]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - include/linux/seccomp.h
Merge tag 'staging-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
[mirror_ubuntu-bionic-kernel.git] / include / linux / seccomp.h
1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_SECCOMP_H
3 #define _LINUX_SECCOMP_H
4
5 #include <uapi/linux/seccomp.h>
6
7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG)
9
10 #ifdef CONFIG_SECCOMP
11
12 #include <linux/thread_info.h>
13 #include <asm/seccomp.h>
14
15 struct seccomp_filter;
16 /**
17 * struct seccomp - the state of a seccomp'ed process
18 *
19 * @mode: indicates one of the valid values above for controlled
20 * system calls available to a process.
21 * @filter: must always point to a valid seccomp-filter or NULL as it is
22 * accessed without locking during system call entry.
23 *
24 * @filter must only be accessed from the context of current as there
25 * is no read locking.
26 */
27 struct seccomp {
28 int mode;
29 struct seccomp_filter *filter;
30 };
31
32 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
33 extern int __secure_computing(const struct seccomp_data *sd);
34 static inline int secure_computing(const struct seccomp_data *sd)
35 {
36 if (unlikely(test_thread_flag(TIF_SECCOMP)))
37 return __secure_computing(sd);
38 return 0;
39 }
40 #else
41 extern void secure_computing_strict(int this_syscall);
42 #endif
43
44 extern long prctl_get_seccomp(void);
45 extern long prctl_set_seccomp(unsigned long, char __user *);
46
47 static inline int seccomp_mode(struct seccomp *s)
48 {
49 return s->mode;
50 }
51
52 #else /* CONFIG_SECCOMP */
53
54 #include <linux/errno.h>
55
56 struct seccomp { };
57 struct seccomp_filter { };
58
59 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
60 static inline int secure_computing(struct seccomp_data *sd) { return 0; }
61 #else
62 static inline void secure_computing_strict(int this_syscall) { return; }
63 #endif
64
65 static inline long prctl_get_seccomp(void)
66 {
67 return -EINVAL;
68 }
69
70 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
71 {
72 return -EINVAL;
73 }
74
75 static inline int seccomp_mode(struct seccomp *s)
76 {
77 return SECCOMP_MODE_DISABLED;
78 }
79 #endif /* CONFIG_SECCOMP */
80
81 #ifdef CONFIG_SECCOMP_FILTER
82 extern void put_seccomp_filter(struct task_struct *tsk);
83 extern void get_seccomp_filter(struct task_struct *tsk);
84 #else /* CONFIG_SECCOMP_FILTER */
85 static inline void put_seccomp_filter(struct task_struct *tsk)
86 {
87 return;
88 }
89 static inline void get_seccomp_filter(struct task_struct *tsk)
90 {
91 return;
92 }
93 #endif /* CONFIG_SECCOMP_FILTER */
94
95 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
96 extern long seccomp_get_filter(struct task_struct *task,
97 unsigned long filter_off, void __user *data);
98 #else
99 static inline long seccomp_get_filter(struct task_struct *task,
100 unsigned long n, void __user *data)
101 {
102 return -EINVAL;
103 }
104 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
105 #endif /* _LINUX_SECCOMP_H */