1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _LINUX_SECCOMP_H
3#define _LINUX_SECCOMP_H
4
5#include <uapi/linux/seccomp.h>
6#include <linux/seccomp_types.h>
7
8#define SECCOMP_FILTER_FLAG_MASK	(SECCOMP_FILTER_FLAG_TSYNC | \
9					 SECCOMP_FILTER_FLAG_LOG | \
10					 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
11					 SECCOMP_FILTER_FLAG_NEW_LISTENER | \
12					 SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \
13					 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
14
15/* sizeof() the first published struct seccomp_notif_addfd */
16#define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
17#define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
18
19#ifdef CONFIG_SECCOMP
20
21#include <linux/thread_info.h>
22#include <linux/atomic.h>
23#include <asm/seccomp.h>
24
25#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
26extern int __secure_computing(const struct seccomp_data *sd);
27static inline int secure_computing(void)
28{
29	if (unlikely(test_syscall_work(SECCOMP)))
30		return  __secure_computing(NULL);
31	return 0;
32}
33#else
34extern void secure_computing_strict(int this_syscall);
35#endif
36
37extern long prctl_get_seccomp(void);
38extern long prctl_set_seccomp(unsigned long, void __user *);
39
40static inline int seccomp_mode(struct seccomp *s)
41{
42	return s->mode;
43}
44
45#else /* CONFIG_SECCOMP */
46
47#include <linux/errno.h>
48
49struct seccomp_data;
50
51#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
52static inline int secure_computing(void) { return 0; }
53static inline int __secure_computing(const struct seccomp_data *sd) { return 0; }
54#else
55static inline void secure_computing_strict(int this_syscall) { return; }
56#endif
57
58static inline long prctl_get_seccomp(void)
59{
60	return -EINVAL;
61}
62
63static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
64{
65	return -EINVAL;
66}
67
68static inline int seccomp_mode(struct seccomp *s)
69{
70	return SECCOMP_MODE_DISABLED;
71}
72#endif /* CONFIG_SECCOMP */
73
74#ifdef CONFIG_SECCOMP_FILTER
75extern void seccomp_filter_release(struct task_struct *tsk);
76extern void get_seccomp_filter(struct task_struct *tsk);
77#else  /* CONFIG_SECCOMP_FILTER */
78static inline void seccomp_filter_release(struct task_struct *tsk)
79{
80	return;
81}
82static inline void get_seccomp_filter(struct task_struct *tsk)
83{
84	return;
85}
86#endif /* CONFIG_SECCOMP_FILTER */
87
88#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
89extern long seccomp_get_filter(struct task_struct *task,
90			       unsigned long filter_off, void __user *data);
91extern long seccomp_get_metadata(struct task_struct *task,
92				 unsigned long filter_off, void __user *data);
93#else
94static inline long seccomp_get_filter(struct task_struct *task,
95				      unsigned long n, void __user *data)
96{
97	return -EINVAL;
98}
99static inline long seccomp_get_metadata(struct task_struct *task,
100					unsigned long filter_off,
101					void __user *data)
102{
103	return -EINVAL;
104}
105#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
106
107#ifdef CONFIG_SECCOMP_CACHE_DEBUG
108struct seq_file;
109struct pid_namespace;
110struct pid;
111
112int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
113			   struct pid *pid, struct task_struct *task);
114#endif
115#endif /* _LINUX_SECCOMP_H */
116