mirror of
https://github.com/linux-msm/laptops-kernel.git
synced 2026-08-13 14:19:53 -07:00
Christian Brauner
935a213f14
One handler, one entry registered disabled, an interpreter per guest architecture bound to a file one write at a time. The load program picks one by name per exec: - an aarch64 binary runs the interpreter bound as "first" and a riscv one the interpreter bound as "second", from a single entry and a single handler - unlinking a bound interpreter and putting a different binary in its place changes nothing, which is what the binding exists for - the entry reports what it bound, under the names it bound them as - a name the entry did not bind fails the exec with -ENOENT rather than falling back to anything - activating the entry refuses further binding with -EBUSY, a later disable does not undo that, and an entry registered without 'D' never accepted a '+' write to begin with - a name binds one interpreter, and control characters are refused - the command has to end at the write, bytes past an embedded nul are refused - an entry binds at most 100 interpreters, the next one is refused with -ENOSPC The test interpreter prints its argv[0], which is the path the kernel ran that copy under, so one binary installed at two paths tells the harness which of them the program picked. Link: https://patch.msgid.link/20260730-work-binfmt_misc-preopen-v1-8-4a0b0da71f16@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
77 lines
2.3 KiB
C
77 lines
2.3 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* binfmt_misc_ops handler for the selftest's bound-interpreter case: one
|
|
* handler, one entry, an interpreter per guest architecture - each bound to
|
|
* a file when the entry was registered rather than to a path resolved at
|
|
* exec time. The load program names the one it wants; a name the entry did
|
|
* not bind fails the exec, which the harness checks too.
|
|
*/
|
|
#include "vmlinux.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
#define EI_CLASS 4
|
|
#define ELFCLASS64 2
|
|
#define E_MACHINE_OFF 18
|
|
#define EM_ARM 40
|
|
#define EM_AARCH64 183
|
|
#define EM_RISCV 243
|
|
|
|
extern int bpf_binprm_select_interp(struct linux_binprm *bprm,
|
|
const char *name, size_t name__sz) __ksym;
|
|
|
|
/* The guest architecture of a 64-bit ELF, or zero if it is not one. */
|
|
static __u16 elf_machine(struct linux_binprm *bprm)
|
|
{
|
|
if (bprm->buf[0] != 0x7f || bprm->buf[1] != 'E' ||
|
|
bprm->buf[2] != 'L' || bprm->buf[3] != 'F' ||
|
|
bprm->buf[EI_CLASS] != ELFCLASS64)
|
|
return 0;
|
|
|
|
/* Little-endian 16-bit field, read byte-wise for the verifier. */
|
|
return (__u8)bprm->buf[E_MACHINE_OFF] |
|
|
((__u16)(__u8)bprm->buf[E_MACHINE_OFF + 1] << 8);
|
|
}
|
|
|
|
SEC("struct_ops.s/match")
|
|
bool BPF_PROG(interp_bind_match, struct linux_binprm *bprm)
|
|
{
|
|
__u16 machine = elf_machine(bprm);
|
|
|
|
return machine == EM_AARCH64 || machine == EM_RISCV ||
|
|
machine == EM_ARM;
|
|
}
|
|
|
|
SEC("struct_ops.s/load")
|
|
int BPF_PROG(interp_bind_load, struct linux_binprm *bprm)
|
|
{
|
|
/*
|
|
* Names, not paths: each one selects a file the entry pre-opened, so
|
|
* nothing is resolved here or later, in any namespace. The buffers
|
|
* are on the stack because the verifier rejects .rodata for a sized
|
|
* memory argument.
|
|
*/
|
|
char first[] = "first";
|
|
char second[] = "second";
|
|
char unbound[] = "unbound";
|
|
|
|
switch (elf_machine(bprm)) {
|
|
case EM_AARCH64:
|
|
return bpf_binprm_select_interp(bprm, first, sizeof(first));
|
|
case EM_RISCV:
|
|
return bpf_binprm_select_interp(bprm, second, sizeof(second));
|
|
}
|
|
|
|
/* The entry bound nothing under this name: -ENOENT fails the exec. */
|
|
return bpf_binprm_select_interp(bprm, unbound, sizeof(unbound));
|
|
}
|
|
|
|
SEC(".struct_ops.link")
|
|
struct binfmt_misc_ops interp_bind = {
|
|
.match = (void *)interp_bind_match,
|
|
.load = (void *)interp_bind_load,
|
|
.name = "interp_bind",
|
|
};
|