blob: 2296e6b2f690760e5b1c2ab33091349be8d9ef58 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _LINUX_SECCOMP_H
2#define _LINUX_SECCOMP_H
3
David Howells607ca462012-10-13 10:46:48 +01004#include <uapi/linux/seccomp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005
Kees Cookc2e1f2e2014-06-05 00:23:17 -07006#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC)
7
Linus Torvalds1da177e2005-04-16 15:20:36 -07008#ifdef CONFIG_SECCOMP
9
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/thread_info.h>
11#include <asm/seccomp.h>
12
Will Drewrye2cfabdf2012-04-12 16:47:57 -050013struct seccomp_filter;
14/**
15 * struct seccomp - the state of a seccomp'ed process
16 *
17 * @mode: indicates one of the valid values above for controlled
18 * system calls available to a process.
Kees Cookdbd952122014-06-27 15:18:48 -070019 * @filter: must always point to a valid seccomp-filter or NULL as it is
20 * accessed without locking during system call entry.
Will Drewrye2cfabdf2012-04-12 16:47:57 -050021 *
22 * @filter must only be accessed from the context of current as there
Kees Cookdbd952122014-06-27 15:18:48 -070023 * is no read locking.
Will Drewrye2cfabdf2012-04-12 16:47:57 -050024 */
Will Drewry932eceb2012-04-12 16:47:54 -050025struct seccomp {
26 int mode;
Will Drewrye2cfabdf2012-04-12 16:47:57 -050027 struct seccomp_filter *filter;
Will Drewry932eceb2012-04-12 16:47:54 -050028};
Linus Torvalds1da177e2005-04-16 15:20:36 -070029
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070030#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
31extern int __secure_computing(void);
32static inline int secure_computing(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -070033{
34 if (unlikely(test_thread_flag(TIF_SECCOMP)))
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070035 return __secure_computing();
Will Drewryacf3b2c2012-04-12 16:47:59 -050036 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070037}
Andy Lutomirski13aa72f02014-07-21 18:49:15 -070038
39#define SECCOMP_PHASE1_OK 0
40#define SECCOMP_PHASE1_SKIP 1
41
Andy Lutomirskid39bd002014-07-21 18:49:16 -070042extern u32 seccomp_phase1(struct seccomp_data *sd);
Andy Lutomirski13aa72f02014-07-21 18:49:15 -070043int seccomp_phase2(u32 phase1_result);
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070044#else
45extern void secure_computing_strict(int this_syscall);
46#endif
Will Drewrye4da89d2012-04-17 14:48:57 -050047
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -070048extern long prctl_get_seccomp(void);
Will Drewrye2cfabdf2012-04-12 16:47:57 -050049extern long prctl_set_seccomp(unsigned long, char __user *);
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -070050
Will Drewry932eceb2012-04-12 16:47:54 -050051static inline int seccomp_mode(struct seccomp *s)
Andy Lutomirski5cec93c2011-06-05 13:50:24 -040052{
53 return s->mode;
54}
55
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#else /* CONFIG_SECCOMP */
57
Ralf Baechle42a17ad2009-04-18 11:30:56 +020058#include <linux/errno.h>
59
Will Drewry932eceb2012-04-12 16:47:54 -050060struct seccomp { };
Will Drewrye2cfabdf2012-04-12 16:47:57 -050061struct seccomp_filter { };
Linus Torvalds1da177e2005-04-16 15:20:36 -070062
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070063#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
64static inline int secure_computing(void) { return 0; }
65#else
Will Drewrye4da89d2012-04-17 14:48:57 -050066static inline void secure_computing_strict(int this_syscall) { return; }
Andy Lutomirskia4412fc2014-07-21 18:49:14 -070067#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070068
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -070069static inline long prctl_get_seccomp(void)
70{
71 return -EINVAL;
72}
73
Will Drewrye2cfabdf2012-04-12 16:47:57 -050074static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
Andrea Arcangeli1d9d02f2007-07-15 23:41:32 -070075{
76 return -EINVAL;
77}
78
Will Drewry932eceb2012-04-12 16:47:54 -050079static inline int seccomp_mode(struct seccomp *s)
Andy Lutomirski5cec93c2011-06-05 13:50:24 -040080{
Kees Cook221272f2015-06-15 15:29:16 -070081 return SECCOMP_MODE_DISABLED;
Andy Lutomirski5cec93c2011-06-05 13:50:24 -040082}
Linus Torvalds1da177e2005-04-16 15:20:36 -070083#endif /* CONFIG_SECCOMP */
84
Will Drewrye2cfabdf2012-04-12 16:47:57 -050085#ifdef CONFIG_SECCOMP_FILTER
86extern void put_seccomp_filter(struct task_struct *tsk);
87extern void get_seccomp_filter(struct task_struct *tsk);
Will Drewrye2cfabdf2012-04-12 16:47:57 -050088#else /* CONFIG_SECCOMP_FILTER */
89static inline void put_seccomp_filter(struct task_struct *tsk)
90{
91 return;
92}
93static inline void get_seccomp_filter(struct task_struct *tsk)
94{
95 return;
96}
97#endif /* CONFIG_SECCOMP_FILTER */
Tycho Andersenf8e529e2015-10-27 09:23:59 +090098
99#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
100extern long seccomp_get_filter(struct task_struct *task,
101 unsigned long filter_off, void __user *data);
102#else
103static inline long seccomp_get_filter(struct task_struct *task,
104 unsigned long n, void __user *data)
105{
106 return -EINVAL;
107}
108#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109#endif /* _LINUX_SECCOMP_H */