libseccomp_sys/
lib.rs

1// SPDX-License-Identifier: Apache-2.0 or MIT
2//
3// Copyright 2021 Sony Group Corporation
4//
5
6#![allow(non_camel_case_types)]
7#![allow(non_snake_case)]
8
9//! Raw FFI bindings for libseccomp library
10
11use std::os::raw::*;
12
13pub const SECCOMP_MODE_DISABLED: u64 = 0;
14pub const SECCOMP_MODE_STRICT: u64 = 1;
15pub const SECCOMP_MODE_FILTER: u64 = 2;
16
17pub const SECCOMP_SET_MODE_STRICT: u32 = 0;
18pub const SECCOMP_SET_MODE_FILTER: u32 = 1;
19pub const SECCOMP_GET_ACTION_AVAIL: u32 = 2;
20pub const SECCOMP_GET_NOTIF_SIZES: u32 = 3;
21
22pub const SECCOMP_FILTER_FLAG_TSYNC: u32 = 1;
23pub const SECCOMP_FILTER_FLAG_LOG: u32 = 2;
24pub const SECCOMP_FILTER_FLAG_SPEC_ALLOW: u32 = 4;
25pub const SECCOMP_FILTER_FLAG_NEW_LISTENER: u32 = 8;
26pub const SECCOMP_FILTER_FLAG_TSYNC_ESRCH: u32 = 16;
27
28pub const SECCOMP_RET_KILL_PROCESS: u32 = 0x80000000;
29pub const SECCOMP_RET_KILL_THREAD: u32 = 0x00000000;
30pub const SECCOMP_RET_KILL: u32 = SECCOMP_RET_KILL_THREAD;
31pub const SECCOMP_RET_TRAP: u32 = 0x00030000;
32pub const SECCOMP_RET_ERRNO: u32 = 0x00050000;
33pub const SECCOMP_RET_USER_NOTIF: u32 = 0x7fc00000;
34pub const SECCOMP_RET_TRACE: u32 = 0x7ff00000;
35pub const SECCOMP_RET_LOG: u32 = 0x7ffc0000;
36pub const SECCOMP_RET_ALLOW: u32 = 0x7fff0000;
37
38pub const SECCOMP_RET_ACTION_FULL: u32 = 0xffff0000;
39pub const SECCOMP_RET_ACTION: u32 = 0x7fff0000;
40pub const SECCOMP_RET_DATA: u32 = 0x0000ffff;
41
42#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
43#[repr(C)]
44pub struct seccomp_data {
45    pub nr: c_int,
46    pub arch: u32,
47    pub instruction_pointer: u64,
48    pub args: [u64; 6],
49}
50
51#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
52#[repr(C)]
53pub struct seccomp_notif_sizes {
54    pub seccomp_notif: u16,
55    pub seccomp_notif_resp: u16,
56    pub seccomp_data: u16,
57}
58
59#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
60#[repr(C)]
61pub struct seccomp_notif {
62    pub id: u64,
63    pub pid: u32,
64    pub flags: u32,
65    pub data: seccomp_data,
66}
67
68/// Tell the kernel to execute the target's system call
69///
70/// `linux/seccomp.h`:
71///
72/// > Note, the `SECCOMP_USER_NOTIF_FLAG_CONTINUE` flag must be used with caution!
73/// > If set by the process supervising the syscalls of another process the
74/// > syscall will continue. This is problematic because of an inherent TOCTOU.
75/// > An attacker can exploit the time while the supervised process is waiting on
76/// > a response from the supervising process to rewrite syscall arguments which
77/// > are passed as pointers of the intercepted syscall.
78/// > It should be absolutely clear that this means that the seccomp notifier
79/// > _cannot_ be used to implement a security policy! It should only ever be used
80/// > in scenarios where a more privileged process supervises the syscalls of a
81/// > lesser privileged process to get around kernel-enforced security
82/// > restrictions when the privileged process deems this safe. In other words,
83/// > in order to continue a syscall the supervising process should be sure that
84/// > another security mechanism or the kernel itself will sufficiently block
85/// > syscalls if arguments are rewritten to something unsafe.
86/// >
87/// > Similar precautions should be applied when stacking `SECCOMP_RET_USER_NOTIF`
88/// > or `SECCOMP_RET_TRACE`. For `SECCOMP_RET_USER_NOTIF` filters acting on the
89/// > same syscall, the most recently added filter takes precedence. This means
90/// > that the new `SECCOMP_RET_USER_NOTIF` filter can override any
91/// > `SECCOMP_IOCTL_NOTIF_SEND` from earlier filters, essentially allowing all
92/// > such filtered syscalls to be executed by sending the response
93/// > `SECCOMP_USER_NOTIF_FLAG_CONTINUE`. Note that `SECCOMP_RET_TRACE` can equally
94/// > be overridden by `SECCOMP_USER_NOTIF_FLAG_CONTINUE`.
95pub const SECCOMP_USER_NOTIF_FLAG_CONTINUE: u32 = 1;
96
97#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
98#[repr(C)]
99pub struct seccomp_notif_resp {
100    pub id: u64,
101    pub val: i64,
102    pub error: i32,
103    pub flags: u32,
104}
105
106pub const SECCOMP_ADDFD_FLAG_SETFD: u32 = 1;
107pub const SECCOMP_ADDFD_FLAG_SEND: u32 = 2;
108
109#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
110#[repr(C)]
111pub struct seccomp_notif_addfd {
112    pub id: u64,
113    pub flags: u32,
114    pub srcfd: u32,
115    pub newfd: u32,
116    pub newfd_flags: u32,
117}
118
119/// version information
120#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
121#[repr(C)]
122pub struct scmp_version {
123    pub major: c_uint,
124    pub minor: c_uint,
125    pub micro: c_uint,
126}
127
128/// Filter context/handle (`*mut`)
129pub type scmp_filter_ctx = *mut c_void;
130/// Filter context/handle (`*const`)
131pub type const_scmp_filter_ctx = *const c_void;
132
133/// Filter attributes
134#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
135#[repr(C)]
136pub enum scmp_filter_attr {
137    _SCMP_FLTATR_MIN = 0,
138    /// default filter action
139    SCMP_FLTATR_ACT_DEFAULT = 1,
140    /// bad architecture action
141    SCMP_FLTATR_ACT_BADARCH = 2,
142    /// set `NO_NEW_PRIVS` on filter load
143    SCMP_FLTATR_CTL_NNP = 3,
144    /// sync threads on filter load
145    SCMP_FLTATR_CTL_TSYNC = 4,
146    /// allow rules with a -1 syscall
147    SCMP_FLTATR_API_TSKIP = 5,
148    /// log not-allowed actions
149    SCMP_FLTATR_CTL_LOG = 6,
150    /// disable SSB mitigation
151    SCMP_FLTATR_CTL_SSB = 7,
152    /// filter optimization level:
153    /// - 0: currently unused
154    /// - 1: rules weighted by priority and complexity (DEFAULT)
155    /// - 2: binary tree sorted by syscall number
156    SCMP_FLTATR_CTL_OPTIMIZE = 8,
157    /// return the system return codes
158    SCMP_FLTATR_API_SYSRAWRC = 9,
159    /// request wait killable semantics
160    SCMP_FLTATR_CTL_WAITKILL = 10,
161    _SCMP_FLTATR_MAX,
162}
163
164/// Comparison operators
165#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
166#[repr(C)]
167pub enum scmp_compare {
168    _SCMP_CMP_MIN = 0,
169    /// not equal
170    SCMP_CMP_NE = 1,
171    /// less than
172    SCMP_CMP_LT = 2,
173    /// less than or equal
174    SCMP_CMP_LE = 3,
175    /// equal
176    SCMP_CMP_EQ = 4,
177    /// greater than or equal
178    SCMP_CMP_GE = 5,
179    /// greater than
180    SCMP_CMP_GT = 6,
181    /// masked equality
182    SCMP_CMP_MASKED_EQ = 7,
183    _SCMP_CMP_MAX,
184}
185
186/// Argument datum
187pub type scmp_datum_t = u64;
188
189/// Argument / Value comparison definition
190#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
191#[repr(C)]
192pub struct scmp_arg_cmp {
193    /// argument number, starting at 0
194    pub arg: c_uint,
195    /// the comparison op, e.g. `SCMP_CMP_*`
196    pub op: scmp_compare,
197    pub datum_a: scmp_datum_t,
198    pub datum_b: scmp_datum_t,
199}
200
201/// The native architecture token
202pub const SCMP_ARCH_NATIVE: u32 = 0x0;
203/// The x86 (32-bit) architecture token
204pub const SCMP_ARCH_X86: u32 = 0x40000003;
205/// The x86-64 (64-bit) architecture token
206pub const SCMP_ARCH_X86_64: u32 = 0xc000003e;
207/// The x32 (32-bit x86_64) architecture token
208///
209/// NOTE: this is different from the value used by the kernel because libseccomp need to
210/// be able to distinguish between x32 and x86_64
211pub const SCMP_ARCH_X32: u32 = 0x4000003e;
212pub const SCMP_ARCH_ARM: u32 = 0x40000028;
213pub const SCMP_ARCH_AARCH64: u32 = 0xc00000b7;
214pub const SCMP_ARCH_LOONGARCH64: u32 = 0xc0000102;
215pub const SCMP_ARCH_M68K: u32 = 0x4;
216pub const SCMP_ARCH_MIPS: u32 = 0x8;
217pub const SCMP_ARCH_MIPS64: u32 = 0x80000008;
218pub const SCMP_ARCH_MIPS64N32: u32 = 0xa0000008;
219pub const SCMP_ARCH_MIPSEL: u32 = 0x40000008;
220pub const SCMP_ARCH_MIPSEL64: u32 = 0xc0000008;
221pub const SCMP_ARCH_MIPSEL64N32: u32 = 0xe0000008;
222pub const SCMP_ARCH_PPC: u32 = 0x14;
223pub const SCMP_ARCH_PPC64: u32 = 0x80000015;
224pub const SCMP_ARCH_PPC64LE: u32 = 0xc0000015;
225pub const SCMP_ARCH_S390: u32 = 0x16;
226pub const SCMP_ARCH_S390X: u32 = 0x80000016;
227pub const SCMP_ARCH_PARISC: u32 = 0xf;
228pub const SCMP_ARCH_PARISC64: u32 = 0x8000000f;
229pub const SCMP_ARCH_RISCV64: u32 = 0xc00000f3;
230pub const SCMP_ARCH_SHEB: u32 = 0x2a;
231pub const SCMP_ARCH_SH: u32 = 0x4000002a;
232
233pub const SCMP_ACT_MASK: u32 = SECCOMP_RET_ACTION_FULL;
234/// Kill the process
235pub const SCMP_ACT_KILL_PROCESS: u32 = 0x80000000;
236/// Kill the thread
237pub const SCMP_ACT_KILL_THREAD: u32 = 0x00000000;
238/// Kill the thread, defined for backward compatibility
239pub const SCMP_ACT_KILL: u32 = SCMP_ACT_KILL_THREAD;
240/// Throw a `SIGSYS` signal
241pub const SCMP_ACT_TRAP: u32 = 0x00030000;
242/// Notifies userspace
243pub const SCMP_ACT_NOTIFY: u32 = 0x7fc00000;
244pub const SCMP_ACT_ERRNO_MASK: u32 = 0x00050000;
245/// Return the specified error code
246#[must_use]
247pub const fn SCMP_ACT_ERRNO(x: u16) -> u32 {
248    SCMP_ACT_ERRNO_MASK | x as u32
249}
250pub const SCMP_ACT_TRACE_MASK: u32 = 0x7ff00000;
251/// Notify a tracing process with the specified value
252#[must_use]
253pub const fn SCMP_ACT_TRACE(x: u16) -> u32 {
254    SCMP_ACT_TRACE_MASK | x as u32
255}
256/// Allow the syscall to be executed after the action has been logged
257pub const SCMP_ACT_LOG: u32 = 0x7ffc0000;
258/// Allow the syscall to be executed
259pub const SCMP_ACT_ALLOW: u32 = 0x7fff0000;
260
261#[link(name = "seccomp")]
262extern "C" {
263
264    /// Query the library version information
265    ///
266    /// This function returns a pointer to a populated [`scmp_version`] struct, the
267    /// caller does not need to free the structure when finished.
268    pub fn seccomp_version() -> *const scmp_version;
269
270    /// Query the library's level of API support
271    ///
272    /// This function returns an API level value indicating the current supported
273    /// functionality.  It is important to note that this level of support is
274    /// determined at runtime and therefore can change based on the running kernel
275    /// and system configuration (e.g. any previously loaded seccomp filters).  This
276    /// function can be called multiple times, but it only queries the system the
277    /// first time it is called, the API level is cached and used in subsequent
278    /// calls.
279    ///
280    /// The current API levels are described below:
281    /// - 0
282    ///   - reserved
283    /// - 1
284    ///   - base level
285    /// - 2
286    ///   - support for the [`SCMP_FLTATR_CTL_TSYNC`](scmp_filter_attr::SCMP_FLTATR_CTL_TSYNC) filter attribute
287    ///   - uses the [`seccomp(2)`] syscall instead of the [`prctl(2)`] syscall
288    /// - 3
289    ///   - support for the [`SCMP_FLTATR_CTL_LOG`](scmp_filter_attr::SCMP_FLTATR_CTL_LOG) filter attribute
290    ///   - support for the [`SCMP_ACT_LOG`] action
291    ///   - support for the [`SCMP_ACT_KILL_PROCESS`] action
292    /// - 4
293    ///   - support for the [`SCMP_FLTATR_CTL_SSB`](scmp_filter_attr::SCMP_FLTATR_CTL_SSB) filter attribute
294    /// - 5
295    ///   - support for the [`SCMP_ACT_NOTIFY`] action and notify APIs
296    /// - 6
297    ///   - support the simultaneous use of [`SCMP_FLTATR_CTL_TSYNC`](scmp_filter_attr::SCMP_FLTATR_CTL_TSYNC) and notify APIs
298    /// - 7
299    ///   - support for the [`SCMP_FLTATR_CTL_WAITKILL`](scmp_filter_attr::SCMP_FLTATR_CTL_WAITKILL) filter attribute
300    ///
301    /// [`seccomp(2)`]: https://man7.org/linux/man-pages/man2/seccomp.2.html
302    /// [`prctl(2)`]: https://man7.org/linux/man-pages/man2/prctl.2.html
303    pub fn seccomp_api_get() -> c_uint;
304
305    /// Set the library's level of API support
306    ///
307    /// This function forcibly sets the API level of the library at runtime.  Valid
308    /// API levels are discussed in the description of the [`seccomp_api_get()`]
309    /// function.  General use of this function is strongly discouraged.
310    pub fn seccomp_api_set(level: c_uint) -> c_int;
311
312    /// Initialize the filter state
313    ///
314    /// - `def_action`: the default filter action
315    ///
316    /// This function initializes the internal seccomp filter state and should
317    /// be called before any other functions in this library to ensure the filter
318    /// state is initialized.  Returns a filter context on success, `ptr::null()` on failure.
319    pub fn seccomp_init(def_action: u32) -> scmp_filter_ctx;
320
321    /// Reset the filter state
322    ///
323    /// - `ctx`: the filter context
324    /// - `def_action`: the default filter action
325    ///
326    /// This function resets the given seccomp filter state and ensures the
327    /// filter state is reinitialized.  This function does not reset any seccomp
328    /// filters already loaded into the kernel.  Returns zero on success, negative
329    /// values on failure.
330    pub fn seccomp_reset(ctx: scmp_filter_ctx, def_action: u32) -> c_int;
331
332    /// Destroys the filter state and releases any resources
333    ///
334    /// - `ctx`: the filter context
335    ///
336    /// This functions destroys the given seccomp filter state and releases any
337    /// resources, including memory, associated with the filter state.  This
338    /// function does not reset any seccomp filters already loaded into the kernel.
339    /// The filter context can no longer be used after calling this function.
340    pub fn seccomp_release(ctx: scmp_filter_ctx);
341
342    /// Merge two filters
343    ///
344    /// - `ctx_dst`: the destination filter context
345    /// - `ctx_src`: the source filter context
346    ///
347    /// This function merges two filter contexts into a single filter context and
348    /// destroys the second filter context.  The two filter contexts must have the
349    /// same attribute values and not contain any of the same architectures; if they
350    /// do, the merge operation will fail.  On success, the source filter context
351    /// will be destroyed and should no longer be used; it is not necessary to
352    /// call [`seccomp_release()`] on the source filter context.  Returns zero on
353    /// success, negative values on failure.
354    pub fn seccomp_merge(ctx_dst: scmp_filter_ctx, ctx_src: scmp_filter_ctx) -> c_int;
355
356    /// Resolve the architecture name to a architecture token
357    ///
358    /// - `arch_name`: the architecture name
359    ///
360    /// This function resolves the given architecture name to a token suitable for
361    /// use with libseccomp, returns zero on failure.
362    pub fn seccomp_arch_resolve_name(arch_name: *const c_char) -> u32;
363
364    /// Return the native architecture token
365    ///
366    /// This function returns the native architecture token value, e.g. `SCMP_ARCH_*`.
367    pub fn seccomp_arch_native() -> u32;
368
369    /// Check to see if an existing architecture is present in the filter
370    ///
371    /// - `ctx`: the filter context
372    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
373    ///
374    /// This function tests to see if a given architecture is included in the filter
375    /// context.  If the architecture token is [`SCMP_ARCH_NATIVE`] then the native
376    /// architecture will be assumed.  Returns zero if the architecture exists in
377    /// the filter, `-libc::EEXIST` if it is not present, and other negative values on
378    /// failure.
379    pub fn seccomp_arch_exist(ctx: const_scmp_filter_ctx, arch_token: u32) -> c_int;
380
381    /// Adds an architecture to the filter
382    ///
383    /// - `ctx`: the filter context
384    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
385    ///
386    /// This function adds a new architecture to the given seccomp filter context.
387    /// Any new rules added after this function successfully returns will be added
388    /// to this architecture but existing rules will not be added to this
389    /// architecture.  If the architecture token is [`SCMP_ARCH_NATIVE`] then the native
390    /// architecture will be assumed.  Returns zero on success, `-libc::EEXIST` if
391    /// specified architecture is already present, other negative values on failure.
392    pub fn seccomp_arch_add(ctx: scmp_filter_ctx, arch_token: u32) -> c_int;
393
394    /// Removes an architecture from the filter
395    ///
396    /// - `ctx`: the filter context
397    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
398    ///
399    /// This function removes an architecture from the given seccomp filter context.
400    /// If the architecture token is [`SCMP_ARCH_NATIVE`] then the native architecture
401    /// will be assumed.  Returns zero on success, negative values on failure.
402    pub fn seccomp_arch_remove(ctx: scmp_filter_ctx, arch_token: u32) -> c_int;
403
404    /// Loads the filter into the kernel
405    ///
406    /// - `ctx`: the filter context
407    ///
408    /// This function loads the given seccomp filter context into the kernel.  If
409    /// the filter was loaded correctly, the kernel will be enforcing the filter
410    /// when this function returns.  Returns zero on success, negative values on
411    /// error.
412    pub fn seccomp_load(ctx: const_scmp_filter_ctx) -> c_int;
413
414    /// Set the value of a filter attribute
415    ///
416    /// - `ctx`: the filter context
417    /// - `attr`: the filter attribute name
418    /// - `value`: the filter attribute value
419    ///
420    /// This function fetches the value of the given attribute name and returns it
421    /// via `value`.  Returns zero on success, negative values on failure.
422    pub fn seccomp_attr_get(
423        ctx: const_scmp_filter_ctx,
424        attr: scmp_filter_attr,
425        value: *mut u32,
426    ) -> c_int;
427
428    /// Set the value of a filter attribute
429    ///
430    /// - `ctx`: the filter context
431    /// - `attr`: the filter attribute name
432    /// - `value`: the filter attribute value
433    ///
434    /// This function sets the value of the given attribute.  Returns zero on
435    /// success, negative values on failure.
436    pub fn seccomp_attr_set(ctx: scmp_filter_ctx, attr: scmp_filter_attr, value: u32) -> c_int;
437
438    /// Resolve a syscall number to a name
439    ///
440    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
441    /// - `num`: the syscall number
442    ///
443    /// Resolve the given syscall number to the syscall name for the given
444    /// architecture; it is up to the caller to free the returned string.  Returns
445    /// the syscall name on success, `ptr::null()` on failure
446    pub fn seccomp_syscall_resolve_num_arch(arch_token: u32, num: c_int) -> *const c_char;
447
448    /// Resolve a syscall name to a number
449    ///
450    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
451    /// - `name`: the syscall name
452    ///
453    /// Resolve the given syscall name to the syscall number for the given
454    /// architecture.  Returns the syscall number on success, including negative
455    /// pseudo syscall numbers (e.g. `__PNR_*`); returns [`__NR_SCMP_ERROR`] on failure.
456    pub fn seccomp_syscall_resolve_name_arch(arch_token: u32, name: *const c_char) -> c_int;
457
458    /// Resolve a syscall name to a number and perform any rewriting necessary
459    ///
460    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
461    /// - `name`: the syscall name
462    ///
463    /// Resolve the given syscall name to the syscall number for the given
464    /// architecture and do any necessary syscall rewriting needed by the
465    /// architecture.  Returns the syscall number on success, including negative
466    /// pseudo syscall numbers (e.g. `__PNR_*`); returns [`__NR_SCMP_ERROR`] on failure.
467    pub fn seccomp_syscall_resolve_name_rewrite(arch_token: u32, name: *const c_char) -> c_int;
468
469    /// Resolve a syscall name to a number
470    ///
471    /// - `name`: the syscall name
472    ///
473    /// Resolve the given syscall name to the syscall number.  Returns the syscall
474    /// number on success, including negative pseudo syscall numbers (e.g. `__PNR_*`);
475    /// returns [`__NR_SCMP_ERROR`] on failure.
476    pub fn seccomp_syscall_resolve_name(name: *const c_char) -> c_int;
477
478    /// Set the priority of a given syscall
479    ///
480    /// - `ctx`: the filter context
481    /// - `syscall`: the syscall number
482    /// - `priority`: priority value, higher value == higher priority
483    ///
484    /// This function sets the priority of the given syscall; this value is used
485    /// when generating the seccomp filter code such that higher priority syscalls
486    /// will incur less filter code overhead than the lower priority syscalls in the
487    /// filter.  Returns zero on success, negative values on failure.
488    pub fn seccomp_syscall_priority(ctx: scmp_filter_ctx, syscall: c_int, priority: u8) -> c_int;
489
490    /// Add a new rule to the filter
491    ///
492    /// - `ctx`: the filter context
493    /// - `action`: the filter action
494    /// - `syscall`: the syscall number
495    /// - `arg_cnt`: the number of argument filters in the argument filter chain
496    /// - `...`: [`scmp_arg_cmp`] structs
497    ///
498    /// This function adds a series of new argument/value checks to the seccomp
499    /// filter for the given syscall; multiple argument/value checks can be
500    /// specified and they will be chained together (AND'd together) in the filter.
501    /// If the specified rule needs to be adjusted due to architecture specifics it
502    /// will be adjusted without notification.  Returns zero on success, negative
503    /// values on failure.
504    pub fn seccomp_rule_add(
505        ctx: scmp_filter_ctx,
506        action: u32,
507        syscall: c_int,
508        arg_cnt: c_uint,
509        ...
510    ) -> c_int;
511
512    /// Add a new rule to the filter
513    ///
514    /// - `ctx`: the filter context
515    /// - `action`: the filter action
516    /// - `syscall`: the syscall number
517    /// - `arg_cnt`: the number of elements in the arg_array parameter
518    /// - `arg_array`: array of [`scmp_arg_cmp`] structs
519    ///
520    /// This function adds a series of new argument/value checks to the seccomp
521    /// filter for the given syscall; multiple argument/value checks can be
522    /// specified and they will be chained together (AND'd together) in the filter.
523    /// If the specified rule needs to be adjusted due to architecture specifics it
524    /// will be adjusted without notification.  Returns zero on success, negative
525    /// values on failure.
526    pub fn seccomp_rule_add_array(
527        ctx: scmp_filter_ctx,
528        action: u32,
529        syscall: c_int,
530        arg_cnt: c_uint,
531        arg_array: *const scmp_arg_cmp,
532    ) -> c_int;
533
534    /// Add a new rule to the filter
535    ///
536    /// - `ctx`: the filter context
537    /// - `action`: the filter action
538    /// - `syscall`: the syscall number
539    /// - `arg_cnt`: the number of argument filters in the argument filter chain
540    /// - `...`: [`scmp_arg_cmp`] structs
541    ///
542    /// This function adds a series of new argument/value checks to the seccomp
543    /// filter for the given syscall; multiple argument/value checks can be
544    /// specified and they will be chained together (AND'd together) in the filter.
545    /// If the specified rule can not be represented on the architecture the
546    /// function will fail.  Returns zero on success, negative values on failure.
547    pub fn seccomp_rule_add_exact(
548        ctx: scmp_filter_ctx,
549        action: u32,
550        syscall: c_int,
551        arg_cnt: c_uint,
552        ...
553    ) -> c_int;
554
555    /// Add a new rule to the filter
556    ///
557    /// - `ctx`: the filter context
558    /// - `action`: the filter action
559    /// - `syscall`: the syscall number
560    /// - `arg_cnt`:  the number of elements in the arg_array parameter
561    /// - `arg_array`: array of scmp_arg_cmp structs
562    ///
563    /// This function adds a series of new argument/value checks to the seccomp
564    /// filter for the given syscall; multiple argument/value checks can be
565    /// specified and they will be chained together (AND'd together) in the filter.
566    /// If the specified rule can not be represented on the architecture the
567    /// function will fail.  Returns zero on success, negative values on failure.
568    pub fn seccomp_rule_add_exact_array(
569        ctx: scmp_filter_ctx,
570        action: u32,
571        syscall: c_int,
572        arg_cnt: c_uint,
573        arg_array: *const scmp_arg_cmp,
574    ) -> c_int;
575
576    /// Allocate a pair of notification request/response structures
577    ///
578    /// - `req`: the request location
579    /// - `resp`: the response location
580    ///
581    /// This function allocates a pair of request/response structure by computing
582    /// the correct sized based on the currently running kernel. It returns zero on
583    /// success, and negative values on failure.
584    pub fn seccomp_notify_alloc(
585        req: *mut *mut seccomp_notif,
586        resp: *mut *mut seccomp_notif_resp,
587    ) -> c_int;
588
589    /// Free a pair of notification request/response structures.
590    ///
591    /// - `req`: the request location
592    /// - `resp`: the response location
593    pub fn seccomp_notify_free(req: *mut seccomp_notif, resp: *mut seccomp_notif_resp) -> c_int;
594
595    /// Send a notification response to a seccomp notification fd
596    ///
597    /// - `fd`: the notification fd
598    /// - `resp`: the response buffer to use
599    ///
600    /// Sends a notification response on this fd. This function is thread safe
601    /// (synchronization is performed in the kernel). Returns zero on success,
602    /// negative values on error.
603    pub fn seccomp_notify_receive(fd: c_int, req: *mut seccomp_notif) -> c_int;
604
605    /// Check if a notification id is still valid
606    ///
607    /// - `fd`: the notification fd
608    /// - `id`: the id to test
609    ///
610    /// Checks to see if a notification id is still valid. Returns 0 on success, and
611    /// negative values on failure.
612    pub fn seccomp_notify_respond(fd: c_int, resp: *mut seccomp_notif_resp) -> c_int;
613
614    /// Check if a notification id is still valid
615    ///
616    /// - `fd`: the notification fd
617    /// - `id`: the id to test
618    ///
619    /// Checks to see if a notification id is still valid. Returns 0 on success, and
620    /// negative values on failure.
621    pub fn seccomp_notify_id_valid(fd: c_int, id: u64) -> c_int;
622
623    /// Return the notification fd from a filter that has already been loaded
624    ///
625    /// - `ctx`: the filter context
626    ///
627    /// This returns the listener fd that was generated when the seccomp policy was
628    /// loaded. This is only valid after [`seccomp_load()`] with a filter that makes
629    /// use of [`SCMP_ACT_NOTIFY`].
630    pub fn seccomp_notify_fd(ctx: const_scmp_filter_ctx) -> c_int;
631
632    /// Generate seccomp Pseudo Filter Code (PFC) and export it to a file
633    ///
634    /// - `ctx`: the filter context
635    /// - `fd`: the destination fd
636    ///
637    /// This function generates seccomp Pseudo Filter Code (PFC) and writes it to
638    /// the given fd.  Returns zero on success, negative values on failure.
639    pub fn seccomp_export_pfc(ctx: const_scmp_filter_ctx, fd: c_int) -> c_int;
640
641    /// Generate seccomp Berkeley Packet Filter (BPF) code and export it to a file
642    ///
643    /// - `ctx`: the filter context
644    /// - `fd`: the destination fd
645    ///
646    /// This function generates seccomp Berkeley Packer Filter (BPF) code and writes
647    /// it to the given fd.  Returns zero on success, negative values on failure.
648    pub fn seccomp_export_bpf(ctx: const_scmp_filter_ctx, fd: c_int) -> c_int;
649
650    /// Generate seccomp Berkeley Packet Filter (BPF) code and export it to a buffer
651    ///
652    /// - `ctx`: the filter context
653    /// - `buf`: the destination buffer
654    /// - `len`: on input the length of the buffer, on output the number of bytes in the program
655    ///
656    /// This function generates seccomp Berkeley Packer Filter (BPF) code and writes
657    /// it to the given buffer.  Returns zero on success, negative values on failure.
658    pub fn seccomp_export_bpf_mem(
659        ctx: const_scmp_filter_ctx,
660        buf: *mut c_void,
661        len: *mut usize,
662    ) -> c_int;
663
664    /// Start a new seccomp filter transaction
665    ///
666    /// - `ctx`: the filter context
667    ///
668    /// This function starts a new seccomp filter transaction that the caller can use
669    /// to perform any number of filter modifications which can then be committed
670    /// to the filter using [`seccomp_transaction_commit()`] or rejected using
671    /// [`seccomp_transaction_reject()`]. It is important to note that
672    /// transactions only affect the seccomp filter state while it is being
673    /// managed by libseccomp; seccomp filters which have been loaded into the
674    /// kernel can not be modified, only new seccomp filters can be added on top
675    /// of the existing loaded filter stack. Returns zero on success, negative values on failure.
676    pub fn seccomp_transaction_start(ctx: const_scmp_filter_ctx) -> c_int;
677
678    /// Reject a transaction started by [`seccomp_transaction_start`]
679    ///
680    /// - `ctx`: the filter context
681    ///
682    /// This function rejects the current seccomp filter transaction, discarding all
683    /// the filter modifications made during the transaction. Once rejected, the filter
684    /// context remains unchanged as it was before the transaction started.
685    pub fn seccomp_transaction_reject(ctx: scmp_filter_ctx);
686
687    /// Commit a transaction started by [`seccomp_transaction_start`]
688    ///
689    /// - `ctx`: the filter context
690    ///
691    /// This function commits the current seccomp filter transaction, applying all
692    /// the filter modifications made during the transaction to the filter context.
693    /// Once committed, the changes are finalized and cannot be undone.
694    /// Returns zero on success, negative values on failure.
695    pub fn seccomp_transaction_commit(ctx: scmp_filter_ctx) -> c_int;
696
697    ///  Precompute the seccomp filter for future use
698    ///
699    ///  - `ctx`: the filter context
700    ///
701    ///  This function precomputes the seccomp filter and stores it internally for
702    ///  future use, speeding up [`seccomp_load()`] and other functions which require
703    ///  the generated filter.
704    pub fn seccomp_precompute(ctx: const_scmp_filter_ctx) -> c_int;
705}
706
707/// Negative pseudo syscall number returned by some functions in case of an error
708pub const __NR_SCMP_ERROR: c_int = -1;
709pub const __NR_SCMP_UNDEF: c_int = -2;
libseccomp_sys/lib.rs

libseccomp_sys/
lib.rs
