When I try

strace ping google.com


strace ls 


even strace curl <domain>

The first two systemcalls are always,

execve("/usr/bin/curl", ["curl", "google.com"], 0x7ffecf1bc378 /* 61 vars */) = 0
brk(NULL)                               = 0x55f553c49000

Can someone please tell me if execve will always be the first systemcall when I execute anything?

I read this manual page, https://linux.die.net/man/2/execve But don't understand if execve is really a system call or executable program?


In Linux a new process is created via fork(), which makes a child process which is almost identical to the parent process. To create a new process whose program is different than the program of the original process, the new child process immediately calls execve(), which is basically the process saying "replace my current program with this other program".

brk(NULL) is the process asking where its heap memory ends. Many programs call this as their first system call (which will show up right after execve()) because they use malloc() right away (or a library call they make uses malloc() internally). If the program and its library calls don't need to call malloc() for a while then something besides brk(NULL) will be the second system call.

  • Linux's brk(0) actually just checks the current break, it doesn't change it yet. – ilkkachu Aug 27 '18 at 8:38
  • Oops, I'd glossed over that brk()'s argument was NULL/0. (And I didn't know about it special behavior on that value) – Matthew Cline Aug 27 '18 at 14:12
  • but that doesn't explain why brk(NULL) is the 2nd system call. Well I just realized it is not always the 2nd systemcall. When I run strace ping google.com, I get access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory) as a 2nd call after execve – MaverickD Aug 29 '18 at 0:48
  • @MaverickD added more details to my answer. – Matthew Cline Aug 29 '18 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.