LXR linux/include/linux/seccomp.h

   1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _LINUX_SECCOMP_H
   3#define _LINUX_SECCOMP_H
   4
   5#include <uapi/linux/seccomp.h>
   6
   7#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC | \
   8                                         SECCOMP_FILTER_FLAG_LOG | \
   9                                         SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
  10                                         SECCOMP_FILTER_FLAG_NEW_LISTENER)
  11
  12#ifdef CONFIG_SECCOMP
  13
  14#include <linux/thread_info.h>
  15#include <asm/seccomp.h>
  16
  17struct seccomp_filter;
  18/**
  19 * struct seccomp - the state of a seccomp'ed process
  20 *
  21 * @mode:  indicates one of the valid values above for controlled
  22 *         system calls available to a process.
  23 * @filter: must always point to a valid seccomp-filter or NULL as it is
  24 *          accessed without locking during system call entry.
  25 *
  26 *          @filter must only be accessed from the context of current as there
  27 *          is no read locking.
  28 */
  29struct seccomp {
  30        int mode;
  31        struct seccomp_filter *filter;
  32};
  33
  34#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  35extern int __secure_computing(const struct seccomp_data *sd);
  36static inline int secure_computing(const struct seccomp_data *sd)
  37{
  38        if (unlikely(test_thread_flag(TIF_SECCOMP)))
  39                return  __secure_computing(sd);
  40        return 0;
  41}
  42#else
  43extern void secure_computing_strict(int this_syscall);
  44#endif
  45
  46extern long prctl_get_seccomp(void);
  47extern long prctl_set_seccomp(unsigned long, void __user *);
  48
  49static inline int seccomp_mode(struct seccomp *s)
  50{
  51        return s->mode;
  52}
  53
  54#else /* CONFIG_SECCOMP */
  55
  56#include <linux/errno.h>
  57
  58struct seccomp { };
  59struct seccomp_filter { };
  60
  61#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  62static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  63#else
  64static inline void secure_computing_strict(int this_syscall) { return; }
  65#endif
  66
  67static inline long prctl_get_seccomp(void)
  68{
  69        return -EINVAL;
  70}
  71
  72static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  73{
  74        return -EINVAL;
  75}
  76
  77static inline int seccomp_mode(struct seccomp *s)
  78{
  79        return SECCOMP_MODE_DISABLED;
  80}
  81#endif /* CONFIG_SECCOMP */
  82
  83#ifdef CONFIG_SECCOMP_FILTER
  84extern void put_seccomp_filter(struct task_struct *tsk);
  85extern void get_seccomp_filter(struct task_struct *tsk);
  86#else  /* CONFIG_SECCOMP_FILTER */
  87static inline void put_seccomp_filter(struct task_struct *tsk)
  88{
  89        return;
  90}
  91static inline void get_seccomp_filter(struct task_struct *tsk)
  92{
  93        return;
  94}
  95#endif /* CONFIG_SECCOMP_FILTER */
  96
  97#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  98extern long seccomp_get_filter(struct task_struct *task,
  99                               unsigned long filter_off, void __user *data);
 100extern long seccomp_get_metadata(struct task_struct *task,
 101                                 unsigned long filter_off, void __user *data);
 102#else
 103static inline long seccomp_get_filter(struct task_struct *task,
 104                                      unsigned long n, void __user *data)
 105{
 106        return -EINVAL;
 107}
 108static inline long seccomp_get_metadata(struct task_struct *task,
 109                                        unsigned long filter_off,
 110                                        void __user *data)
 111{
 112        return -EINVAL;
 113}
 114#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 115#endif /* _LINUX_SECCOMP_H */
 116