[linux-2.6-block.git] / include / uapi / linux / seccomp.h

#ifndef _UAPI_LINUX_SECCOMP_H
#define _UAPI_LINUX_SECCOMP_H

#include <linux/compiler.h>
#include <linux/types.h>


/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
#define SECCOMP_MODE_DISABLED	0 /* seccomp is not in use. */
#define SECCOMP_MODE_STRICT	1 /* uses hard-coded filter. */
#define SECCOMP_MODE_FILTER	2 /* uses user-supplied filter. */

/*
 * All BPF programs must return a 32-bit value.
 * The bottom 16-bits are for optional return data.
 * The upper 16-bits are ordered from least permissive values to most.
 *
 * The ordering ensures that a min_t() over composed return values always
 * selects the least permissive choice.
 */
#define SECCOMP_RET_KILL	0x00000000U /* kill the task immediately */
#define SECCOMP_RET_TRAP	0x00030000U /* disallow and force a SIGSYS */
#define SECCOMP_RET_ERRNO	0x00050000U /* returns an errno */
#define SECCOMP_RET_TRACE	0x7ff00000U /* pass to a tracer or disallow */
#define SECCOMP_RET_ALLOW	0x7fff0000U /* allow */

/* Masks for the return value sections. */
#define SECCOMP_RET_ACTION	0x7fff0000U
#define SECCOMP_RET_DATA	0x0000ffffU

/**
 * struct seccomp_data - the format the BPF program executes over.
 * @nr: the system call number
 * @arch: indicates system call convention as an AUDIT_ARCH_* value
 *        as defined in <linux/audit.h>.
 * @instruction_pointer: at the time of the system call.
 * @args: up to 6 system call arguments always stored as 64-bit values
 *        regardless of the architecture.
 */
struct seccomp_data {
	int nr;
	__u32 arch;
	__u64 instruction_pointer;
	__u64 args[6];
};

#endif /* _UAPI_LINUX_SECCOMP_H */
Commit	Line	Data
607ca46e DH	1	#ifndef _UAPI_LINUX_SECCOMP_H
	2	#define _UAPI_LINUX_SECCOMP_H
	3
	4	#include <linux/compiler.h>
	5	#include <linux/types.h>
	6
	7
	8	/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
	9	#define SECCOMP_MODE_DISABLED 0 /* seccomp is not in use. */
	10	#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
	11	#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
	12
	13	/*
	14	* All BPF programs must return a 32-bit value.
	15	* The bottom 16-bits are for optional return data.
	16	* The upper 16-bits are ordered from least permissive values to most.
	17	*
	18	* The ordering ensures that a min_t() over composed return values always
	19	* selects the least permissive choice.
	20	*/
	21	#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
	22	#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
	23	#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
	24	#define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
	25	#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
	26
	27	/* Masks for the return value sections. */
	28	#define SECCOMP_RET_ACTION 0x7fff0000U
	29	#define SECCOMP_RET_DATA 0x0000ffffU
	30
	31	/**
	32	* struct seccomp_data - the format the BPF program executes over.
	33	* @nr: the system call number
	34	* @arch: indicates system call convention as an AUDIT_ARCH_* value
	35	* as defined in <linux/audit.h>.
	36	* @instruction_pointer: at the time of the system call.
	37	* @args: up to 6 system call arguments always stored as 64-bit values
	38	* regardless of the architecture.
	39	*/
	40	struct seccomp_data {
	41	int nr;
	42	__u32 arch;
	43	__u64 instruction_pointer;
	44	__u64 args[6];
	45	};
	46
	47	#endif /* _UAPI_LINUX_SECCOMP_H */