was to easily run a snippit of code on the fly without dealing with the required physical file. – dtyler Oct 7 '11 at 14:59
  • Yes, I understand. But for that, one could simply use csh. – rozcietrzewiacz Oct 7 '11 at 15:03

Just like @TheQUUX suggested, I haven't tested it my self but you might want to try out cling - "the interactive C++ interpreter, built on top of LLVM and Clang libraries.".

Find more info here: https://cdn.rawgit.com/root-project/cling/master/www/index.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.