LXR linux/include/linux/seccomp.h

   1#ifndef _LINUX_SECCOMP_H
   2#define _LINUX_SECCOMP_H
   3
   4#include <uapi/linux/seccomp.h>
   5
   6#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC)
   7
   8#ifdef CONFIG_SECCOMP
   9
  10#include <linux/thread_info.h>
  11#include <asm/seccomp.h>
  12
  13struct seccomp_filter;
  14/**
  15 * struct seccomp - the state of a seccomp'ed process
  16 *
  17 * @mode:  indicates one of the valid values above for controlled
  18 *         system calls available to a process.
  19 * @filter: must always point to a valid seccomp-filter or NULL as it is
  20 *          accessed without locking during system call entry.
  21 *
  22 *          @filter must only be accessed from the context of current as there
  23 *          is no read locking.
  24 */
  25struct seccomp {
  26        int mode;
  27        struct seccomp_filter *filter;
  28};
  29
  30#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  31extern int __secure_computing(const struct seccomp_data *sd);
  32static inline int secure_computing(const struct seccomp_data *sd)
  33{
  34        if (unlikely(test_thread_flag(TIF_SECCOMP)))
  35                return  __secure_computing(sd);
  36        return 0;
  37}
  38#else
  39extern void secure_computing_strict(int this_syscall);
  40#endif
  41
  42extern long prctl_get_seccomp(void);
  43extern long prctl_set_seccomp(unsigned long, char __user *);
  44
  45static inline int seccomp_mode(struct seccomp *s)
  46{
  47        return s->mode;
  48}
  49
  50#else /* CONFIG_SECCOMP */
  51
  52#include <linux/errno.h>
  53
  54struct seccomp { };
  55struct seccomp_filter { };
  56
  57#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  58static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  59#else
  60static inline void secure_computing_strict(int this_syscall) { return; }
  61#endif
  62
  63static inline long prctl_get_seccomp(void)
  64{
  65        return -EINVAL;
  66}
  67
  68static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  69{
  70        return -EINVAL;
  71}
  72
  73static inline int seccomp_mode(struct seccomp *s)
  74{
  75        return SECCOMP_MODE_DISABLED;
  76}
  77#endif /* CONFIG_SECCOMP */
  78
  79#ifdef CONFIG_SECCOMP_FILTER
  80extern void put_seccomp_filter(struct task_struct *tsk);
  81extern void get_seccomp_filter(struct task_struct *tsk);
  82#else  /* CONFIG_SECCOMP_FILTER */
  83static inline void put_seccomp_filter(struct task_struct *tsk)
  84{
  85        return;
  86}
  87static inline void get_seccomp_filter(struct task_struct *tsk)
  88{
  89        return;
  90}
  91#endif /* CONFIG_SECCOMP_FILTER */
  92
  93#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  94extern long seccomp_get_filter(struct task_struct *task,
  95                               unsigned long filter_off, void __user *data);
  96#else
  97static inline long seccomp_get_filter(struct task_struct *task,
  98                                      unsigned long n, void __user *data)
  99{
 100        return -EINVAL;
 101}
 102#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 103#endif /* _LINUX_SECCOMP_H */
 104