On Fri, Sep 5, 2025 at 2:43 PM Eduard Zingerman <eddyz87@xxxxxxxxx> wrote: > > On Fri, 2025-09-05 at 14:38 -0700, Andrii Nakryiko wrote: > > [...] > > > > > > Fun fact: if you do a minimal Fedora install (dnf group install core) > > > > > "which" is not installed by default o.O > > > > > (not suggesting any changes). > > > > > > > > I switched to `command -v bpftool` for now, is there any gotcha with > > > > that one as well? > > > > > > Should be fine, I guess: > > > > > > $ rpm -qf /usr/sbin/command > > > bash-5.2.37-1.fc42.x86_64 > > > > command is actually a shell built-in ([0]). At least for Bourne shells, I think. > > > > [0] https://pubs.opengroup.org/onlinepubs/009695399/utilities/command.html > > > > Yes, but looks like it's a separate binary, not a command: > > $ strace command -v ls 2>&1 | grep command > execve("/usr/bin/command", ["command", "-v", "ls"], 0x7ffffeaef7b0 /* 65 vars */) = 0 > > (Not that it changes much). You nerd sniped me here :) You get that execve("/usr/bin/command") because strace forces the command to be resolved as binary. If you run something like execsnoop in background and execute `command -v blah` you won't see this execve. ¯\_(ツ)_/¯ > > [...]
