LXR linux/include/linux/seccomp.h

   1/* SPDX-License-Identifier: GPL-2.0 */
   2#ifndef _LINUX_SECCOMP_H
   3#define _LINUX_SECCOMP_H
   4
   5#include <uapi/linux/seccomp.h>
   6
   7#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC | \
   8                                         SECCOMP_FILTER_FLAG_LOG | \
   9                                         SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
  10                                         SECCOMP_FILTER_FLAG_NEW_LISTENER | \
  11                                         SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
  12
  13/* sizeof() the first published struct seccomp_notif_addfd */
  14#define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
  15#define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
  16
  17#ifdef CONFIG_SECCOMP
  18
  19#include <linux/thread_info.h>
  20#include <linux/atomic.h>
  21#include <asm/seccomp.h>
  22
  23struct seccomp_filter;
  24/**
  25 * struct seccomp - the state of a seccomp'ed process
  26 *
  27 * @mode:  indicates one of the valid values above for controlled
  28 *         system calls available to a process.
  29 * @filter: must always point to a valid seccomp-filter or NULL as it is
  30 *          accessed without locking during system call entry.
  31 *
  32 *          @filter must only be accessed from the context of current as there
  33 *          is no read locking.
  34 */
  35struct seccomp {
  36        int mode;
  37        atomic_t filter_count;
  38        struct seccomp_filter *filter;
  39};
  40
  41#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  42extern int __secure_computing(const struct seccomp_data *sd);
  43static inline int secure_computing(void)
  44{
  45        if (unlikely(test_thread_flag(TIF_SECCOMP)))
  46                return  __secure_computing(NULL);
  47        return 0;
  48}
  49#else
  50extern void secure_computing_strict(int this_syscall);
  51#endif
  52
  53extern long prctl_get_seccomp(void);
  54extern long prctl_set_seccomp(unsigned long, void __user *);
  55
  56static inline int seccomp_mode(struct seccomp *s)
  57{
  58        return s->mode;
  59}
  60
  61#else /* CONFIG_SECCOMP */
  62
  63#include <linux/errno.h>
  64
  65struct seccomp { };
  66struct seccomp_filter { };
  67struct seccomp_data;
  68
  69#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  70static inline int secure_computing(void) { return 0; }
  71static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
  72#else
  73static inline void secure_computing_strict(int this_syscall) { return; }
  74#endif
  75
  76static inline long prctl_get_seccomp(void)
  77{
  78        return -EINVAL;
  79}
  80
  81static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  82{
  83        return -EINVAL;
  84}
  85
  86static inline int seccomp_mode(struct seccomp *s)
  87{
  88        return SECCOMP_MODE_DISABLED;
  89}
  90#endif /* CONFIG_SECCOMP */
  91
  92#ifdef CONFIG_SECCOMP_FILTER
  93extern void seccomp_filter_release(struct task_struct *tsk);
  94extern void get_seccomp_filter(struct task_struct *tsk);
  95#else  /* CONFIG_SECCOMP_FILTER */
  96static inline void seccomp_filter_release(struct task_struct *tsk)
  97{
  98        return;
  99}
 100static inline void get_seccomp_filter(struct task_struct *tsk)
 101{
 102        return;
 103}
 104#endif /* CONFIG_SECCOMP_FILTER */
 105
 106#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
 107extern long seccomp_get_filter(struct task_struct *task,
 108                               unsigned long filter_off, void __user *data);
 109extern long seccomp_get_metadata(struct task_struct *task,
 110                                 unsigned long filter_off, void __user *data);
 111#else
 112static inline long seccomp_get_filter(struct task_struct *task,
 113                                      unsigned long n, void __user *data)
 114{
 115        return -EINVAL;
 116}
 117static inline long seccomp_get_metadata(struct task_struct *task,
 118                                        unsigned long filter_off,
 119                                        void __user *data)
 120{
 121        return -EINVAL;
 122}
 123#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 124#endif /* _LINUX_SECCOMP_H */
 125