5

I following Michael's reply to see what executable formats my Ubuntu can recognize to execute

$ ls -l /proc/sys/fs/binfmt_misc/
total 0
-rw-r--r-- 1 root root 0 Apr 19 16:11 cli
-rw-r--r-- 1 root root 0 Apr 19 16:11 jar
-rw-r--r-- 1 root root 0 Apr 19 16:11 python2.7
-rw-r--r-- 1 root root 0 Apr 19 16:11 python3.5
--w------- 1 root root 0 Apr 19 16:11 register
-rw-r--r-- 1 root root 0 Apr 19 16:11 status

I have never intentionally changed anything there, and the files were created by default or when I installed some other programs.

$ cat /proc/sys/fs/binfmt_misc/cli
enabled
interpreter /usr/lib/binfmt-support/run-detectors
flags: 
offset 0
magic 4d5a

What kind of executable format is this? I googled "magic 4d5a" and found https://en.wikipedia.org/wiki/DOS_MZ_executable, but I am not sure how the file was created there since it is not a native executable format to Linux. Did installation of wine add it?

$ cat /proc/sys/fs/binfmt_misc/jar
enabled
interpreter /usr/lib/jvm/java-9-oracle/lib/jexec
flags: 
offset 0
magic 504b0304

Is the above for JVM bytecode format?

$ cat /proc/sys/fs/binfmt_misc/python3.5 
enabled
interpreter /usr/bin/python3.5
flags: 
offset 0
magic 160d0d0a

Is the above for Python bytecode or Python?

$ cat /proc/sys/fs/binfmt_misc/status
enabled

$ cat /proc/sys/fs/binfmt_misc/register 
cat: /proc/sys/fs/binfmt_misc/register: Permission denied

What is /proc/sys/fs/binfmt_misc/register used for? Does it also allow some executable format?

Does ELF format need a file under /proc/sys/fs/binfmt_misc/?

Thanks.

Stephen Kitt
  • 434,908
Tim
  • 101,790

1 Answers1

7

See How is Mono magical? for more background. /proc/sys/fs/binfmt_misc is a virtual file system managed by binfmt_misc (which is why the files are all 0-sized).

cli is used for Windows and .NET executables (and really any MZ executable, as also used in DOS and OS/2); the detector it refers to determines whether a given binary should be run using Wine or Mono.

jar provides support for JAR files, as used by Java programs. You can thus make a JAR executable, and run it directly (instead of using java -jar ...).

The python files provide support for Python bytecode.

status shows the overall status of binfmt_misc: in this case, it’s enabled.

register allows new formats to be registered. This is done by echoing a string in a specific format (see the documentation for details) to register. The registered format will show up as a new file alongside cli, jar and the others.

Many kinds of executable formats can be registered using binfmt_misc. They can be matched using a file extension (.jar etc., although JAR files are identified by their “PK” signature instead) or a magic value (“MZ” etc.), as long as the magic value occurs within the first 128 bytes. Beyond the files you’ve listed, other formats typically handled in this way are binaries for other architectures (“interpreted” by QEMU, or emulators such as Hatari), some interpreted game formats (the love game engine registers itself in this fashion under Debian at least)...

Under Debian and derivatives, packages register binary formats using binfmt-support and files in /usr/share/binfmts/cli; dlocate -S /usr/share/binfmts/* will tell you which packages are adding binary formats.

ELF doesn’t need any registration, it’s supported natively by the kernel.

Stephen Kitt
  • 434,908
  • Thanks. What are the differences between magic word set up by binfmt_misc and shebang, from the perspective of calling execve()? Can the first argument to execve() be either a file containing a magic word set up by binfmt_misc, or a file containing a shebang? https://unix.stackexchange.com/questions/439376/how-is-a-bash-script-executed-via-its-filename-as-command-name-with-and-without#comment795018_439390 – Tim Apr 23 '18 at 22:14
  • See the execve manpage: the first argument can point to either a binary executable, or a script starting with a shebang. What constitutes a binary executable is determined by the kernel: in Linux, binaries are supported by one of the binfmt_ modules, which include a.out, ELF, em86 (on Alpha), flat files, “misc” (as in binfmt_misc), and scripts with a shebang. (So the Linux implementation treats scripts in the same way as binaries.) – Stephen Kitt Apr 24 '18 at 11:16
  • Thanks. "in Linux, binaries are supported by one of the binfmt_ modules, which include a.out, ELF, em86 (on Alpha), flat files, “misc” (as in binfmt_misc), and scripts with a shebang." (1) What do you mean by a.out ? Do you mean ELF? When gcc my.c, it generates a.out, which has ELF format. (2) What does " flat files" mean? I heard that flat files are text files in database like scenario (https://en.wikipedia.org/wiki/Flat_file_database), but not sure that is what you meant (3) What does “misc” as in binfmt_misc mean? (4) What is the source/reference for the sentence? – Tim Apr 24 '18 at 12:29
  • The reference is the kernel source code (see also the configuration descriptions). a.out means a.out, the old executable format. (And yes, many C compilers use a.out as their default target name, independently of the format...) “Flat files” refers to the uClinux binary format. – Stephen Kitt Apr 24 '18 at 12:38
  • (5) "binaries are supported by one of the binfmt_modules". What other binfmt_ modules besides binfmt_misc? lsmod | grep binfmt_ and locate binfmt_ only show binfmt_misc. – Tim Apr 24 '18 at 12:39
  • You won’t find other binfmt modules in most systems; for example, current Debian kernels build ELF and script support into the kernel, binfmt_misc as a module, and nothing else. – Stephen Kitt Apr 24 '18 at 12:41
  • (3) I can't find out what “misc” (as in binfmt_misc) means as a binary executable file formt. I don't know what it is. – Tim Apr 24 '18 at 12:41
  • See the documentation (also linked in the answer): “misc” stands for “miscellaneous”, and there is no single miscellaneous binary format — binfmt_misc provides support for miscellaneous binary formats, that’s why it’s named that way. – Stephen Kitt Apr 24 '18 at 12:42
  • Thanks. Stephen. I'd appreciate also if you could take a look at https://stackoverflow.com/questions/52416969/is-a-registered-custom-executable-format-also-described-by-an-object-of-type-li?noredirect=1#comment91778309_52416969 – Tim Sep 20 '18 at 21:18