5

I following Michael's reply to see what executable formats my Ubuntu can recognize to execute

$ ls -l /proc/sys/fs/binfmt_misc/
total 0
-rw-r--r-- 1 root root 0 Apr 19 16:11 cli
-rw-r--r-- 1 root root 0 Apr 19 16:11 jar
-rw-r--r-- 1 root root 0 Apr 19 16:11 python2.7
-rw-r--r-- 1 root root 0 Apr 19 16:11 python3.5
--w------- 1 root root 0 Apr 19 16:11 register
-rw-r--r-- 1 root root 0 Apr 19 16:11 status

I have never intentionally changed anything there, and the files were created by default or when I installed some other programs.

$ cat /proc/sys/fs/binfmt_misc/cli
enabled
interpreter /usr/lib/binfmt-support/run-detectors
flags: 
offset 0
magic 4d5a

What kind of executable format is this? I googled "magic 4d5a" and found https://en.wikipedia.org/wiki/DOS_MZ_executable, but I am not sure how the file was created there since it is not a native executable format to Linux. Did installation of wine add it?

$ cat /proc/sys/fs/binfmt_misc/jar
enabled
interpreter /usr/lib/jvm/java-9-oracle/lib/jexec
flags: 
offset 0
magic 504b0304

Is the above for JVM bytecode format?

$ cat /proc/sys/fs/binfmt_misc/python3.5 
enabled
interpreter /usr/bin/python3.5
flags: 
offset 0
magic 160d0d0a

Is the above for Python bytecode or Python?

$ cat /proc/sys/fs/binfmt_misc/status
enabled

$ cat /proc/sys/fs/binfmt_misc/register 
cat: /proc/sys/fs/binfmt_misc/register: Permission denied

What is /proc/sys/fs/binfmt_misc/register used for? Does it also allow some executable format?

Does ELF format need a file under /proc/sys/fs/binfmt_misc/?

Thanks.

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
Tim
  • 98,580
  • 191
  • 570
  • 977

1 Answers1

7

See How is Mono magical? for more background. /proc/sys/fs/binfmt_misc is a virtual file system managed by binfmt_misc (which is why the files are all 0-sized).

cli is used for Windows and .NET executables (and really any MZ executable, as also used in DOS and OS/2); the detector it refers to determines whether a given binary should be run using Wine or Mono.

jar provides support for JAR files, as used by Java programs. You can thus make a JAR executable, and run it directly (instead of using java -jar ...).

The python files provide support for Python bytecode.

status shows the overall status of binfmt_misc: in this case, it’s enabled.

register allows new formats to be registered. This is done by echoing a string in a specific format (see the documentation for details) to register. The registered format will show up as a new file alongside cli, jar and the others.

Many kinds of executable formats can be registered using binfmt_misc. They can be matched using a file extension (.jar etc., although JAR files are identified by their “PK” signature instead) or a magic value (“MZ” etc.), as long as the magic value occurs within the first 128 bytes. Beyond the files you’ve listed, other formats typically handled in this way are binaries for other architectures (“interpreted” by QEMU, or emulators such as Hatari), some interpreted game formats (the love game engine registers itself in this fashion under Debian at least)...

Under Debian and derivatives, packages register binary formats using binfmt-support and files in /usr/share/binfmts/cli; dlocate -S /usr/share/binfmts/* will tell you which packages are adding binary formats.

ELF doesn’t need any registration, it’s supported natively by the kernel.

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • Thanks. What are the differences between magic word set up by binfmt_misc and shebang, from the perspective of calling `execve()`? Can the first argument to `execve()` be either a file containing a magic word set up by binfmt_misc, or a file containing a shebang? https://unix.stackexchange.com/questions/439376/how-is-a-bash-script-executed-via-its-filename-as-command-name-with-and-without#comment795018_439390 – Tim Apr 23 '18 at 22:14
  • See [the `execve` manpage](http://man7.org/linux/man-pages/man2/execve.2.html): the first argument can point to either a binary executable, or a script starting with a shebang. What constitutes a binary executable is determined by the kernel: in Linux, binaries are supported by one of the `binfmt_` modules, which include `a.out`, ELF, `em86` (on Alpha), flat files, “misc” (as in `binfmt_misc`), and scripts with a shebang. (So the Linux *implementation* treats scripts in the same way as binaries.) – Stephen Kitt Apr 24 '18 at 11:16
  • Thanks. "in Linux, binaries are supported by one of the binfmt_ modules, which include a.out, ELF, em86 (on Alpha), flat files, “misc” (as in binfmt_misc), and scripts with a shebang." (1) What do you mean by `a.out` ? Do you mean ELF? When `gcc my.c`, it generates `a.out`, which has ELF format. (2) What does " flat files" mean? I heard that flat files are text files in database like scenario (https://en.wikipedia.org/wiki/Flat_file_database), but not sure that is what you meant (3) What does “misc” as in `binfmt_misc` mean? (4) What is the source/reference for the sentence? – Tim Apr 24 '18 at 12:29
  • The reference is [the kernel source code](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs) (see also [the configuration descriptions](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/Kconfig.binfmt)). `a.out` means [a.out](https://en.wikipedia.org/wiki/A.out), the old executable format. (And yes, many C compilers use `a.out` as their default target name, independently of the format...) “Flat files” refers to the uClinux binary format. – Stephen Kitt Apr 24 '18 at 12:38
  • (5) "binaries are supported by one of the `binfmt_ `modules". What other `binfmt_` modules besides `binfmt_misc`? `lsmod | grep binfmt_` and `locate binfmt_` only show `binfmt_misc`. – Tim Apr 24 '18 at 12:39
  • You won’t find other `binfmt` modules in most systems; for example, current Debian kernels build ELF and script support into the kernel, `binfmt_misc` as a module, and nothing else. – Stephen Kitt Apr 24 '18 at 12:41
  • (3) I can't find out what “misc” (as in binfmt_misc) means as a binary executable file formt. I don't know what it is. – Tim Apr 24 '18 at 12:41
  • See [the documentation](https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html) (also linked in the answer): “misc” stands for “miscellaneous”, and there is no single miscellaneous binary format — `binfmt_misc` provides support for miscellaneous binary formats, that’s why it’s named that way. – Stephen Kitt Apr 24 '18 at 12:42
  • Thanks. Stephen. I'd appreciate also if you could take a look at https://stackoverflow.com/questions/52416969/is-a-registered-custom-executable-format-also-described-by-an-object-of-type-li?noredirect=1#comment91778309_52416969 – Tim Sep 20 '18 at 21:18