getenv(3)

👑 getenv(3) — Library Functions Manual 👑

okay bestie, say hi to getenv(3) — this is the libc call that goes digging through your process's environment list to pull out an environment variable for you. And it brought a security-conscious bestie along too: secure_getenv. Both of them live in the Standard C library (libc, -lc). no cap 💅

---

✨ NAME ✨

getenv, secure_getenv — get an environment variable 🌸

---

🎀 LIBRARY 🎀

Standard C library (libc, -lc)

---

🦋 SYNOPSIS 🦋

#include <stdlib.h>

char *getenv(const char *name);
char *secure_getenv(const char *name);

💜 Feature Test Macro Requirements for glibc (see feature_test_macros(7)):

• secure_getenv(): _GNU_SOURCE

---

🌈 DESCRIPTION 🌈

so getenv() literally scrolls the environment list looking for the variable called name, and hands you back a pointer to the matching value string. it's giving personal assistant energy 🫶

secure_getenv() is exactly the same as getenv() except for one icon behaviour: it returns NULL in any case where "secure execution" is required. dramatic? yes. necessary? also yes 🔥

Secure execution is required if any one of these was true when the program run by the calling process was loaded:

• the process's effective user ID did not match its real user ID, or the process's effective group ID did not match its real group ID (typically this is the result of executing a set-user-ID or set-group-ID program);
• the effective capability bit was set on the executable file; or
• the process has a nonempty permitted capability set.

Secure execution may also be required if it got triggered by some Linux security modules. 👀

The whole point of secure_getenv() is to live in general-purpose libraries so you avoid the vulnerabilities that happen when set-user-ID or set-group-ID programs accidentally trust the environment. like, imagine trusting the environment. couldn't be her 🙈

---

💖 RETURN VALUE 💖

getenv() returns a pointer to the value in the environment — or NULL if there's no match. that's it, that's the whole return policy bestie 💅

---

🧚 ATTRIBUTES 🧚

for an explanation of the terms used in this section, see attributes(7). (no tables here, we're keeping it cute and listy ⭐)

• Interface: getenv(), secure_getenv()
• Attribute: Thread safety
• Value: MT-Safe env

---

⭐ STANDARDS ⭐

• getenv() — C11, POSIX.1-2008.
• secure_getenv() — POSIX.1-2024.

---

📜 HISTORY 📜

• getenv() — POSIX.1-2001, C89, C99, SVr4, 4.3BSD.
• secure_getenv() — POSIX.1-2024, glibc 2.17.

look at her, she's been around. veteran queen energy 👑

---

💀 NOTES 💀

The strings in the environment list are shaped like name=value. that's the whole format, no frills 🍓

As typically implemented, getenv() returns a pointer to a string inside the environment list. so bestie… do not modify that string. like, at all. modifying it changes the environment of the process. it's not a little oopsie, it's a whole situation 😭

The implementation of getenv() is not required to be reentrant. the string your return value points to may be statically allocated, and it can get modified by a subsequent call to getenv(), putenv(3), setenv(3), or unsetenv(3). so if you're holding onto that pointer, protect your peace and copy it 🫶

⚠️ warning bestie: that pointer is not yours forever. it's borrowed, and someone else's call can rewrite it out from under you.

The "secure execution" mode of secure_getenv() is controlled by the AT_SECURE flag contained in the auxiliary vector passed from the kernel to user space. iykyk 🧚

---

🌸 SEE ALSO 🌸

clearenv(3), getauxval(3), putenv(3), setenv(3), unsetenv(3), capabilities(7), environ(7)

---

that's the whole page, and it's iconic. this one's from Linux man-pages 6.20, dated 2026-02-08 — go check your env, stay safe, and never trust the environment in a setuid program. periodt 💖✨