OLD | NEW |
(Empty) | |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #ifndef SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_ |
| 6 #define SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_ |
| 7 |
| 8 #include <linux/filter.h> |
| 9 |
| 10 // The Seccomp2 kernel ABI is not part of older versions of glibc. |
| 11 // As we can't break compilation with these versions of the library, |
| 12 // we explicitly define all missing symbols. |
| 13 // If we ever decide that we can now rely on system headers, the following |
| 14 // include files should be enabled: |
| 15 // #include <linux/audit.h> |
| 16 // #include <linux/seccomp.h> |
| 17 |
| 18 // For audit.h |
| 19 #ifndef EM_ARM |
| 20 #define EM_ARM 40 |
| 21 #endif |
| 22 #ifndef EM_386 |
| 23 #define EM_386 3 |
| 24 #endif |
| 25 #ifndef EM_X86_64 |
| 26 #define EM_X86_64 62 |
| 27 #endif |
| 28 #ifndef EM_MIPS |
| 29 #define EM_MIPS 8 |
| 30 #endif |
| 31 #ifndef EM_AARCH64 |
| 32 #define EM_AARCH64 183 |
| 33 #endif |
| 34 |
| 35 #ifndef __AUDIT_ARCH_64BIT |
| 36 #define __AUDIT_ARCH_64BIT 0x80000000 |
| 37 #endif |
| 38 #ifndef __AUDIT_ARCH_LE |
| 39 #define __AUDIT_ARCH_LE 0x40000000 |
| 40 #endif |
| 41 #ifndef AUDIT_ARCH_ARM |
| 42 #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE) |
| 43 #endif |
| 44 #ifndef AUDIT_ARCH_I386 |
| 45 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE) |
| 46 #endif |
| 47 #ifndef AUDIT_ARCH_X86_64 |
| 48 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) |
| 49 #endif |
| 50 #ifndef AUDIT_ARCH_MIPSEL |
| 51 #define AUDIT_ARCH_MIPSEL (EM_MIPS|__AUDIT_ARCH_LE) |
| 52 #endif |
| 53 #ifndef AUDIT_ARCH_AARCH64 |
| 54 #define AUDIT_ARCH_AARCH64 (EM_AARCH64 | __AUDIT_ARCH_64BIT | __AUDIT_ARCH_LE) |
| 55 #endif |
| 56 |
| 57 // For prctl.h |
| 58 #ifndef PR_SET_SECCOMP |
| 59 #define PR_SET_SECCOMP 22 |
| 60 #define PR_GET_SECCOMP 21 |
| 61 #endif |
| 62 #ifndef PR_SET_NO_NEW_PRIVS |
| 63 #define PR_SET_NO_NEW_PRIVS 38 |
| 64 #define PR_GET_NO_NEW_PRIVS 39 |
| 65 #endif |
| 66 #ifndef IPC_64 |
| 67 #define IPC_64 0x0100 |
| 68 #endif |
| 69 |
| 70 #ifndef BPF_MOD |
| 71 #define BPF_MOD 0x90 |
| 72 #endif |
| 73 #ifndef BPF_XOR |
| 74 #define BPF_XOR 0xA0 |
| 75 #endif |
| 76 |
| 77 // In order to build will older tool chains, we currently have to avoid |
| 78 // including <linux/seccomp.h>. Until that can be fixed (if ever). Rely on |
| 79 // our own definitions of the seccomp kernel ABI. |
| 80 #ifndef SECCOMP_MODE_FILTER |
| 81 #define SECCOMP_MODE_DISABLED 0 |
| 82 #define SECCOMP_MODE_STRICT 1 |
| 83 #define SECCOMP_MODE_FILTER 2 // User user-supplied filter |
| 84 #endif |
| 85 |
| 86 #ifndef SECCOMP_SET_MODE_STRICT |
| 87 #define SECCOMP_SET_MODE_STRICT 0 |
| 88 #endif |
| 89 #ifndef SECCOMP_SET_MODE_FILTER |
| 90 #define SECCOMP_SET_MODE_FILTER 1 |
| 91 #endif |
| 92 #ifndef SECCOMP_FILTER_FLAG_TSYNC |
| 93 #define SECCOMP_FILTER_FLAG_TSYNC 1 |
| 94 #endif |
| 95 |
| 96 #ifndef SECCOMP_RET_KILL |
| 97 // Return values supported for BPF filter programs. Please note that the |
| 98 // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only |
| 99 // ever be used internally, and would result in the kernel killing our process. |
| 100 #define SECCOMP_RET_KILL 0x00000000U // Kill the task immediately |
| 101 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value |
| 102 #define SECCOMP_RET_TRAP 0x00030000U // Disallow and force a SIGSYS |
| 103 #define SECCOMP_RET_ERRNO 0x00050000U // Returns an errno |
| 104 #define SECCOMP_RET_TRACE 0x7ff00000U // Pass to a tracer or disallow |
| 105 #define SECCOMP_RET_ALLOW 0x7fff0000U // Allow |
| 106 #define SECCOMP_RET_ACTION 0xffff0000U // Masks for the return value |
| 107 #define SECCOMP_RET_DATA 0x0000ffffU // sections |
| 108 #else |
| 109 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value |
| 110 #endif |
| 111 |
| 112 #ifndef SYS_SECCOMP |
| 113 #define SYS_SECCOMP 1 |
| 114 #endif |
| 115 |
| 116 #endif // SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SECCOMP_H_ |
OLD | NEW |