Merge patch series "binfmt_misc: transparent interpreters and PT_INTERP loader substitution"

Christian Brauner <brauner@kernel.org> says:

binfmt_misc has exactly one execution model where the registered
interpreter becomes the executed program and the matched binary is
handed to it as an argument. For wine or qemu-user that is the point.
For a per-binary loader it is backwards. The interpreter is an
implementation detail of running the binary, yet it owns the entire
process identity:

- argv[0] and /proc/pid/cmdline show the interpreter invocation, not
  what the caller executed.

- /proc/self/exe names the interpreter. Relocatable programs commonly
  locate themselves through it and find the dynamic linker instead.

- A binary passed to execveat() as an inaccessible O_CLOEXEC fd
  cannot run at all as the interpreter has no path to open it by.

- gdb cross-validates AT_ENTRY/AT_PHDR against the exe file and
  discards the load displacement on mismatch leaving PIE symbols
  unrelocated.

This series adds two dispatch modes that close the gap from opposite
ends:

(1) transparent dispatch

    Registered with the 'T' flag or chosen per exec with
    BPF_BINPRM_TRANSPARENT. The binary is sent to the interpreter through
    AT_EXECFD, the argument vector stays exactly as the caller built it,
    and the kernel labels mm->exe_file and comm with the binary. A new
    AT_FLAGS_TRANSPARENT_INTERP aux vector bit is raised indicating that
    nothing was spliced, argv belongs to the program, and to load it from
    the descriptor.

    The interpreter keeps control of mapping the binary, so the mode
    covers foreign architectures and non-ELF payloads.

    The exe label is not a new privilege. It names precisely the file the
    caller passed to execve(), not a file of the process's choosing. That
    file is permission-checked, write-denied while the process runs and
    recorded by audit. Credential derivation does not change exactly as
    today.

(2) loader substitution

    The kernel executes the matched binary natively as the main image
    and substitutes the registered interpreter for the binary's
    PT_INTERP. binfmt_misc functions as a PT_INTERP override. There is
    no contract and no identity to reconstruct. So a stock dynamic
    loader works unchanged. Hence, 'L' is for native-arch ELF with
    PT_INTERP.

The two modes compose. A bpf handler reads the ELF header from bprm->buf
and grades per binary, picking 'L' where it applies and 'T' or classic
dispatch for the rest. If userspace control over relocation is wanted
'T' is the way to go.

* patches from https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.org: (21 commits)
  binfmt_misc: document loader substitution
  selftests/exec: test binfmt_misc loader substitution
  binfmt_misc: let a bpf handler request loader substitution
  binfmt_misc: add the 'L' loader substitution flag
  binfmt_elf_fdpic: consume a stashed PT_INTERP substitute
  binfmt_elf: consume a stashed PT_INTERP substitute
  exec: carry a PT_INTERP substitute in struct linux_binprm
  binfmt_misc: document the transparent identity contract
  selftests/exec: test the transparent binfmt_misc mode
  binfmt_misc: let a bpf handler run the interpreter transparently
  binfmt_misc: add a static transparent flag 'T'
  binfmt_misc: add transparent interpreter dispatch
  exec: label mm->exe_file with the binary for a transparent dispatch
  exec: add AT_FLAGS_TRANSPARENT_INTERP
  selftests/exec: convert the binfmt_misc bpf test to the kselftest harness
  exec: release the replaced file with do_close_execat()
  binfmt_misc: split out entry_open_interpreter() and build_interp_argv()
  binfmt_misc: normalize the per-exec invocation flags
  binfmt_misc: table-drive the register string flags
  docs, binfmt_misc: keep general usage out of the handler sections
  ...

Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

2 files changed, 33 insertions, 0 deletions

diff --git a/include/linux/binfmt_misc.h b/include/linux/binfmt_misc.h
index d3112a00cc19..4abdfd36b3fa 100644
--- a/include/linux/binfmt_misc.h
+++ b/include/linux/binfmt_misc.h
@@ -16,6 +16,12 @@ struct user_namespace;
  * @BPF_BINPRM_CREDENTIALS: compute credentials from the binary; implies execfd
  *                          (like the 'C' flag)
  * @BPF_BINPRM_EXECFD: pass the binary via AT_EXECFD (like the 'O' flag)
+ * @BPF_BINPRM_TRANSPARENT: leave argv untouched, the interpreter takes the
+ *                          binary from AT_EXECFD (like the 'T' flag); implies
+ *                          execfd, excludes preserve-argv0
+ * @BPF_BINPRM_LOADER: substitute the interpreter for the binary's PT_INTERP
+ *                     and run the binary as a native exec (like the 'L'
+ *                     flag); excludes every other flag
  *
  * Set from a load program with bpf_binprm_set_flags(). Unlike a static entry,
  * a bpf handler chooses these per exec rather than once at registration.
@@ -24,6 +30,8 @@ enum bpf_binprm_flags {
 	BPF_BINPRM_PRESERVE_ARGV0	= (1ULL << 0),
 	BPF_BINPRM_CREDENTIALS		= (1ULL << 1),
 	BPF_BINPRM_EXECFD		= (1ULL << 2),
+	BPF_BINPRM_TRANSPARENT		= (1ULL << 3),
+	BPF_BINPRM_LOADER		= (1ULL << 4),
 };
 
 /**
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 03e1794b5cbb..a2daecbb01d6 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -62,6 +62,7 @@ struct linux_binprm {
 		is_check:1;
 	struct file *executable; /* Executable to pass to the interpreter */
 	struct file *interpreter;
+	struct file *loader;
 	struct file *file;
 	struct cred *cred;	/* new credentials */
 	int unsafe;		/* how unsafe this exec is (mask of LSM_UNSAFE_*) */
@@ -93,6 +94,28 @@ struct linux_binprm {
 #define BINPRM_FLAGS_PRESERVE_ARGV0_BIT 3
 #define BINPRM_FLAGS_PRESERVE_ARGV0 (1 << BINPRM_FLAGS_PRESERVE_ARGV0_BIT)
 
+/* binfmt_misc dispatched to the interpreter transparently */
+#define BINPRM_FLAGS_TRANSPARENT_INTERP_BIT 4
+#define BINPRM_FLAGS_TRANSPARENT_INTERP (1 << BINPRM_FLAGS_TRANSPARENT_INTERP_BIT)
+
+/**
+ * bprm_at_flags - the AT_FLAGS this invocation implies
+ * @bprm: binary that is being executed
+ *
+ * Tell the program on the receiving end which dispatch contract it got.
+ *
+ * Return: the AT_FLAGS value for this exec
+ */
+static inline unsigned long bprm_at_flags(const struct linux_binprm *bprm)
+{
+	/* Transparency preserves the whole argv, argv[0] included. */
+	if (bprm->interp_flags & BINPRM_FLAGS_TRANSPARENT_INTERP)
+		return AT_FLAGS_TRANSPARENT_INTERP;
+	if (bprm->interp_flags & BINPRM_FLAGS_PRESERVE_ARGV0)
+		return AT_FLAGS_PRESERVE_ARGV0;
+	return 0;
+}
+
 /*
  * This structure defines the functions that are used to load the binary formats that
  * linux accepts.
@@ -137,6 +160,8 @@ extern int begin_new_exec(struct linux_binprm * bprm);
 extern void setup_new_exec(struct linux_binprm * bprm);
 extern void finalize_exec(struct linux_binprm *bprm);
 extern void would_dump(struct linux_binprm *, struct file *);
+struct file *bprm_open_interpreter(struct linux_binprm *bprm, const char *path);
+void bprm_drop_loader(struct linux_binprm *bprm);
 
 extern int suid_dumpable;