include/linux/seccomp.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2 #ifndef _LINUX_SECCOMP_H
   3 #define _LINUX_SECCOMP_H
   4
   5 #include <uapi/linux/seccomp.h>
   6
   7 #define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC | \
   8                                          SECCOMP_FILTER_FLAG_LOG)
   9
  10 #ifdef CONFIG_SECCOMP
  11
  12 #include <linux/thread_info.h>
  13 #include <asm/seccomp.h>
  14
  15 struct seccomp_filter;
  16 /**
  17  * struct seccomp - the state of a seccomp'ed process
  18  *
  19  * @mode:  indicates one of the valid values above for controlled
  20  *         system calls available to a process.
  21  * @filter: must always point to a valid seccomp-filter or NULL as it is
  22  *          accessed without locking during system call entry.
  23  *
  24  *          @filter must only be accessed from the context of current as there
  25  *          is no read locking.
  26  */
  27 struct seccomp {
  28         int mode;
  29         struct seccomp_filter *filter;
  30 };
  31
  32 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  33 extern int __secure_computing(const struct seccomp_data *sd);
  34 static inline int secure_computing(const struct seccomp_data *sd)
  35 {
  36         if (unlikely(test_thread_flag(TIF_SECCOMP)))
  37                 return  __secure_computing(sd);
  38         return 0;
  39 }
  40 #else
  41 extern void secure_computing_strict(int this_syscall);
  42 #endif
  43
  44 extern long prctl_get_seccomp(void);
  45 extern long prctl_set_seccomp(unsigned long, char __user *);
  46
  47 static inline int seccomp_mode(struct seccomp *s)
  48 {
  49         return s->mode;
  50 }
  51
  52 #else /* CONFIG_SECCOMP */
  53
  54 #include <linux/errno.h>
  55
  56 struct seccomp { };
  57 struct seccomp_filter { };
  58
  59 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  60 static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  61 #else
  62 static inline void secure_computing_strict(int this_syscall) { return; }
  63 #endif
  64
  65 static inline long prctl_get_seccomp(void)
  66 {
  67         return -EINVAL;
  68 }
  69
  70 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  71 {
  72         return -EINVAL;
  73 }
  74
  75 static inline int seccomp_mode(struct seccomp *s)
  76 {
  77         return SECCOMP_MODE_DISABLED;
  78 }
  79 #endif /* CONFIG_SECCOMP */
  80
  81 #ifdef CONFIG_SECCOMP_FILTER
  82 extern void put_seccomp_filter(struct task_struct *tsk);
  83 extern void get_seccomp_filter(struct task_struct *tsk);
  84 #else  /* CONFIG_SECCOMP_FILTER */
  85 static inline void put_seccomp_filter(struct task_struct *tsk)
  86 {
  87         return;
  88 }
  89 static inline void get_seccomp_filter(struct task_struct *tsk)
  90 {
  91         return;
  92 }
  93 #endif /* CONFIG_SECCOMP_FILTER */
  94
  95 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  96 extern long seccomp_get_filter(struct task_struct *task,
  97                                unsigned long filter_off, void __user *data);
  98 #else
  99 static inline long seccomp_get_filter(struct task_struct *task,
 100                                       unsigned long n, void __user *data)
 101 {
 102         return -EINVAL;
 103 }
 104 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
 105 #endif /* _LINUX_SECCOMP_H */