binfmt_misc turns an interpreter registration into an execution path

Linux can recognize a non-native executable and hand it to an interpreter through binfmt_misc . The mechanism is useful for emulation, language runtimes, and cross-platform build systems. It also creates an execution path that may be invisible in a normal review of file permissions.

The kernel documentation describes registration through /proc/sys/fs/binfmt_misc/register . A registration string identifies a binary type by magic bytes or filename extension and names an interpreter. Once registered, executing a matching file can invoke that interpreter instead of returning an ordinary format error. The interpreter path and mount namespace therefore belong to the security boundary.

The namespace changes the evidence

binfmt_misc is mounted as a filesystem. A container, service manager, or test runner may have its own view of that mount and its own registrations.…