1 /* SPDX-License-Identifier: LGPL-2.1+ */
10 const char* seccomp_arch_to_string(uint32_t c
);
11 int seccomp_arch_from_string(const char *n
, uint32_t *ret
);
13 int seccomp_init_for_arch(scmp_filter_ctx
*ret
, uint32_t arch
, uint32_t default_action
);
15 bool is_seccomp_available(void);
17 typedef struct SyscallFilterSet
{
24 /* Please leave DEFAULT first, but sort the rest alphabetically */
25 SYSCALL_FILTER_SET_DEFAULT
,
26 SYSCALL_FILTER_SET_AIO
,
27 SYSCALL_FILTER_SET_BASIC_IO
,
28 SYSCALL_FILTER_SET_CHOWN
,
29 SYSCALL_FILTER_SET_CLOCK
,
30 SYSCALL_FILTER_SET_CPU_EMULATION
,
31 SYSCALL_FILTER_SET_DEBUG
,
32 SYSCALL_FILTER_SET_FILE_SYSTEM
,
33 SYSCALL_FILTER_SET_IO_EVENT
,
34 SYSCALL_FILTER_SET_IPC
,
35 SYSCALL_FILTER_SET_KEYRING
,
36 SYSCALL_FILTER_SET_MEMLOCK
,
37 SYSCALL_FILTER_SET_MODULE
,
38 SYSCALL_FILTER_SET_MOUNT
,
39 SYSCALL_FILTER_SET_NETWORK_IO
,
40 SYSCALL_FILTER_SET_OBSOLETE
,
41 SYSCALL_FILTER_SET_PKEY
,
42 SYSCALL_FILTER_SET_PRIVILEGED
,
43 SYSCALL_FILTER_SET_PROCESS
,
44 SYSCALL_FILTER_SET_RAW_IO
,
45 SYSCALL_FILTER_SET_REBOOT
,
46 SYSCALL_FILTER_SET_RESOURCES
,
47 SYSCALL_FILTER_SET_SETUID
,
48 SYSCALL_FILTER_SET_SIGNAL
,
49 SYSCALL_FILTER_SET_SWAP
,
50 SYSCALL_FILTER_SET_SYNC
,
51 SYSCALL_FILTER_SET_SYSTEM_SERVICE
,
52 SYSCALL_FILTER_SET_TIMER
,
53 _SYSCALL_FILTER_SET_MAX
56 extern const SyscallFilterSet syscall_filter_sets
[];
58 const SyscallFilterSet
*syscall_filter_set_find(const char *name
);
60 int seccomp_filter_set_add(Hashmap
*s
, bool b
, const SyscallFilterSet
*set
);
62 int seccomp_add_syscall_filter_item(scmp_filter_ctx
*ctx
, const char *name
, uint32_t action
, char **exclude
, bool log_missing
);
64 int seccomp_load_syscall_filter_set(uint32_t default_action
, const SyscallFilterSet
*set
, uint32_t action
, bool log_missing
);
65 int seccomp_load_syscall_filter_set_raw(uint32_t default_action
, Hashmap
* set
, uint32_t action
, bool log_missing
);
67 typedef enum SeccompParseFlags
{
68 SECCOMP_PARSE_INVERT
= 1 << 0,
69 SECCOMP_PARSE_ALLOW_LIST
= 1 << 1,
70 SECCOMP_PARSE_LOG
= 1 << 2,
71 SECCOMP_PARSE_PERMISSIVE
= 1 << 3,
74 int seccomp_parse_syscall_filter(
78 SeccompParseFlags flags
,
80 const char *filename
, unsigned line
);
82 int seccomp_restrict_archs(Set
*archs
);
83 int seccomp_restrict_namespaces(unsigned long retain
);
84 int seccomp_protect_sysctl(void);
85 int seccomp_protect_syslog(void);
86 int seccomp_restrict_address_families(Set
*address_families
, bool allow_list
);
87 int seccomp_restrict_realtime(void);
88 int seccomp_memory_deny_write_execute(void);
89 int seccomp_lock_personality(unsigned long personality
);
90 int seccomp_protect_hostname(void);
91 int seccomp_restrict_suid_sgid(void);
93 extern const uint32_t seccomp_local_archs
[];
95 #define SECCOMP_FOREACH_LOCAL_ARCH(arch) \
96 for (unsigned _i = ({ (arch) = seccomp_local_archs[0]; 0; }); \
97 seccomp_local_archs[_i] != (uint32_t) -1; \
98 (arch) = seccomp_local_archs[++_i])
100 /* EACCES: does not have the CAP_SYS_ADMIN or no_new_privs == 1
101 * ENOMEM: out of memory, failed to allocate space for a libseccomp structure, or would exceed a defined constant
102 * EFAULT: addresses passed as args (by libseccomp) are invalid */
103 #define ERRNO_IS_SECCOMP_FATAL(r) \
104 IN_SET(abs(r), EPERM, EACCES, ENOMEM, EFAULT)
106 DEFINE_TRIVIAL_CLEANUP_FUNC(scmp_filter_ctx
, seccomp_release
);
108 int parse_syscall_archs(char **l
, Set
**ret_archs
);
110 uint32_t scmp_act_kill_process(void);