No. The string is split to extract at most one argument. See: https://linux.die.net/man/2/execve https://linux.die.net/man/2/execve So in fact "-S" is not pass

No. The string is split to extract at most one argument. See: https://linux.die.net/man/2/execve https://linux.die.net/man/2/execve So in fact "-S" is not passed as a separate argument, but as a prefix in the first (and only) argument, and env then extracts it and acts accordingly: ``` $ /usr/bin/env "-S echo deadbeef" deadbeef ```