1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _LINUX_SECCOMP_H
3#define _LINUX_SECCOMP_H
4
5#include <uapi/linux/seccomp.h>
6#include <linux/seccomp_types.h>
7
8#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
9 SECCOMP_FILTER_FLAG_LOG | \
10 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
11 SECCOMP_FILTER_FLAG_NEW_LISTENER | \
12 SECCOMP_FILTER_FLAG_TSYNC_ESRCH | \
13 SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
14
15/* sizeof() the first published struct seccomp_notif_addfd */
16#define SECCOMP_NOTIFY_ADDFD_SIZE_VER0 24
17#define SECCOMP_NOTIFY_ADDFD_SIZE_LATEST SECCOMP_NOTIFY_ADDFD_SIZE_VER0
18
19#ifdef CONFIG_SECCOMP
20
21#include <linux/thread_info.h>
22#include <linux/atomic.h>
23#include <asm/seccomp.h>
24
25extern int __secure_computing(void);
26
27#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
28static inline int secure_computing(void)
29{
30 if (unlikely(test_syscall_work(SECCOMP)))
31 return __secure_computing();
32 return 0;
33}
34#else
35extern void secure_computing_strict(int this_syscall);
36#endif
37
38extern long prctl_get_seccomp(void);
39extern long prctl_set_seccomp(unsigned long, void __user *);
40
41static inline int seccomp_mode(struct seccomp *s)
42{
43 return s->mode;
44}
45
46#else /* CONFIG_SECCOMP */
47
48#include <linux/errno.h>
49
50struct seccomp_data;
51
52#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
53static inline int secure_computing(void) { return 0; }
54#else
55static inline void secure_computing_strict(int this_syscall) { return; }
56#endif
57static inline int __secure_computing(void) { return 0; }
58
59static inline long prctl_get_seccomp(void)
60{
61 return -EINVAL;
62}
63
64static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
65{
66 return -EINVAL;
67}
68
69static inline int seccomp_mode(struct seccomp *s)
70{
71 return SECCOMP_MODE_DISABLED;
72}
73#endif /* CONFIG_SECCOMP */
74
75#ifdef CONFIG_SECCOMP_FILTER
76extern void seccomp_filter_release(struct task_struct *tsk);
77extern void get_seccomp_filter(struct task_struct *tsk);
78#else /* CONFIG_SECCOMP_FILTER */
79static inline void seccomp_filter_release(struct task_struct *tsk)
80{
81 return;
82}
83static inline void get_seccomp_filter(struct task_struct *tsk)
84{
85 return;
86}
87#endif /* CONFIG_SECCOMP_FILTER */
88
89#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
90extern long seccomp_get_filter(struct task_struct *task,
91 unsigned long filter_off, void __user *data);
92extern long seccomp_get_metadata(struct task_struct *task,
93 unsigned long filter_off, void __user *data);
94#else
95static inline long seccomp_get_filter(struct task_struct *task,
96 unsigned long n, void __user *data)
97{
98 return -EINVAL;
99}
100static inline long seccomp_get_metadata(struct task_struct *task,
101 unsigned long filter_off,
102 void __user *data)
103{
104 return -EINVAL;
105}
106#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
107
108#ifdef CONFIG_SECCOMP_CACHE_DEBUG
109struct seq_file;
110struct pid_namespace;
111struct pid;
112
113int proc_pid_seccomp_cache(struct seq_file *m, struct pid_namespace *ns,
114 struct pid *pid, struct task_struct *task);
115#endif
116#endif /* _LINUX_SECCOMP_H */
117