include/linux/seccomp.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 #ifndef _LINUX_SECCOMP_H
   3 #define _LINUX_SECCOMP_H
   4
   5 #include <uapi/linux/seccomp.h>
   6 #include <linux/seccomp_types.h>
   7
   8 #define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC | \
   9                                          SECCOMP_FILTER_FLAG_LOG | \
  10                                          SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
  11                                          SECCOMP_FILTER_FLAG_NEW_LISTENER | \
  12                                          SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \
  13                                          SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
  14
  15 /* sizeof() the first published struct seccomp_notif_addfd */
  16 #define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
  17 #define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
  18
  19 #ifdef CONFIG_SECCOMP
  20
  21 #include <linux/thread_info.h>
  22 #include <linux/atomic.h>
  23 #include <asm/seccomp.h>
  24
  25 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  26 extern int __secure_computing(const struct seccomp_data *sd);
  27 static inline int secure_computing(void)
  28 {
  29         if (unlikely(test_syscall_work(SECCOMP)))
  30                 return  __secure_computing(NULL);
  31         return 0;
  32 }
  33 #else
  34 extern void secure_computing_strict(int this_syscall);
  35 static inline int __secure_computing(const struct seccomp_data *sd)
  36 {
  37         secure_computing_strict(sd->nr);
  38         return 0;
  39 }
  40 #endif
  41
  42 extern long prctl_get_seccomp(void);
  43 extern long prctl_set_seccomp(unsigned long, void __user *);
  44
  45 static inline int seccomp_mode(struct seccomp *s)
  46 {
  47         return s->mode;
  48 }
  49
  50 #else /* CONFIG_SECCOMP */
  51
  52 #include <linux/errno.h>
  53
  54 struct seccomp_data;
  55
  56 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  57 static inline int secure_computing(void) { return 0; }
  58 static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
  59 #else
  60 static inline void secure_computing_strict(int this_syscall) { return; }
  61 #endif
  62
  63 static inline long prctl_get_seccomp(void)
  64 {
  65         return -EINVAL;
  66 }
  67
  68 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  69 {
  70         return -EINVAL;
  71 }
  72
  73 static inline int seccomp_mode(struct seccomp *s)
  74 {
  75         return SECCOMP_MODE_DISABLED;
  76 }
  77 #endif /* CONFIG_SECCOMP */
  78
  79 #ifdef CONFIG_SECCOMP_FILTER
  80 extern void seccomp_filter_release(struct task_struct *tsk);
  81 extern void get_seccomp_filter(struct task_struct *tsk);
  82 #else  /* CONFIG_SECCOMP_FILTER */
  83 static inline void seccomp_filter_release(struct task_struct *tsk)
  84 {
  85         return;
  86 }
  87 static inline void get_seccomp_filter(struct task_struct *tsk)
  88 {
  89         return;
  90 }
  91 #endif /* CONFIG_SECCOMP_FILTER */
  92
  93 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  94 extern long seccomp_get_filter(struct task_struct *task,
  95                                unsigned long filter_off, void __user *data);
  96 extern long seccomp_get_metadata(struct task_struct *task,
  97                                  unsigned long filter_off, void __user *data);
  98 #else
  99 static inline long seccomp_get_filter(struct task_struct *task,
 100                                       unsigned long n, void __user *data)
 101 {
 102         return -EINVAL;
 103 }
 104 static inline long seccomp_get_metadata(struct task_struct *task,
 105                                         unsigned long filter_off,
 106                                         void __user *data)
 107 {
 108         return -EINVAL;
 109 }
 110 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 111
 112 #ifdef CONFIG_SECCOMP_CACHE_DEBUG
 113 struct seq_file;
 114 struct pid_namespace;
 115 struct pid;
 116
 117 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
 118                            struct pid *pid, struct task_struct *task);
 119 #endif
 120 #endif /* _LINUX_SECCOMP_H */