Roll src/third_party/WebKit e0eac24:489c548 (svn 193311:193320)
[chromium-blink-merge.git] / sandbox / linux / system_headers / linux_seccomp.h
blob40029c8efbbc663874f425e1550aace19286ad9e
1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_
6 #define SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_
8 #include <linux/filter.h>
10 // The Seccomp2 kernel ABI is not part of older versions of glibc.
11 // As we can't break compilation with these versions of the library,
12 // we explicitly define all missing symbols.
13 // If we ever decide that we can now rely on system headers, the following
14 // include files should be enabled:
15 // #include <linux/audit.h>
16 // #include <linux/seccomp.h>
18 // For audit.h
19 #ifndef EM_ARM
20 #define EM_ARM 40
21 #endif
22 #ifndef EM_386
23 #define EM_386 3
24 #endif
25 #ifndef EM_X86_64
26 #define EM_X86_64 62
27 #endif
28 #ifndef EM_MIPS
29 #define EM_MIPS 8
30 #endif
31 #ifndef EM_AARCH64
32 #define EM_AARCH64 183
33 #endif
35 #ifndef __AUDIT_ARCH_64BIT
36 #define __AUDIT_ARCH_64BIT 0x80000000
37 #endif
38 #ifndef __AUDIT_ARCH_LE
39 #define __AUDIT_ARCH_LE 0x40000000
40 #endif
41 #ifndef AUDIT_ARCH_ARM
42 #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE)
43 #endif
44 #ifndef AUDIT_ARCH_I386
45 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE)
46 #endif
47 #ifndef AUDIT_ARCH_X86_64
48 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
49 #endif
50 #ifndef AUDIT_ARCH_MIPSEL
51 #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE)
52 #endif
53 #ifndef AUDIT_ARCH_AARCH64
54 #define AUDIT_ARCH_AARCH64 (EM_AARCH64 | __AUDIT_ARCH_64BIT | __AUDIT_ARCH_LE)
55 #endif
57 // For prctl.h
58 #ifndef PR_SET_SECCOMP
59 #define PR_SET_SECCOMP 22
60 #define PR_GET_SECCOMP 21
61 #endif
62 #ifndef PR_SET_NO_NEW_PRIVS
63 #define PR_SET_NO_NEW_PRIVS 38
64 #define PR_GET_NO_NEW_PRIVS 39
65 #endif
66 #ifndef IPC_64
67 #define IPC_64 0x0100
68 #endif
70 #ifndef BPF_MOD
71 #define BPF_MOD 0x90
72 #endif
73 #ifndef BPF_XOR
74 #define BPF_XOR 0xA0
75 #endif
77 // In order to build will older tool chains, we currently have to avoid
78 // including <linux/seccomp.h>. Until that can be fixed (if ever). Rely on
79 // our own definitions of the seccomp kernel ABI.
80 #ifndef SECCOMP_MODE_FILTER
81 #define SECCOMP_MODE_DISABLED 0
82 #define SECCOMP_MODE_STRICT 1
83 #define SECCOMP_MODE_FILTER 2 // User user-supplied filter
84 #endif
86 #ifndef SECCOMP_SET_MODE_STRICT
87 #define SECCOMP_SET_MODE_STRICT 0
88 #endif
89 #ifndef SECCOMP_SET_MODE_FILTER
90 #define SECCOMP_SET_MODE_FILTER 1
91 #endif
92 #ifndef SECCOMP_FILTER_FLAG_TSYNC
93 #define SECCOMP_FILTER_FLAG_TSYNC 1
94 #endif
96 #ifndef SECCOMP_RET_KILL
97 // Return values supported for BPF filter programs. Please note that the
98 // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only
99 // ever be used internally, and would result in the kernel killing our process.
100 #define SECCOMP_RET_KILL 0x00000000U // Kill the task immediately
101 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value
102 #define SECCOMP_RET_TRAP 0x00030000U // Disallow and force a SIGSYS
103 #define SECCOMP_RET_ERRNO 0x00050000U // Returns an errno
104 #define SECCOMP_RET_TRACE 0x7ff00000U // Pass to a tracer or disallow
105 #define SECCOMP_RET_ALLOW 0x7fff0000U // Allow
106 #define SECCOMP_RET_ACTION 0xffff0000U // Masks for the return value
107 #define SECCOMP_RET_DATA 0x0000ffffU // sections
108 #else
109 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value
110 #endif
112 #ifndef SYS_SECCOMP
113 #define SYS_SECCOMP 1
114 #endif
116 #endif // SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_