LXR linux/include/linux/seccomp.h

   1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _LINUX_SECCOMP_H
   3#define _LINUX_SECCOMP_H
   4
   5#include <uapi/linux/seccomp.h>
   6
   7#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC | \
   8                                         SECCOMP_FILTER_FLAG_LOG)
   9
  10#ifdef CONFIG_SECCOMP
  11
  12#include <linux/thread_info.h>
  13#include <asm/seccomp.h>
  14
  15struct seccomp_filter;
  16/**
  17 * struct seccomp - the state of a seccomp'ed process
  18 *
  19 * @mode:  indicates one of the valid values above for controlled
  20 *         system calls available to a process.
  21 * @filter: must always point to a valid seccomp-filter or NULL as it is
  22 *          accessed without locking during system call entry.
  23 *
  24 *          @filter must only be accessed from the context of current as there
  25 *          is no read locking.
  26 */
  27struct seccomp {
  28        int mode;
  29        struct seccomp_filter *filter;
  30};
  31
  32#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  33extern int __secure_computing(const struct seccomp_data *sd);
  34static inline int secure_computing(const struct seccomp_data *sd)
  35{
  36        if (unlikely(test_thread_flag(TIF_SECCOMP)))
  37                return  __secure_computing(sd);
  38        return 0;
  39}
  40#else
  41extern void secure_computing_strict(int this_syscall);
  42#endif
  43
  44extern long prctl_get_seccomp(void);
  45extern long prctl_set_seccomp(unsigned long, char __user *);
  46
  47static inline int seccomp_mode(struct seccomp *s)
  48{
  49        return s->mode;
  50}
  51
  52#else /* CONFIG_SECCOMP */
  53
  54#include <linux/errno.h>
  55
  56struct seccomp { };
  57struct seccomp_filter { };
  58
  59#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  60static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  61#else
  62static inline void secure_computing_strict(int this_syscall) { return; }
  63#endif
  64
  65static inline long prctl_get_seccomp(void)
  66{
  67        return -EINVAL;
  68}
  69
  70static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  71{
  72        return -EINVAL;
  73}
  74
  75static inline int seccomp_mode(struct seccomp *s)
  76{
  77        return SECCOMP_MODE_DISABLED;
  78}
  79#endif /* CONFIG_SECCOMP */
  80
  81#ifdef CONFIG_SECCOMP_FILTER
  82extern void put_seccomp_filter(struct task_struct *tsk);
  83extern void get_seccomp_filter(struct task_struct *tsk);
  84#else  /* CONFIG_SECCOMP_FILTER */
  85static inline void put_seccomp_filter(struct task_struct *tsk)
  86{
  87        return;
  88}
  89static inline void get_seccomp_filter(struct task_struct *tsk)
  90{
  91        return;
  92}
  93#endif /* CONFIG_SECCOMP_FILTER */
  94
  95#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  96extern long seccomp_get_filter(struct task_struct *task,
  97                               unsigned long filter_off, void __user *data);
  98#else
  99static inline long seccomp_get_filter(struct task_struct *task,
 100                                      unsigned long n, void __user *data)
 101{
 102        return -EINVAL;
 103}
 104#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 105#endif /* _LINUX_SECCOMP_H */
 106