> This patch could in theory solve our problems, except for the "no root"
We're not really enabling $ORIGIN in core elf unconditionally with weird escape hatches to make it fit for a subset of binaries. > > In any case, I think it wouldn't be crazy to allow registering > > "default" handlers that appear in all binfmt_misc instances if needed > > so containers with separate binfmt_misc always have the bpf program > > available. [...] > > Maybe we can have a "default eBPF program" loaded for > `PT_INTERP_WITH_ORIGIN`? I think this could even just be part of systemd. You ship the distro with a file for that in /etc/binfmt.d/ and systemd loads that bpf program for PT_INTERP_WITH_ORIGIN. Then you're good to go for all your binaries with the 'L' option my other patch series adds. This is policy that the admin should decide, not an arbitrary extension into elf core.
