binfmt_misc: let a bpf handler choose the invocation flags per exec

The 'P', 'C' and 'O' flags of a binfmt_misc entry - preserve argv[0],
compute credentials from the binary, and pass the binary as an open file
descriptor - are fixed at registration and apply to every binary the entry
matches. A bpf handler matches, selects the interpreter and reads the
binary per exec, so the flags should be its per-exec decision too: one
handler may match both setuid and non-setuid binaries, argv[0]-sensitive
ones and not.

Honor the flags the load program stages in bprm->bpf_flags through the
bpf_binprm_set_flags() kfunc: BPF_BINPRM_PRESERVE_ARGV0,
BPF_BINPRM_CREDENTIALS and BPF_BINPRM_EXECFD map to 'P', 'C' and 'O' and
keep the semantics of their static counterparts, credentials implying the
open file descriptor included.

Flags staged by a load program that then fails are dropped on the way out
so they cannot leak into a later handler's exec, and the argv[0] decision
acts on the entry's own choice instead of testing the accumulated
bprm->interp_flags bit, which an earlier chain level may have left set and
binfmt_misc never clears.

Since a 'B' entry's flags come from the program, it carries none in the
register string: 'P', 'C' and 'O' are rejected there alongside 'F', which
was already meaningless for it. load_misc_binary() takes the flags from
the entry for a static handler and from bprm->bpf_flags for a bpf one.

Link: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-7-57b7529c002c@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/Documentation/admin-guide/binfmt-misc.rst b/Documentation/admin-guide/binfmt-misc.rst
index c2c18ca9ff8e5244d568426509694584f8964f26..85bbf4845f99bc3f349ac36e745a982ea5c3b50b 100644 (file)
--- a/Documentation/admin-guide/binfmt-misc.rst
+++ b/Documentation/admin-guide/binfmt-misc.rst
@@ -135,18 +135,29 @@ interpreter and the binary, exactly like the optional argument of a ``#!``
 interpreter line, e.g. for a handler that resolves ``$ORIGIN`` in a script's
 ``#!`` path and needs to preserve the argument that followed it.
 
+The invocation flags a static entry fixes at registration - ``P``, ``C``
+and ``O`` - are per-exec choices for a bpf handler, made by the ``load``
+program with the ``bpf_binprm_set_flags()`` kfunc, so a single handler can
+decide them differently for each binary it handles:
+
+- ``BPF_BINPRM_PRESERVE_ARGV0`` keeps the caller's ``argv[0]`` (the ``P``
+  flag).
+- ``BPF_BINPRM_CREDENTIALS`` computes credentials from the binary (the ``C``
+  flag), bounded to user namespaces that map the binary's owner just like
+  any other setuid exec.
+- ``BPF_BINPRM_EXECFD`` opens the binary on the interpreter's behalf and
+  passes it through the ``AT_EXECFD`` aux vector entry (the ``O`` flag), so
+  the interpreter can run binaries it could not open by path.
+
+Because these are program choices, a ``B`` entry carries no flags in the
+register string; ``F`` (pre-open a fixed interpreter) has no meaning for it.
+
 A handler is looked up only in the user namespace the struct_ops map was
 registered in. Handlers are not inherited, so an entry can only reference a
 handler registered in the same user namespace as its binfmt_misc instance.
 The entry keeps the handler alive; deleting the struct_ops map only prevents
 new activations.
 
-The ``F`` flag cannot be combined with ``B`` entries: it pre-opens a fixed
-interpreter at registration time and a ``B`` entry has none. The ``C`` flag
-works as it does for a static entry: the interpreter runs with the matched
-binary's credentials, bounded to user namespaces that map the binary's owner
-just like any other setuid exec.
-
 To use binfmt_misc you have to mount it first. You can mount it with
 ``mount -t binfmt_misc none /proc/sys/fs/binfmt_misc`` command, or you can add
 a line ``none  /proc/sys/fs/binfmt_misc binfmt_misc defaults 0 0`` to your

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 507f833a3179111d788f819f265742a4ecb00f96..c3064f2557ca238ea20fbbcd711c6059d97d3fea 100644 (file)
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -284,6 +284,7 @@ drop_staged:
        /* A failing load leaves nothing behind for later entries. */
        kfree(bprm->bpf_interp_arg);
        bprm->bpf_interp_arg = NULL;
+       bprm->bpf_flags = 0;
        return ERR_PTR(retval);
 }
 
@@ -296,6 +297,7 @@ static int load_misc_binary(struct linux_binprm *bprm)
        const char *interpreter;
        struct file *interp_file;
        struct binfmt_misc *misc;
+       bool preserve_argv0, want_execfd, want_creds;
        int retval;
 
        misc = current_binfmt_misc();
@@ -314,7 +316,28 @@ static int load_misc_binary(struct linux_binprm *bprm)
        if (IS_ERR(interpreter))
                return PTR_ERR(interpreter);
 
-       if (fmt->flags & MISC_FMT_PRESERVE_ARGV0) {
+       /*
+        * The invocation flags are fixed at registration for a static handler
+        * and chosen per exec by the load program, via bpf_binprm_set_flags(),
+        * for a bpf one.
+        */
+       if (test_bit(MISC_FMT_BPF_BIT, &fmt->flags)) {
+               u64 f = bprm->bpf_flags;
+
+               /* Clear so it can't accumulate into a nested interpreter level. */
+               bprm->bpf_flags = 0;
+
+               preserve_argv0 = f & BPF_BINPRM_PRESERVE_ARGV0;
+               want_creds = f & BPF_BINPRM_CREDENTIALS;
+               want_execfd = f & (BPF_BINPRM_CREDENTIALS | BPF_BINPRM_EXECFD);
+       } else {
+               preserve_argv0 = fmt->flags & MISC_FMT_PRESERVE_ARGV0;
+               want_creds = fmt->flags & MISC_FMT_CREDENTIALS;
+               want_execfd = fmt->flags & MISC_FMT_OPEN_BINARY;
+       }
+
+       /* The entry's own choice - not one accumulated from an earlier level. */
+       if (preserve_argv0) {
                bprm->interp_flags |= BINPRM_FLAGS_PRESERVE_ARGV0;
        } else {
                retval = remove_arg_zero(bprm);
@@ -370,9 +393,9 @@ static int load_misc_binary(struct linux_binprm *bprm)
                return PTR_ERR(interp_file);
 
        bprm->interpreter = interp_file;
-       if (fmt->flags & MISC_FMT_OPEN_BINARY)
+       if (want_execfd)
                bprm->have_execfd = 1;
-       if (fmt->flags & MISC_FMT_CREDENTIALS)
+       if (want_creds)
                bprm->execfd_creds = 1;
        return 0;
 }
@@ -650,14 +673,14 @@ static struct binfmt_misc_entry *create_entry(const char __user *buffer,
                return ERR_PTR(-EINVAL);
 
        /*
-        * 'F' pre-opens a fixed interpreter at registration time which is
-        * meaningless for a per-exec computed path. 'C' is fine: it honors the
-        * suid bits of the matched binary exactly like a static entry, gated by
-        * the same vfsuid_has_mapping() check in bprm_fill_uid() that keeps the
-        * transition to uids mapped in the caller's user namespace.
+        * A bpf handler decides the invocation flags per exec with
+        * bpf_binprm_set_flags() rather than fixing them at registration, so a
+        * 'B' entry carries no flags: 'P', 'C' and 'O' become per-exec choices
+        * and 'F' (pre-open a fixed interpreter) is meaningless for it.
         */
        if (test_bit(MISC_FMT_BPF_BIT, &e->flags) &&
-           (e->flags & MISC_FMT_OPEN_FILE))
+           (e->flags & (MISC_FMT_PRESERVE_ARGV0 | MISC_FMT_OPEN_BINARY |
+                        MISC_FMT_CREDENTIALS | MISC_FMT_OPEN_FILE)))
                return ERR_PTR(-EINVAL);
 
        return no_free_ptr(e);