{"record":{"id":"1b239c0333adbd51","repo":"awslabs/llrt","slug":"fexecve-failed","errorCode":null,"errorMessage":"fexecve failed","messagePattern":"fexecve failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"llrt/src/main.c","lineNumber":337,"sourceCode":"  if (memorySize > 2048)\n  {\n    memoryFactor = 0.95;\n  }\n\n  char mimallocReserveMemoryMb[16];\n  sprintf(mimallocReserveMemoryMb, \"%iMiB\", (int)(memorySize * memoryFactor));\n\n  setenv(\"_START_TIME\", startTimeStr, false);\n  setenv(\"MIMALLOC_RESERVE_OS_MEMORY\", mimallocReserveMemoryMb, false);\n  setenv(\"MIMALLOC_LIMIT_OS_ALLOC\", \"1\", false);\n\n  logInfo(\"Starting app\\n\");\n\n  fexecve(outputFd, new_argv, environ);\n\n  logError(\"Failed to start executable\");\n\n  err(1, \"fexecve failed\");\n\n  return 1;\n}","sourceCodeStart":319,"sourceCodeEnd":340,"githubUrl":"https://github.com/awslabs/llrt/blob/742fc00b82cbeaab1c1b76f0d706c302a5cbc306/llrt/src/main.c#L319-L340","documentation":"main() finishes boot by exec'ing the freshly decompressed runtime with fexecve(outputFd, new_argv, environ), executing the binary held in the memfd. This error means fexecve returned (it only returns on failure), so the embedded runtime could not be started. The preceding logError notes the executable failed to start; this is the terminal abort.","triggerScenarios":"fexecve fails with ENOENT (no interpreter for a PT_INTERP binary or /proc not mounted so the memfd /proc/self/fd path is unavailable), EACCES/EPERM (noexec mount policy via noexec /proc, SELinux denying memfd exec, `no_new_privs`/LSM rules), ENOMEM, or ETXTBSY in odd fd-flag states. Requires /proc mounted since fexecve relies on /proc/self/fd.","commonSituations":"Containers or chroots without /proc mounted, hardened Kubernetes/SELinux policies blocking execve of memfd files, `noexec` mounted /proc or /dev, old kernel/glibc without fexecve support, and security products that block anonymous-memory execution.","solutions":["Ensure /proc is mounted inside the container/chroot (fexecve needs /proc/self/fd): mount -t proc proc /proc.","Adjust security policy to permit executing memfd files: SELinux boolean/policy (allow execmem/execveat), AppArmor profile, or remove `noexec` from the /proc mount.","Use a Linux kernel with execveat support (>= 3.19) and a recent glibc/musl so fexecve works natively.","Check for ENOENT from a missing ELF interpreter — use a statically linked llrt build if the target system lacks the dynamic loader.","Run `strace -f -e trace=execveat,fexecve` to identify the exact errno, then address that specific denial."],"exampleFix":"// before (chroot without proc)\nchroot /srv/box /usr/local/bin/llrt app.js\n// after\nmount -t proc proc /srv/box/proc && chroot /srv/box /usr/local/bin/llrt app.js","handlingStrategy":"validation","validationCode":"// Verify the exec prerequisites before launching llrt:\nimport { existsSync, statSync } from 'node:fs';\nfunction canExecMemfd() {\n  if (!existsSync('/proc/self/fd')) return false;              // fexecve needs /proc\n  const st = statSync('/proc');\n  return true;\n}\nif (!canExecMemfd()) throw new Error('Mount /proc and ensure exec of memfd files is allowed');","typeGuard":null,"tryCatchPattern":"try {\n  child_process.execFileSync('./llrt', ['app.js']);\n} catch (e) {\n  if (e.status === 1 && /fexecve failed/.test(String(e.stderr))) {\n    // mount /proc, relax SELinux/noexec policy, or use a statically linked build, then retry\n  }\n}","preventionTips":["Always mount /proc in containers/chroots where llrt runs.","Avoid `noexec` on /proc and allow execveat/memfd execution in SELinux/AppArmor policies.","Prefer statically linked llrt builds when target systems may lack the ELF dynamic loader.","Diagnose with `strace -e trace=execveat` to capture the exact errno before changing policy."],"tags":["fexecve","exec","permission","sandbox","proc"],"backgroundTag":"exec-failed","analyzedSha":"742fc00b82cbeaab1c1b76f0d706c302a5cbc306","analyzedAt":"2026-09-12T11:14:07.838Z","contentChangedAt":"2026-09-12T11:14:07.838Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}