libcライブラリをstringsすると、"/bin/sh" などのパス文字列を見つけることができる。
$ strings -tx /lib/i386-linux-gnu/libc-2.15.so | grep " /" ... 161d98 /bin/sh 161ee4 /tmp 162bf8 /dev/tty 162c3d /proc/self/maps 1633bf /etc/localtime ...
これらの定義は、主に次のファイルにある。
/* Default search path. */
#define _PATH_DEFPATH "/usr/bin:/bin"
/* All standard utilities path. */
#define _PATH_STDPATH \
"/usr/bin:/bin:/usr/sbin:/sbin:/usr/contrib/bin:/usr/old/bin"
#define _PATH_BSHELL "/bin/sh"
#define _PATH_CONSOLE "/dev/console"
#define _PATH_CSHELL "/bin/csh"
#define _PATH_DEVDB "/var/run/dev.db"
#define _PATH_DEVNULL "/dev/null"
#define _PATH_DRUM "/dev/drum"
#define _PATH_GSHADOW "/etc/gshadow"
#define _PATH_KMEM "/dev/kmem"
#define _PATH_MAILDIR "/var/mail"
#define _PATH_LASTLOG "/var/log/lastlog"
#define _PATH_MAN "/usr/man"
#define _PATH_MEM "/dev/mem"
#define _PATH_MNTTAB "/etc/fstab"
#define _PATH_MOUNTED "/var/run/mtab"
#define _PATH_NOLOGIN "/etc/nologin"
#define _PATH_PRESERVE "/var/preserve"
#define _PATH_RWHODIR "/var/rwho"
#define _PATH_SENDMAIL "/usr/sbin/sendmail"
#define _PATH_SHADOW "/etc/shadow"
#define _PATH_SHELLS "/etc/shells"
#define _PATH_TTY "/dev/tty"
#define _PATH_UNIX "/vmunix"
#define _PATH_UTMP "/var/run/utmp"
#define _PATH_UTMP_DB "/var/run/utmp.db"
#define _PATH_VI "/usr/bin/vi"
#define _PATH_WTMP "/var/log/wtmp"
/* Provide trailing slash, since mostly used for building pathnames. */
#define _PATH_DEV "/dev/"
#define _PATH_TMP "/tmp/"
#define _PATH_VARDB "/var/db/"
#define _PATH_VARRUN "/var/run/"
#define _PATH_VARTMP "/var/tmp/"
_PATH_VIが興味深いが、定義されているだけで実際には使われておらず、バイナリ中にも存在しないようである。
