[linux.git] / include / uapi / linux / seccomp.h

#ifndef _UAPI_LINUX_SECCOMP_H
#define _UAPI_LINUX_SECCOMP_H

#include <linux/compiler.h>
#include <linux/types.h>


/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
#define SECCOMP_MODE_DISABLED	0 /* seccomp is not in use. */
#define SECCOMP_MODE_STRICT	1 /* uses hard-coded filter. */
#define SECCOMP_MODE_FILTER	2 /* uses user-supplied filter. */

/* Valid operations for seccomp syscall. */
#define SECCOMP_SET_MODE_STRICT	0
#define SECCOMP_SET_MODE_FILTER	1

/* Valid flags for SECCOMP_SET_MODE_FILTER */
#define SECCOMP_FILTER_FLAG_TSYNC	1

/*
 * All BPF programs must return a 32-bit value.
 * The bottom 16-bits are for optional return data.
 * The upper 16-bits are ordered from least permissive values to most.
 *
 * The ordering ensures that a min_t() over composed return values always
 * selects the least permissive choice.
 */
#define SECCOMP_RET_KILL	0x00000000U /* kill the task immediately */
#define SECCOMP_RET_TRAP	0x00030000U /* disallow and force a SIGSYS */
#define SECCOMP_RET_ERRNO	0x00050000U /* returns an errno */
#define SECCOMP_RET_TRACE	0x7ff00000U /* pass to a tracer or disallow */
#define SECCOMP_RET_ALLOW	0x7fff0000U /* allow */

/* Masks for the return value sections. */
#define SECCOMP_RET_ACTION	0x7fff0000U
#define SECCOMP_RET_DATA	0x0000ffffU

/**
 * struct seccomp_data - the format the BPF program executes over.
 * @nr: the system call number
 * @arch: indicates system call convention as an AUDIT_ARCH_* value
 *        as defined in <linux/audit.h>.
 * @instruction_pointer: at the time of the system call.
 * @args: up to 6 system call arguments always stored as 64-bit values
 *        regardless of the architecture.
 */
struct seccomp_data {
	int nr;
	__u32 arch;
	__u64 instruction_pointer;
	__u64 args[6];
};

#endif /* _UAPI_LINUX_SECCOMP_H */
Commit	Line	Data
607ca46e DH	1	#ifndef _UAPI_LINUX_SECCOMP_H
	2	#define _UAPI_LINUX_SECCOMP_H
	3
	4	#include <linux/compiler.h>
	5	#include <linux/types.h>
	6
	7
	8	/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
	9	#define SECCOMP_MODE_DISABLED 0 /* seccomp is not in use. */
	10	#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
	11	#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
	12
48dc92b9 KC	13	/* Valid operations for seccomp syscall. */
	14	#define SECCOMP_SET_MODE_STRICT 0
	15	#define SECCOMP_SET_MODE_FILTER 1
	16
c2e1f2e3 KC	17	/* Valid flags for SECCOMP_SET_MODE_FILTER */
	18	#define SECCOMP_FILTER_FLAG_TSYNC 1
	19
607ca46e DH	20	/*
	21	* All BPF programs must return a 32-bit value.
	22	* The bottom 16-bits are for optional return data.
	23	* The upper 16-bits are ordered from least permissive values to most.
	24	*
	25	* The ordering ensures that a min_t() over composed return values always
	26	* selects the least permissive choice.
	27	*/
	28	#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
	29	#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
	30	#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
	31	#define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
	32	#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
	33
	34	/* Masks for the return value sections. */
	35	#define SECCOMP_RET_ACTION 0x7fff0000U
	36	#define SECCOMP_RET_DATA 0x0000ffffU
	37
	38	/**
	39	* struct seccomp_data - the format the BPF program executes over.
	40	* @nr: the system call number
	41	* @arch: indicates system call convention as an AUDIT_ARCH_* value
	42	* as defined in <linux/audit.h>.
	43	* @instruction_pointer: at the time of the system call.
	44	* @args: up to 6 system call arguments always stored as 64-bit values
	45	* regardless of the architecture.
	46	*/
	47	struct seccomp_data {
	48	int nr;
	49	__u32 arch;
	50	__u64 instruction_pointer;
	51	__u64 args[6];
	52	};
	53
	54	#endif /* _UAPI_LINUX_SECCOMP_H */