From nobody Mon Sep 28 04:53:46 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AF353FB067; Wed, 26 Aug 2026 15:56:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787759765; cv=none; b=LVT6iwGtRXDJoPQE9n4cgldpbH8ADOKsULiGqX+Ysm9+uuM6nORWV/qfk0hju9i4yy1/RLK8RE/UtXtzXUrUBHwGksZsr3MriiZJAJKU4yDGVWqS1Kf8dNRcuOQRPMdey+OWCvFj4EFciG+mhxWJXup9nZwbivyZqQHh/SoTByI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787759765; c=relaxed/simple; bh=/DI1LeiV4wOLRgjpw4V8nHUf0uW01ksKySY2chdDeSU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WcCFyux3+6nyS1dJ58bqmLLrUuVX9mZV2gck9CQnHnem6LuEeG1qhMn5cnWJUFWEzooF8vnOcSTzsiH82bqxFrlg18lHAQJ7yxkjbrmSA7irlc4scJPq4ZXoTpYzyHf/PRHZb/SpVd32w+rNiIvp8A0/giq+kPHzgUgVXMe7dFQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aG2+GO6G; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aG2+GO6G" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F3DF1F00A3A; Wed, 26 Aug 2026 15:55:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787759761; bh=Xv6LvbJXor25svpyF1shB5+LUX7dxOQBbe5g57lme0s=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=aG2+GO6GAZcXlhCpgH4qqw7omdbZ3lTajbsgfjPtKnShfu336O/+yok0gpWBwbMyW UnC3yKhfup2dfl8lfHCHm19GXWaVZy3azoYf08PvN+emHgQA68VZmlbExfYvzG4ekO yB1ubax7/mGSYGYh7XcMZqHFdcvDb9Ka7DtDiYl1HMXEsh8yginUNM2seFi/jfnExZ 7k42I0xrAC9bIOd8BJ49XyO5DrZa5syu9TCHEDgn3iFFmDyKa3pXDmiSNUkNu4UJoM kUuQEOZyLKlJSMPF63ra2VbzjCIRXHlhL0QFhj6CKWD5OyK1lW4h7TEsF5DE3f6A+w 7kQdiwLbw+CMQ== From: Christian Brauner Date: Wed, 26 Aug 2026 17:55:46 +0200 Subject: [PATCH 1/3] binfmt_misc: only let punctuation delimit a register string Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260826-work-binfmt_misc-delim-v1-1-43618adf8599@kernel.org> References: <20260826-work-binfmt_misc-delim-v1-0-43618adf8599@kernel.org> In-Reply-To: <20260826-work-binfmt_misc-delim-v1-0-43618adf8599@kernel.org> To: linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Jan Kara , Kees Cook , linux-mm@kvack.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-doc@vger.kernel.org, Farid Zakaria , "Christian Brauner (Amutable)" X-Mailer: b4 0.17-dev-362b8 X-Developer-Signature: v=1; a=openpgp-sha256; l=1730; i=brauner@kernel.org; h=from:subject:message-id; bh=/DI1LeiV4wOLRgjpw4V8nHUf0uW01ksKySY2chdDeSU=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWT183Qz6cbvOhpjcTr2U+iqQ49fPVTbfn5tje3Mt9t/r rkoOeHixI5SFgYxLgZZMUUWh3aTcLnlPBWbjTI1YOawMoEMYeDiFICJsOkyMkzVKO9/Z66x/tG9 n8vYinpqf/s85Ft4z/Drr7KZE0WOGl1kZLgotkVbfnXS9FDJX/cXL1pcsXyFxu6F6z6/z+bsteP teswNAA== X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Currently we accept arbitrary delimiters which really makes no sense and from looking around it's an unused feature. Everytime we add a flag the number of possible delimiter shrinks and it makes extensions much more hazardous than they need to be. Stop it and only accept punctional as delimiters. This extends commit 8e85d50ba111 ("binfmt_misc: reject a flag character as the field delimiter"). Letters, digits, whitespace, control characters, bytes above 0x7f and the backslash now get -EINVAL. Everything deployed uses ':' anyway. Suggested-by: Farid Zakaria Signed-off-by: Christian Brauner (Amutable) Reviewed-by: Farid Zakaria --- fs/binfmt_misc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index ddfd3aa57ac8..809c91d21b39 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -100,6 +100,13 @@ static const struct binfmt_misc_flag *misc_flag_by_cha= r(const char c) return NULL; } =20 +static bool misc_valid_delim(const char c) +{ + if (!isascii(c) || !ispunct(c)) + return false; + return c !=3D '\\'; +} + struct binfmt_misc_entry { struct hlist_node node; unsigned long flags; /* type, status, etc. */ @@ -872,10 +879,9 @@ static struct binfmt_misc_entry *create_entry(const ch= ar __user *buffer, =20 del =3D *p++; /* delimiter */ =20 - pr_debug("register: delim: %#x {%c}\n", del, del); + pr_debug("register: delim: %#x\n", del); =20 - /* A flag-char delimiter runs the flag scan off the buffer. */ - if (misc_flag_by_char(del)) + if (!misc_valid_delim(del)) return ERR_PTR(-EINVAL); =20 /* Pad the buffer with the delim to simplify parsing below. */ --=20 2.53.0 From nobody Mon Sep 28 04:53:46 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16F3E3FBB5A; Wed, 26 Aug 2026 15:56:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787759766; cv=none; b=dXTQyv3op2POlJdgdB6fi75S6vuROgNjQthiUUlrh8G1gbjHcF+JV4G3BApSPIIIzIcoFol66GjlB4eUj/puMkdy0cyF2jD+p/oMfh4XMdK92FisMFX/MWBDi5zseAmUkRXAqdwkCyGEB/e50us6vub/0WjJBWOHM5MHW9Jr1Yo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787759766; c=relaxed/simple; bh=653qz3nDY95B3k6oyXltdsVnQQkTWcEE8ubSGxx0fbo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=CMiiwcTRy3rElDULXI/0Wl2yv0pc9xb5S+swCZFfkwIr/H/OJRa6erHptm9h+V+PyF0D5SHENNfpBL20LC+8WNNm5m0CHw2FC9132cPOyvHwtJhRO1tmNNMCnNVRx+iAzvNEcoEmsJf0NbGu3esjvVKwaLQ+fYTIO0bL2Pm1vUY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NpNbeG7Q; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NpNbeG7Q" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 620831F000E9; Wed, 26 Aug 2026 15:56:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787759764; bh=7AJOXS7+FmhIjs+QHaVJiOWkg62Yl8bLA9jCz7ES/Zg=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=NpNbeG7QIzDMh6RL6aLU7mL5L8eblE+RXsu59K3or1cIT0ZfKd6YOIDldAxxy6PsE EKZ0/lzI5WH+IZz6S0byhCGimtJ3IlkiBMDu5AMkI9YcIhc4AIK/OYehGL2njx790N FOk1APnd++One2KJ3LZs1dJGUDj1U7eF/a0MeAz/hHa0uqe3oGVF367wiTZpDwupia 479kDzuC33TyZz+o9T+67z/py39Ob7GIS7CaTVuWlGk8SO/Ixn8WObgJ6MCU7m0JXY 0L5Rbs52IrXmUWlxZSX0rhNoDsqpg2eGreTy7U9pOfS2ddDFHkZD4YC1sQ0s+3hdmP XRPJqbdPBUD/w== From: Christian Brauner Date: Wed, 26 Aug 2026 17:55:47 +0200 Subject: [PATCH 2/3] selftests/exec: test delimiter restrictions Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260826-work-binfmt_misc-delim-v1-2-43618adf8599@kernel.org> References: <20260826-work-binfmt_misc-delim-v1-0-43618adf8599@kernel.org> In-Reply-To: <20260826-work-binfmt_misc-delim-v1-0-43618adf8599@kernel.org> To: linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Jan Kara , Kees Cook , linux-mm@kvack.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-doc@vger.kernel.org, Farid Zakaria , "Christian Brauner (Amutable)" X-Mailer: b4 0.17-dev-362b8 X-Developer-Signature: v=1; a=openpgp-sha256; l=4526; i=brauner@kernel.org; h=from:subject:message-id; bh=653qz3nDY95B3k6oyXltdsVnQQkTWcEE8ubSGxx0fbo=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWT183RnqfOu+t3y0NQ09cTdpOdv9ixyur1gv9XrmKMHt 775dbrtT0cpC4MYF4OsmCKLQ7tJuNxynorNRpkaMHNYmUCGMHBxCsBEousY/ju+ZDrk1WCvmp42 6xXbpikMBZ9yPEI+PnQ9t2KRxaZYx8eMDBvqXbqXrGSVy55oudc2vvvm4xtJl5peJ638f+Hr/wu PJBkB X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Test that the new delimiter restrictions work. Signed-off-by: Christian Brauner (Amutable) --- tools/testing/selftests/exec/Makefile | 4 + tools/testing/selftests/exec/binfmt_misc_delim.c | 127 +++++++++++++++++++= ++++ 2 files changed, 131 insertions(+) diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftest= s/exec/Makefile index b640af8f02b5..2220ed345e92 100644 --- a/tools/testing/selftests/exec/Makefile +++ b/tools/testing/selftests/exec/Makefile @@ -45,6 +45,10 @@ TEST_GEN_FILES +=3D binfmt_transparent_interp TEST_GEN_PROGS +=3D binfmt_misc_loader TEST_GEN_FILES +=3D binfmt_loader_payload binfmt_loader_payload_static =20 +# Only ASCII punctuation delimits the fields of a register string, so a new +# flag character cannot change which strings register. No bpf toolchain. +TEST_GEN_PROGS +=3D binfmt_misc_delim + # binfmt_misc bpf-backed ('B') handler test: a libbpf harness plus its # struct_ops objects and the test interpreter/app it routes between. Only # built when clang, bpftool, the vmlinux BTF and libbpf are all present diff --git a/tools/testing/selftests/exec/binfmt_misc_delim.c b/tools/testi= ng/selftests/exec/binfmt_misc_delim.c new file mode 100644 index 000000000000..ffc17cb78545 --- /dev/null +++ b/tools/testing/selftests/exec/binfmt_misc_delim.c @@ -0,0 +1,127 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Test which characters may delimit the fields of a register string. + */ +#define _GNU_SOURCE +#include +#include + +#include "binfmt_misc_common.h" +#include "kselftest_harness.h" + +#define ENTRY "bmdelim" +/* Shares no character with the sets below, or a refusal proves nothing. */ +#define MAGIC "bmmagic" +#define INTERP "/bin/true" + +/* + * ASCII punctuation without '\' and '/'. The backslash is refused because + * it would cut a magic that uses \x to escape short. '/' is accepted + * but cannot delimit a rule that names an absolute interpreter. + */ +#define PUNCTUATION "!\"#$%&'()*+,-.:;<=3D>?@[]^_`{|}~" + +/* 'M', 'E' and 'B' name types, 'P' through 'D' are the flags. */ +#define LETTERS "MEBPOCFTLDqz" +#define DIGITS "0157" +#define WHITESPACE " \t\n" +#define CONTROL "\001\033\177" +#define NON_ASCII "\200\244\377" + +/* ':bmdelim:E::bmmagic::/bin/true:' with @del in place of every ':'. */ +static int register_with(char del) +{ + char rule[128]; + + snprintf(rule, sizeof(rule), "%c%s%cE%c%c%s%c%c%s%c", del, ENTRY, del, + del, del, MAGIC, del, del, INTERP, del); + return write_reg(rule); +} + +/* No character of @set may delimit a register string. */ +static void expect_refused(struct __test_metadata *_metadata, const char *= set) +{ + const char *d; + + for (d =3D set; *d; d++) { + int rc =3D register_with(*d); + + EXPECT_EQ(rc, -1) + TH_LOG("%#x delimited a register string", + (unsigned char)*d); + if (rc =3D=3D 0) { + unregister(ENTRY); + continue; + } + EXPECT_EQ(errno, EINVAL); + } +} + +FIXTURE(delim) { +}; + +FIXTURE_SETUP(delim) +{ + if (getuid() !=3D 0) + SKIP(return, "test must be run as root"); + if (!binfmt_misc_available()) + SKIP(return, "no binfmt_misc"); + + /* A kernel without the allow-list takes any character but a flag. */ + if (register_with('q') =3D=3D 0) { + unregister(ENTRY); + SKIP(return, "kernel without the delimiter allow-list"); + } +} + +FIXTURE_TEARDOWN(delim) +{ + unregister(ENTRY); +} + +/* Punctuation delimits, which is all anything deployed ever uses. */ +TEST_F(delim, punctuation_accepted) +{ + const char *d; + + for (d =3D PUNCTUATION; *d; d++) { + EXPECT_EQ(register_with(*d), 0) + TH_LOG("'%c' refused with errno %d", *d, errno); + unregister(ENTRY); + } +} + +/* Letters name the types and the flags, so none of them can delimit. */ +TEST_F(delim, letters_refused) +{ + expect_refused(_metadata, LETTERS); +} + +/* The offset field is written in digits. */ +TEST_F(delim, digits_refused) +{ + expect_refused(_metadata, DIGITS); +} + +TEST_F(delim, whitespace_refused) +{ + expect_refused(_metadata, WHITESPACE); +} + +TEST_F(delim, control_refused) +{ + expect_refused(_metadata, CONTROL); +} + +TEST_F(delim, non_ascii_refused) +{ + expect_refused(_metadata, NON_ASCII); +} + +/* The escape character would cut every magic that uses one short. */ +TEST_F(delim, backslash_refused) +{ + expect_refused(_metadata, "\\"); +} + +TEST_HARNESS_MAIN --=20 2.53.0 From nobody Mon Sep 28 04:53:46 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05B7B44C646; Wed, 26 Aug 2026 15:56:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787759769; cv=none; b=RWmlvsE3Tl6W+9MoRO4zAPxUgXDSwVF5c7cK1bMOx9gnF7Ucp218GUYfCWfVHtl2ioxY9e4791VL+sKZjcVo3JfnVj3kIlq922gobu/6i21mKtNU6QRkeUiphkizlzZi4kdFuhIQxWiLazsvmexH3IFVqyfMxrghZEU+Pb5BSdc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787759769; c=relaxed/simple; bh=PndQPAXcBeOaQi7lJUgei03fmhGSoQt6dZRbXT9rno4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=nJhu84GZ9+ONUxGy054z0huWgHlhuIDOiBthzZDwffGl6JrwhyvLC1t24aZy5dGz3q+y9B6G6WbOt01MIZizfaLhpIh7lV1zs7VEbjcLs+B1uWOT929QuWpatpEtPNxzVbNv3GNSyhnMnLsoLKAmnFNchjjhZB28G05bxv7t6oA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VylVp4aL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VylVp4aL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37A821F00A3D; Wed, 26 Aug 2026 15:56:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787759767; bh=NKxxVO9WHJPVfrvijFU6xCamxUW5/MUbTlElGx2vOjw=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=VylVp4aLzoj6h2ekemVf7MQp3OCAp7cDjz3M/q4OACcXKDRYDvy3YTMSXZedvDHdk Vj8aZNPn407fWGqDPrwGM3nrGyZi6UHLYS6F4M9SVn5fU3VuUQARqvk3l7Tu98y8X2 lWW4duh0K9e3dGo6vWEf/UN18MnESm/QDHE+CxpinZAh66x7MXKkah1PNv6fYLwyVX Y/ghYYGhs+h/T+iVQoa9kiPdH9Ed97Q/eXh7k0OYFBhNb6CExRCy1aZ+0KTIl9ayZy k69T7XjFVLHsN/vGElXQZgh6a6Rdh5nSSRkzAhimlSvxOG1sLMhdt/kJQ9bxxAZTuV YaVDmFik2x6zg== From: Christian Brauner Date: Wed, 26 Aug 2026 17:55:48 +0200 Subject: [PATCH 3/3] binfmt_misc: document the field delimiter Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260826-work-binfmt_misc-delim-v1-3-43618adf8599@kernel.org> References: <20260826-work-binfmt_misc-delim-v1-0-43618adf8599@kernel.org> In-Reply-To: <20260826-work-binfmt_misc-delim-v1-0-43618adf8599@kernel.org> To: linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Jan Kara , Kees Cook , linux-mm@kvack.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-doc@vger.kernel.org, Farid Zakaria , "Christian Brauner (Amutable)" X-Mailer: b4 0.17-dev-362b8 X-Developer-Signature: v=1; a=openpgp-sha256; l=894; i=brauner@kernel.org; h=from:subject:message-id; bh=PndQPAXcBeOaQi7lJUgei03fmhGSoQt6dZRbXT9rno4=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWT183RbnOWo0riQGX/MUCv02qU6Zu/ZgWYdP2tn9yraz l7hq3ymo5SFQYyLQVZMkcWh3SRcbjlPxWajTA2YOaxMIEMYuDgFYCKr0hn+Vz/gnMhrvWk933OR GRZCL/TE+6UyHM17XXJm6k86cLs5nuF/cHefEaPzp6/5U3OYF51m/JO+5rPMhDCOOjavLkm+8zu 5AA== X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Document the field delimiter. Signed-off-by: Christian Brauner (Amutable) Reviewed-by: Farid Zakaria --- Documentation/admin-guide/binfmt-misc.rst | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Documentation/admin-guide/binfmt-misc.rst b/Documentation/admi= n-guide/binfmt-misc.rst index d26b63a27c25..9e84b877d06d 100644 --- a/Documentation/admin-guide/binfmt-misc.rst +++ b/Documentation/admin-guide/binfmt-misc.rst @@ -19,6 +19,9 @@ To actually register a new binary type, you have to set u= p a string looking like ``:name:type:offset:magic:mask:interpreter:flags`` (where you can choose t= he ``:`` upon your needs) and echo it to ``/proc/sys/fs/binfmt_misc/register`= `. =20 +The first character of the string is its field delimiter and can be any +ASCII punctuation character other than the backslash ``\``. + Here is what the fields mean: =20 - ``name`` --=20 2.53.0