1/* SPDX-License-Identifier: GPL-2.0 */ 2#ifndef _LINUX_SECCOMP_H 3#define _LINUX_SECCOMP_H 4 5#include <uapi/linux/seccomp.h> 6#include <linux/seccomp_types.h> 7 8#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \ 9 SECCOMP_FILTER_FLAG_LOG | \ 10 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \ 11 SECCOMP_FILTER_FLAG_NEW_LISTENER | \ 12 SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \ 13 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV) 14 15/* sizeof() the first published struct seccomp_notif_addfd */ 16#define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24 17#define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0 18 19#ifdef CONFIG_SECCOMP 20 21#include <linux/thread_info.h> 22#include <linux/atomic.h> 23#include <asm/seccomp.h> 24 25#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 26extern int __secure_computing(const struct seccomp_data *sd); 27static inline int secure_computing(void) 28{ 29 if (unlikely(test_syscall_work(SECCOMP))) 30 return __secure_computing(NULL); 31 return 0; 32} 33#else 34extern void secure_computing_strict(int this_syscall); 35#endif 36 37extern long prctl_get_seccomp(void); 38extern long prctl_set_seccomp(unsigned long, void __user *); 39 40static inline int seccomp_mode(struct seccomp *s) 41{ 42 return s->mode; 43} 44 45#else /* CONFIG_SECCOMP */ 46 47#include <linux/errno.h> 48 49struct seccomp_data; 50 51#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 52static inline int secure_computing(void) { return 0; } 53static inline int __secure_computing(const struct seccomp_data *sd) { return 0; } 54#else 55static inline void secure_computing_strict(int this_syscall) { return; } 56#endif 57 58static inline long prctl_get_seccomp(void) 59{ 60 return -EINVAL; 61} 62 63static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3) 64{ 65 return -EINVAL; 66} 67 68static inline int seccomp_mode(struct seccomp *s) 69{ 70 return SECCOMP_MODE_DISABLED; 71} 72#endif /* CONFIG_SECCOMP */ 73 74#ifdef CONFIG_SECCOMP_FILTER 75extern void seccomp_filter_release(struct task_struct *tsk); 76extern void get_seccomp_filter(struct task_struct *tsk); 77#else /* CONFIG_SECCOMP_FILTER */ 78static inline void seccomp_filter_release(struct task_struct *tsk) 79{ 80 return; 81} 82static inline void get_seccomp_filter(struct task_struct *tsk) 83{ 84 return; 85} 86#endif /* CONFIG_SECCOMP_FILTER */ 87 88#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 89extern long seccomp_get_filter(struct task_struct *task, 90 unsigned long filter_off, void __user *data); 91extern long seccomp_get_metadata(struct task_struct *task, 92 unsigned long filter_off, void __user *data); 93#else 94static inline long seccomp_get_filter(struct task_struct *task, 95 unsigned long n, void __user *data) 96{ 97 return -EINVAL; 98} 99static inline long seccomp_get_metadata(struct task_struct *task, 100 unsigned long filter_off, 101 void __user *data) 102{ 103 return -EINVAL; 104} 105#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */ 106 107#ifdef CONFIG_SECCOMP_CACHE_DEBUG 108struct seq_file; 109struct pid_namespace; 110struct pid; 111 112int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns, 113 struct pid *pid, struct task_struct *task); 114#endif 115#endif /* _LINUX_SECCOMP_H */ 116