1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_SECCOMP_H
3 #define _LINUX_SECCOMP_H
5 #include <uapi/linux/seccomp.h>
7 #define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
10 SECCOMP_FILTER_FLAG_NEW_LISTENER)
14 #include <linux/thread_info.h>
15 #include <asm/seccomp.h>
17 struct seccomp_filter;
19 * struct seccomp - the state of a seccomp'ed process
21 * @mode: indicates one of the valid values above for controlled
22 * system calls available to a process.
23 * @filter: must always point to a valid seccomp-filter or NULL as it is
24 * accessed without locking during system call entry.
26 * @filter must only be accessed from the context of current as there
31 struct seccomp_filter *filter;
34 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
35 extern int __secure_computing(const struct seccomp_data *sd);
36 static inline int secure_computing(const struct seccomp_data *sd)
38 if (unlikely(test_thread_flag(TIF_SECCOMP)))
39 return __secure_computing(sd);
43 extern void secure_computing_strict(int this_syscall);
46 extern long prctl_get_seccomp(void);
47 extern long prctl_set_seccomp(unsigned long, void __user *);
49 static inline int seccomp_mode(struct seccomp *s)
54 #else /* CONFIG_SECCOMP */
56 #include <linux/errno.h>
59 struct seccomp_filter { };
61 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
62 static inline int secure_computing(struct seccomp_data *sd) { return 0; }
64 static inline void secure_computing_strict(int this_syscall) { return; }
67 static inline long prctl_get_seccomp(void)
72 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
77 static inline int seccomp_mode(struct seccomp *s)
79 return SECCOMP_MODE_DISABLED;
81 #endif /* CONFIG_SECCOMP */
83 #ifdef CONFIG_SECCOMP_FILTER
84 extern void put_seccomp_filter(struct task_struct *tsk);
85 extern void get_seccomp_filter(struct task_struct *tsk);
86 #else /* CONFIG_SECCOMP_FILTER */
87 static inline void put_seccomp_filter(struct task_struct *tsk)
91 static inline void get_seccomp_filter(struct task_struct *tsk)
95 #endif /* CONFIG_SECCOMP_FILTER */
97 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
98 extern long seccomp_get_filter(struct task_struct *task,
99 unsigned long filter_off, void __user *data);
100 extern long seccomp_get_metadata(struct task_struct *task,
101 unsigned long filter_off, void __user *data);
103 static inline long seccomp_get_filter(struct task_struct *task,
104 unsigned long n, void __user *data)
108 static inline long seccomp_get_metadata(struct task_struct *task,
109 unsigned long filter_off,
114 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
115 #endif /* _LINUX_SECCOMP_H */