I used auditd to log all executions. The commands I catched are these, the first one being the initial one. /usr/bin/qemu-x86_64-static /usr/share/code/bin/../code /usr/share/code/bin/../resources/app/out/cli.js --verbose -> /usr/bin/qemu-x86_64-static /usr/share/code/code --verbose --no-sandbox -> /usr/bin/qemu-x86_64-static /usr/share/code/code --type=zygote --no-sandbox
These commands are run successfully. Note the --type=zygote thing on the last one. Since we get the qemu error that type=gpu-process is not supported, it is weird, that type=zygote is properly executed. In the console, I can see the same message still: > qemu: unknown option 'type=gpu-process' So this call was not catched by auditd. I wonder if it can be so different from the others... Maybe code is depending on argv[0] being code? I do not know how binfmt or qemu-static is dealing with these things...
