1 /* SPDX-License-Identifier: LGPL-2.1+ */
5 This file is part of systemd.
7 Copyright 2014 Lennart Poettering
16 const char* seccomp_arch_to_string(uint32_t c
);
17 int seccomp_arch_from_string(const char *n
, uint32_t *ret
);
19 int seccomp_init_for_arch(scmp_filter_ctx
*ret
, uint32_t arch
, uint32_t default_action
);
21 bool is_seccomp_available(void);
23 typedef struct SyscallFilterSet
{
30 /* Please leave DEFAULT first, but sort the rest alphabetically */
31 SYSCALL_FILTER_SET_DEFAULT
,
32 SYSCALL_FILTER_SET_AIO
,
33 SYSCALL_FILTER_SET_BASIC_IO
,
34 SYSCALL_FILTER_SET_CHOWN
,
35 SYSCALL_FILTER_SET_CLOCK
,
36 SYSCALL_FILTER_SET_CPU_EMULATION
,
37 SYSCALL_FILTER_SET_DEBUG
,
38 SYSCALL_FILTER_SET_FILE_SYSTEM
,
39 SYSCALL_FILTER_SET_IO_EVENT
,
40 SYSCALL_FILTER_SET_IPC
,
41 SYSCALL_FILTER_SET_KEYRING
,
42 SYSCALL_FILTER_SET_MEMLOCK
,
43 SYSCALL_FILTER_SET_MODULE
,
44 SYSCALL_FILTER_SET_MOUNT
,
45 SYSCALL_FILTER_SET_NETWORK_IO
,
46 SYSCALL_FILTER_SET_OBSOLETE
,
47 SYSCALL_FILTER_SET_PRIVILEGED
,
48 SYSCALL_FILTER_SET_PROCESS
,
49 SYSCALL_FILTER_SET_RAW_IO
,
50 SYSCALL_FILTER_SET_REBOOT
,
51 SYSCALL_FILTER_SET_RESOURCES
,
52 SYSCALL_FILTER_SET_SETUID
,
53 SYSCALL_FILTER_SET_SIGNAL
,
54 SYSCALL_FILTER_SET_SWAP
,
55 SYSCALL_FILTER_SET_SYNC
,
56 SYSCALL_FILTER_SET_TIMER
,
57 _SYSCALL_FILTER_SET_MAX
60 extern const SyscallFilterSet syscall_filter_sets
[];
62 const SyscallFilterSet
*syscall_filter_set_find(const char *name
);
64 int seccomp_filter_set_add(Hashmap
*s
, bool b
, const SyscallFilterSet
*set
);
66 int seccomp_add_syscall_filter_item(scmp_filter_ctx
*ctx
, const char *name
, uint32_t action
, char **exclude
);
68 int seccomp_load_syscall_filter_set(uint32_t default_action
, const SyscallFilterSet
*set
, uint32_t action
);
69 int seccomp_load_syscall_filter_set_raw(uint32_t default_action
, Hashmap
* set
, uint32_t action
);
71 typedef enum SeccompParseFlags
{
72 SECCOMP_PARSE_INVERT
= 1 << 0,
73 SECCOMP_PARSE_WHITELIST
= 1 << 1,
74 SECCOMP_PARSE_LOG
= 1 << 2,
75 SECCOMP_PARSE_PERMISSIVE
= 1 << 3,
78 int seccomp_parse_syscall_filter_full(
79 const char *name
, int errno_num
, Hashmap
*filter
, SeccompParseFlags flags
,
80 const char *unit
, const char *filename
, unsigned line
);
82 static inline int seccomp_parse_syscall_filter(const char *name
, int errno_num
, Hashmap
*filter
, SeccompParseFlags flags
) {
83 return seccomp_parse_syscall_filter_full(name
, errno_num
, filter
, flags
, NULL
, NULL
, 0);
86 int seccomp_restrict_archs(Set
*archs
);
87 int seccomp_restrict_namespaces(unsigned long retain
);
88 int seccomp_protect_sysctl(void);
89 int seccomp_restrict_address_families(Set
*address_families
, bool whitelist
);
90 int seccomp_restrict_realtime(void);
91 int seccomp_memory_deny_write_execute(void);
92 int seccomp_lock_personality(unsigned long personality
);
94 extern const uint32_t seccomp_local_archs
[];
96 #define SECCOMP_FOREACH_LOCAL_ARCH(arch) \
97 for (unsigned _i = ({ (arch) = seccomp_local_archs[0]; 0; }); \
98 seccomp_local_archs[_i] != (uint32_t) -1; \
99 (arch) = seccomp_local_archs[++_i])
101 DEFINE_TRIVIAL_CLEANUP_FUNC(scmp_filter_ctx
, seccomp_release
);
103 int parse_syscall_archs(char **l
, Set
**archs
);