Merge patch series "binfmt_misc: transparent interpreters and PT_INTERP loader substi...

Christian Brauner <brauner@kernel.org> says:

binfmt_misc has exactly one execution model where the registered
interpreter becomes the executed program and the matched binary is
handed to it as an argument. For wine or qemu-user that is the point.
For a per-binary loader it is backwards. The interpreter is an
implementation detail of running the binary, yet it owns the entire
process identity:

- argv[0] and /proc/pid/cmdline show the interpreter invocation, not
  what the caller executed.

- /proc/self/exe names the interpreter. Relocatable programs commonly
  locate themselves through it and find the dynamic linker instead.

- A binary passed to execveat() as an inaccessible O_CLOEXEC fd
  cannot run at all as the interpreter has no path to open it by.

- gdb cross-validates AT_ENTRY/AT_PHDR against the exe file and
  discards the load displacement on mismatch leaving PIE symbols
  unrelocated.

This series adds two dispatch modes that close the gap from opposite
ends:

(1) transparent dispatch

    Registered with the 'T' flag or chosen per exec with
    BPF_BINPRM_TRANSPARENT. The binary is sent to the interpreter through
    AT_EXECFD, the argument vector stays exactly as the caller built it,
    and the kernel labels mm->exe_file and comm with the binary. A new
    AT_FLAGS_TRANSPARENT_INTERP aux vector bit is raised indicating that
    nothing was spliced, argv belongs to the program, and to load it from
    the descriptor.

    The interpreter keeps control of mapping the binary, so the mode
    covers foreign architectures and non-ELF payloads.

    The exe label is not a new privilege. It names precisely the file the
    caller passed to execve(), not a file of the process's choosing. That
    file is permission-checked, write-denied while the process runs and
    recorded by audit. Credential derivation does not change exactly as
    today.

(2) loader substitution

    The kernel executes the matched binary natively as the main image
    and substitutes the registered interpreter for the binary's
    PT_INTERP. binfmt_misc functions as a PT_INTERP override. There is
    no contract and no identity to reconstruct. So a stock dynamic
    loader works unchanged. Hence, 'L' is for native-arch ELF with
    PT_INTERP.

The two modes compose. A bpf handler reads the ELF header from bprm->buf
and grades per binary, picking 'L' where it applies and 'T' or classic
dispatch for the rest. If userspace control over relocation is wanted
'T' is the way to go.

* patches from https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.org: (21 commits)
  binfmt_misc: document loader substitution
  selftests/exec: test binfmt_misc loader substitution
  binfmt_misc: let a bpf handler request loader substitution
  binfmt_misc: add the 'L' loader substitution flag
  binfmt_elf_fdpic: consume a stashed PT_INTERP substitute
  binfmt_elf: consume a stashed PT_INTERP substitute
  exec: carry a PT_INTERP substitute in struct linux_binprm
  binfmt_misc: document the transparent identity contract
  selftests/exec: test the transparent binfmt_misc mode
  binfmt_misc: let a bpf handler run the interpreter transparently
  binfmt_misc: add a static transparent flag 'T'
  binfmt_misc: add transparent interpreter dispatch
  exec: label mm->exe_file with the binary for a transparent dispatch
  exec: add AT_FLAGS_TRANSPARENT_INTERP
  selftests/exec: convert the binfmt_misc bpf test to the kselftest harness
  exec: release the replaced file with do_close_execat()
  binfmt_misc: split out entry_open_interpreter() and build_interp_argv()
  binfmt_misc: normalize the per-exec invocation flags
  binfmt_misc: table-drive the register string flags
  docs, binfmt_misc: keep general usage out of the handler sections
  ...

Link: https://patch.msgid.link/20260721-work-bpf-binfmt_misc-ptinterp-v2-0-e57866e4ae0f@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>