[linux-block.git] / include / uapi / linux / seccomp.h

/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _UAPI_LINUX_SECCOMP_H
#define _UAPI_LINUX_SECCOMP_H

#include <linux/compiler.h>
#include <linux/types.h>


/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
#define SECCOMP_MODE_DISABLED	0 /* seccomp is not in use. */
#define SECCOMP_MODE_STRICT	1 /* uses hard-coded filter. */
#define SECCOMP_MODE_FILTER	2 /* uses user-supplied filter. */

/* Valid operations for seccomp syscall. */
#define SECCOMP_SET_MODE_STRICT		0
#define SECCOMP_SET_MODE_FILTER		1
#define SECCOMP_GET_ACTION_AVAIL	2
#define SECCOMP_GET_NOTIF_SIZES		3

/* Valid flags for SECCOMP_SET_MODE_FILTER */
#define SECCOMP_FILTER_FLAG_TSYNC		(1UL << 0)
#define SECCOMP_FILTER_FLAG_LOG			(1UL << 1)
#define SECCOMP_FILTER_FLAG_SPEC_ALLOW		(1UL << 2)
#define SECCOMP_FILTER_FLAG_NEW_LISTENER	(1UL << 3)
#define SECCOMP_FILTER_FLAG_TSYNC_ESRCH		(1UL << 4)

/*
 * All BPF programs must return a 32-bit value.
 * The bottom 16-bits are for optional return data.
 * The upper 16-bits are ordered from least permissive values to most,
 * as a signed value (so 0x8000000 is negative).
 *
 * The ordering ensures that a min_t() over composed return values always
 * selects the least permissive choice.
 */
#define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
#define SECCOMP_RET_KILL_THREAD	 0x00000000U /* kill the thread */
#define SECCOMP_RET_KILL	 SECCOMP_RET_KILL_THREAD
#define SECCOMP_RET_TRAP	 0x00030000U /* disallow and force a SIGSYS */
#define SECCOMP_RET_ERRNO	 0x00050000U /* returns an errno */
#define SECCOMP_RET_USER_NOTIF	 0x7fc00000U /* notifies userspace */
#define SECCOMP_RET_TRACE	 0x7ff00000U /* pass to a tracer or disallow */
#define SECCOMP_RET_LOG		 0x7ffc0000U /* allow after logging */
#define SECCOMP_RET_ALLOW	 0x7fff0000U /* allow */

/* Masks for the return value sections. */
#define SECCOMP_RET_ACTION_FULL	0xffff0000U
#define SECCOMP_RET_ACTION	0x7fff0000U
#define SECCOMP_RET_DATA	0x0000ffffU

/**
 * struct seccomp_data - the format the BPF program executes over.
 * @nr: the system call number
 * @arch: indicates system call convention as an AUDIT_ARCH_* value
 *        as defined in <linux/audit.h>.
 * @instruction_pointer: at the time of the system call.
 * @args: up to 6 system call arguments always stored as 64-bit values
 *        regardless of the architecture.
 */
struct seccomp_data {
	int nr;
	__u32 arch;
	__u64 instruction_pointer;
	__u64 args[6];
};

struct seccomp_notif_sizes {
	__u16 seccomp_notif;
	__u16 seccomp_notif_resp;
	__u16 seccomp_data;
};

struct seccomp_notif {
	__u64 id;
	__u32 pid;
	__u32 flags;
	struct seccomp_data data;
};

/*
 * Valid flags for struct seccomp_notif_resp
 *
 * Note, the SECCOMP_USER_NOTIF_FLAG_CONTINUE flag must be used with caution!
 * If set by the process supervising the syscalls of another process the
 * syscall will continue. This is problematic because of an inherent TOCTOU.
 * An attacker can exploit the time while the supervised process is waiting on
 * a response from the supervising process to rewrite syscall arguments which
 * are passed as pointers of the intercepted syscall.
 * It should be absolutely clear that this means that the seccomp notifier
 * _cannot_ be used to implement a security policy! It should only ever be used
 * in scenarios where a more privileged process supervises the syscalls of a
 * lesser privileged process to get around kernel-enforced security
 * restrictions when the privileged process deems this safe. In other words,
 * in order to continue a syscall the supervising process should be sure that
 * another security mechanism or the kernel itself will sufficiently block
 * syscalls if arguments are rewritten to something unsafe.
 *
 * Similar precautions should be applied when stacking SECCOMP_RET_USER_NOTIF
 * or SECCOMP_RET_TRACE. For SECCOMP_RET_USER_NOTIF filters acting on the
 * same syscall, the most recently added filter takes precedence. This means
 * that the new SECCOMP_RET_USER_NOTIF filter can override any
 * SECCOMP_IOCTL_NOTIF_SEND from earlier filters, essentially allowing all
 * such filtered syscalls to be executed by sending the response
 * SECCOMP_USER_NOTIF_FLAG_CONTINUE. Note that SECCOMP_RET_TRACE can equally
 * be overriden by SECCOMP_USER_NOTIF_FLAG_CONTINUE.
 */
#define SECCOMP_USER_NOTIF_FLAG_CONTINUE (1UL << 0)

struct seccomp_notif_resp {
	__u64 id;
	__s64 val;
	__s32 error;
	__u32 flags;
};

#define SECCOMP_IOC_MAGIC		'!'
#define SECCOMP_IO(nr)			_IO(SECCOMP_IOC_MAGIC, nr)
#define SECCOMP_IOR(nr, type)		_IOR(SECCOMP_IOC_MAGIC, nr, type)
#define SECCOMP_IOW(nr, type)		_IOW(SECCOMP_IOC_MAGIC, nr, type)
#define SECCOMP_IOWR(nr, type)		_IOWR(SECCOMP_IOC_MAGIC, nr, type)

/* Flags for seccomp notification fd ioctl. */
#define SECCOMP_IOCTL_NOTIF_RECV	SECCOMP_IOWR(0, struct seccomp_notif)
#define SECCOMP_IOCTL_NOTIF_SEND	SECCOMP_IOWR(1,	\
						struct seccomp_notif_resp)
#define SECCOMP_IOCTL_NOTIF_ID_VALID	SECCOMP_IOR(2, __u64)
#endif /* _UAPI_LINUX_SECCOMP_H */
Commit	Line	Data
6f52b16c	1	/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
607ca46e DH	2	#ifndef _UAPI_LINUX_SECCOMP_H
	3	#define _UAPI_LINUX_SECCOMP_H
	4
	5	#include <linux/compiler.h>
	6	#include <linux/types.h>
	7
	8
	9	/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
	10	#define SECCOMP_MODE_DISABLED 0 /* seccomp is not in use. */
	11	#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
	12	#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
	13
48dc92b9	14	/* Valid operations for seccomp syscall. */
d612b1fd TH	15	#define SECCOMP_SET_MODE_STRICT 0
	16	#define SECCOMP_SET_MODE_FILTER 1
	17	#define SECCOMP_GET_ACTION_AVAIL 2
6a21cc50	18	#define SECCOMP_GET_NOTIF_SIZES 3
48dc92b9	19
c2e1f2e3	20	/* Valid flags for SECCOMP_SET_MODE_FILTER */
6a21cc50 TA	21	#define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0)
	22	#define SECCOMP_FILTER_FLAG_LOG (1UL << 1)
	23	#define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
	24	#define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3)
51891498	25	#define SECCOMP_FILTER_FLAG_TSYNC_ESRCH (1UL << 4)
c2e1f2e3	26
607ca46e DH	27	/*
	28	* All BPF programs must return a 32-bit value.
	29	* The bottom 16-bits are for optional return data.
4d3b0b05 KC	30	* The upper 16-bits are ordered from least permissive values to most,
4d3b0b05 KC	31	* as a signed value (so 0x8000000 is negative).
607ca46e DH	32	*
	33	* The ordering ensures that a min_t() over composed return values always
	34	* selects the least permissive choice.
	35	*/
4d3b0b05 KC	36	#define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
	37	#define SECCOMP_RET_KILL_THREAD 0x00000000U /* kill the thread */
	38	#define SECCOMP_RET_KILL SECCOMP_RET_KILL_THREAD
	39	#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
	40	#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
6a21cc50	41	#define SECCOMP_RET_USER_NOTIF 0x7fc00000U /* notifies userspace */
4d3b0b05 KC	42	#define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
	43	#define SECCOMP_RET_LOG 0x7ffc0000U /* allow after logging */
	44	#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
607ca46e DH	45
607ca46e DH	46	/* Masks for the return value sections. */
0466bdb9	47	#define SECCOMP_RET_ACTION_FULL 0xffff0000U
607ca46e DH	48	#define SECCOMP_RET_ACTION 0x7fff0000U
	49	#define SECCOMP_RET_DATA 0x0000ffffU
	50
	51	/**
	52	* struct seccomp_data - the format the BPF program executes over.
	53	* @nr: the system call number
	54	* @arch: indicates system call convention as an AUDIT_ARCH_* value
	55	* as defined in <linux/audit.h>.
	56	* @instruction_pointer: at the time of the system call.
	57	* @args: up to 6 system call arguments always stored as 64-bit values
	58	* regardless of the architecture.
	59	*/
	60	struct seccomp_data {
	61	int nr;
	62	__u32 arch;
	63	__u64 instruction_pointer;
	64	__u64 args[6];
	65	};
	66
6a21cc50 TA	67	struct seccomp_notif_sizes {
	68	__u16 seccomp_notif;
	69	__u16 seccomp_notif_resp;
	70	__u16 seccomp_data;
	71	};
	72
	73	struct seccomp_notif {
	74	__u64 id;
	75	__u32 pid;
	76	__u32 flags;
	77	struct seccomp_data data;
	78	};
	79
fb3c5386 CB	80	/*
	81	* Valid flags for struct seccomp_notif_resp
	82	*
	83	* Note, the SECCOMP_USER_NOTIF_FLAG_CONTINUE flag must be used with caution!
	84	* If set by the process supervising the syscalls of another process the
	85	* syscall will continue. This is problematic because of an inherent TOCTOU.
	86	* An attacker can exploit the time while the supervised process is waiting on
	87	* a response from the supervising process to rewrite syscall arguments which
	88	* are passed as pointers of the intercepted syscall.
	89	* It should be absolutely clear that this means that the seccomp notifier
	90	* _cannot_ be used to implement a security policy! It should only ever be used
	91	* in scenarios where a more privileged process supervises the syscalls of a
	92	* lesser privileged process to get around kernel-enforced security
	93	* restrictions when the privileged process deems this safe. In other words,
	94	* in order to continue a syscall the supervising process should be sure that
	95	* another security mechanism or the kernel itself will sufficiently block
	96	* syscalls if arguments are rewritten to something unsafe.
	97	*
	98	* Similar precautions should be applied when stacking SECCOMP_RET_USER_NOTIF
	99	* or SECCOMP_RET_TRACE. For SECCOMP_RET_USER_NOTIF filters acting on the
	100	* same syscall, the most recently added filter takes precedence. This means
	101	* that the new SECCOMP_RET_USER_NOTIF filter can override any
	102	* SECCOMP_IOCTL_NOTIF_SEND from earlier filters, essentially allowing all
	103	* such filtered syscalls to be executed by sending the response
	104	* SECCOMP_USER_NOTIF_FLAG_CONTINUE. Note that SECCOMP_RET_TRACE can equally
	105	* be overriden by SECCOMP_USER_NOTIF_FLAG_CONTINUE.
	106	*/
23b2c96f	107	#define SECCOMP_USER_NOTIF_FLAG_CONTINUE (1UL << 0)
fb3c5386	108
6a21cc50 TA	109	struct seccomp_notif_resp {
	110	__u64 id;
	111	__s64 val;
	112	__s32 error;
	113	__u32 flags;
	114	};
	115
	116	#define SECCOMP_IOC_MAGIC '!'
	117	#define SECCOMP_IO(nr) _IO(SECCOMP_IOC_MAGIC, nr)
	118	#define SECCOMP_IOR(nr, type) _IOR(SECCOMP_IOC_MAGIC, nr, type)
	119	#define SECCOMP_IOW(nr, type) _IOW(SECCOMP_IOC_MAGIC, nr, type)
	120	#define SECCOMP_IOWR(nr, type) _IOWR(SECCOMP_IOC_MAGIC, nr, type)
	121
	122	/* Flags for seccomp notification fd ioctl. */
	123	#define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif)
	124	#define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \
	125	struct seccomp_notif_resp)
	126	#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64)
607ca46e	127	#endif /* _UAPI_LINUX_SECCOMP_H */