1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _LINUX_SECCOMP_H 3 #define _LINUX_SECCOMP_H 4 5 #include <uapi/linux/seccomp.h> 6 7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \ 8 SECCOMP_FILTER_FLAG_LOG | \ 9 SECCOMP_FILTER_FLAG_SPEC_ALLOW) 10 11 #ifdef CONFIG_SECCOMP 12 13 #include <linux/thread_info.h> 14 #include <asm/seccomp.h> 15 16 struct seccomp_filter; 17 /** 18 * struct seccomp - the state of a seccomp'ed process 19 * 20 * @mode: indicates one of the valid values above for controlled 21 * system calls available to a process. 22 * @filter: must always point to a valid seccomp-filter or NULL as it is 23 * accessed without locking during system call entry. 24 * 25 * @filter must only be accessed from the context of current as there 26 * is no read locking. 27 */ 28 struct seccomp { 29 int mode; 30 struct seccomp_filter *filter; 31 }; 32 33 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER 34 extern int __secure_computing(const struct seccomp_data *sd); secure_computing(const struct seccomp_data * sd)35static inline int secure_computing(const struct seccomp_data *sd) 36 { 37 if (unlikely(test_thread_flag(TIF_SECCOMP))) 38 return __secure_computing(sd); 39 return 0; 40 } 41 #else 42 extern void secure_computing_strict(int this_syscall); 43 #endif 44 45 extern long prctl_get_seccomp(void); 46 extern long prctl_set_seccomp(unsigned long, char __user *); 47 seccomp_mode(struct seccomp * s)48static inline int seccomp_mode(struct seccomp *s) 49 { 50 return s->mode; 51 } 52 53 #else /* CONFIG_SECCOMP */ 54 55 #include <linux/errno.h> 56 57 struct seccomp { }; 58 struct seccomp_filter { }; 59 60 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER secure_computing(struct seccomp_data * sd)61static inline int secure_computing(struct seccomp_data *sd) { return 0; } 62 #else secure_computing_strict(int this_syscall)63static inline void secure_computing_strict(int this_syscall) { return; } 64 #endif 65 prctl_get_seccomp(void)66static inline long prctl_get_seccomp(void) 67 { 68 return -EINVAL; 69 } 70 prctl_set_seccomp(unsigned long arg2,char __user * arg3)71static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3) 72 { 73 return -EINVAL; 74 } 75 seccomp_mode(struct seccomp * s)76static inline int seccomp_mode(struct seccomp *s) 77 { 78 return SECCOMP_MODE_DISABLED; 79 } 80 #endif /* CONFIG_SECCOMP */ 81 82 #ifdef CONFIG_SECCOMP_FILTER 83 extern void put_seccomp_filter(struct task_struct *tsk); 84 extern void get_seccomp_filter(struct task_struct *tsk); 85 #else /* CONFIG_SECCOMP_FILTER */ put_seccomp_filter(struct task_struct * tsk)86static inline void put_seccomp_filter(struct task_struct *tsk) 87 { 88 return; 89 } get_seccomp_filter(struct task_struct * tsk)90static inline void get_seccomp_filter(struct task_struct *tsk) 91 { 92 return; 93 } 94 #endif /* CONFIG_SECCOMP_FILTER */ 95 96 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE) 97 extern long seccomp_get_filter(struct task_struct *task, 98 unsigned long filter_off, void __user *data); 99 #else seccomp_get_filter(struct task_struct * task,unsigned long n,void __user * data)100static inline long seccomp_get_filter(struct task_struct *task, 101 unsigned long n, void __user *data) 102 { 103 return -EINVAL; 104 } 105 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */ 106 #endif /* _LINUX_SECCOMP_H */ 107