From: Christian Brauner Date: Tue, 14 Jul 2026 19:58:12 +0000 (+0200) Subject: binfmt_misc: let a bpf handler choose the invocation flags per exec X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=186aaff0d12b0e5b8af44cfb439b978e58ed74e4;p=thirdparty%2Flinux.git binfmt_misc: let a bpf handler choose the invocation flags per exec The 'P', 'C' and 'O' flags of a binfmt_misc entry - preserve argv[0], compute credentials from the binary, and pass the binary as an open file descriptor - are fixed at registration and apply to every binary the entry matches. A bpf handler matches, selects the interpreter and reads the binary per exec, so the flags should be its per-exec decision too: one handler may match both setuid and non-setuid binaries, argv[0]-sensitive ones and not. Honor the flags the load program stages in bprm->bpf_flags through the bpf_binprm_set_flags() kfunc: BPF_BINPRM_PRESERVE_ARGV0, BPF_BINPRM_CREDENTIALS and BPF_BINPRM_EXECFD map to 'P', 'C' and 'O' and keep the semantics of their static counterparts, credentials implying the open file descriptor included. Flags staged by a load program that then fails are dropped on the way out so they cannot leak into a later handler's exec, and the argv[0] decision acts on the entry's own choice instead of testing the accumulated bprm->interp_flags bit, which an earlier chain level may have left set and binfmt_misc never clears. Since a 'B' entry's flags come from the program, it carries none in the register string: 'P', 'C' and 'O' are rejected there alongside 'F', which was already meaningless for it. load_misc_binary() takes the flags from the entry for a static handler and from bprm->bpf_flags for a bpf one. Link: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-7-57b7529c002c@kernel.org Signed-off-by: Christian Brauner (Amutable) --- diff --git a/Documentation/admin-guide/binfmt-misc.rst b/Documentation/admin-guide/binfmt-misc.rst index c2c18ca9ff8e..85bbf4845f99 100644 --- a/Documentation/admin-guide/binfmt-misc.rst +++ b/Documentation/admin-guide/binfmt-misc.rst @@ -135,18 +135,29 @@ interpreter and the binary, exactly like the optional argument of a ``#!`` interpreter line, e.g. for a handler that resolves ``$ORIGIN`` in a script's ``#!`` path and needs to preserve the argument that followed it. +The invocation flags a static entry fixes at registration - ``P``, ``C`` +and ``O`` - are per-exec choices for a bpf handler, made by the ``load`` +program with the ``bpf_binprm_set_flags()`` kfunc, so a single handler can +decide them differently for each binary it handles: + +- ``BPF_BINPRM_PRESERVE_ARGV0`` keeps the caller's ``argv[0]`` (the ``P`` + flag). +- ``BPF_BINPRM_CREDENTIALS`` computes credentials from the binary (the ``C`` + flag), bounded to user namespaces that map the binary's owner just like + any other setuid exec. +- ``BPF_BINPRM_EXECFD`` opens the binary on the interpreter's behalf and + passes it through the ``AT_EXECFD`` aux vector entry (the ``O`` flag), so + the interpreter can run binaries it could not open by path. + +Because these are program choices, a ``B`` entry carries no flags in the +register string; ``F`` (pre-open a fixed interpreter) has no meaning for it. + A handler is looked up only in the user namespace the struct_ops map was registered in. Handlers are not inherited, so an entry can only reference a handler registered in the same user namespace as its binfmt_misc instance. The entry keeps the handler alive; deleting the struct_ops map only prevents new activations. -The ``F`` flag cannot be combined with ``B`` entries: it pre-opens a fixed -interpreter at registration time and a ``B`` entry has none. The ``C`` flag -works as it does for a static entry: the interpreter runs with the matched -binary's credentials, bounded to user namespaces that map the binary's owner -just like any other setuid exec. - To use binfmt_misc you have to mount it first. You can mount it with ``mount -t binfmt_misc none /proc/sys/fs/binfmt_misc`` command, or you can add a line ``none /proc/sys/fs/binfmt_misc binfmt_misc defaults 0 0`` to your diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index 507f833a3179..c3064f2557ca 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -284,6 +284,7 @@ drop_staged: /* A failing load leaves nothing behind for later entries. */ kfree(bprm->bpf_interp_arg); bprm->bpf_interp_arg = NULL; + bprm->bpf_flags = 0; return ERR_PTR(retval); } @@ -296,6 +297,7 @@ static int load_misc_binary(struct linux_binprm *bprm) const char *interpreter; struct file *interp_file; struct binfmt_misc *misc; + bool preserve_argv0, want_execfd, want_creds; int retval; misc = current_binfmt_misc(); @@ -314,7 +316,28 @@ static int load_misc_binary(struct linux_binprm *bprm) if (IS_ERR(interpreter)) return PTR_ERR(interpreter); - if (fmt->flags & MISC_FMT_PRESERVE_ARGV0) { + /* + * The invocation flags are fixed at registration for a static handler + * and chosen per exec by the load program, via bpf_binprm_set_flags(), + * for a bpf one. + */ + if (test_bit(MISC_FMT_BPF_BIT, &fmt->flags)) { + u64 f = bprm->bpf_flags; + + /* Clear so it can't accumulate into a nested interpreter level. */ + bprm->bpf_flags = 0; + + preserve_argv0 = f & BPF_BINPRM_PRESERVE_ARGV0; + want_creds = f & BPF_BINPRM_CREDENTIALS; + want_execfd = f & (BPF_BINPRM_CREDENTIALS | BPF_BINPRM_EXECFD); + } else { + preserve_argv0 = fmt->flags & MISC_FMT_PRESERVE_ARGV0; + want_creds = fmt->flags & MISC_FMT_CREDENTIALS; + want_execfd = fmt->flags & MISC_FMT_OPEN_BINARY; + } + + /* The entry's own choice - not one accumulated from an earlier level. */ + if (preserve_argv0) { bprm->interp_flags |= BINPRM_FLAGS_PRESERVE_ARGV0; } else { retval = remove_arg_zero(bprm); @@ -370,9 +393,9 @@ static int load_misc_binary(struct linux_binprm *bprm) return PTR_ERR(interp_file); bprm->interpreter = interp_file; - if (fmt->flags & MISC_FMT_OPEN_BINARY) + if (want_execfd) bprm->have_execfd = 1; - if (fmt->flags & MISC_FMT_CREDENTIALS) + if (want_creds) bprm->execfd_creds = 1; return 0; } @@ -650,14 +673,14 @@ static struct binfmt_misc_entry *create_entry(const char __user *buffer, return ERR_PTR(-EINVAL); /* - * 'F' pre-opens a fixed interpreter at registration time which is - * meaningless for a per-exec computed path. 'C' is fine: it honors the - * suid bits of the matched binary exactly like a static entry, gated by - * the same vfsuid_has_mapping() check in bprm_fill_uid() that keeps the - * transition to uids mapped in the caller's user namespace. + * A bpf handler decides the invocation flags per exec with + * bpf_binprm_set_flags() rather than fixing them at registration, so a + * 'B' entry carries no flags: 'P', 'C' and 'O' become per-exec choices + * and 'F' (pre-open a fixed interpreter) is meaningless for it. */ if (test_bit(MISC_FMT_BPF_BIT, &e->flags) && - (e->flags & MISC_FMT_OPEN_FILE)) + (e->flags & (MISC_FMT_PRESERVE_ARGV0 | MISC_FMT_OPEN_BINARY | + MISC_FMT_CREDENTIALS | MISC_FMT_OPEN_FILE))) return ERR_PTR(-EINVAL); return no_free_ptr(e);