Eric Lee / smarc-fsl-linux-kernel

Blame view

include/linux/seccomp.h 2.94 KB
edit raw normal view history
d7d243b52   Eric Lee   SMARC-iMX8MQ Linu... 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
 
  /* SPDX-License-Identifier: GPL-2.0 */
  #ifndef _LINUX_SECCOMP_H
  #define _LINUX_SECCOMP_H
  
  #include <uapi/linux/seccomp.h>
  
  #define SECCOMP_FILTER_FLAG_MASK	(SECCOMP_FILTER_FLAG_TSYNC | \
  					 SECCOMP_FILTER_FLAG_LOG | \
  					 SECCOMP_FILTER_FLAG_SPEC_ALLOW | \
  					 SECCOMP_FILTER_FLAG_NEW_LISTENER)
  
  #ifdef CONFIG_SECCOMP
  
  #include <linux/thread_info.h>
  #include <asm/seccomp.h>
  
  struct seccomp_filter;
  /**
   * struct seccomp - the state of a seccomp'ed process
   *
   * @mode:  indicates one of the valid values above for controlled
   *         system calls available to a process.
   * @filter: must always point to a valid seccomp-filter or NULL as it is
   *          accessed without locking during system call entry.
   *
   *          @filter must only be accessed from the context of current as there
   *          is no read locking.
   */
  struct seccomp {
  	int mode;
  	struct seccomp_filter *filter;
  };
  
  #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  extern int __secure_computing(const struct seccomp_data *sd);
  static inline int secure_computing(const struct seccomp_data *sd)
  {
  	if (unlikely(test_thread_flag(TIF_SECCOMP)))
  		return  __secure_computing(sd);
  	return 0;
  }
  #else
  extern void secure_computing_strict(int this_syscall);
  #endif
  
  extern long prctl_get_seccomp(void);
  extern long prctl_set_seccomp(unsigned long, void __user *);
  
  static inline int seccomp_mode(struct seccomp *s)
  {
  	return s->mode;
  }
  
  #else /* CONFIG_SECCOMP */
  
  #include <linux/errno.h>
  
  struct seccomp { };
  struct seccomp_filter { };
  
  #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
  static inline int secure_computing(struct seccomp_data *sd) { return 0; }
  #else
  static inline void secure_computing_strict(int this_syscall) { return; }
  #endif
  
  static inline long prctl_get_seccomp(void)
  {
  	return -EINVAL;
  }
  
  static inline long prctl_set_seccomp(unsigned long arg2, char __user *arg3)
  {
  	return -EINVAL;
  }
  
  static inline int seccomp_mode(struct seccomp *s)
  {
  	return SECCOMP_MODE_DISABLED;
  }
  #endif /* CONFIG_SECCOMP */
  
  #ifdef CONFIG_SECCOMP_FILTER
  extern void put_seccomp_filter(struct task_struct *tsk);
  extern void get_seccomp_filter(struct task_struct *tsk);
  #else  /* CONFIG_SECCOMP_FILTER */
  static inline void put_seccomp_filter(struct task_struct *tsk)
  {
  	return;
  }
  static inline void get_seccomp_filter(struct task_struct *tsk)
  {
  	return;
  }
  #endif /* CONFIG_SECCOMP_FILTER */
  
  #if defined(CONFIG_SECCOMP_FILTER) && defined(CONFIG_CHECKPOINT_RESTORE)
  extern long seccomp_get_filter(struct task_struct *task,
  			       unsigned long filter_off, void __user *data);
  extern long seccomp_get_metadata(struct task_struct *task,
  				 unsigned long filter_off, void __user *data);
  #else
  static inline long seccomp_get_filter(struct task_struct *task,
  				      unsigned long n, void __user *data)
  {
  	return -EINVAL;
  }
  static inline long seccomp_get_metadata(struct task_struct *task,
  					unsigned long filter_off,
  					void __user *data)
  {
  	return -EINVAL;
  }
  #endif /* CONFIG_SECCOMP_FILTER && CONFIG_CHECKPOINT_RESTORE */
  #endif /* _LINUX_SECCOMP_H */