include/linux/seccomp.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 #ifndef _LINUX_SECCOMP_H
   3 #define _LINUX_SECCOMP_H
   4
   5 #include <uapi/linux/seccomp.h>
   6
   7 #define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC      | \
   8                                          SECCOMP_FILTER_FLAG_LOG        | \
   9                                          SECCOMP_FILTER_FLAG_SPEC_ALLOW)
  10
  11 #ifdef CONFIG_SECCOMP
  12
  13 #include <linux/thread_info.h>
  14 #include <asm/seccomp.h>
  15
  16 struct seccomp_filter;
  17 /**
  18  * struct seccomp - the state of a seccomp'ed process
  19  *
  20  * @mode:  indicates one of the valid values above for controlled
  21  *         system calls available to a process.
  22  * @filter: must always point to a valid seccomp-filter or NULL as it is
  23  *          accessed without locking during system call entry.
  24  *
  25  *          @filter must only be accessed from the context of current as there
  26  *          is no read locking.
  27  */
  28 struct seccomp {
  29         int mode;
  30         struct seccomp_filter *filter;
  31 };
  32
  33 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  34 extern int __secure_computing(const struct seccomp_data *sd);
  35 static inline int secure_computing(const struct seccomp_data *sd)
  36 {
  37         if (unlikely(test_thread_flag(TIF_SECCOMP)))
  38                 return  __secure_computing(sd);
  39         return 0;
  40 }
  41 #else
  42 extern void secure_computing_strict(int this_syscall);
  43 #endif
  44
  45 extern long prctl_get_seccomp(void);
  46 extern long prctl_set_seccomp(unsigned long, char __user *);
  47
  48 static inline int seccomp_mode(struct seccomp *s)
  49 {
  50         return s->mode;
  51 }
  52
  53 #else /* CONFIG_SECCOMP */
  54
  55 #include <linux/errno.h>
  56
  57 struct seccomp { };
  58 struct seccomp_filter { };
  59
  60 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  61 static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  62 #else
  63 static inline void secure_computing_strict(int this_syscall) { return; }
  64 #endif
  65
  66 static inline long prctl_get_seccomp(void)
  67 {
  68         return -EINVAL;
  69 }
  70
  71 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  72 {
  73         return -EINVAL;
  74 }
  75
  76 static inline int seccomp_mode(struct seccomp *s)
  77 {
  78         return SECCOMP_MODE_DISABLED;
  79 }
  80 #endif /* CONFIG_SECCOMP */
  81
  82 #ifdef CONFIG_SECCOMP_FILTER
  83 extern void put_seccomp_filter(struct task_struct *tsk);
  84 extern void get_seccomp_filter(struct task_struct *tsk);
  85 #else  /* CONFIG_SECCOMP_FILTER */
  86 static inline void put_seccomp_filter(struct task_struct *tsk)
  87 {
  88         return;
  89 }
  90 static inline void get_seccomp_filter(struct task_struct *tsk)
  91 {
  92         return;
  93 }
  94 #endif /* CONFIG_SECCOMP_FILTER */
  95
  96 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  97 extern long seccomp_get_filter(struct task_struct *task,
  98                                unsigned long filter_off, void __user *data);
  99 #else
 100 static inline long seccomp_get_filter(struct task_struct *task,
 101                                       unsigned long n, void __user *data)
 102 {
 103         return -EINVAL;
 104 }
 105 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 106 #endif /* _LINUX_SECCOMP_H */