1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _LINUX_SECCOMP_H
3#define _LINUX_SECCOMP_H
4
5#include <uapi/linux/seccomp.h>
6
7#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \
8 SECCOMP_FILTER_FLAG_LOG | \
9 SECCOMP_FILTER_FLAG_SPEC_ALLOW)
10
11#ifdef CONFIG_SECCOMP
12
13#include <linux/thread_info.h>
14#include <asm/seccomp.h>
15
16struct seccomp_filter;
17/**
18 * struct seccomp - the state of a seccomp'ed process
19 *
20 * @mode: indicates one of the valid values above for controlled
21 * system calls available to a process.
22 * @filter: must always point to a valid seccomp-filter or NULL as it is
23 * accessed without locking during system call entry.
24 *
25 * @filter must only be accessed from the context of current as there
26 * is no read locking.
27 */
28struct seccomp {
29 int mode;
30 struct seccomp_filter *filter;
31};
32
33#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
34extern int __secure_computing(const struct seccomp_data *sd);
35static inline int secure_computing(const struct seccomp_data *sd)
36{
37 if (unlikely(test_thread_flag(TIF_SECCOMP)))
38 return __secure_computing(sd);
39 return 0;
40}
41#else
42extern void secure_computing_strict(int this_syscall);
43#endif
44
45extern long prctl_get_seccomp(void);
46extern long prctl_set_seccomp(unsigned long, char __user *);
47
48static inline int seccomp_mode(struct seccomp *s)
49{
50 return s->mode;
51}
52
53#else /* CONFIG_SECCOMP */
54
55#include <linux/errno.h>
56
57struct seccomp { };
58struct seccomp_filter { };
59
60#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
61static inline int secure_computing(struct seccomp_data *sd) { return 0; }
62#else
63static inline void secure_computing_strict(int this_syscall) { return; }
64#endif
65
66static inline long prctl_get_seccomp(void)
67{
68 return -EINVAL;
69}
70
71static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
72{
73 return -EINVAL;
74}
75
76static inline int seccomp_mode(struct seccomp *s)
77{
78 return SECCOMP_MODE_DISABLED;
79}
80#endif /* CONFIG_SECCOMP */
81
82#ifdef CONFIG_SECCOMP_FILTER
83extern void put_seccomp_filter(struct task_struct *tsk);
84extern void get_seccomp_filter(struct task_struct *tsk);
85#else /* CONFIG_SECCOMP_FILTER */
86static inline void put_seccomp_filter(struct task_struct *tsk)
87{
88 return;
89}
90static inline void get_seccomp_filter(struct task_struct *tsk)
91{
92 return;
93}
94#endif /* CONFIG_SECCOMP_FILTER */
95
96#if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
97extern long seccomp_get_filter(struct task_struct *task,
98 unsigned long filter_off, void __user *data);
99extern long seccomp_get_metadata(struct task_struct *task,
100 unsigned long filter_off, void __user *data);
101#else
102static inline long seccomp_get_filter(struct task_struct *task,
103 unsigned long n, void __user *data)
104{
105 return -EINVAL;
106}
107static inline long seccomp_get_metadata(struct task_struct *task,
108 unsigned long filter_off,
109 void __user *data)
110{
111 return -EINVAL;
112}
113#endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
114#endif /* _LINUX_SECCOMP_H */
115