1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_SECCOMP_H
3 #define _LINUX_SECCOMP_H
4
5 #include <uapi/linux/seccomp.h>
6
7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
10 SECCOMP_FILTER_FLAG_NEW_LISTENER | \
11 SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \
12 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
13
14 /* sizeof() the first published struct seccomp_notif_addfd */
15 #define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
16 #define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
17
18 #ifdef CONFIG_SECCOMP
19
20 #include <linux/thread_info.h>
21 #include <linux/atomic.h>
22 #include <asm/seccomp.h>
23
24 struct seccomp_filter;
25 /**
26 * struct seccomp - the state of a seccomp'ed process
27 *
28 * @mode: indicates one of the valid values above for controlled
29 * system calls available to a process.
30 * @filter: must always point to a valid seccomp-filter or NULL as it is
31 * accessed without locking during system call entry.
32 *
33 * @filter must only be accessed from the context of current as there
34 * is no read locking.
35 */
36 struct seccomp {
37 int mode;
38 atomic_t filter_count;
39 struct seccomp_filter *filter;
40 };
41
42 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
43 extern int __secure_computing(const struct seccomp_data *sd);
secure_computing(void)44 static inline int secure_computing(void)
45 {
46 if (unlikely(test_syscall_work(SECCOMP)))
47 return __secure_computing(NULL);
48 return 0;
49 }
50 #else
51 extern void secure_computing_strict(int this_syscall);
52 #endif
53
54 extern long prctl_get_seccomp(void);
55 extern long prctl_set_seccomp(unsigned long, void __user *);
56
seccomp_mode(struct seccomp * s)57 static inline int seccomp_mode(struct seccomp *s)
58 {
59 return s->mode;
60 }
61
62 #else /* CONFIG_SECCOMP */
63
64 #include <linux/errno.h>
65
66 struct seccomp { };
67 struct seccomp_filter { };
68 struct seccomp_data;
69
70 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
secure_computing(void)71 static inline int secure_computing(void) { return 0; }
__secure_computing(const struct seccomp_data * sd)72 static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
73 #else
secure_computing_strict(int this_syscall)74 static inline void secure_computing_strict(int this_syscall) { return; }
75 #endif
76
prctl_get_seccomp(void)77 static inline long prctl_get_seccomp(void)
78 {
79 return -EINVAL;
80 }
81
prctl_set_seccomp(unsigned long arg2,char __user * arg3)82 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
83 {
84 return -EINVAL;
85 }
86
seccomp_mode(struct seccomp * s)87 static inline int seccomp_mode(struct seccomp *s)
88 {
89 return SECCOMP_MODE_DISABLED;
90 }
91 #endif /* CONFIG_SECCOMP */
92
93 #ifdef CONFIG_SECCOMP_FILTER
94 extern void seccomp_filter_release(struct task_struct *tsk);
95 extern void get_seccomp_filter(struct task_struct *tsk);
96 #else /* CONFIG_SECCOMP_FILTER */
seccomp_filter_release(struct task_struct * tsk)97 static inline void seccomp_filter_release(struct task_struct *tsk)
98 {
99 return;
100 }
get_seccomp_filter(struct task_struct * tsk)101 static inline void get_seccomp_filter(struct task_struct *tsk)
102 {
103 return;
104 }
105 #endif /* CONFIG_SECCOMP_FILTER */
106
107 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
108 extern long seccomp_get_filter(struct task_struct *task,
109 unsigned long filter_off, void __user *data);
110 extern long seccomp_get_metadata(struct task_struct *task,
111 unsigned long filter_off, void __user *data);
112 #else
seccomp_get_filter(struct task_struct * task,unsigned long n,void __user * data)113 static inline long seccomp_get_filter(struct task_struct *task,
114 unsigned long n, void __user *data)
115 {
116 return -EINVAL;
117 }
seccomp_get_metadata(struct task_struct * task,unsigned long filter_off,void __user * data)118 static inline long seccomp_get_metadata(struct task_struct *task,
119 unsigned long filter_off,
120 void __user *data)
121 {
122 return -EINVAL;
123 }
124 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
125
126 #ifdef CONFIG_SECCOMP_CACHE_DEBUG
127 struct seq_file;
128
129 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
130 struct pid *pid, struct task_struct *task);
131 #endif
132 #endif /* _LINUX_SECCOMP_H */
133