1 #ifndef _LINUX_SECCOMP_H
2 #define _LINUX_SECCOMP_H
3 
4 #include <uapi/linux/seccomp.h>
5 
6 #define SECCOMP_FILTER_FLAG_MASK	(SECCOMP_FILTER_FLAG_TSYNC)
7 
8 #ifdef CONFIG_SECCOMP
9 
10 #include <linux/thread_info.h>
11 #include <asm/seccomp.h>
12 
13 struct seccomp_filter;
14 /**
15  * struct seccomp - the state of a seccomp'ed process
16  *
17  * @mode:  indicates one of the valid values above for controlled
18  *         system calls available to a process.
19  * @filter: must always point to a valid seccomp-filter or NULL as it is
20  *          accessed without locking during system call entry.
21  *
22  *          @filter must only be accessed from the context of current as there
23  *          is no read locking.
24  */
25 struct seccomp {
26 	int mode;
27 	struct seccomp_filter *filter;
28 };
29 
30 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
31 extern int __secure_computing(void);
secure_computing(void)32 static inline int secure_computing(void)
33 {
34 	if (unlikely(test_thread_flag(TIF_SECCOMP)))
35 		return  __secure_computing();
36 	return 0;
37 }
38 
39 #define SECCOMP_PHASE1_OK	0
40 #define SECCOMP_PHASE1_SKIP	1
41 
42 extern u32 seccomp_phase1(struct seccomp_data *sd);
43 int seccomp_phase2(u32 phase1_result);
44 #else
45 extern void secure_computing_strict(int this_syscall);
46 #endif
47 
48 extern long prctl_get_seccomp(void);
49 extern long prctl_set_seccomp(unsigned long, char __user *);
50 
seccomp_mode(struct seccomp * s)51 static inline int seccomp_mode(struct seccomp *s)
52 {
53 	return s->mode;
54 }
55 
56 #else /* CONFIG_SECCOMP */
57 
58 #include <linux/errno.h>
59 
60 struct seccomp { };
61 struct seccomp_filter { };
62 
63 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
secure_computing(void)64 static inline int secure_computing(void) { return 0; }
65 #else
secure_computing_strict(int this_syscall)66 static inline void secure_computing_strict(int this_syscall) { return; }
67 #endif
68 
prctl_get_seccomp(void)69 static inline long prctl_get_seccomp(void)
70 {
71 	return -EINVAL;
72 }
73 
prctl_set_seccomp(unsigned long arg2,char __user * arg3)74 static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
75 {
76 	return -EINVAL;
77 }
78 
seccomp_mode(struct seccomp * s)79 static inline int seccomp_mode(struct seccomp *s)
80 {
81 	return SECCOMP_MODE_DISABLED;
82 }
83 #endif /* CONFIG_SECCOMP */
84 
85 #ifdef CONFIG_SECCOMP_FILTER
86 extern void put_seccomp_filter(struct task_struct *tsk);
87 extern void get_seccomp_filter(struct task_struct *tsk);
88 #else  /* CONFIG_SECCOMP_FILTER */
put_seccomp_filter(struct task_struct * tsk)89 static inline void put_seccomp_filter(struct task_struct *tsk)
90 {
91 	return;
92 }
get_seccomp_filter(struct task_struct * tsk)93 static inline void get_seccomp_filter(struct task_struct *tsk)
94 {
95 	return;
96 }
97 #endif /* CONFIG_SECCOMP_FILTER */
98 
99 #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
100 extern long seccomp_get_filter(struct task_struct *task,
101 			       unsigned long filter_off, void __user *data);
102 #else
seccomp_get_filter(struct task_struct * task,unsigned long n,void __user * data)103 static inline long seccomp_get_filter(struct task_struct *task,
104 				      unsigned long n, void __user *data)
105 {
106 	return -EINVAL;
107 }
108 #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
109 #endif /* _LINUX_SECCOMP_H */
110