1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_SECCOMP_H
3 #define _LINUX_SECCOMP_H
4
5 #include <uapi/linux/seccomp.h>
6
7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW)
10
11 #ifdef CONFIG_SECCOMP
12
13 #include <linux/thread_info.h>
14 #include <asm/seccomp.h>
15
16 struct seccomp_filter;
17 /**
18 * struct seccomp - the state of a seccomp'ed process
19 *
20 * @mode: indicates one of the valid values above for controlled
21 * system calls available to a process.
22 * @filter: must always point to a valid seccomp-filter or NULL as it is
23 * accessed without locking during system call entry.
24 *
25 * @filter must only be accessed from the context of current as there
26 * is no read locking.
27 */
28 struct seccomp {
29 int mode;
30 struct seccomp_filter *filter;
31 };
32
33 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
34 extern int __secure_computing(const struct seccomp_data *sd);
secure_computing(const struct seccomp_data * sd)35 static inline int secure_computing(const struct seccomp_data *sd)
36 {
37 if (unlikely(test_thread_flag(TIF_SECCOMP)))
38 return __secure_computing(sd);
39 return 0;
40 }
41 #else
42 extern void secure_computing_strict(int this_syscall);
43 #endif
44
45 extern long prctl_get_seccomp(void);
46 extern long prctl_set_seccomp(unsigned long, char __user *);
47
seccomp_mode(struct seccomp * s)48 static inline int seccomp_mode(struct seccomp *s)
49 {
50 return s->mode;
51 }
52
53 #else /* CONFIG_SECCOMP */
54
55 #include <linux/errno.h>
56
57 struct seccomp { };
58 struct seccomp_filter { };
59
60 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
secure_computing(struct seccomp_data * sd)61 static inline int secure_computing(struct seccomp_data *sd) { return 0; }
62 #else
secure_computing_strict(int this_syscall)63 static inline void secure_computing_strict(int this_syscall) { return; }
64 #endif
65
prctl_get_seccomp(void)66 static inline long prctl_get_seccomp(void)
67 {
68 return -EINVAL;
69 }
70
prctl_set_seccomp(unsigned long arg2,char __user * arg3)71 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
72 {
73 return -EINVAL;
74 }
75
seccomp_mode(struct seccomp * s)76 static inline int seccomp_mode(struct seccomp *s)
77 {
78 return SECCOMP_MODE_DISABLED;
79 }
80 #endif /* CONFIG_SECCOMP */
81
82 #ifdef CONFIG_SECCOMP_FILTER
83 extern void put_seccomp_filter(struct task_struct *tsk);
84 extern void get_seccomp_filter(struct task_struct *tsk);
85 #else /* CONFIG_SECCOMP_FILTER */
put_seccomp_filter(struct task_struct * tsk)86 static inline void put_seccomp_filter(struct task_struct *tsk)
87 {
88 return;
89 }
get_seccomp_filter(struct task_struct * tsk)90 static inline void get_seccomp_filter(struct task_struct *tsk)
91 {
92 return;
93 }
94 #endif /* CONFIG_SECCOMP_FILTER */
95
96 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
97 extern long seccomp_get_filter(struct task_struct *task,
98 unsigned long filter_off, void __user *data);
99 extern long seccomp_get_metadata(struct task_struct *task,
100 unsigned long filter_off, void __user *data);
101 #else
seccomp_get_filter(struct task_struct * task,unsigned long n,void __user * data)102 static inline long seccomp_get_filter(struct task_struct *task,
103 unsigned long n, void __user *data)
104 {
105 return -EINVAL;
106 }
seccomp_get_metadata(struct task_struct * task,unsigned long filter_off,void __user * data)107 static inline long seccomp_get_metadata(struct task_struct *task,
108 unsigned long filter_off,
109 void __user *data)
110 {
111 return -EINVAL;
112 }
113 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
114 #endif /* _LINUX_SECCOMP_H */
115