seccomp-bpf.h 2.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. /*
  2. * seccomp example for x86 (32-bit and 64-bit) with BPF macros
  3. *
  4. * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
  5. * Authors:
  6. * Will Drewry <wad@chromium.org>
  7. * Kees Cook <keescook@chromium.org>
  8. *
  9. * Use of this source code is governed by a BSD-style license that can be
  10. * found in the LICENSE file.
  11. */
  12. #ifndef _SECCOMP_BPF_H_
  13. #define _SECCOMP_BPF_H_
  14. #define _GNU_SOURCE 1
  15. #include <stdio.h>
  16. #include <stddef.h>
  17. #include <stdlib.h>
  18. #include <errno.h>
  19. #include <signal.h>
  20. #include <string.h>
  21. #include <unistd.h>
  22. #include <endian.h>
  23. #include <sys/prctl.h>
  24. #ifndef PR_SET_NO_NEW_PRIVS
  25. # define PR_SET_NO_NEW_PRIVS 38
  26. #endif
  27. #include <linux/unistd.h>
  28. #include <linux/audit.h>
  29. #include <linux/filter.h>
  30. #ifdef HAVE_LINUX_SECCOMP_H
  31. # include <linux/seccomp.h>
  32. #endif
  33. #ifndef SECCOMP_MODE_FILTER
  34. #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
  35. #define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
  36. #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
  37. #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
  38. #define SECCOMP_RET_LOG 0x00070000U
  39. #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
  40. #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
  41. #define SECCOMP_RET_ERROR(x) (SECCOMP_RET_ERRNO | ((x) & 0x0000ffffU))
  42. #define SECCOMP_RET_LOGGER(x) (SECCOMP_RET_LOG | ((x) & 0x0000ffffU))
  43. struct seccomp_data {
  44. int nr;
  45. __u32 arch;
  46. __u64 instruction_pointer;
  47. __u64 args[6];
  48. };
  49. #endif
  50. #ifndef SYS_SECCOMP
  51. # define SYS_SECCOMP 1
  52. #endif
  53. #define syscall_nr (offsetof(struct seccomp_data, nr))
  54. #define arch_nr (offsetof(struct seccomp_data, arch))
  55. #if defined(__i386__)
  56. # define REG_SYSCALL REG_EAX
  57. # define ARCH_NR AUDIT_ARCH_I386
  58. #elif defined(__x86_64__)
  59. # define REG_SYSCALL REG_RAX
  60. # define ARCH_NR AUDIT_ARCH_X86_64
  61. #elif defined(__mips__)
  62. # define REG_SYSCALL regs[2]
  63. # if __BYTE_ORDER == __LITTLE_ENDIAN
  64. # define ARCH_NR AUDIT_ARCH_MIPSEL
  65. # else
  66. # define ARCH_NR AUDIT_ARCH_MIPS
  67. # endif
  68. #elif defined(__arm__) && (defined(__ARM_EABI__) || defined(__thumb__))
  69. # define REG_SYSCALL regs.uregs[7]
  70. # if __BYTE_ORDER == __LITTLE_ENDIAN
  71. # define ARCH_NR AUDIT_ARCH_ARM
  72. # else
  73. # define ARCH_NR AUDIT_ARCH_ARMEB
  74. # endif
  75. #elif defined(__PPC__)
  76. # define REG_SYSCALL regs.gpr[0]
  77. # define ARCH_NR AUDIT_ARCH_PPC
  78. #else
  79. # warning "Platform does not support seccomp filter yet"
  80. # define REG_SYSCALL 0
  81. # define ARCH_NR 0
  82. #endif
  83. #endif /* _SECCOMP_BPF_H_ */