[mirror_ubuntu-artful-kernel.git] / include / uapi / linux / seccomp.h

#ifndef _UAPI_LINUX_SECCOMP_H
#define _UAPI_LINUX_SECCOMP_H

#include <linux/compiler.h>
#include <linux/types.h>


/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
#define SECCOMP_MODE_DISABLED	0 /* seccomp is not in use. */
#define SECCOMP_MODE_STRICT	1 /* uses hard-coded filter. */
#define SECCOMP_MODE_FILTER	2 /* uses user-supplied filter. */

/* Valid operations for seccomp syscall. */
#define SECCOMP_SET_MODE_STRICT	0
#define SECCOMP_SET_MODE_FILTER	1

/*
 * All BPF programs must return a 32-bit value.
 * The bottom 16-bits are for optional return data.
 * The upper 16-bits are ordered from least permissive values to most.
 *
 * The ordering ensures that a min_t() over composed return values always
 * selects the least permissive choice.
 */
#define SECCOMP_RET_KILL	0x00000000U /* kill the task immediately */
#define SECCOMP_RET_TRAP	0x00030000U /* disallow and force a SIGSYS */
#define SECCOMP_RET_ERRNO	0x00050000U /* returns an errno */
#define SECCOMP_RET_TRACE	0x7ff00000U /* pass to a tracer or disallow */
#define SECCOMP_RET_ALLOW	0x7fff0000U /* allow */

/* Masks for the return value sections. */
#define SECCOMP_RET_ACTION	0x7fff0000U
#define SECCOMP_RET_DATA	0x0000ffffU

/**
 * struct seccomp_data - the format the BPF program executes over.
 * @nr: the system call number
 * @arch: indicates system call convention as an AUDIT_ARCH_* value
 *        as defined in <linux/audit.h>.
 * @instruction_pointer: at the time of the system call.
 * @args: up to 6 system call arguments always stored as 64-bit values
 *        regardless of the architecture.
 */
struct seccomp_data {
	int nr;
	__u32 arch;
	__u64 instruction_pointer;
	__u64 args[6];
};

#endif /* _UAPI_LINUX_SECCOMP_H */
Commit	Line	Data
607ca46e DH	1	#ifndef _UAPI_LINUX_SECCOMP_H
	2	#define _UAPI_LINUX_SECCOMP_H
	3
	4	#include <linux/compiler.h>
	5	#include <linux/types.h>
	6
	7
	8	/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
	9	#define SECCOMP_MODE_DISABLED 0 /* seccomp is not in use. */
	10	#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
	11	#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
	12
48dc92b9 KC	13	/* Valid operations for seccomp syscall. */
	14	#define SECCOMP_SET_MODE_STRICT 0
	15	#define SECCOMP_SET_MODE_FILTER 1
	16
607ca46e DH	17	/*
	18	* All BPF programs must return a 32-bit value.
	19	* The bottom 16-bits are for optional return data.
	20	* The upper 16-bits are ordered from least permissive values to most.
	21	*
	22	* The ordering ensures that a min_t() over composed return values always
	23	* selects the least permissive choice.
	24	*/
	25	#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
	26	#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
	27	#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
	28	#define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
	29	#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
	30
	31	/* Masks for the return value sections. */
	32	#define SECCOMP_RET_ACTION 0x7fff0000U
	33	#define SECCOMP_RET_DATA 0x0000ffffU
	34
	35	/**
	36	* struct seccomp_data - the format the BPF program executes over.
	37	* @nr: the system call number
	38	* @arch: indicates system call convention as an AUDIT_ARCH_* value
	39	* as defined in <linux/audit.h>.
	40	* @instruction_pointer: at the time of the system call.
	41	* @args: up to 6 system call arguments always stored as 64-bit values
	42	* regardless of the architecture.
	43	*/
	44	struct seccomp_data {
	45	int nr;
	46	__u32 arch;
	47	__u64 instruction_pointer;
	48	__u64 args[6];
	49	};
	50
	51	#endif /* _UAPI_LINUX_SECCOMP_H */