[PATCH 1/3] elf: load the main program from AT_EXECFD when run as a binfmt interpreter

[Christian Brauner]

On Wed, Jul 15, 2026 at 12:38:32PM +0200, Andreas Schwab wrote:
> On Jul 15 2026, Christian Brauner wrote:
> 
> > +      /* Move the descriptor out of the standard range: it is closed
> > +	 once the program is mapped, and a secure process must not
> > +	 start with a silently closed standard descriptor.  The
> > +	 standard descriptor check at startup ran while the descriptor
> > +	 still occupied the slot, so run it again once the slot is
> > +	 free.  */
> > +      if (execfd >= 0 && execfd <= STDERR_FILENO)
> > +	{
> > +	  int movedfd = __fcntl64_nocancel (execfd, F_DUPFD,
> > +					    STDERR_FILENO + 1);
> > +	  if (movedfd >= 0)
> 
> If F_DUPFD failed here in a __libc_enable_secure program, it will be run
> with a closed std desc, defeating __libc_check_standard_fds.

Right. It's handled in 3/3, which is where the evacuation moves to after
option parsing. The re-check went with it. That does leave 1/3 exposed
on its own. I'll pull the re-check back into this patch for v2. Thanks!