Re: [RFC PATCH] fs: introduce pluggable ELF interpreter loader registry

From: Christian Brauner

Date: Sat Jul 04 2026 - 04:15:57 EST

On 2026-07-03 11:32 -0700, Farid Zakaria wrote:
> On Fri, Jul 3, 2026 at 2:22 AM Christian Brauner <brauner@xxxxxxxxxx> wrote:
> >
> > > Introduce a pluggable framework for ELF binary loading to allow dynamic
> > > resolution and redirection of program interpreters (PT_INTERP). This is
> > > primarily designed to support hermetic path resolution like NixOS $ORIGIN
> > > relative dynamic linkers without bloating the core ELF loader or compromising
> > > system execution security.
> > >
> > > Introduce a new registration interface for kernel modules to register
> > > open_interpreter callbacks. Standard ELF loading queries this registry; if a
> > > plugin resolves a custom segment type (like PT_INTERP_NIX), it returns a file
> > > descriptor for the resolved interpreter. Secure execution environments
> > > (bprm->secureexec) bypass relative resolution for safety.
> > >
> > > Signed-off-by: Farid Zakaria <farid.m.zakaria@xxxxxxxxx>
> > >
> > > diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
> > > index 1949e25c7741..ef4277fd8050 100644
> > > --- a/fs/Kconfig.binfmt
> > > +++ b/fs/Kconfig.binfmt
> > > @@ -38,6 +38,21 @@ config BINFMT_ELF_KUNIT_TEST
> > > only needed for debugging. Note that with CONFIG_COMPAT=y, the
> > > compat_binfmt_elf KUnit test is also created.
> > >
> > > +config BINFMT_ELF_PLUGINS
> > > + bool "Enable plugin support for ELF interpreter loading"
> > > + depends on BINFMT_ELF
> > > + help
> > > + This option allows kernel modules to register handlers to dynamically
> > > + resolve and override the ELF program interpreter (e.g. supporting relative
> > > + interpreter paths with $ORIGIN).
> > > +
> > > +config BINFMT_ELF_NIX
> > > + tristate "ELF interpreter plugin for NixOS ($ORIGIN support)"
> > > + depends on BINFMT_ELF_PLUGINS
> > > + help
> > > + This builds the NixOS ELF interpreter plugin. It intercepts PT_INTERP_NIX
> > > + headers to resolve relative and $ORIGIN interpreter paths.
> > > +
> > > config COMPAT_BINFMT_ELF
> > > def_bool y
> > > depends on COMPAT && BINFMT_ELF
> > > diff --git a/fs/Makefile b/fs/Makefile
> > > index 89a8a9d207d1..bd81e7ff64f3 100644
> > > --- a/fs/Makefile
> > > +++ b/fs/Makefile
> > > @@ -35,6 +35,7 @@ obj-$(CONFIG_FILE_LOCKING) += locks.o
> > > obj-$(CONFIG_BINFMT_MISC) += binfmt_misc.o
> > > obj-$(CONFIG_BINFMT_SCRIPT) += binfmt_script.o
> > > obj-$(CONFIG_BINFMT_ELF) += binfmt_elf.o
> > > +obj-$(CONFIG_BINFMT_ELF_NIX) += binfmt_elf_nix.o
> > > obj-$(CONFIG_COMPAT_BINFMT_ELF) += compat_binfmt_elf.o
> > > obj-$(CONFIG_BINFMT_ELF_FDPIC) += binfmt_elf_fdpic.o
> > > obj-$(CONFIG_BINFMT_FLAT) += binfmt_flat.o
> > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > > index 16a56b6b3f6c..53fa2681555a 100644
> > > --- a/fs/binfmt_elf.c
> > > +++ b/fs/binfmt_elf.c
> > > @@ -35,6 +35,7 @@
> > > #include <linux/random.h>
> > > #include <linux/elf.h>
> > > #include <linux/elf-randomize.h>
> > > +#include <linux/elf_plugins.h>
> > > #include <linux/utsname.h>
> > > #include <linux/coredump.h>
> > > #include <linux/sched.h>
> > > @@ -870,6 +871,12 @@ static int load_elf_binary(struct linux_binprm *bprm)
> > > if (!elf_phdata)
> > > goto out;
> > >
> > > + interpreter = elf_plugin_open_interpreter(bprm, elf_ex, elf_phdata);
> > > + if (IS_ERR(interpreter)) {
> > > + retval = PTR_ERR(interpreter);
> > > + goto out_free_ph;
> > > + }
> > > +
> > > elf_ppnt = elf_phdata;
> > > for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) {
> > > char *elf_interpreter;
> > > @@ -882,6 +889,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
> > > if (elf_ppnt->p_type != PT_INTERP)
> > > continue;
> > >
> > > + if (interpreter)
> > > + continue;
> > > +
> >
> >
> > > /*
> > > * This is the program interpreter used for shared libraries -
> > > * for now assume that this is an a.out format binary.
> > > @@ -935,6 +945,20 @@ static int load_elf_binary(struct linux_binprm *bprm)
> > > goto out_free_ph;
> > > }
> > >
> > > + if (interpreter && !interp_elf_ex) {
> > > + interp_elf_ex = kmalloc_obj(*interp_elf_ex);
> > > + if (!interp_elf_ex) {
> > > + retval = -ENOMEM;
> > > + goto out_free_file;
> > > + }
> > > +
> > > + /* Get the exec headers */
> > > + retval = elf_read(interpreter, interp_elf_ex,
> > > + sizeof(*interp_elf_ex), 0);
> > > + if (retval < 0)
> > > + goto out_free_dentry;
> > > + }
> > > +
> > > elf_ppnt = elf_phdata;
> > > for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++)
> > > switch (elf_ppnt->p_type) {
> > > diff --git a/fs/binfmt_elf_nix.c b/fs/binfmt_elf_nix.c
> > > new file mode 100644
> > > index 000000000000..d28b92c30939
> > > --- /dev/null
> > > +++ b/fs/binfmt_elf_nix.c
> > > @@ -0,0 +1,108 @@
> > > +// SPDX-License-Identifier: GPL-2.0-only
> > > +#include <linux/module.h>
> > > +#include <linux/kernel.h>
> > > +#include <linux/init.h>
> > > +#include <linux/fs.h>
> > > +#include <linux/path.h>
> > > +#include <linux/namei.h>
> > > +#include <linux/elf.h>
> > > +#include <linux/elf_plugins.h>
> > > +#include <linux/slab.h>
> > > +
> > > +MODULE_DESCRIPTION("ELF Interpreter plugin for NixOS / $ORIGIN");
> > > +MODULE_AUTHOR("Farid Zakaria");
> > > +MODULE_LICENSE("GPL");
> > > +
> > > +/* Mnemonic value for NixOS-specific program interpreter: 'N', 'I', 'X', 3 */
> > > +#define PT_INTERP_NIX (PT_LOOS + 0x4e49583)
> > > +
> > > +static struct file *nix_open_interpreter(struct linux_binprm *bprm,
> > > + struct elfhdr *elf_ex,
> > > + struct elf_phdr *elf_phdata)
> > > +{
> > > + struct elf_phdr *elf_ppnt;
> > > + struct file *interpreter = NULL;
> > > + char *elf_interpreter = NULL;
> > > + int i, retval;
> > > +
> > > + /* Find the custom Nix interpreter header */
> > > + elf_ppnt = elf_phdata;
> > > + for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) {
> > > + if (elf_ppnt->p_type == PT_INTERP_NIX)
> > > + break;
> > > + }
> >
> >
> > > +
> > > + if (i == elf_ex->e_phnum)
> > > + return NULL; /* Segment not present; fall back to others */
> > > +
> > > + /* Security check: refuse relative interp resolution on secure execution */
> > > + if (bprm->secureexec) {
> > > + pr_warn_once("binfmt_elf_nix: secureexec active, refusing custom interpreter lookup\n");
> > > + return NULL; /* Fallback to standard PT_INTERP */
> > > + }
> > > +
> > > + if (elf_ppnt->p_filesz > PATH_MAX || elf_ppnt->p_filesz < 2)
> > > + return ERR_PTR(-ENOEXEC);
> > > +
> > > + elf_interpreter = kmalloc(elf_ppnt->p_filesz, GFP_KERNEL);
> > > + if (!elf_interpreter)
> > > + return ERR_PTR(-ENOMEM);
> > > +
> > > + /* Read the interpreter path from the executable file */
> > > + retval = kernel_read(bprm->file, elf_interpreter, elf_ppnt->p_filesz, &elf_ppnt->p_offset);
> >
> >
> > > + if (retval != elf_ppnt->p_filesz) {
> > > + retval = (retval < 0) ? retval : -EIO;
> > > + goto out_free;
> > > + }
> > > +
> > > + if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') {
> > > + retval = -ENOEXEC;
> > > + goto out_free;
> > > + }
> > > +
> > > + /* Path Resolution: Absolute vs. $ORIGIN */
> > > + if (elf_interpreter[0] == '/') {
> > > + interpreter = open_exec(elf_interpreter);
> > > + } else if (strncmp(elf_interpreter, "$ORIGIN/", 8) == 0 || strncmp(elf_interpreter, "${ORIGIN}/", 10) == 0) {
> > > + const char *rel_path = (elf_interpreter[0] == '$') ? (elf_interpreter + 8) : (elf_interpreter + 10);
> >
> >
> > > + struct path parent_path;
> > > +
> > > + /* Reference parent directory of the executed file safely */
> > > + parent_path.mnt = mntget(bprm->file->f_path.mnt);
> > > + parent_path.dentry = dget_parent(bprm->file->f_path.dentry);
> > > +
> > > + /* Open relative to parent directory */
> > > + interpreter = file_open_root(&parent_path, rel_path, O_RDONLY, 0);
> >
> >
> > > +
> > > + path_put(&parent_path);
> > > + } else {
> > > + /* Naked relative paths are rejected for safety */
> > > + retval = -ENOEXEC;
> > > + goto out_free;
> > > + }
> > > +
> > > + kfree(elf_interpreter);
> > > + return interpreter;
> > > +
> > > +out_free:
> > > + kfree(elf_interpreter);
> > > + return ERR_PTR(retval);
> > > +}
> > > +
> > > +static struct elf_plugin nix_elf_plugin = {
> > > + .owner = THIS_MODULE,
> > > + .open_interpreter = nix_open_interpreter,
> > > +};
> > > +
> > > +static int __init binfmt_elf_nix_init(void)
> > > +{
> > > + return register_elf_plugin(&nix_elf_plugin);
> > > +}
> > > +
> > > +static void __exit binfmt_elf_nix_exit(void)
> > > +{
> > > + unregister_elf_plugin(&nix_elf_plugin);
> > > +}
> > > +
> > > +module_init(binfmt_elf_nix_init);
> > > +module_exit(binfmt_elf_nix_exit);
> > > diff --git a/fs/exec.c b/fs/exec.c
> > > index b92fe7db176c..45813bbce833 100644
> > > --- a/fs/exec.c
> > > +++ b/fs/exec.c
> > > @@ -46,6 +46,7 @@
> > > #include <linux/key.h>
> > > #include <linux/personality.h>
> > > #include <linux/binfmts.h>
> > > +#include <linux/elf_plugins.h>
> > > #include <linux/utsname.h>
> > > #include <linux/pid_namespace.h>
> > > #include <linux/module.h>
> > > @@ -108,6 +109,52 @@ void unregister_binfmt(struct linux_binfmt * fmt)
> > >
> > > EXPORT_SYMBOL(unregister_binfmt);
> > >
> > > +#if IS_ENABLED(CONFIG_BINFMT_ELF_PLUGINS)
> > > +static DEFINE_MUTEX(elf_plugins_lock);
> > > +static LIST_HEAD(elf_plugins);
> > > +
> > > +int register_elf_plugin(struct elf_plugin *plugin)
> > > +{
> > > + mutex_lock(&elf_plugins_lock);
> > > + list_add_tail(&plugin->list, &elf_plugins);
> > > + mutex_unlock(&elf_plugins_lock);
> > > + return 0;
> > > +}
> > > +EXPORT_SYMBOL_GPL(register_elf_plugin);
> > > +
> > > +void unregister_elf_plugin(struct elf_plugin *plugin)
> > > +{
> > > + mutex_lock(&elf_plugins_lock);
> > > + list_del(&plugin->list);
> > > + mutex_unlock(&elf_plugins_lock);
> > > +}
> > > +EXPORT_SYMBOL_GPL(unregister_elf_plugin);
> > > +
> > > +struct file *elf_plugin_open_interpreter(struct linux_binprm *bprm,
> > > + struct elfhdr *elf_ex,
> > > + struct elf_phdr *elf_phdata)
> > > +{
> > > + struct elf_plugin *plugin;
> > > + struct file *file = NULL;
> > > +
> > > + mutex_lock(&elf_plugins_lock);
> > > + list_for_each_entry(plugin, &elf_plugins, list) {
> > > + if (!try_module_get(plugin->owner))
> > > + continue;
> > > + mutex_unlock(&elf_plugins_lock);
> > > +
> > > + file = plugin->open_interpreter(bprm, elf_ex, elf_phdata);
> >
> > I have to say I do not like this at all because it also means you need
> > actual kernel modules for custom binaries. Yeech.
> >
>
> Isn't this already true via binfmt for new binary formats?
> ELF support in binfmt itself is also built-in from what I understand.
>
> Anyway, I'm not too attached to the idea, I'm just trying to
> brainstorm on how to get it done.
>
> > I think you should extend binfmt_misc for that, combining it with bpf.
> > When binfmt_misc selects the interpreter a bpf program is run. That bpf
> > program is passed the necessary information to make a decision. It can
> > check whether it's in the right sandbox. Then checks if the interpreter
> > starts with the magic ORIGIN string or whatever. Once it has determined
> > that a binfmt_misc entry applies things progress as usual. Then you can
> > point binfmt_misc at a static binary that finds the right loader to use.
> >
>
> My audit of this shows it might be doable, but it's definitely
> confusing, and I'm still not clear it solves the problem -- I will
> work through an example on my NixOS machine. I think I can patch
> https://github.com/nix-community/nix-ld to maybe act as this
> trampoline for binfmt_misc to read PT_INTERP_NIX. I will try that and
> respond back if it works conceptually at least to maybe keep the
> discussion moving forward and to explore the space more.
>
> If binfmt_misc has to point to a wrapper binary, that wrapper must
> live at a fixed, hardcoded absolute path.
> I guess we could bootstrap it for NixOS only but one other problem I
> forsee: /proc/self/exe is now something else than expected
>
> The entire goal of relocatability is to allow binaries to run on any
> host machine without relying on global, hardcoded system paths.
> Just to demo how Nix is designed to let you copy code from a machine
> to another with *ideally* no assumptions.
> Here is a simple hello world:
>
> #hello.nix
> with import <nixpkgs> {};
> runCommandCC "hello" {} ''
> mkdir -p $out/bin
> gcc -x c -o $out/bin/hello - <<\INNER_EOF
> #include <stdio.h>
> int main() {
> printf("Hello, World!\n");
> return 0;
> }
> INNER_EOF
> ''
>
> We can then build it:
> > nix build -f hello.nix
>
> My machine uses the default /nix/store prefix, so the interpreter is
> set to there.
> > patchelf --print-interpreter ./result/bin/hello
> /nix/store/7nbi22pcc92y2fqbkyp7h3srvvklmckb-glibc-2.40-224/lib/ld-linux-x86-64.so.2
>
> If I were to use a machine with a different prefix
> /home/fmzakari/.local/nix then I couldn't "substitute" (download from
> the cache), this binary.

This was just an example. The bpf program can calculate a path however
it sees fit including making use of ORIGIN or whatever.