LXR linux/include/linux/seccomp.h

   1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _LINUX_SECCOMP_H
   3#define _LINUX_SECCOMP_H
   4
   5#include <uapi/linux/seccomp.h>
   6
   7#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC      | \
   8                                         SECCOMP_FILTER_FLAG_LOG        | \
   9                                         SECCOMP_FILTER_FLAG_SPEC_ALLOW)
  10
  11#ifdef CONFIG_SECCOMP
  12
  13#include <linux/thread_info.h>
  14#include <asm/seccomp.h>
  15
  16struct seccomp_filter;
  17/**
  18 * struct seccomp - the state of a seccomp'ed process
  19 *
  20 * @mode:  indicates one of the valid values above for controlled
  21 *         system calls available to a process.
  22 * @filter: must always point to a valid seccomp-filter or NULL as it is
  23 *          accessed without locking during system call entry.
  24 *
  25 *          @filter must only be accessed from the context of current as there
  26 *          is no read locking.
  27 */
  28struct seccomp {
  29        int mode;
  30        struct seccomp_filter *filter;
  31};
  32
  33#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  34extern int __secure_computing(const struct seccomp_data *sd);
  35static inline int secure_computing(const struct seccomp_data *sd)
  36{
  37        if (unlikely(test_thread_flag(TIF_SECCOMP)))
  38                return  __secure_computing(sd);
  39        return 0;
  40}
  41#else
  42extern void secure_computing_strict(int this_syscall);
  43#endif
  44
  45extern long prctl_get_seccomp(void);
  46extern long prctl_set_seccomp(unsigned long, char __user *);
  47
  48static inline int seccomp_mode(struct seccomp *s)
  49{
  50        return s->mode;
  51}
  52
  53#else /* CONFIG_SECCOMP */
  54
  55#include <linux/errno.h>
  56
  57struct seccomp { };
  58struct seccomp_filter { };
  59
  60#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  61static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  62#else
  63static inline void secure_computing_strict(int this_syscall) { return; }
  64#endif
  65
  66static inline long prctl_get_seccomp(void)
  67{
  68        return -EINVAL;
  69}
  70
  71static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  72{
  73        return -EINVAL;
  74}
  75
  76static inline int seccomp_mode(struct seccomp *s)
  77{
  78        return SECCOMP_MODE_DISABLED;
  79}
  80#endif /* CONFIG_SECCOMP */
  81
  82#ifdef CONFIG_SECCOMP_FILTER
  83extern void put_seccomp_filter(struct task_struct *tsk);
  84extern void get_seccomp_filter(struct task_struct *tsk);
  85#else  /* CONFIG_SECCOMP_FILTER */
  86static inline void put_seccomp_filter(struct task_struct *tsk)
  87{
  88        return;
  89}
  90static inline void get_seccomp_filter(struct task_struct *tsk)
  91{
  92        return;
  93}
  94#endif /* CONFIG_SECCOMP_FILTER */
  95
  96#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  97extern long seccomp_get_filter(struct task_struct *task,
  98                               unsigned long filter_off, void __user *data);
  99extern long seccomp_get_metadata(struct task_struct *task,
 100                                 unsigned long filter_off, void __user *data);
 101#else
 102static inline long seccomp_get_filter(struct task_struct *task,
 103                                      unsigned long n, void __user *data)
 104{
 105        return -EINVAL;
 106}
 107static inline long seccomp_get_metadata(struct task_struct *task,
 108                                        unsigned long filter_off,
 109                                        void __user *data)
 110{
 111        return -EINVAL;
 112}
 113#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 114#endif /* _LINUX_SECCOMP_H */
 115