STRUCT BINFMT_MISC_OPS(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

🌸 struct binfmt_misc_ops(9) 🌸

okay bestie, welcome to the Kernel API Manual β€” section 9, the fun one where we talk about structures. This is the page for struct binfmt_misc_ops, aka the bpf-backed binary type handler, and yes it's giving main character energy in the exec path πŸ’…

✨ NAME ✨

struct binfmt_misc_ops β€” bpf-backed binary type handler πŸŽ€

✨ SYNOPSIS ✨

struct binfmt_misc_ops {
    bool (*match)(struct linux_binprm *bprm);
    int (*load)(struct linux_binprm *bprm);
    char name[BINFMT_MISC_OPS_NAME_MAX];
 };

look at it. three little fields. tiny struct, huge responsibilities, no cap 🫢

✨ Members ✨

  • match β€” decides whether this handler applies to bprm. it gets consulted from the entry lookup walk, right alongside the static magic and extension matching, in registration order with first-match-wins semantics β€” so whoever shows up first wins, periodt. it's sleepable, which means it can literally go read the binary to make its decision πŸ‘‘ but heads up: the verifier rejects the interpreter selection kfuncs in it, so don't try that in here, it's not that kind of function πŸ™ˆ
  • load β€” picks an interpreter for the matched bprm, either via bpf_binprm_set_interp, or one the entry bound via bpf_binprm_select_interp β€” and then returns zero. important lore: a match is committed, so a failure fails the exec instead of falling through to later entries. like, no plan B, it's over 😭 the one exception? -ENOEXEC doesn't fail the exec β€” it just moves on to the remaining binary formats. that's the escape hatch, iykyk πŸ”₯
  • name β€” the name that 'B' entries reference the handler by. it lives in a char name[BINFMT_MISC_OPS_NAME_MAX], so keep it cute and keep it short πŸ“

✨ SEE ALSO ✨

  • Kernel file ./include/linux/binfmt_misc.h β€” struct binfmt_misc_interp(9)
  • enum bpf_binprm_flags(9)

go read those next, bestie, they're literally in the same header 🌈


and that's the page!! πŸ’– this slice of kernel lore came from ./include/linux, dated October 2026, and the whole thing is filed under struct binfmt_misc_ops(9) β€” slay, go forth and register your handlers responsibly 🧚✨

πŸ“¦ where this page comes from