ENUM BPF_BINPRM_FLAGS(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

πŸ’… enum bpf_binprm_flags(9) πŸ’…

okay so bestie, welcome to the Kernel API Manual β€” this is the page for enum bpf_binprm_flags, and honestly? it's giving "tiny enum, huge responsibilities". stay with me, it's cute.


✨ NAME ✨

enum bpf_binprm_flags β€” the per-exec invocation flags that a load program can request πŸŽ€

like, per. exec. every single time. not once at registration. we'll get there.


✨ SYNOPSIS ✨

enum bpf_binprm_flags {
    BPF_BINPRM_PRESERVE_ARGV0 ,
    BPF_BINPRM_CREDENTIALS ,
    BPF_BINPRM_EXECFD ,
    BPF_BINPRM_TRANSPARENT ,
    BPF_BINPRM_LOADER

};

✨ OPTIONS ✨

🌸 Constants

  • BPF_BINPRM_PRESERVE_ARGV0 β€” keeps the caller's argv[0] around, no take-backsies. this one's the 'P' flag energy πŸ’–
  • BPF_BINPRM_CREDENTIALS β€” computes the credentials from the binary. lowkey implies execfd. it's the 'C' flag πŸ”₯
  • BPF_BINPRM_EXECFD β€” passes the binary over via AT_EXECFD. classic 'O' flag behaviour 🫢
  • BPF_BINPRM_TRANSPARENT β€” leaves argv completely untouched, and the interpreter pulls the binary from AT_EXECFD. this is the 'T' flag. heads up: it implies execfd and it excludes preserve-argv0 β€” they are not friends, do not put them in the same group chat 😭
  • BPF_BINPRM_LOADER β€” swaps the interpreter in for the binary's PT_INTERP and runs the binary as a native exec. that's the 'L' flag, and it's kind of a main character because it excludes every other flag. periodt πŸ‘‘

✨ Description ✨

so these get set from a load program with bpf_binprm_set_flags. that's the whole vibe.

and here's the part that slaps: unlike a static entry β€” which picks its thing once at registration and then just lives like that forever β€” a bpf handler chooses these per exec rather than once at registration. every exec gets a fresh vibe check πŸ’…βœ¨


✨ SEE ALSO ✨

  • Kernel file ./include/linux/binfmt_misc.h β€” struct binfmt_misc_interp(9), struct binfmt_misc_ops(9) πŸ¦‹

that's the page, bestie! this icon was brought to you by the source in ./include/linux, dated October 2026, straight out of the Kernel API Manual β€” go forth and flag responsibly πŸŽ€πŸ’œπŸŒŸ

πŸ“¦ where this page comes from