1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _LINUX_SECCOMP_H 3 #define _LINUX_SECCOMP_H 4 5 #include <uapi/linux/seccomp.h> 6 #include <linux/seccomp_types.h> 7 8 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \ 9 SECCOMP_FILTER_FLAG_LOG | \ 10 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \ 11 SECCOMP_FILTER_FLAG_NEW_LISTENER | \ 12 SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \ 13 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) 14 15 /* sizeof() the first published struct seccomp_notif_addfd */ 16 #define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24 17 #define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0 18 19 #ifdef CONFIG_SECCOMP 20 21 #include <linux/thread_info.h> 22 #include <linux/atomic.h> 23 #include <asm/seccomp.h> 24 25 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 26 extern int __secure_computing(const struct seccomp_data *sd); 27 static inline int secure_computing(void) 28 { 29 if (unlikely(test_syscall_work(SECCOMP))) 30 return __secure_computing(NULL); 31 return 0; 32 } 33 #else 34 extern void secure_computing_strict(int this_syscall); 35 static inline int __secure_computing(const struct seccomp_data *sd) 36 { 37 secure_computing_strict(sd->nr); 38 return 0; 39 } 40 #endif 41 42 extern long prctl_get_seccomp(void); 43 extern long prctl_set_seccomp(unsigned long, void __user *); 44 45 static inline int seccomp_mode(struct seccomp *s) 46 { 47 return s->mode; 48 } 49 50 #else /* CONFIG_SECCOMP */ 51 52 #include <linux/errno.h> 53 54 struct seccomp_data; 55 56 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 57 static inline int secure_computing(void) { return 0; } 58 #else 59 static inline void secure_computing_strict(int this_syscall) { return; } 60 #endif 61 static inline int __secure_computing(const struct seccomp_data *sd) { return 0; } 62 63 static inline long prctl_get_seccomp(void) 64 { 65 return -EINVAL; 66 } 67 68 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3) 69 { 70 return -EINVAL; 71 } 72 73 static inline int seccomp_mode(struct seccomp *s) 74 { 75 return SECCOMP_MODE_DISABLED; 76 } 77 #endif /* CONFIG_SECCOMP */ 78 79 #ifdef CONFIG_SECCOMP_FILTER 80 extern void seccomp_filter_release(struct task_struct *tsk); 81 extern void get_seccomp_filter(struct task_struct *tsk); 82 #else /* CONFIG_SECCOMP_FILTER */ 83 static inline void seccomp_filter_release(struct task_struct *tsk) 84 { 85 return; 86 } 87 static inline void get_seccomp_filter(struct task_struct *tsk) 88 { 89 return; 90 } 91 #endif /* CONFIG_SECCOMP_FILTER */ 92 93 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 94 extern long seccomp_get_filter(struct task_struct *task, 95 unsigned long filter_off, void __user *data); 96 extern long seccomp_get_metadata(struct task_struct *task, 97 unsigned long filter_off, void __user *data); 98 #else 99 static inline long seccomp_get_filter(struct task_struct *task, 100 unsigned long n, void __user *data) 101 { 102 return -EINVAL; 103 } 104 static inline long seccomp_get_metadata(struct task_struct *task, 105 unsigned long filter_off, 106 void __user *data) 107 { 108 return -EINVAL; 109 } 110 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */ 111 112 #ifdef CONFIG_SECCOMP_CACHE_DEBUG 113 struct seq_file; 114 struct pid_namespace; 115 struct pid; 116 117 int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, 118 struct pid *pid, struct task_struct *task); 119 #endif 120 #endif /* _LINUX_SECCOMP_H */ 121