Re: [RFC PATCH] fs: binfmt_misc: introduce eBPF-based matching and interpreter selection

[Alessandro Di Federico <ale@rev.ng>]

On Tue, 07 Jul 2026 13:34:46 +0200
Christian Brauner <brauner@kernel.org> wrote:

> > That makes sense -- but you will need CAP_BPF etc.. to load the new
> > programs though if inside a userns.  
> 
> Right, bpf tokens exist to delegate bpf access to containers. Not
> always ideal but it works for such cases. 

Hi everyone, first post here.

tl;dr I think an $ORIGIN+PT_INTERP-like feature should be available by
default (no root) since portable software is most important when you're
an unprivileged user.

I've recently read about this patch and I'm super excited. An
ORIGIN-like feature for loaders is something I wanted for years. Let me
share our use case + some additional nix use cases.

We have a package/build system that makes heavy use of RPATH+ORIGIN to
make portable installation directories of our software, as in: extract
a plain .tar in ~/mysoftware, `./myexecutable` and it works [1]. No
root, no run-time patching, no namespaces.

Now, this means we need to ship all of our dependencies properly
RPATH'd (using $ORIGIN). The only exception is the libc, which we can't
ship, since we can't put $ORIGIN in PT_INTERP. This means we
need to link against an ancient libc in order to be compatible with
a wide range of host libcs. Needless to say, is a *huge* pain.

This patch could in theory solve our problems, except for the "no root"
part, which I think it's the most important one. After all, if you
assume your user is root (at least at install time), you don't have big
problems, just drop your software in /opt/mysoftware and ship your
loader in there.

But I think being able to use $ORIGIN from non-root users would be
useful also for nix, not when you are on NixOS (where I'd assume they'd
enable PT_INTERP_NIX by default), but when you're on a non-NixOS system.

There are several projects that aim at running nix without root:

    https://github.com/davhau/nix-portable
    https://github.com/nixie-dev/nixie

Currently they either use user namespaces or ptrace. However, the former
is restricted under Ubuntu (`apparmor_restrict_unprivileged_unconfined`)
and the latter is not ideal.
AFAIU it'd be possible to avoid all of this if $ORIGIN was available by
default in PT_INTERP, or at least the biggest roadblocker would go away.

I understand that enabling $ORIGIN in PT_INTERP can be problematic (I
should dig into that actually).
However, in whatever way this gets supported, I think that in order to
be actually useful in the most important use cases where portability is
important (i.e., no root, no user namespaces), having this feature
available *by default* is important.

> In any case, I think it wouldn't be crazy to allow registering
> "default" handlers that appear in all binfmt_misc instances if needed
> so containers with separate binfmt_misc always have the bpf program
> available. [...]

Maybe we can have a "default eBPF program" loaded for
`PT_INTERP_WITH_ORIGIN`?

We toolchain people are happy to tamper with our binaries, but if these
features are not available by default, their use is going to be limited.

In any case, thanks for this work, I've been wanting this for a long
time.

--
Alessandro Di Federico
rev.ng Labs

[1] https://github.com/revng/orchestra

Note that this is soon going to be dismissed in favor of nix itself.

Example artifact:

wget 'https://rev.ng/downloads/revng-distributable/develop.tar.xz'
tar xaf develop.tar.xaf
$ ./revng-public-demo/root/lib64/llvm/llvm/bin/clang --version
clang version 16.0.1