1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_SECCOMP_H
3 #define _LINUX_SECCOMP_H
5 #include <uapi/linux/seccomp.h>
7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
10 SECCOMP_FILTER_FLAG_NEW_LISTENER | \
11 SECCOMP_FILTER_FLAG_TSYNC_ESRCH)
15 #include <linux/thread_info.h>
16 #include <asm/seccomp.h>
18 struct seccomp_filter;
20 * struct seccomp - the state of a seccomp'ed process
22 * @mode: indicates one of the valid values above for controlled
23 * system calls available to a process.
24 * @filter: must always point to a valid seccomp-filter or NULL as it is
25 * accessed without locking during system call entry.
27 * @filter must only be accessed from the context of current as there
32 struct seccomp_filter *filter;
35 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
36 extern int __secure_computing(const struct seccomp_data *sd);
37 static inline int secure_computing(void)
39 if (unlikely(test_thread_flag(TIF_SECCOMP)))
40 return __secure_computing(NULL);
44 extern void secure_computing_strict(int this_syscall);
47 extern long prctl_get_seccomp(void);
48 extern long prctl_set_seccomp(unsigned long, void __user *);
50 static inline int seccomp_mode(struct seccomp *s)
55 #else /* CONFIG_SECCOMP */
57 #include <linux/errno.h>
60 struct seccomp_filter { };
62 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
63 static inline int secure_computing(void) { return 0; }
65 static inline void secure_computing_strict(int this_syscall) { return; }
68 static inline long prctl_get_seccomp(void)
73 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
78 static inline int seccomp_mode(struct seccomp *s)
80 return SECCOMP_MODE_DISABLED;
82 #endif /* CONFIG_SECCOMP */
84 #ifdef CONFIG_SECCOMP_FILTER
85 extern void put_seccomp_filter(struct task_struct *tsk);
86 extern void get_seccomp_filter(struct task_struct *tsk);
87 #else /* CONFIG_SECCOMP_FILTER */
88 static inline void put_seccomp_filter(struct task_struct *tsk)
92 static inline void get_seccomp_filter(struct task_struct *tsk)
96 #endif /* CONFIG_SECCOMP_FILTER */
98 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
99 extern long seccomp_get_filter(struct task_struct *task,
100 unsigned long filter_off, void __user *data);
101 extern long seccomp_get_metadata(struct task_struct *task,
102 unsigned long filter_off, void __user *data);
104 static inline long seccomp_get_filter(struct task_struct *task,
105 unsigned long n, void __user *data)
109 static inline long seccomp_get_metadata(struct task_struct *task,
110 unsigned long filter_off,
115 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
116 #endif /* _LINUX_SECCOMP_H */