bpf_binprm_set_interp(9)

💖 NAME 💖

okay bestie, this is bpf_binprm_set_interp(9) from the Kernel API Manual (section 9), and its whole job is selecting the interpreter for the current exec. yes, that’s the vibe. 🦋

✨ SYNOPSIS ✨

__bpf_kfunc int bpf_binprm_set_interp (struct linux_binprm *bprm , const
       char *path , size_t path__sz );

🌸 ARGUMENTS 🌸

• bprm — the binary that is being executed. main character of this exec.
• path — absolute path to the interpreter. must be absolute, no cap.
• path__sz — size of the path buffer, including the terminating NUL. don’t forget the NUL, bestie. 😭

🎀 DESCRIPTION 🎀

so this kfunc is for the load program of a struct binfmt_misc_ops handler — call it there before you return zero. and listen: the verifier will reject this call from any other program, including the handler’s own match program. like, it's giving “strict guest list only.” 💅

the path gets opened with the credentials of the task doing the exec, and that happens after the program returns. if you call it again, you’re replacing the selection — same thing happens if you select an interpreter the entry bound with bpf_binprm_select_interp. so yes, last pick wins energy. ✨

⭐ RETURN ⭐

0 on success, a negative errno on failure. periodt. 🫶

👑 SEE ALSO 👑

go peek at the Kernel file ./fs/binfmt_misc_bpf.c, plus these besties:

• binfmt_misc_get_ops(9)
• bpf_binprm_select_interp(9)
• bpf_binprm_set_interp_arg(9)
• bpf_binprm_set_flags(9)

okay that’s the page, bestie — source/version ./fs, date October 2026, signing off 💅✨