[PATCH 00/21] binfmt_misc: transparent interpreters and PT_INTERP loader substitution

[Christian Brauner <brauner@kernel.org>]

binfmt_misc has exactly one execution model where the registered
interpreter becomes the executed program and the matched binary is
handed to it as an argument. For wine or qemu-user that is the point.
For a per-binary loader it is backwards. The interpreter is an
implementation detail of running the binary, yet it owns the entire
process identity:

- argv[0] and /proc/pid/cmdline show the interpreter invocation, not
  what the caller executed.

- /proc/self/exe names the interpreter. Relocatable programs commonly
  locate themselves through it and find the dynamic linker instead.

- A binary passed to execveat() as an inaccessible O_CLOEXEC fd
  cannot run at all as the interpreter has no path to open it by.

- gdb cross-validates AT_ENTRY/AT_PHDR against the exe file and
  discards the load displacement on mismatch leaving PIE symbols
  unrelocated.

This series adds two dispatch modes that close the gap from opposite
ends:

(1) transparent dispatch

   Registered with the 'T' flag or chosen per exec with
   BPF_BINPRM_TRANSPARENT. The binary travels through AT_EXECFD, the
   argument vector stays exactly as the caller built it, and the kernel
   labels mm->exe_file and comm with the binary. A new aux vector bit,
   AT_FLAGS_TRANSPARENT_INTERP, is raised indicating that nothing
   was spliced, argv belongs to the program, and to load it from the
   descriptor.

   The interpreter keeps control of mapping the binary, so the mode
   covers foreign architectures and non-ELF payloads.

   The exe label is not a new privilege. It names precisely the file the
   caller passed to execve(), not a file of the process's choosing. That
   file is permission-checked, write-denied while the process runs and
   recorded by audit. Credential derivation does not change exactly as
   today.

(2) The second is loader substitution. The kernel executes the matched
    binary natively as the main image and substitutes the registered
    interpreter for the loader named in the binary's PT_INTERP.
    binfmt_misc stops meaning becomes a PT_INTERP override. There is no
    contract and no identity to reconstruct, so a stock dynamic loader
    works unchanged. So 'L' is for native-arch ELF with PT_INTERP. The
    modes compose. A bpf handler reads the ELF header from bprm->buf and
    grades per binary, picking 'L' where it applies and 'T' or classic
    dispatch for the rest.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
Christian Brauner (21):
      exec: do not act on a stale execfd request without an executable
      docs, binfmt_misc: keep general usage out of the handler sections
      binfmt_misc: table-drive the register string flags
      binfmt_misc: normalize the per-exec invocation flags
      binfmt_misc: split out entry_open_interpreter()
      binfmt_misc: split out build_interp_argv()
      exec: release the replaced file with do_close_execat()
      exec: add AT_FLAGS_TRANSPARENT_INTERP
      exec: label mm->exe_file with the binary for a transparent dispatch
      binfmt_misc: add transparent interpreter dispatch
      binfmt_misc: add a static transparent flag 'T'
      binfmt_misc: let a bpf handler run the interpreter transparently
      selftests/exec: convert the binfmt_misc bpf test to the kselftest harness
      selftests/exec: test the transparent binfmt_misc mode
      binfmt_misc: document the transparent identity contract
      exec: carry a PT_INTERP substitute in struct linux_binprm
      binfmt_elf: consume a stashed PT_INTERP substitute
      binfmt_misc: add the 'L' loader substitution flag
      binfmt_misc: let a bpf handler request loader substitution
      selftests/exec: test binfmt_misc loader substitution
      binfmt_misc: document loader substitution

 Documentation/admin-guide/binfmt-misc.rst          | 159 +++++++--
 fs/binfmt_elf.c                                    |  20 +-
 fs/binfmt_elf_fdpic.c                              |   5 +-
 fs/binfmt_misc.c                                   | 311 ++++++++++++------
 fs/binfmt_misc_bpf.c                               |  18 +-
 fs/exec.c                                          |  54 ++-
 include/linux/binfmt_misc.h                        |   8 +
 include/linux/binfmts.h                            |   9 +-
 include/uapi/linux/binfmts.h                       |   7 +
 tools/testing/selftests/exec/.gitignore            |   5 +
 tools/testing/selftests/exec/Makefile              |  30 +-
 .../testing/selftests/exec/binfmt_loader_payload.c | 196 +++++++++++
 tools/testing/selftests/exec/binfmt_misc_bpf.c     | 362 +++++++++++---------
 tools/testing/selftests/exec/binfmt_misc_common.h  | 146 +++++++++
 tools/testing/selftests/exec/binfmt_misc_loader.c  | 363 +++++++++++++++++++++
 .../selftests/exec/binfmt_misc_transparent.c       | 108 ++++++
 .../selftests/exec/binfmt_transparent_interp.c     | 130 ++++++++
 tools/testing/selftests/exec/loader.bpf.c          |  56 ++++
 tools/testing/selftests/exec/transparent.bpf.c     |  57 ++++
 19 files changed, 1748 insertions(+), 296 deletions(-)
---
base-commit: 34296289b1a63a5394271b4e35918d3c9ad530dc
change-id: 20260719-work-bpf-binfmt_misc-ptinterp-e6ee99ff6ba8