Re: [RFC PATCH v2] binfmt_misc: add binfmt_misc_select tracepoint

[Christian Brauner]

On Thu, Oct 29, 2026 at 09:58:49PM +0300, Eneshan Karaca wrote:
> From: Eneshan Erdoğan Karaca <BoxStrikesTeam@xxxxxxxxx>
> 
> A binfmt_misc entry can select an interpreter for an exec.  With a BPF
> 'B' handler, that selection can be made by a BPF struct_ops program.
> The kernel commits the decision in bprm->interp and bprm->flags, but it
> does not emit an event at the selection point.
> 
> Existing observers have to reconstruct the decision from
> /proc/PID/exe, AT_EXECFD, AT_FLAGS, or /proc/PID/maps.  These sources
> are mode-dependent: a transparent dispatch still reports the original
> binary in /proc/PID/exe, and a short-lived process can exit before the
> observer reads it.  A classic dispatch reports the interpreter, but
> not which handler selected it or which invocation flags were used.
> 
> Add a tracepoint after the interpreter and the invocation flags are
> selected.  The caller passes the matched entry and the raw flags; the
> trace event resolves the handler name and masks the flags with
> MISC_FMT_INVOCATION_FLAGS.  The event reports the binary filename, the
> selected interpreter, the handler name, the invocation flags, and the
> pid.
> 
> The tracepoint is observability only; it does not change exec
> behavior.
> 
> Assisted-by: LLM
> Signed-off-by: Eneshan Erdoğan Karaca <BoxStrikesTeam@xxxxxxxxx>
> ---

This is whitespace damaged. So Sashiko can't look at it.
Resend it properly, please.