SQLite Database Files Can Be Executed Directly on Linux

Summary

Farid Zakaria demonstrates a trick where a SQLite database file on Linux is turned directly into an executable binary. In this method, the 4-byte application identifier field is set to 'SELF', and ELF components are stored within SQLite tables. Execution is managed via a C-based self-interpreter through a binfmt_misc kernel registration.

Why it matters

This example shows how SQLite's flexible file format can be used to blur the line between data storage and executable code on Linux. It offers a compact, self-contained distribution mechanism that avoids traditional packaging overhead, which is particularly relevant for system programmers and NixOS users. It also highlights how Linux's binfmt_misc mechanism can be repurposed for creative binary formats.

Highlights

• The 4-byte application identifier field at offset 68 in SQLite is hijacked and set to 'SELF', allowing the file to be recognized by the kernel.
• ELF sections are stored as rows in SQLite tables and are extracted at runtime by a C interpreter.
• The binfmt_misc registration ensures that any file matching the SELF magic bytes is automatically executed by the kernel.

Critical take

While technically clever, this is a niche system hack with limited practical adoption. It requires root-level kernel module registration, a custom C interpreter, and introduces a significant attack surface; any file containing the SELF magic bytes can be automatically executed. The 'SELF' acronym (Structured Executable & Linkable Format) reads more like a fun experiment than a production-ready packaging format.