bpf_binprm_set_flags(9)

💅 bpf_binprm_set_flags(9) — the Kernel API Manual page, bestie edition 🎀

okay so this is bpf_binprm_set_flags(9) from the Kernel API Manual, and it's literally the little function that picks which interpreter invocation flags your exec gets. let's get into it ✨

---

✨ NAME ✨

bpf_binprm_set_flags — choose the interpreter invocation flags for this exec 🦋

---

🌸 SYNOPSIS 🌸

__bpf_kfunc int bpf_binprm_set_flags (struct linux_binprm *bprm , enum
       bpf_binprm_flags flags );

like, that's the whole signature, no cap 💅

---

🎀 ARGUMENTS 🎀

• bprm — the binary that is being executed 🫶
• flags — an OR of enum bpf_binprm_flags values, so you can stack 'em ⭐

---

🧚 DESCRIPTION 🧚

okay so first thing: this is to be called from the load program of a struct binfmt_misc_ops handler. that's the vibe. 👑

it decides per exec what a static entry fixes at registration with the P, C, O, T and L flags. iconic behaviour honestly.

here's what each flag is giving:

• BPF_BINPRM_PRESERVE_ARGV0 — keeps the caller's argv[0] 💖
• BPF_BINPRM_CREDENTIALS — computes credentials from the binary 🔥
• BPF_BINPRM_EXECFD — hands the binary to the interpreter through AT_EXECFD 🌈
• BPF_BINPRM_TRANSPARENT — additionally leaves the argument vector untouched, making the exec look like a direct execution of the binary ✨
• BPF_BINPRM_LOADER — substitutes the interpreter for the binary's PT_INTERP and runs the binary as a native exec; it excludes every other flag 💀

and some housekeeping notes that matter:

calling it again replaces the flags — it does not add to them 🫶

passing zero clears them again, back to nothing, clean slate 🧼

---

⭐ RETURN ⭐

• 0 on success 🎉
• -EINVAL if flags contains an unknown bit or an invalid combination 😭

---

🦋 SEE ALSO 🦋

• Kernel file ./fs/binfmt_misc_bpf.c
• binfmt_misc_get_ops(9)
• bpf_binprm_set_interp(9)
• bpf_binprm_select_interp(9)
• bpf_binprm_set_interp_arg(9)

like, go read those next, they're all part of the same little friend group 💅👑

---

and that's the page bestie!! 🌸 mwah 💜

from ./fs, dated October 2026 — page bpf_binprm_set_flags(9), out 🫡✨ no cap, read the flags before you ship it 🎀