Binfmt misc

{{Short description|Binary file format}}

{{DISPLAYTITLE:binfmt_misc}}

binfmt_misc (Miscellaneous Binary Format) is a capability of the Linux kernel which allows arbitrary executable file formats to be recognized and passed to certain user space applications, such as emulators and virtual machines.[https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html Kernel Support for miscellaneous Binary Formats (binfmt_misc)] The Linux Kernel documentation It is one of a number of binary format handlers in the kernel that are involved in preparing a user-space program to run.[https://lwn.net/Articles/630727/ How programs get run], January 28, 2015, by David Drysdale, LWN.net

The executable formats are registered through the special purpose file system binfmt_misc file-system interface (usually mounted under part of /proc). This is either done directly by sending special sequences to the register procfs file or using a wrapper like Debian-based distributions binfmt-support package[http://packages.debian.org/sid/binfmt-support Details of package binfmt-support in sid], Debian or systemd's systemd-binfmt.service.[https://www.freedesktop.org/software/systemd/man/systemd-binfmt.service.html# systemd-binfmt.service], freedesktop.org[https://www.freedesktop.org/software/systemd/man/binfmt.d.html binfmt.d], freedesktop.org

Registration

According to the [https://docs.kernel.org/admin-guide/binfmt-misc.html kernel docs] the register file contains lines which define executable types to be handled. Each line is of the form:

:name:type:offset:magic:mask:interpreter:flags

  • name is the name of the binary format.
  • type is either E or M
  • If it is E, the executable file format is identified by its filename extension: magic is the file extension to be associated with the binary format; offset and mask are ignored.
  • If it is M, the format is identified by magic number at an absolute offset (defaults to 0) in the file and mask is a bitmask (defaults to all 0xFF) indicating which bits in the number are significant.
  • interpreter is a program that is to be run with the matching file as an argument.
  • flags (optional) is a string of letters, each controlling a certain aspect of interpreter invocation:
  • P to preserve the original program name typed by user in command line — by adding that name to argv; the interpreter has to be aware of this so it can correctly pass that additional parameter to the interpreted program as its argv[0].
  • O to open the program file and pass its file descriptor to the interpreter so it could read an otherwise unreadable file (for which the user does not have the "Read" permission).
  • C to determine new process credentials based on program file rather than interpreter file (see setuid); implies O flag.
  • F to make the kernel open the binary at configuration time instead of lazily at startup time, so that it is available inside other mount namespaces and chroots as well.

Each format has a corresponding file entry in the /proc/sys/fs/binfmt_misc directory which can be read to get information about a given file format.

Deregistration

{{sxhl|2=console|

$ echo -1 >/proc/sys/fs/binfmt_misc/status # all entries

$ echo -1 >/proc/sys/fs/binfmt_misc/qemu-xtensa # single entry

}}

Common usage

  • binfmt_misc allows Java programs to be passed directly to the Java virtual machine.[https://www.kernel.org/doc/html/latest/admin-guide/java.html Java(tm) Binary Kernel Support for Linux v1.03] The Linux Kernel documentation
  • binfmt_misc allows identification of PE executables using the magic number "MZ". Examples:
  • :DOSWin:M::MZ::/usr/bin/wine: will hand all such files to Wine (thus assuming they are ordinary MS-DOS or Microsoft Windows executable)
  • :CLR:M::MZ::/usr/bin/mono: will hand such files to Mono (thus assuming they are .NET executables)[https://www.kernel.org/doc/html/latest/admin-guide/mono.html Mono(tm) Binary Kernel Support for Linux] The Linux Kernel documentation[http://www.mono-project.com/Guide:Running_Mono_Applications Guide:Running Mono Applications]
  • Microsoft's WSL1 uses binfmt to allow for calling Windows programs from Linux. The line is equivalent to :WSLInterOP:M::MZ::/init:P.
  • binfmt_misc can also be combined with QEMU's user-mode emulation or Box86 to execute programs for other processor architectures as if they were native binaries.{{Citation|title=Official QEMU mirror|date=23 November 2022 |url=https://github.com/qemu/qemu/blob/f31160c7d1b89cfb4dd4001a23575b42141cb0ec/qemu-doc.texi#L2590|publisher=QEMU}}
  • binfmt can be used to turn some compiled languages such as Go into scripting languages, acting as a substitute for the shebang line.{{Citation|title=Using Go as a scripting language in Linux|date=2018-02-20|url=https://blog.cloudflare.com/using-go-as-a-scripting-language-in-linux/|publisher=Cloudflare|access-date=2019-05-05}}

References