Changes in binfmt_misc_interplimit.c

b9cba7ebfe539f3e4bbdd03a1e0efa3b30b3f592 - Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 17 Aug 2026 17:35:25 +0200

Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull binfmt updates from Christian Brauner: "This contains a bunch of work for binfmt_misc. It fixes a bunch of old bugs, reworks the locking, and then extends the format registry so a binary type can be matched programmatically and its interpreter computed per exec instead of being a fixed string recorded at registration time. This allows nixos and other to e.g., implement relocatable binaries meaning the interpreter/dynamic loader can be determined programatically, say found relative to the binary. The mechanism is flexible and can support other policies: - Handler lookup is now an rcu walk. An exec that matches no binfmt_misc entry should now never write to a shared cacheline - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles - convert the entry file to a seq_file which simplifies things quite a bit and kills a lot of custom logic - make flags proper enums - rename struct Node to binfmt_misc_entry - allow entries to be removed with unlink(2) - Add the ability to attach bpf programs to binfmt_misc entries so it's possible to dynamically choose the execution environment such as the loader or interpreter on a per binary basis. A handler is an instance of a binfmt_misc_ops struct_ops with a ->match() and a ->load() program. match() decides from the entry lookup walk whether the handler applies under the same registration-order. It can read file content as needed not only the prefetched 256 bytes in bprm->buf. load() then selects the interpreter and stages it through the new bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and bpf_binprm_set_flags() kfuncs. Handlers are published in a registry keyed by the registering task's user namespace and activated through the existing text interface with a new 'B' type carrying the handler name: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register The permission and namespacing model is unchanged. Activating a handler requires the same write access to an instance as any other registration. A container mounting its own instance escapes the host's entries exactly as before. The computed interpreter is opened with open_exec() under the caller's credentials and goes through full LSM vetting as the next binprm level. A program can only ever redirect the caller to something the caller could exec anyway. - Two dispatch modes are added. So far the chosen interpreter owns the whole process identity (argv[0], /proc/pid/cmdline, /proc/self/exe all name interpreter information). So relocatable find the dynamic linker instead. Also a binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips because AT_ENTRY and AT_PHDR do not match the exe file. So PIE symbols are unrelocated. This adds transparent dispatch which allows the interpreter to load the binary through AT_EXECFD and leaves the argument vector exactly as the caller built it and labels mm->exe_file and comm with the binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector bit. The interpreter keeps control of mapping the binary. The second mode is loader substitution. This allows a binary to be executed natively and only the interpreter to be changed. - Last, interpreters can be bound at registration time. Each interpreter is opened by its own write with the credentials the entry file was opened with. The program picks one per exec with bpf_binprm_select_interp(). Ucounts are used to properly account for pre-opened interpreters via /proc/sys/user/max_binfmt_misc_interpreters"* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits) binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpreters binfmt_misc: document interpreters bound by a 'B' entry selftests/exec: test interpreters bound to a 'B' entry binfmt_misc: let a 'B' entry bind its interpreters binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp selftests/exec: share the bpf handler preconditions binfmt_misc: document registering an entry disabled selftests/exec: test registering an entry disabled selftests/exec: let binfmt_flag_supported() return a bool selftests/exec: check that a binfmt_misc instance cannot be pinned binfmt_misc: let a register string create an entry disabled binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm ... List of files: /linux/tools/testing/selftests/exec/binfmt_misc_interplimit.c

68aabd01ddd26ced458a9e5716a640eaf8e4b7a6 - Merge patch series "binfmt_misc: bound the interpreters an entry can pre-open"

Mon, 03 Aug 2026 23:36:38 +0200

Merge patch series "binfmt_misc: bound the interpreters an entry can pre-open"Christian Brauner says:An 'F' entry opens its interpreter at registration and every exec runs aclone of it. A 'B' entry does the same for each interpreter it binds. Thatfile stays open for as long as the entry lives. So it pins the file, itsinode, the mount it came from and that mount's superblock.An entry binds at most 100 interpreters, but nothing caps the entries.binfmt_misc is container mountable so all of this is reachable byunprivileged users.While the pins go away when the instance is unmounted, it's still weirdfor an unprivileged namespace to be allowed to do this. And the fix issimple.Charge each binding to the user namespace and uid that makes it againsta new UCOUNT_BINFMT_MISC_INTERPRETERS and refuse with -ENOSPC when thelimit is hit.A per-instance cap won't do. Instances are keyed on the user namespace, sowhatever constant I pick gets multiplied by however many namespaces thecaller cares to create. inc_ucount() charges the namespace and every oneof its ancestors, and a namespace can only ever raise its own limit, sonesting buys nothing.The knob is /proc/sys/user/max_binfmt_misc_interpreters, per namespace likeevery other ucount. I left it at the max_threads/2 default thatfork_init() hands a new ucount type. Nothing anyone runs today comesanywhere near that.Selftests for all of it, including that a nested namespace can't buyitself budget.* patches from https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-0-4a2435500bd9@kernel.org: binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpretersLink: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-0-4a2435500bd9@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/binfmt_misc_interplimit.c

f2b69ea2d1a017f0c8e848ff875f4cf2492d2bd0 - selftests/exec: test the pre-opened interpreter limit

Mon, 03 Aug 2026 14:15:01 +0200

selftests/exec: test the pre-opened interpreter limit- an interpreter opened at registration is charged- an interpreter a 'B' entry binds is charged too- an entry that opens none is not- removing an entry gives the charge back- a nested user namespace cannot buy itself budget by raising its own limitSkips where the sysctl or binfmt_misc is missing. The 'B' case lives inbinfmt_misc_bpf.c because binding needs a handler. It binds from a childin a user namespace of its own, through the fd the child inherited, sothe charge lands on the child while the interpreter is still opened withthe entry file's credentials, and nothing outside the child sees achanged limit.Link: https://patch.msgid.link/20260803-work-binfmt_misc-interplimit-v1-2-4a2435500bd9@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/binfmt_misc_interplimit.c