1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _LINUX_SECCOMP_H
3#define _LINUX_SECCOMP_H
4
5#include <uapi/linux/seccomp.h>
6
7#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
10 SECCOMP_FILTER_FLAG_NEW_LISTENER | \
11 SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \
12 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
13
14/* sizeof() the first published struct seccomp_notif_addfd */
15#define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
16#define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
17
18#ifdef CONFIG_SECCOMP
19
20#include <linux/thread_info.h>
21#include <linux/atomic.h>
22#include <asm/seccomp.h>
23
24struct seccomp_filter;
25/**
26 * struct seccomp - the state of a seccomp'ed process
27 *
28 * @mode: indicates one of the valid values above for controlled
29 * system calls available to a process.
30 * @filter_count: number of seccomp filters
31 * @filter: must always point to a valid seccomp-filter or NULL as it is
32 * accessed without locking during system call entry.
33 *
34 * @filter must only be accessed from the context of current as there
35 * is no read locking.
36 */
37struct seccomp {
38 int mode;
39 atomic_t filter_count;
40 struct seccomp_filter *filter;
41};
42
43#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
44extern int __secure_computing(const struct seccomp_data *sd);
45static inline int secure_computing(void)
46{
47 if (unlikely(test_syscall_work(SECCOMP)))
48 return __secure_computing(NULL);
49 return 0;
50}
51#else
52extern void secure_computing_strict(int this_syscall);
53#endif
54
55extern long prctl_get_seccomp(void);
56extern long prctl_set_seccomp(unsigned long, void __user *);
57
58static inline int seccomp_mode(struct seccomp *s)
59{
60 return s->mode;
61}
62
63#else /* CONFIG_SECCOMP */
64
65#include <linux/errno.h>
66
67struct seccomp { };
68struct seccomp_filter { };
69struct seccomp_data;
70
71#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
72static inline int secure_computing(void) { return 0; }
73static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
74#else
75static inline void secure_computing_strict(int this_syscall) { return; }
76#endif
77
78static inline long prctl_get_seccomp(void)
79{
80 return -EINVAL;
81}
82
83static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
84{
85 return -EINVAL;
86}
87
88static inline int seccomp_mode(struct seccomp *s)
89{
90 return SECCOMP_MODE_DISABLED;
91}
92#endif /* CONFIG_SECCOMP */
93
94#ifdef CONFIG_SECCOMP_FILTER
95extern void seccomp_filter_release(struct task_struct *tsk);
96extern void get_seccomp_filter(struct task_struct *tsk);
97#else /* CONFIG_SECCOMP_FILTER */
98static inline void seccomp_filter_release(struct task_struct *tsk)
99{
100 return;
101}
102static inline void get_seccomp_filter(struct task_struct *tsk)
103{
104 return;
105}
106#endif /* CONFIG_SECCOMP_FILTER */
107
108#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
109extern long seccomp_get_filter(struct task_struct *task,
110 unsigned long filter_off, void __user *data);
111extern long seccomp_get_metadata(struct task_struct *task,
112 unsigned long filter_off, void __user *data);
113#else
114static inline long seccomp_get_filter(struct task_struct *task,
115 unsigned long n, void __user *data)
116{
117 return -EINVAL;
118}
119static inline long seccomp_get_metadata(struct task_struct *task,
120 unsigned long filter_off,
121 void __user *data)
122{
123 return -EINVAL;
124}
125#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
126
127#ifdef CONFIG_SECCOMP_CACHE_DEBUG
128struct seq_file;
129
130int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
131 struct pid *pid, struct task_struct *task);
132#endif
133#endif /* _LINUX_SECCOMP_H */
134

source code of linux/include/linux/seccomp.h