1*4882a593Smuzhiyun /* SPDX-License-Identifier: GPL-2.0 */
2*4882a593Smuzhiyun #ifndef _LINUX_SECCOMP_H
3*4882a593Smuzhiyun #define _LINUX_SECCOMP_H
4*4882a593Smuzhiyun
5*4882a593Smuzhiyun #include <uapi/linux/seccomp.h>
6*4882a593Smuzhiyun
7*4882a593Smuzhiyun #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8*4882a593Smuzhiyun SECCOMP_FILTER_FLAG_LOG | \
9*4882a593Smuzhiyun SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
10*4882a593Smuzhiyun SECCOMP_FILTER_FLAG_NEW_LISTENER | \
11*4882a593Smuzhiyun SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
12*4882a593Smuzhiyun
13*4882a593Smuzhiyun /* sizeof() the first published struct seccomp_notif_addfd */
14*4882a593Smuzhiyun #define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
15*4882a593Smuzhiyun #define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
16*4882a593Smuzhiyun
17*4882a593Smuzhiyun #ifdef CONFIG_SECCOMP
18*4882a593Smuzhiyun
19*4882a593Smuzhiyun #include <linux/thread_info.h>
20*4882a593Smuzhiyun #include <linux/atomic.h>
21*4882a593Smuzhiyun #include <asm/seccomp.h>
22*4882a593Smuzhiyun
23*4882a593Smuzhiyun struct seccomp_filter;
24*4882a593Smuzhiyun /**
25*4882a593Smuzhiyun * struct seccomp - the state of a seccomp'ed process
26*4882a593Smuzhiyun *
27*4882a593Smuzhiyun * @mode: indicates one of the valid values above for controlled
28*4882a593Smuzhiyun * system calls available to a process.
29*4882a593Smuzhiyun * @filter: must always point to a valid seccomp-filter or NULL as it is
30*4882a593Smuzhiyun * accessed without locking during system call entry.
31*4882a593Smuzhiyun *
32*4882a593Smuzhiyun * @filter must only be accessed from the context of current as there
33*4882a593Smuzhiyun * is no read locking.
34*4882a593Smuzhiyun */
35*4882a593Smuzhiyun struct seccomp {
36*4882a593Smuzhiyun int mode;
37*4882a593Smuzhiyun atomic_t filter_count;
38*4882a593Smuzhiyun struct seccomp_filter *filter;
39*4882a593Smuzhiyun };
40*4882a593Smuzhiyun
41*4882a593Smuzhiyun #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
42*4882a593Smuzhiyun extern int __secure_computing(const struct seccomp_data *sd);
secure_computing(void)43*4882a593Smuzhiyun static inline int secure_computing(void)
44*4882a593Smuzhiyun {
45*4882a593Smuzhiyun if (unlikely(test_thread_flag(TIF_SECCOMP)))
46*4882a593Smuzhiyun return __secure_computing(NULL);
47*4882a593Smuzhiyun return 0;
48*4882a593Smuzhiyun }
49*4882a593Smuzhiyun #else
50*4882a593Smuzhiyun extern void secure_computing_strict(int this_syscall);
51*4882a593Smuzhiyun #endif
52*4882a593Smuzhiyun
53*4882a593Smuzhiyun extern long prctl_get_seccomp(void);
54*4882a593Smuzhiyun extern long prctl_set_seccomp(unsigned long, void __user *);
55*4882a593Smuzhiyun
seccomp_mode(struct seccomp * s)56*4882a593Smuzhiyun static inline int seccomp_mode(struct seccomp *s)
57*4882a593Smuzhiyun {
58*4882a593Smuzhiyun return s->mode;
59*4882a593Smuzhiyun }
60*4882a593Smuzhiyun
61*4882a593Smuzhiyun #else /* CONFIG_SECCOMP */
62*4882a593Smuzhiyun
63*4882a593Smuzhiyun #include <linux/errno.h>
64*4882a593Smuzhiyun
65*4882a593Smuzhiyun struct seccomp { };
66*4882a593Smuzhiyun struct seccomp_filter { };
67*4882a593Smuzhiyun struct seccomp_data;
68*4882a593Smuzhiyun
69*4882a593Smuzhiyun #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
secure_computing(void)70*4882a593Smuzhiyun static inline int secure_computing(void) { return 0; }
__secure_computing(const struct seccomp_data * sd)71*4882a593Smuzhiyun static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
72*4882a593Smuzhiyun #else
secure_computing_strict(int this_syscall)73*4882a593Smuzhiyun static inline void secure_computing_strict(int this_syscall) { return; }
74*4882a593Smuzhiyun #endif
75*4882a593Smuzhiyun
prctl_get_seccomp(void)76*4882a593Smuzhiyun static inline long prctl_get_seccomp(void)
77*4882a593Smuzhiyun {
78*4882a593Smuzhiyun return -EINVAL;
79*4882a593Smuzhiyun }
80*4882a593Smuzhiyun
prctl_set_seccomp(unsigned long arg2,char __user * arg3)81*4882a593Smuzhiyun static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
82*4882a593Smuzhiyun {
83*4882a593Smuzhiyun return -EINVAL;
84*4882a593Smuzhiyun }
85*4882a593Smuzhiyun
seccomp_mode(struct seccomp * s)86*4882a593Smuzhiyun static inline int seccomp_mode(struct seccomp *s)
87*4882a593Smuzhiyun {
88*4882a593Smuzhiyun return SECCOMP_MODE_DISABLED;
89*4882a593Smuzhiyun }
90*4882a593Smuzhiyun #endif /* CONFIG_SECCOMP */
91*4882a593Smuzhiyun
92*4882a593Smuzhiyun #ifdef CONFIG_SECCOMP_FILTER
93*4882a593Smuzhiyun extern void seccomp_filter_release(struct task_struct *tsk);
94*4882a593Smuzhiyun extern void get_seccomp_filter(struct task_struct *tsk);
95*4882a593Smuzhiyun #else /* CONFIG_SECCOMP_FILTER */
seccomp_filter_release(struct task_struct * tsk)96*4882a593Smuzhiyun static inline void seccomp_filter_release(struct task_struct *tsk)
97*4882a593Smuzhiyun {
98*4882a593Smuzhiyun return;
99*4882a593Smuzhiyun }
get_seccomp_filter(struct task_struct * tsk)100*4882a593Smuzhiyun static inline void get_seccomp_filter(struct task_struct *tsk)
101*4882a593Smuzhiyun {
102*4882a593Smuzhiyun return;
103*4882a593Smuzhiyun }
104*4882a593Smuzhiyun #endif /* CONFIG_SECCOMP_FILTER */
105*4882a593Smuzhiyun
106*4882a593Smuzhiyun #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
107*4882a593Smuzhiyun extern long seccomp_get_filter(struct task_struct *task,
108*4882a593Smuzhiyun unsigned long filter_off, void __user *data);
109*4882a593Smuzhiyun extern long seccomp_get_metadata(struct task_struct *task,
110*4882a593Smuzhiyun unsigned long filter_off, void __user *data);
111*4882a593Smuzhiyun #else
seccomp_get_filter(struct task_struct * task,unsigned long n,void __user * data)112*4882a593Smuzhiyun static inline long seccomp_get_filter(struct task_struct *task,
113*4882a593Smuzhiyun unsigned long n, void __user *data)
114*4882a593Smuzhiyun {
115*4882a593Smuzhiyun return -EINVAL;
116*4882a593Smuzhiyun }
seccomp_get_metadata(struct task_struct * task,unsigned long filter_off,void __user * data)117*4882a593Smuzhiyun static inline long seccomp_get_metadata(struct task_struct *task,
118*4882a593Smuzhiyun unsigned long filter_off,
119*4882a593Smuzhiyun void __user *data)
120*4882a593Smuzhiyun {
121*4882a593Smuzhiyun return -EINVAL;
122*4882a593Smuzhiyun }
123*4882a593Smuzhiyun #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
124*4882a593Smuzhiyun #endif /* _LINUX_SECCOMP_H */
125