Lines Matching defs:seccomp
3 * linux/kernel/seccomp.c
16 #define pr_fmt(fmt) "seccomp: " fmt
27 #include <linux/seccomp.h>
69 * The seccomp data. This pointer is valid the entire time this
92 * dying, a new seccomp addfd message, or changing to REPLIED
136 * struct notification - container for seccomp userspace notifications. Since
137 * most seccomp filters will not have notification listeners attached and this
158 * struct action_cache - per-filter cache of seccomp actions per
189 * struct seccomp_filter - container for seccomp BPF programs
216 * with current->seccomp.filter, the most recently attached or inherited filter.
267 * seccomp_check_filter - verify seccomp filter code
361 * seccomp_cache_check_allow - lookup seccomp cache
362 * @sfilter: The seccomp filter
363 * @sd: The seccomp data to lookup the cache with
396 * seccomp_run_filters - evaluates all seccomp filters against @sd
397 * @sd: optional seccomp data to be passed to filters
402 * Returns valid seccomp BPF response codes.
410 READ_ONCE(current->seccomp.filter);
439 if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
453 task->seccomp.mode = seccomp_mode;
459 /* Assume default seccomp processes want spec flaw mitigation. */
485 * either not in the correct seccomp mode or did not have an ancestral
486 * seccomp filter.
507 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
508 (thread->seccomp.mode == SECCOMP_MODE_FILTER &&
509 is_ancestor(thread->seccomp.filter,
510 caller->seccomp.filter)))
577 if (READ_ONCE(tsk->seccomp.filter) == NULL)
581 orig = tsk->seccomp.filter;
583 tsk->seccomp.filter = NULL;
634 __seccomp_filter_release(thread->seccomp.filter);
637 smp_store_release(&thread->seccomp.filter,
638 caller->seccomp.filter);
639 atomic_set(&thread->seccomp.filter_count,
640 atomic_read(&caller->seccomp.filter_count));
645 * a thread that sets it up, enters seccomp,
652 * Opt the other thread into seccomp if needed.
657 if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
664 * seccomp_prepare_filter: Prepares a seccomp filter for use.
686 * Installing a seccomp filter requires that the task has
767 * @sd: The seccomp data to check against, only syscall number and arch
885 * @sfilter: The seccomp filter
912 * @filter: seccomp filter to add to the current process
918 * seccomp mode or did not have an ancestral seccomp filter
931 for (walker = current->seccomp.filter; walker; walker = walker->prev)
961 filter->prev = current->seccomp.filter;
963 current->seccomp.filter = filter;
964 atomic_inc(¤t->seccomp.filter_count);
981 struct seccomp_filter *orig = tsk->seccomp.filter;
1082 current->seccomp.mode = SECCOMP_MODE_DEAD;
1090 int mode = current->seccomp.mode;
1356 current->seccomp.mode = SECCOMP_MODE_DEAD;
1388 int mode = current->seccomp.mode;
1416 return current->seccomp.mode;
1420 * seccomp_set_mode_strict: internal function for setting strict seccomp
1422 * Once current->seccomp.mode is non-zero, it may not be changed.
1901 ret = anon_inode_getfile("seccomp notify", &seccomp_notify_ops,
1922 * we use current->seccomp.filter.
1933 for (cur = current->seccomp.filter; cur; cur = cur->prev) {
1942 * seccomp_set_mode_filter: internal function for setting seccomp filter
1950 * Once current->seccomp.mode is non-zero, it may not be changed.
2008 * Make sure we cannot change seccomp or nnp state via TSYNC
2124 SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
2131 * prctl_set_seccomp: configures current->seccomp.mode
2177 if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
2182 orig = task->seccomp.filter;
2219 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2257 current->seccomp.mode != SECCOMP_MODE_DISABLED) {
2505 register_sysctl_init("kernel/seccomp", seccomp_sysctl_table);
2535 * We don't want some sandboxed process to know what their seccomp
2544 f = READ_ONCE(task->seccomp.filter);