popen always returns NULL on Android due to hardcoded /bin/sh path

[xinyugit]

The prebuilt qjs-linux-<arch> binaries from quickjs-ng releases work on Android to some extent, because they are statically linked. However, the popen function (used by the runtime) always returns NULL on Android.

Root cause:

• On Linux, popen internally calls posix_spawn(&child_pid, "/bin/sh", …), which hardcodes the path to /bin/sh.
• On Android, the standard shell is located at /system/bin/sh, not /bin/sh.
• Therefore, any attempt to use popen (e.g., via qjs executing shell commands) fails and returns NULL.

Expected behavior:
popen should work on Android by respecting the system’s actual shell location (e.g., /system/bin/sh), or it should be configurable to support different environments.

Suggested solution (for maintainers):

• Modify the internal popen implementation or the shell path used in posix_spawn to be configurable (e.g., via an environment variable like QJS_SHELL or a compile-time option).
• Alternatively, use execvp with sh and rely on PATH lookup, which might locate /system/bin/sh on Android.
• As a workaround, consider documenting that users on Android can set PATH to include /system/bin before calling popen, but the current hardcoded path remains the real fix.

Environment:

• quickjs-ng release: e.g., qjs-linux-x86_64 (or any qjs-linux-* binary)
• Android: tested on Android 10+ (Termux or native environment)

Steps to reproduce:

1. Download a qjs-linux-<arch> binary from the releases page.
2. Run it on Android (using e.g., Termux or an Android shell).
3. Execute a simple JavaScript command that uses popen, such as:

    const file = std.popen("ping 127.0.0.1", "r");
    console.log('file:',file);

   Or any built‑in function that relies on popen.
4. Observe that the command returns null or fails silently.

Additional note:
This issue does not occur when building quickjs‑ng natively for Android (e.g., with $PREFIX/bin/sh properly resolved), only when using the prebuilt Linux‑targeted binaries on Android.

Thank you for maintaining quickjs‑ng! I’d appreciate any guidance or a fix for this cross‑platform compatibility issue.

[saghul]

I'd say a native Android build would be the right way forward.

I wouldn't mind having it. Are you up for writing a CI job that creates the Android release artifact?

[bnoordhuis]

popen should work on Android by respecting the system’s actual shell location

We call popen(3), which is a libc function. It sounds like you're hitting an Android bug, not a quickjs bug.

[xinyugit]

popen can work normally on Android, but the Linux build version of qjs statically compiles libc to the target file. I have analyzed this target file through IDA reverse engineering, and in the popen function, '/bin/sh' exists in hard coded form. The shell for Android is/system/bin/sh.  I have successfully verified by executing 'ln - s/system/bin/bin' in the adb shell.

…

---Original--- From: "Ben ***@***.***> Date: Mon, May 25, 2026 02:40 AM To: ***@***.***>; Cc: ***@***.******@***.***>; Subject: Re: [quickjs-ng/quickjs] popen always returns NULL on Android due to hardcoded /bin/sh path (Issue #1512) bnoordhuis left a comment (quickjs-ng/quickjs#1512) popen should work on Android by respecting the system’s actual shell location We call popen(3), which is a libc function. It sounds like you're hitting an Android bug, not a quickjs bug. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you authored the thread.Message ID: ***@***.***>

[bnoordhuis]

Ah okay, I get it now - you're using the statically linked musl build. Still not really a quickjs bug (maybe a musl bug, although I expect they don't care about Android) but Saúl's right a native Android build is the best way forward.

[xinyugit]

Ah okay, I get it now - you're using the statically linked musl build. Still not really a quickjs bug (maybe a musl bug, although I expect they don't care about Android) but Saúl's right a native Android build is the best way forward.

It is indeed a bug in musl.
The hardcoding of /bin/sh still exists in the latest (1.2.6) version.
musl-1.2.6/src/stdio/popen.c:41

	if (!(e = posix_spawn(&pid, "/bin/sh", &fa, 0,
	    (char *[]){ "sh", "-c", (char *)cmd, 0 }, __environ))) {
		posix_spawn_file_actions_destroy(&fa);
		f->pipe_pid = pid;
		if (!strchr(mode, 'e'))
			fcntl(p[op], F_SETFD, 0);
		__syscall(SYS_close, p[1-op]);
		__ofl_unlock();
		return f;
	}

This breaks on systems where the shell is not at /bin/sh.

I'll try to write a CI built with native Android NDK.