Changes in .gitignore

b9cba7ebfe539f3e4bbdd03a1e0efa3b30b3f592 - Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 17 Aug 2026 17:35:25 +0200

Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull binfmt updates from Christian Brauner: "This contains a bunch of work for binfmt_misc. It fixes a bunch of old bugs, reworks the locking, and then extends the format registry so a binary type can be matched programmatically and its interpreter computed per exec instead of being a fixed string recorded at registration time. This allows nixos and other to e.g., implement relocatable binaries meaning the interpreter/dynamic loader can be determined programatically, say found relative to the binary. The mechanism is flexible and can support other policies: - Handler lookup is now an rcu walk. An exec that matches no binfmt_misc entry should now never write to a shared cacheline - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles - convert the entry file to a seq_file which simplifies things quite a bit and kills a lot of custom logic - make flags proper enums - rename struct Node to binfmt_misc_entry - allow entries to be removed with unlink(2) - Add the ability to attach bpf programs to binfmt_misc entries so it's possible to dynamically choose the execution environment such as the loader or interpreter on a per binary basis. A handler is an instance of a binfmt_misc_ops struct_ops with a ->match() and a ->load() program. match() decides from the entry lookup walk whether the handler applies under the same registration-order. It can read file content as needed not only the prefetched 256 bytes in bprm->buf. load() then selects the interpreter and stages it through the new bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and bpf_binprm_set_flags() kfuncs. Handlers are published in a registry keyed by the registering task's user namespace and activated through the existing text interface with a new 'B' type carrying the handler name: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register The permission and namespacing model is unchanged. Activating a handler requires the same write access to an instance as any other registration. A container mounting its own instance escapes the host's entries exactly as before. The computed interpreter is opened with open_exec() under the caller's credentials and goes through full LSM vetting as the next binprm level. A program can only ever redirect the caller to something the caller could exec anyway. - Two dispatch modes are added. So far the chosen interpreter owns the whole process identity (argv[0], /proc/pid/cmdline, /proc/self/exe all name interpreter information). So relocatable find the dynamic linker instead. Also a binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips because AT_ENTRY and AT_PHDR do not match the exe file. So PIE symbols are unrelocated. This adds transparent dispatch which allows the interpreter to load the binary through AT_EXECFD and leaves the argument vector exactly as the caller built it and labels mm->exe_file and comm with the binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector bit. The interpreter keeps control of mapping the binary. The second mode is loader substitution. This allows a binary to be executed natively and only the interpreter to be changed. - Last, interpreters can be bound at registration time. Each interpreter is opened by its own write with the credentials the entry file was opened with. The program picks one per exec with bpf_binprm_select_interp(). Ucounts are used to properly account for pre-opened interpreters via /proc/sys/user/max_binfmt_misc_interpreters"* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits) binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpreters binfmt_misc: document interpreters bound by a 'B' entry selftests/exec: test interpreters bound to a 'B' entry binfmt_misc: let a 'B' entry bind its interpreters binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp selftests/exec: share the bpf handler preconditions binfmt_misc: document registering an entry disabled selftests/exec: test registering an entry disabled selftests/exec: let binfmt_flag_supported() return a bool selftests/exec: check that a binfmt_misc instance cannot be pinned binfmt_misc: let a register string create an entry disabled binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm ... List of files: /linux/tools/testing/selftests/exec/.gitignore

68aabd01ddd26ced458a9e5716a640eaf8e4b7a6 - Merge patch series "binfmt_misc: bound the interpreters an entry can pre-open"

Mon, 03 Aug 2026 23:36:38 +0200

Merge patch series "binfmt_misc: bound the interpreters an entry can pre-open"Christian Brauner says:An 'F' entry opens its interpreter at registration and every exec runs aclone of it. A 'B' entry does the same for each interpreter it binds. Thatfile stays open for as long as the entry lives. So it pins the file, itsinode, the mount it came from and that mount's superblock.An entry binds at most 100 interpreters, but nothing caps the entries.binfmt_misc is container mountable so all of this is reachable byunprivileged users.While the pins go away when the instance is unmounted, it's still weirdfor an unprivileged namespace to be allowed to do this. And the fix issimple.Charge each binding to the user namespace and uid that makes it againsta new UCOUNT_BINFMT_MISC_INTERPRETERS and refuse with -ENOSPC when thelimit is hit.A per-instance cap won't do. Instances are keyed on the user namespace, sowhatever constant I pick gets multiplied by however many namespaces thecaller cares to create. inc_ucount() charges the namespace and every oneof its ancestors, and a namespace can only ever raise its own limit, sonesting buys nothing.The knob is /proc/sys/user/max_binfmt_misc_interpreters, per namespace likeevery other ucount. I left it at the max_threads/2 default thatfork_init() hands a new ucount type. Nothing anyone runs today comesanywhere near that.Selftests for all of it, including that a nested namespace can't buyitself budget.* patches from https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-0-4a2435500bd9@kernel.org: binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpretersLink: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-0-4a2435500bd9@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

f2b69ea2d1a017f0c8e848ff875f4cf2492d2bd0 - selftests/exec: test the pre-opened interpreter limit

Mon, 03 Aug 2026 14:15:01 +0200

selftests/exec: test the pre-opened interpreter limit- an interpreter opened at registration is charged- an interpreter a 'B' entry binds is charged too- an entry that opens none is not- removing an entry gives the charge back- a nested user namespace cannot buy itself budget by raising its own limitSkips where the sysctl or binfmt_misc is missing. The 'B' case lives inbinfmt_misc_bpf.c because binding needs a handler. It binds from a childin a user namespace of its own, through the fd the child inherited, sothe charge lands on the child while the interpreter is still opened withthe entry file's credentials, and nothing outside the child sees achanged limit.Link: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-2-4a2435500bd9@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

b2a52381541af862076b5e7d17db2ca76e921e95 - Merge patch series "binfmt_misc: transparent interpreters and PT_INTERP loader substitution"

Sat, 25 Jul 2026 11:11:48 +0200

Merge patch series "binfmt_misc: transparent interpreters and PT_INTERP loader substitution"Christian Brauner says:binfmt_misc has exactly one execution model where the registeredinterpreter becomes the executed program and the matched binary ishanded to it as an argument. For wine or qemu-user that is the point.For a per-binary loader it is backwards. The interpreter is animplementation detail of running the binary, yet it owns the entireprocess identity:- argv[0] and /proc/pid/cmdline show the interpreter invocation, not what the caller executed.- /proc/self/exe names the interpreter. Relocatable programs commonly locate themselves through it and find the dynamic linker instead.- A binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all as the interpreter has no path to open it by.- gdb cross-validates AT_ENTRY/AT_PHDR against the exe file and discards the load displacement on mismatch leaving PIE symbols unrelocated.This series adds two dispatch modes that close the gap from oppositeends:(1) transparent dispatch Registered with the 'T' flag or chosen per exec with BPF_BINPRM_TRANSPARENT. The binary is sent to the interpreter through AT_EXECFD, the argument vector stays exactly as the caller built it, and the kernel labels mm->exe_file and comm with the binary. A new AT_FLAGS_TRANSPARENT_INTERP aux vector bit is raised indicating that nothing was spliced, argv belongs to the program, and to load it from the descriptor. The interpreter keeps control of mapping the binary, so the mode covers foreign architectures and non-ELF payloads. The exe label is not a new privilege. It names precisely the file the caller passed to execve(), not a file of the process's choosing. That file is permission-checked, write-denied while the process runs and recorded by audit. Credential derivation does not change exactly as today.(2) loader substitution The kernel executes the matched binary natively as the main image and substitutes the registered interpreter for the binary's PT_INTERP. binfmt_misc functions as a PT_INTERP override. There is no contract and no identity to reconstruct. So a stock dynamic loader works unchanged. Hence, 'L' is for native-arch ELF with PT_INTERP.The two modes compose. A bpf handler reads the ELF header from bprm->bufand grades per binary, picking 'L' where it applies and 'T' or classicdispatch for the rest. If userspace control over relocation is wanted'T' is the way to go.* patches from https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.org: (21 commits) binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm binfmt_misc: document the transparent identity contract selftests/exec: test the transparent binfmt_misc mode binfmt_misc: let a bpf handler run the interpreter transparently binfmt_misc: add a static transparent flag 'T' binfmt_misc: add transparent interpreter dispatch exec: label mm->exe_file with the binary for a transparent dispatch exec: add AT_FLAGS_TRANSPARENT_INTERP selftests/exec: convert the binfmt_misc bpf test to the kselftest harness exec: release the replaced file with do_close_execat() binfmt_misc: split out entry_open_interpreter() and build_interp_argv() binfmt_misc: normalize the per-exec invocation flags binfmt_misc: table-drive the register string flags docs, binfmt_misc: keep general usage out of the handler sections ...Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

87c50a5855cf0e1a4a42448b2245f6e90df20a4c - selftests/exec: test binfmt_misc loader substitution

Tue, 21 Jul 2026 16:14:02 +0200

selftests/exec: test binfmt_misc loader substitutionExercise the 'L' flag end to end. The payload runs as the main imagewith a copy of the system loader substituted for its PT_INTERP, andasserts the native identity from inside:- argv exactly as the caller built it- no AT_EXECFD- AT_FLAGS clear- AT_BASE set but outside its own image- AT_PHDR/AT_ENTRY inside it- /proc/self/{exe,comm,stat} and AT_EXECFN all describing the binary- ETXTBSY on the running binary- the substituted loader visible in /proc/self/maps under its real pathMagic matching pokes a marker into the ELF header's e_ident padding(EI_PAD, offset 9), which sits inside the match window and is ignored bykernel and loader alike. the same binary is also matched by extension.Two cases cover the paths where the substitution does not happen. A '#!'file that matched an 'L' entry is claimed by binfmt_script rather than bybinfmt_elf, so the staged substitute has to be released when theinterpreter replaces the file; the test opens the loader for writingafterwards, which fails with ETXTBSY if the write denial was leakedinstead. A relative interpreter path is rejected at registration for both'L' and 'C', neither of which may resolve one against the workingdirectory of whoever runs the binary.The bpf-side BPF_BINPRM_LOADER path shares all machinery past the flagmapping. A harness case for it can join the bpf runtime coverage ofthe transparent series.Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-20-e57866e4ae0f@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

7baee96f8356fbd01db1dc2641c13104413f6434 - selftests/exec: test the transparent binfmt_misc mode

Tue, 21 Jul 2026 16:13:55 +0200

selftests/exec: test the transparent binfmt_misc modeVerify the identity a transparent dispatch constructs, from bothactivation paths.- binfmt_misc_transparent: registers a magic entry with the static 'T' flag and execs a matched binary with arguments.- binfmt_misc_bpf: a handler whose load program sets BPF_BINPRM_TRANSPARENT.Both dispatch to a shared asserting interpreter that runs in place ofthe binary and checks the contract from the inside:- AT_FLAGS carries AT_FLAGS_TRANSPARENT_INTERP- AT_EXECFD refers to the very inode of the binary- /proc/self/exe resolves to the binary- argv and /proc/self/cmdline are exactly what the caller passed with nothing spliced in- comm is the binary's basename- the binary is write-denied while it runsThe static test also validates the registration. 'T' combined with 'P'must be rejected. A kernel that does not know 'T' turns the test into askip. The asserting interpreter and the static test build without thebpf toolchain so the core transparent semantics stay covered on systemswhere the bpf cases are skipped.The flag support probe, the canonical payload argv with therun_payload() helper that execs it, and the identity assertions (exelink, comm, write denial) live in binfmt_misc_common.h; the loadersubstitution test reuses all of them.Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-13-e57866e4ae0f@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

e566d0625876b699ee0e752d672c4de73a440764 - Merge patch series "binfmt_misc: bpf-backed binary type handlers"

Fri, 17 Jul 2026 00:36:22 +0200

Merge patch series "binfmt_misc: bpf-backed binary type handlers"Christian Brauner says:binfmt_misc: bpf-backed binary type handlersThis is a POC for the nix people and Farid and Eric in particular. Iwould take my hands off the wheel now that I POCed this and hand it toFarid if he likes to take it forward.VL;MR (very long, must read):For a while now Farid has been trying to make relocatable, hermeticbinaries (think Nix-style store layouts) work without patchelf tricksor wrapper scripts. For such binaries the right dynamic loader can onlybe determined relative to the location of the binary itself, whichneither PT_INTERP nor a fixed binfmt_misc interpreter string canexpress.The first attempt was $ORIGIN expansion in PT_INTERP [1]. I pushed backon that. Userspace guards $ORIGIN behind AT_SECURE so the kernel wouldhave to make the used loader depend on the type of binary, LSMs wouldneed a say, it changes long-standing behavior in ways that are ripe forloader injection attacks, and bprm->file may not have a usable path atall (memfds, deleted files, unresolvable paths). Making the kernelsplice bprm->file back together with PT_INTERP is terrible. The secondattempt was a pluggable ELF interpreter loader registry [2] which wouldmean actual kernel modules for custom binary formats. Also no.binfmt_misc was invented to kill exactly this horrendous past.What I suggested instead [3] was to put this where delegating binaryformats to userspace already lives: binfmt_misc. The only thingsbinfmt_misc cannot do today are matching programmatically and computingthe interpreter per binary instead of using a fixed string recorded atregistration time. Farid prototyped that with an eBPF program [4] andit turned out quite workable, but the prototype ran a SOCKET_FILTERprogram over bprm->buf, added a new helper to the frozen uapi helperlist, and returned the computed path through per-CPU memory.This series is the proposal turned into what I think the bpf side{c,sh}ould actually look like. It is a POC: it builds, the selftestspass, and the design is what I want to discuss. The selftests areFarid's from his v2 posting, adapted to the contract below.A handler is an instance of the new binfmt_misc_ops struct_ops with aname and two ops: struct binfmt_misc_ops { bool (*match)(struct linux_binprm *bprm); int (*load)(struct linux_binprm *bprm); char name[BINFMT_MISC_OPS_NAME_MAX]; };Both programs receive the bprm as a trusted BTF pointer and both aresleepable. The match program decides from the entry lookup walk whetherthe handler applies, under the same rules as magic matching:registration order, first match wins. It is not limited to theprefetched 256 bytes in bprm->buf: it can read arbitrary file contentthrough bpf_dynptr_from_file(), e.g. to find an ELF interpretersegment at whatever offset it sits. That is what makes multipleindependent handlers workable at all - a handler that cannot read thefile would have to match broadly and reject from its load program,stealing the binaries of every handler registered after it. To makethis safe the entry walk becomes an SRCU read-side section. The loadprogram of the matched handler then selects the interpreter, readingthe file the same way and resolving the binary's location viabpf_path_d_path() on &bprm->file->f_path. That also solves theprototype's limitation of only seeing the first 256 bytes of the file.Selecting is the load program's privilege: the verifier rejects theselection kfuncs in match, keyed off the struct_ops member a programattaches to. A match commits the exec to the handler: a failing loadfails the exec instead of falling through to later entries, with-ENOEXEC handing over to the remaining binary formats, so the walk isnever left and re-entered.The genuinely new piece of bpf surface is a small family of kfuncs: int bpf_binprm_set_interp(struct linux_binprm *bprm, const char *path, size_t path__sz); int bpf_binprm_set_interp_arg(struct linux_binprm *bprm, const char *arg, size_t arg__sz); int bpf_binprm_set_flags(struct linux_binprm *bprm, enum bpf_binprm_flags flags);staging the selected interpreter, an optional single argument for it(the slot the optional argument of a #! interpreter line has), and theper-exec invocation flags - 'P', 'C' and 'O' equivalents. Selectioncannot go through bprm_change_interp() directly becauseload_misc_binary() copies bprm->interp into argv[1] after the programran, hence the staging fields added in patch 1.Registering (attaching) the struct_ops map publishes the handler underits name in a registry keyed by the registering task's user namespace.Activation reuses the existing text interface with a new 'B' type wherethe interpreter field carries the handler name - it consistently nameswhoever supplies the interpreter - and offset, magic, and mask must beempty: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/registerThis keeps the existing permission and namespacing model completelyintact. Activating a handler requires the same write access to abinfmt_misc instance as any other registration, a container mountingits own instance escapes the host's entries exactly as before, andshadowing e.g. all ELF binaries takes the same privilege as a static'M' entry matching \x7fELF does today.The only novelty is that matching becomes programmable. Handler lookupwalks the user namespace hierarchy upwards, mirroring how binfmt_miscinstances themselves are resolved, so a handler registered on the hostcan be activated from a container's own instance without being forcedupon it.The computed interpreter is opened with open_exec() under the caller'scredentials and goes through the full LSM vetting as the next binprmlevel, exactly like a statically registered interpreter, so the programcannot widen access. It only ever redirects the caller to something thecaller could exec anyway.A 'B' entry carries no flags in the register string: the load programchooses the invocation flags per exec through bpf_binprm_set_flags()instead. BPF_BINPRM_PRESERVE_ARGV0, BPF_BINPRM_CREDENTIALS andBPF_BINPRM_EXECFD keep the static 'P', 'C' and 'O' semantics -BPF_BINPRM_CREDENTIALS honors the matched binary's suid bits exactlyas a static 'C' entry does, with the setuid transition gated byvfsuid_has_mapping() in the caller's user namespace either way, whichmakes 'B' handlers usable for a per-binary loader over setuidbinaries. 'F' (pre-open a fixed interpreter) is rejected: a 'B' entryhas no fixed interpreter. AT_EXECVE_CHECK never invokes programs andinterpreter chains stay capped by the usual ELOOP depth.A handler for the Nix case then looks roughly like: SEC("struct_ops.s/match") bool BPF_PROG(nix_match, struct linux_binprm *bprm) { return !bpf_strncmp(bprm->buf, 4, "\x7f" "ELF"); } SEC("struct_ops.s/load") int BPF_PROG(nix_load, struct linux_binprm *bprm) { char path[256]; long n; n = bpf_path_d_path(&bprm->file->f_path, path, sizeof(path)); if (n < 0) return n; /* derive the loader location from the binary's path */ return bpf_binprm_set_interp(bprm, path, sizeof(path)); } SEC(".struct_ops.link") struct binfmt_misc_ops nix = { .match = (void *)nix_match, .load = (void *)nix_load, .name = "nix", };Farid, this should slot underneath your qemu demo from [4] with theprogram ported to struct_ops. Feel free to take it from here.[1]: https://lore.kernel.org/20260622043934.179879-1-farid.m.zakaria@gmail.com[2]: https://lore.kernel.org/20260702214247.1253741-1-farid.m.zakaria@gmail.com[3]: https://lore.kernel.org/20260703-meditation-ratsuchende-moratorium-9ecdf1f3f8bb@brauner[4]: https://lore.kernel.org/20260704211409.1978485-1-farid.m.zakaria@gmail.com* patches from https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-0-57b7529c002c@kernel.org: selftests/exec: add binfmt_misc bpf-backed handler test binfmt_misc: let a bpf handler choose the invocation flags per exec binfmt_misc: let bpf handlers pass an argument to the interpreter bpf: allow fs kfuncs for binfmt_misc_ops programs binfmt_misc: wire up bpf-backed 'B' entries binfmt_misc: let the entry lookup walk sleep binfmt_misc: add binfmt_misc_ops bpf struct_ops exec: stash bpf-selected interpreter state in struct linux_binprmLink: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-0-57b7529c002c@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

277d787feb2edeb3adae81a99fc47294d523a106 - selftests/exec: add binfmt_misc bpf-backed handler test

Tue, 14 Jul 2026 21:58:14 +0200

selftests/exec: add binfmt_misc bpf-backed handler testExercise the bpf-backed ('B') binfmt_misc handlers end to end. A handleris a struct binfmt_misc_ops struct_ops map; the test loads and attachesit (which publishes it by name), activates it with a 'B' entry, andchecks that a matched binary is routed to the interpreter the programselected via bpf_binprm_set_interp().Two self-contained cases are covered: - bpf_interp: the match program matches a synthetic aarch64 ELF header from the prefetched bprm->buf and the load program routes it to a fixed interpreter of its choosing. - nix_origin: the match program parses the program headers to commit only to a "$ORIGIN/..."-relative PT_INTERP and the load program resolves it to an interpreter co-located with the binary -- the relocatable-loader case the kernel ELF loader cannot express. The relocatable binary is linked with PT_INTERP set to the literal "$ORIGIN/binfmt_bpf_interp" (-Wl,--dynamic-linker), which the kernel cannot resolve on its own.Both route to a small test interpreter that prints a marker, proving theprogram-selected interpreter actually ran.The bpf objects are compiled against the running kernel's BTF: theMakefile generates vmlinux.h with bpftool and the harness links libbpf.Override CLANG/BPFTOOL/VMLINUX_BTF/LIBBPF_CFLAGS/LIBBPF_LDLIBS as needed.The bpf pieces are only built when clang, bpftool, the vmlinux BTF andlibbpf are all present (HAVE_BPF_TOOLCHAIN=y forces them) so the otherexec selftests keep building without a bpf toolchain.Christian Brauner (Amutable) says:Adapted to the two-op contract: 'B' entries carry the handler name inthe interpreter field, both programs are sleepable, the match programsdecide. nix_origin reads PT_INTERP from the match program and loadreturns zero on success. Skip on kernels without binfmt_misc_ops in BTF.Build the bpf pieces only when the toolchain is present and gitignorethe generated artifacts.Signed-off-by: Farid Zakaria Link: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-9-57b7529c002c@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/.gitignore

1260ed77798502de9c98020040d2995008de10cc - Merge drm/drm-fixes into drm-misc-fixes

Tue, 08 Apr 2025 10:15:47 +0200

Merge drm/drm-fixes into drm-misc-fixesBackmerging to get updates from v6.15-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/exec/.gitignore

946661e3bef8efa11ba8079d4ebafe6fc3b0aaad - Merge branch 'next' into for-linus

Sat, 05 Apr 2025 08:04:35 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.15 merge window. List of files: /linux/tools/testing/selftests/exec/.gitignore

0b119045b79a672bc6d8f18641c60fc8ce1b4585 - Merge tag 'v6.14-rc4' into next

Wed, 26 Feb 2025 01:03:25 +0100

Merge tag 'v6.14-rc4' into nextSync up with the mainline. List of files: /linux/tools/testing/selftests/exec/.gitignore

9e676a024fa1fa2bd8150c2d2ba85478280353bc - Merge tag 'v6.14-rc1' into perf-tools-next

Wed, 05 Feb 2025 23:57:18 +0100

Merge tag 'v6.14-rc1' into perf-tools-nextTo get the various fixes in the current master.Signed-off-by: Namhyung Kim List of files: /linux/tools/testing/selftests/exec/.gitignore

0410c6121529409b08e81a77ae3ee58c657e2243 - Merge drm/drm-next into drm-xe-next

Fri, 28 Feb 2025 15:54:14 +0100

Merge drm/drm-next into drm-xe-nextSync to fix conlicts between drm-xe-next and drm-intel-next.Signed-off-by: Lucas De Marchi List of files: /linux/tools/testing/selftests/exec/.gitignore

93c7dd1b39444ebd5a6a98e56a363d7a4e646775 - Merge drm/drm-next into drm-misc-next

Thu, 06 Feb 2025 13:47:32 +0100

Merge drm/drm-next into drm-misc-nextBring rc1 to start the new release dev.Signed-off-by: Maxime Ripard List of files: /linux/tools/testing/selftests/exec/.gitignore

ea9f8f2b21795a5d80418a655bcb212d5b89e08f - Merge drm/drm-next into drm-intel-next

Wed, 05 Feb 2025 18:12:37 +0100

Merge drm/drm-next into drm-intel-nextSync with v6.14-rc1.Signed-off-by: Jani Nikula List of files: /linux/tools/testing/selftests/exec/.gitignore

c771600c6af14749609b49565ffb4cac2959710d - Merge drm/drm-next into drm-intel-gt-next

Wed, 05 Feb 2025 10:29:14 +0100

Merge drm/drm-next into drm-intel-gt-nextWe need4ba4f1afb6a9 ("perf: Generic hotplug support for a PMU with a scope")in order to land a i915 PMU simplification and a fix. That landed in 6.12and we are stuck at 6.9 so lets bump things forward.Signed-off-by: Tvrtko Ursulin List of files: /linux/tools/testing/selftests/exec/.gitignore

b3cc7428a32202936904b5b07cf9f135025bafd6 - Merge branch 'for-6.15/amd_sfh' into for-linus

Wed, 26 Mar 2025 13:42:07 +0100

Merge branch 'for-6.15/amd_sfh' into for-linusFrom: Mario Limonciello Some platforms include a human presence detection (HPD) sensor. Whenenabled and a user is detected a wake event will be emitted from thesensor fusion hub that software can react to.Example use cases are "wake from suspend on approach" or to "lockwhen leaving".This is currently enabled by default on supported systems, but userscan't control it. This essentially means that wake on approach isenabled which is a really surprising behavior to users that don'texpect it.Instead of defaulting to enabled add a sysfs knob that users canuse to enable the feature if desirable and set it to disabled bydefault. List of files: /linux/tools/testing/selftests/exec/.gitignore

21266b8df5224c4f677acf9f353eecc9094731f0 - Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Thu, 23 Jan 2025 05:34:42 +0100

Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linuxPull AT_EXECVE_CHECK from Kees Cook: - Implement AT_EXECVE_CHECK flag to execveat(2) (Mickaël Salaün) - Implement EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits (Mickaël Salaün) - Add selftests and samples for AT_EXECVE_CHECK (Mickaël Salaün)* tag 'AT_EXECVE_CHECK-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: ima: instantiate the bprm_creds_for_exec() hook samples/check-exec: Add an enlighten "inc" interpreter and 28 tests selftests: ktap_helpers: Fix uninitialized variable samples/check-exec: Add set-exec selftests/landlock: Add tests for execveat + AT_EXECVE_CHECK selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebits security: Add EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits exec: Add a new AT_EXECVE_CHECK flag to execveat(2) List of files: /linux/tools/testing/selftests/exec/.gitignore

2a69962be4a7e97ab347e05826480a3352c6fbc8 - samples/check-exec: Add an enlighten "inc" interpreter and 28 tests

Thu, 12 Dec 2024 18:42:22 +0100

samples/check-exec: Add an enlighten "inc" interpreter and 28 testsAdd a very simple script interpreter called "inc" that can evaluate twodifferent commands (one per line):- "?" to initialize a counter from user's input;- "+" to increment the counter (which is set to 0 by default).It is enlighten to only interpret executable files according toAT_EXECVE_CHECK and the related securebits: # Executing a script with RESTRICT_FILE is only allowed if the script # is executable: ./set-exec -f -- ./inc script-exec.inc # Allowed ./set-exec -f -- ./inc script-noexec.inc # Denied # Executing stdin with DENY_INTERACTIVE is only allowed if stdin is an # executable regular file: ./set-exec -i -- ./inc -i < script-exec.inc # Allowed ./set-exec -i -- ./inc -i < script-noexec.inc # Denied # However, a pipe is not executable and it is then denied: cat script-noexec.inc | ./set-exec -i -- ./inc -i # Denied # Executing raw data (e.g. command argument) with DENY_INTERACTIVE is # always denied. ./set-exec -i -- ./inc -c "+" # Denied ./inc -c "$(Cc: Christian Brauner Cc: Kees Cook Cc: Paul Moore Cc: Serge Hallyn Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20241212174223.389435-8-mic@digikod.netSigned-off-by: Kees Cook List of files: /linux/tools/testing/selftests/exec/.gitignore

b083cc815376a8ccfba6535b4d59a396b77601d4 - selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebits

Thu, 12 Dec 2024 18:42:18 +0100

selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebitsTest that checks performed by execveat(..., AT_EXECVE_CHECK) areconsistent with noexec mount points and file execute permissions.Test that SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE areinherited by child processes and that they can be pinned with theappropriate SECBIT_EXEC_RESTRICT_FILE_LOCKED andSECBIT_EXEC_DENY_INTERACTIVE_LOCKED bits.Cc: Al Viro Cc: Christian Brauner Cc: Kees Cook Cc: Paul Moore Cc: Serge Hallyn Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20241212174223.389435-4-mic@digikod.netSigned-off-by: Kees Cook List of files: /linux/tools/testing/selftests/exec/.gitignore