include/linux/seccomp.h

   1 #ifndef _LINUX_SECCOMP_H
   2 #define _LINUX_SECCOMP_H
   3
   4 #include <uapi/linux/seccomp.h>
   5
   6 #define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC)
   7
   8 #ifdef CONFIG_SECCOMP
   9
  10 #include <linux/thread_info.h>
  11 #include <asm/seccomp.h>
  12
  13 struct seccomp_filter;
  14 /**
  15  * struct seccomp - the state of a seccomp'ed process
  16  *
  17  * @mode:  indicates one of the valid values above for controlled
  18  *         system calls available to a process.
  19  * @filter: must always point to a valid seccomp-filter or NULL as it is
  20  *          accessed without locking during system call entry.
  21  *
  22  *          @filter must only be accessed from the context of current as there
  23  *          is no read locking.
  24  */
  25 struct seccomp {
  26         int mode;
  27         struct seccomp_filter *filter;
  28 };
  29
  30 extern int __secure_computing(int);
  31 static inline int secure_computing(int this_syscall)
  32 {
  33         if (unlikely(test_thread_flag(TIF_SECCOMP)))
  34                 return  __secure_computing(this_syscall);
  35         return 0;
  36 }
  37
  38 /* A wrapper for architectures supporting only SECCOMP_MODE_STRICT. */
  39 static inline void secure_computing_strict(int this_syscall)
  40 {
  41         BUG_ON(secure_computing(this_syscall) != 0);
  42 }
  43
  44 extern long prctl_get_seccomp(void);
  45 extern long prctl_set_seccomp(unsigned long, char __user *);
  46
  47 static inline int seccomp_mode(struct seccomp *s)
  48 {
  49         return s->mode;
  50 }
  51
  52 #else /* CONFIG_SECCOMP */
  53
  54 #include <linux/errno.h>
  55
  56 struct seccomp { };
  57 struct seccomp_filter { };
  58
  59 static inline int secure_computing(int this_syscall) { return 0; }
  60 static inline void secure_computing_strict(int this_syscall) { return; }
  61
  62 static inline long prctl_get_seccomp(void)
  63 {
  64         return -EINVAL;
  65 }
  66
  67 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  68 {
  69         return -EINVAL;
  70 }
  71
  72 static inline int seccomp_mode(struct seccomp *s)
  73 {
  74         return 0;
  75 }
  76 #endif /* CONFIG_SECCOMP */
  77
  78 #ifdef CONFIG_SECCOMP_FILTER
  79 extern void put_seccomp_filter(struct task_struct *tsk);
  80 extern void get_seccomp_filter(struct task_struct *tsk);
  81 #else  /* CONFIG_SECCOMP_FILTER */
  82 static inline void put_seccomp_filter(struct task_struct *tsk)
  83 {
  84         return;
  85 }
  86 static inline void get_seccomp_filter(struct task_struct *tsk)
  87 {
  88         return;
  89 }
  90 #endif /* CONFIG_SECCOMP_FILTER */
  91 #endif /* _LINUX_SECCOMP_H */