]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - include/linux/seccomp.h
1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_SECCOMP_H
3 #define _LINUX_SECCOMP_H
5 #include <uapi/linux/seccomp.h>
7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW)
13 #include <linux/thread_info.h>
14 #include <asm/seccomp.h>
16 struct seccomp_filter
;
18 * struct seccomp - the state of a seccomp'ed process
20 * @mode: indicates one of the valid values above for controlled
21 * system calls available to a process.
22 * @filter: must always point to a valid seccomp-filter or NULL as it is
23 * accessed without locking during system call entry.
25 * @filter must only be accessed from the context of current as there
30 struct seccomp_filter
*filter
;
33 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
34 extern int __secure_computing(const struct seccomp_data
*sd
);
35 static inline int secure_computing(const struct seccomp_data
*sd
)
37 if (unlikely(test_thread_flag(TIF_SECCOMP
)))
38 return __secure_computing(sd
);
42 extern void secure_computing_strict(int this_syscall
);
45 extern long prctl_get_seccomp(void);
46 extern long prctl_set_seccomp(unsigned long, char __user
*);
48 static inline int seccomp_mode(struct seccomp
*s
)
53 #else /* CONFIG_SECCOMP */
55 #include <linux/errno.h>
58 struct seccomp_filter
{ };
60 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
61 static inline int secure_computing(struct seccomp_data
*sd
) { return 0; }
63 static inline void secure_computing_strict(int this_syscall
) { return; }
66 static inline long prctl_get_seccomp(void)
71 static inline long prctl_set_seccomp(unsigned long arg2
, char __user
*arg3
)
76 static inline int seccomp_mode(struct seccomp
*s
)
78 return SECCOMP_MODE_DISABLED
;
80 #endif /* CONFIG_SECCOMP */
82 #ifdef CONFIG_SECCOMP_FILTER
83 extern void put_seccomp_filter(struct task_struct
*tsk
);
84 extern void get_seccomp_filter(struct task_struct
*tsk
);
85 #else /* CONFIG_SECCOMP_FILTER */
86 static inline void put_seccomp_filter(struct task_struct
*tsk
)
90 static inline void get_seccomp_filter(struct task_struct
*tsk
)
94 #endif /* CONFIG_SECCOMP_FILTER */
96 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
97 extern long seccomp_get_filter(struct task_struct
*task
,
98 unsigned long filter_off
, void __user
*data
);
100 static inline long seccomp_get_filter(struct task_struct
*task
,
101 unsigned long n
, void __user
*data
)
105 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
106 #endif /* _LINUX_SECCOMP_H */