seccomp.h

Go to the documentation of this file.

#ifndef _UAPI_LINUX_SECCOMP_H
#define _UAPI_LINUX_SECCOMP_H

#include <linux/compiler.h>
#include <linux/types.h>


/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
#define SECCOMP_MODE_DISABLED   0 /* seccomp is not in use. */
#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */

/*
 * All BPF programs must return a 32-bit value.
 * The bottom 16-bits are for optional return data.
 * The upper 16-bits are ordered from least permissive values to most.
 *
 * The ordering ensures that a min_t() over composed return values always
 * selects the least permissive choice.
 */
#define SECCOMP_RET_KILL    0x00000000U /* kill the task immediately */
#define SECCOMP_RET_TRAP    0x00030000U /* disallow and force a SIGSYS */
#define SECCOMP_RET_ERRNO   0x00050000U /* returns an errno */
#define SECCOMP_RET_TRACE   0x7ff00000U /* pass to a tracer or disallow */
#define SECCOMP_RET_ALLOW   0x7fff0000U /* allow */

/* Masks for the return value sections. */
#define SECCOMP_RET_ACTION  0x7fff0000U
#define SECCOMP_RET_DATA    0x0000ffffU

struct seccomp_data {
    int nr;
    __u32 arch;
    __u64 instruction_pointer;
    __u64 args[6];
};

#endif /* _UAPI_LINUX_SECCOMP_H */