Changes in config

b9cba7ebfe539f3e4bbdd03a1e0efa3b30b3f592 - Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Mon, 17 Aug 2026 17:35:25 +0200

Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull binfmt updates from Christian Brauner: "This contains a bunch of work for binfmt_misc. It fixes a bunch of old bugs, reworks the locking, and then extends the format registry so a binary type can be matched programmatically and its interpreter computed per exec instead of being a fixed string recorded at registration time. This allows nixos and other to e.g., implement relocatable binaries meaning the interpreter/dynamic loader can be determined programatically, say found relative to the binary. The mechanism is flexible and can support other policies: - Handler lookup is now an rcu walk. An exec that matches no binfmt_misc entry should now never write to a shared cacheline - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles - convert the entry file to a seq_file which simplifies things quite a bit and kills a lot of custom logic - make flags proper enums - rename struct Node to binfmt_misc_entry - allow entries to be removed with unlink(2) - Add the ability to attach bpf programs to binfmt_misc entries so it's possible to dynamically choose the execution environment such as the loader or interpreter on a per binary basis. A handler is an instance of a binfmt_misc_ops struct_ops with a ->match() and a ->load() program. match() decides from the entry lookup walk whether the handler applies under the same registration-order. It can read file content as needed not only the prefetched 256 bytes in bprm->buf. load() then selects the interpreter and stages it through the new bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and bpf_binprm_set_flags() kfuncs. Handlers are published in a registry keyed by the registering task's user namespace and activated through the existing text interface with a new 'B' type carrying the handler name: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register The permission and namespacing model is unchanged. Activating a handler requires the same write access to an instance as any other registration. A container mounting its own instance escapes the host's entries exactly as before. The computed interpreter is opened with open_exec() under the caller's credentials and goes through full LSM vetting as the next binprm level. A program can only ever redirect the caller to something the caller could exec anyway. - Two dispatch modes are added. So far the chosen interpreter owns the whole process identity (argv[0], /proc/pid/cmdline, /proc/self/exe all name interpreter information). So relocatable find the dynamic linker instead. Also a binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips because AT_ENTRY and AT_PHDR do not match the exe file. So PIE symbols are unrelocated. This adds transparent dispatch which allows the interpreter to load the binary through AT_EXECFD and leaves the argument vector exactly as the caller built it and labels mm->exe_file and comm with the binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector bit. The interpreter keeps control of mapping the binary. The second mode is loader substitution. This allows a binary to be executed natively and only the interpreter to be changed. - Last, interpreters can be bound at registration time. Each interpreter is opened by its own write with the credentials the entry file was opened with. The program picks one per exec with bpf_binprm_select_interp(). Ucounts are used to properly account for pre-opened interpreters via /proc/sys/user/max_binfmt_misc_interpreters"* tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits) binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpreters binfmt_misc: document interpreters bound by a 'B' entry selftests/exec: test interpreters bound to a 'B' entry binfmt_misc: let a 'B' entry bind its interpreters binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp selftests/exec: share the bpf handler preconditions binfmt_misc: document registering an entry disabled selftests/exec: test registering an entry disabled selftests/exec: let binfmt_flag_supported() return a bool selftests/exec: check that a binfmt_misc instance cannot be pinned binfmt_misc: let a register string create an entry disabled binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm ... List of files: /linux/tools/testing/selftests/exec/config

25757bc855e388eedf86c69c382857ef2c67b08e - selftests/exec: check that a binfmt_misc instance cannot be pinned

Tue, 28 Jul 2026 14:26:33 +0200

selftests/exec: check that a binfmt_misc instance cannot be pinnedAn 'F' entry whose interpreter keeps the binfmt_misc superblock alivepins the instance that owns it forever. Cover both ways to build that:- an interpreter on the instance's own files, control file and entry file alike- and an instance used as an overlayfs lower layer.Check that an ordinary 'F' registration still succeeds so the fix stayshonest about not changing what 'F' promises.Link: https://patch.msgid.link/20260728-work-binfmt_misc-selfpin-v1-2-74df5daeca5b@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/config

b2a52381541af862076b5e7d17db2ca76e921e95 - Merge patch series "binfmt_misc: transparent interpreters and PT_INTERP loader substitution"

Sat, 25 Jul 2026 11:11:48 +0200

Merge patch series "binfmt_misc: transparent interpreters and PT_INTERP loader substitution"Christian Brauner says:binfmt_misc has exactly one execution model where the registeredinterpreter becomes the executed program and the matched binary ishanded to it as an argument. For wine or qemu-user that is the point.For a per-binary loader it is backwards. The interpreter is animplementation detail of running the binary, yet it owns the entireprocess identity:- argv[0] and /proc/pid/cmdline show the interpreter invocation, not what the caller executed.- /proc/self/exe names the interpreter. Relocatable programs commonly locate themselves through it and find the dynamic linker instead.- A binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all as the interpreter has no path to open it by.- gdb cross-validates AT_ENTRY/AT_PHDR against the exe file and discards the load displacement on mismatch leaving PIE symbols unrelocated.This series adds two dispatch modes that close the gap from oppositeends:(1) transparent dispatch Registered with the 'T' flag or chosen per exec with BPF_BINPRM_TRANSPARENT. The binary is sent to the interpreter through AT_EXECFD, the argument vector stays exactly as the caller built it, and the kernel labels mm->exe_file and comm with the binary. A new AT_FLAGS_TRANSPARENT_INTERP aux vector bit is raised indicating that nothing was spliced, argv belongs to the program, and to load it from the descriptor. The interpreter keeps control of mapping the binary, so the mode covers foreign architectures and non-ELF payloads. The exe label is not a new privilege. It names precisely the file the caller passed to execve(), not a file of the process's choosing. That file is permission-checked, write-denied while the process runs and recorded by audit. Credential derivation does not change exactly as today.(2) loader substitution The kernel executes the matched binary natively as the main image and substitutes the registered interpreter for the binary's PT_INTERP. binfmt_misc functions as a PT_INTERP override. There is no contract and no identity to reconstruct. So a stock dynamic loader works unchanged. Hence, 'L' is for native-arch ELF with PT_INTERP.The two modes compose. A bpf handler reads the ELF header from bprm->bufand grades per binary, picking 'L' where it applies and 'T' or classicdispatch for the rest. If userspace control over relocation is wanted'T' is the way to go.* patches from https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.org: (21 commits) binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm binfmt_misc: document the transparent identity contract selftests/exec: test the transparent binfmt_misc mode binfmt_misc: let a bpf handler run the interpreter transparently binfmt_misc: add a static transparent flag 'T' binfmt_misc: add transparent interpreter dispatch exec: label mm->exe_file with the binary for a transparent dispatch exec: add AT_FLAGS_TRANSPARENT_INTERP selftests/exec: convert the binfmt_misc bpf test to the kselftest harness exec: release the replaced file with do_close_execat() binfmt_misc: split out entry_open_interpreter() and build_interp_argv() binfmt_misc: normalize the per-exec invocation flags binfmt_misc: table-drive the register string flags docs, binfmt_misc: keep general usage out of the handler sections ...Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/config

2686010586df2d8d01f44c670c943b3815dedc22 - selftests/exec: convert the binfmt_misc bpf test to the kselftest harness

Tue, 21 Jul 2026 16:13:49 +0200

selftests/exec: convert the binfmt_misc bpf test to the kselftest harnessThe test reports its own pass and fail lines, returns a bare 4 forKSFT_SKIP and runs both cases in one process, so a failure in the firsttakes the second with it. It also open-codes the register, unregister,file-copy and mount helpers that the tests for the upcoming transparentand loader dispatch modes need again.Convert it to the kselftest harness: a fixture for the common setup andteardown, one TEST_F per case so each is reported and isolatedseparately, and SKIP() for the root, BTF and binfmt_misc preconditions.Move the helpers to a shared header on the way, with the registerhelper preserving the write's errno so a caller can tell a rejectedflag combination (EINVAL) from a kernel that does not know the flag atall. The synthetic ELF header gains an e_machine argument and uses theelf.h constants instead of open-coded numbers.The fixture no longer mounts bpffs. The handler is attached withbpf_map__attach_struct_ops() and nothing is ever pinned, the mount wascarried along from a bpftool-based draft. The bpf objects are compiledwith -DBPF_NO_KFUNC_PROTOTYPES - the guard bpftool emits for exactlythis - instead of sed'ing the prototypes out of the generatedvmlinux.h. And the config fragment records the options the binfmt_misctests need so a merge-config kernel can run them.No change in what is tested.Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-7-e57866e4ae0f@kernel.orgSigned-off-by: Christian Brauner (Amutable) List of files: /linux/tools/testing/selftests/exec/config

1260ed77798502de9c98020040d2995008de10cc - Merge drm/drm-fixes into drm-misc-fixes

Tue, 08 Apr 2025 10:15:47 +0200

Merge drm/drm-fixes into drm-misc-fixesBackmerging to get updates from v6.15-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/exec/config

946661e3bef8efa11ba8079d4ebafe6fc3b0aaad - Merge branch 'next' into for-linus

Sat, 05 Apr 2025 08:04:35 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.15 merge window. List of files: /linux/tools/testing/selftests/exec/config

0b119045b79a672bc6d8f18641c60fc8ce1b4585 - Merge tag 'v6.14-rc4' into next

Wed, 26 Feb 2025 01:03:25 +0100

Merge tag 'v6.14-rc4' into nextSync up with the mainline. List of files: /linux/tools/testing/selftests/exec/config

9e676a024fa1fa2bd8150c2d2ba85478280353bc - Merge tag 'v6.14-rc1' into perf-tools-next

Wed, 05 Feb 2025 23:57:18 +0100

Merge tag 'v6.14-rc1' into perf-tools-nextTo get the various fixes in the current master.Signed-off-by: Namhyung Kim List of files: /linux/tools/testing/selftests/exec/config

0410c6121529409b08e81a77ae3ee58c657e2243 - Merge drm/drm-next into drm-xe-next

Fri, 28 Feb 2025 15:54:14 +0100

Merge drm/drm-next into drm-xe-nextSync to fix conlicts between drm-xe-next and drm-intel-next.Signed-off-by: Lucas De Marchi List of files: /linux/tools/testing/selftests/exec/config

93c7dd1b39444ebd5a6a98e56a363d7a4e646775 - Merge drm/drm-next into drm-misc-next

Thu, 06 Feb 2025 13:47:32 +0100

Merge drm/drm-next into drm-misc-nextBring rc1 to start the new release dev.Signed-off-by: Maxime Ripard List of files: /linux/tools/testing/selftests/exec/config

ea9f8f2b21795a5d80418a655bcb212d5b89e08f - Merge drm/drm-next into drm-intel-next

Wed, 05 Feb 2025 18:12:37 +0100

Merge drm/drm-next into drm-intel-nextSync with v6.14-rc1.Signed-off-by: Jani Nikula List of files: /linux/tools/testing/selftests/exec/config

c771600c6af14749609b49565ffb4cac2959710d - Merge drm/drm-next into drm-intel-gt-next

Wed, 05 Feb 2025 10:29:14 +0100

Merge drm/drm-next into drm-intel-gt-nextWe need4ba4f1afb6a9 ("perf: Generic hotplug support for a PMU with a scope")in order to land a i915 PMU simplification and a fix. That landed in 6.12and we are stuck at 6.9 so lets bump things forward.Signed-off-by: Tvrtko Ursulin List of files: /linux/tools/testing/selftests/exec/config

b3cc7428a32202936904b5b07cf9f135025bafd6 - Merge branch 'for-6.15/amd_sfh' into for-linus

Wed, 26 Mar 2025 13:42:07 +0100

Merge branch 'for-6.15/amd_sfh' into for-linusFrom: Mario Limonciello Some platforms include a human presence detection (HPD) sensor. Whenenabled and a user is detected a wake event will be emitted from thesensor fusion hub that software can react to.Example use cases are "wake from suspend on approach" or to "lockwhen leaving".This is currently enabled by default on supported systems, but userscan't control it. This essentially means that wake on approach isenabled which is a really surprising behavior to users that don'texpect it.Instead of defaulting to enabled add a sysfs knob that users canuse to enable the feature if desirable and set it to disabled bydefault. List of files: /linux/tools/testing/selftests/exec/config

21266b8df5224c4f677acf9f353eecc9094731f0 - Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Thu, 23 Jan 2025 05:34:42 +0100

Merge tag 'AT_EXECVE_CHECK-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linuxPull AT_EXECVE_CHECK from Kees Cook: - Implement AT_EXECVE_CHECK flag to execveat(2) (Mickaël Salaün) - Implement EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits (Mickaël Salaün) - Add selftests and samples for AT_EXECVE_CHECK (Mickaël Salaün)* tag 'AT_EXECVE_CHECK-v6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: ima: instantiate the bprm_creds_for_exec() hook samples/check-exec: Add an enlighten "inc" interpreter and 28 tests selftests: ktap_helpers: Fix uninitialized variable samples/check-exec: Add set-exec selftests/landlock: Add tests for execveat + AT_EXECVE_CHECK selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebits security: Add EXEC_RESTRICT_FILE and EXEC_DENY_INTERACTIVE securebits exec: Add a new AT_EXECVE_CHECK flag to execveat(2) List of files: /linux/tools/testing/selftests/exec/config

b083cc815376a8ccfba6535b4d59a396b77601d4 - selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebits

Thu, 12 Dec 2024 18:42:18 +0100

selftests/exec: Add 32 tests for AT_EXECVE_CHECK and exec securebitsTest that checks performed by execveat(..., AT_EXECVE_CHECK) areconsistent with noexec mount points and file execute permissions.Test that SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE areinherited by child processes and that they can be pinned with theappropriate SECBIT_EXEC_RESTRICT_FILE_LOCKED andSECBIT_EXEC_DENY_INTERACTIVE_LOCKED bits.Cc: Al Viro Cc: Christian Brauner Cc: Kees Cook Cc: Paul Moore Cc: Serge Hallyn Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20241212174223.389435-4-mic@digikod.netSigned-off-by: Kees Cook List of files: /linux/tools/testing/selftests/exec/config