nc/platform/linux-types/uapi/linux/
seccomp.rs

1// Copyright (c) 2020 Xu Shaohua <shaohua@biofan.org>. All rights reserved.
2// Use of this source is governed by Apache-2.0 License that can be found
3// in the LICENSE file.
4
5//! From `include/uapi/linux/seccomp.h`
6
7#![allow(clippy::module_name_repetitions)]
8
9use crate::{IO, IOR, IOW, IOWR};
10
11/// Valid values for seccomp.mode and prctl(`PR_SET_SECCOMP`, `<mode>`)
12/// seccomp is not in use.
13pub const SECCOMP_MODE_DISABLED: u32 = 0;
14/// uses hard-coded filter.
15pub const SECCOMP_MODE_STRICT: u32 = 1;
16/// uses user-supplied filter.
17pub const SECCOMP_MODE_FILTER: u32 = 2;
18
19/// Valid operations for seccomp syscall.
20pub const SECCOMP_SET_MODE_STRICT: u32 = 0;
21pub const SECCOMP_SET_MODE_FILTER: u32 = 1;
22pub const SECCOMP_GET_ACTION_AVAIL: u32 = 2;
23pub const SECCOMP_GET_NOTIF_SIZES: u32 = 3;
24
25/// Valid flags for `SECCOMP_SET_MODE_FILTER`
26pub const SECCOMP_FILTER_FLAG_TSYNC: usize = 1;
27pub const SECCOMP_FILTER_FLAG_LOG: usize = 1 << 1;
28pub const SECCOMP_FILTER_FLAG_SPEC_ALLOW: usize = 1 << 2;
29pub const SECCOMP_FILTER_FLAG_NEW_LISTENER: usize = 1 << 3;
30
31/// All BPF programs must return a 32-bit value.
32///
33/// The bottom 16-bits are for optional return data.
34/// The upper 16-bits are ordered from least permissive values to most,
35/// as a signed value (so 0x8000000 is negative).
36///
37/// The ordering ensures that a `min_t()` over composed return values always
38/// selects the least permissive choice.
39/// kill the process
40pub const SECCOMP_RET_KILL_PROCESS: u32 = 0x8000_0000;
41/// kill the thread
42pub const SECCOMP_RET_KILL_THREAD: u32 = 0x0000_0000;
43pub const SECCOMP_RET_KILL: u32 = SECCOMP_RET_KILL_THREAD;
44/// disallow and force a SIGSYS
45pub const SECCOMP_RET_TRAP: u32 = 0x0003_0000;
46/// returns an errno
47pub const SECCOMP_RET_ERRNO: u32 = 0x0005_0000;
48/// notifies userspace
49pub const SECCOMP_RET_USER_NOTIF: u32 = 0x7fc0_0000;
50/// pass to a tracer or disallow
51pub const SECCOMP_RET_TRACE: u32 = 0x7ff0_0000;
52/// allow after logging
53pub const SECCOMP_RET_LOG: u32 = 0x7ffc_0000;
54/// allow
55pub const SECCOMP_RET_ALLOW: u32 = 0x7fff_0000;
56
57/// Masks for the return value sections.
58pub const SECCOMP_RET_ACTION_FULL: u32 = 0xffff_0000;
59pub const SECCOMP_RET_ACTION: u32 = 0x7fff_0000;
60pub const SECCOMP_RET_DATA: u32 = 0x0000_ffff;
61
62/// struct `seccomp_data` - the format the BPF program executes over.
63///
64/// @nr: the system call number
65/// @arch: indicates system call convention as an `AUDIT_ARCH_*` value
66///        as defined in `<linux/audit.h>`.
67/// `@instruction_pointer`: at the time of the system call.
68/// @args: up to 6 system call arguments always stored as 64-bit values
69///        regardless of the architecture.
70#[repr(C)]
71#[derive(Debug, Default, Clone, Copy)]
72pub struct seccomp_data_t {
73    pub nr: i32,
74    pub arch: u32,
75    pub instruction_pointer: u64,
76    pub args: [u64; 6],
77}
78
79#[repr(C)]
80#[derive(Debug, Default, Clone, Copy)]
81pub struct seccomp_notif_sizes_t {
82    pub seccomp_notif: u16,
83    pub seccomp_notif_resp: u16,
84    pub seccomp_data: u16,
85}
86
87#[repr(C)]
88#[derive(Debug, Default, Clone, Copy)]
89pub struct seccomp_notif_t {
90    pub id: u64,
91    pub pid: u32,
92    pub flags: u32,
93    pub data: seccomp_data_t,
94}
95
96#[repr(C)]
97#[derive(Debug, Default, Clone, Copy)]
98pub struct seccomp_notif_resp_t {
99    pub id: u64,
100    pub val: i64,
101    pub error: i32,
102    pub flags: u32,
103}
104
105pub const SECCOMP_IOC_MAGIC: u8 = b'!';
106
107#[must_use]
108#[inline]
109pub const fn SECCOMP_IO(nr: u32) -> u32 {
110    IO(SECCOMP_IOC_MAGIC, nr)
111}
112
113#[must_use]
114#[inline]
115pub const fn SECCOMP_IOR<T>(nr: u32) -> u32 {
116    IOR::<T>(SECCOMP_IOC_MAGIC, nr)
117}
118
119#[must_use]
120#[inline]
121pub const fn SECCOMP_IOW<T>(nr: u32) -> u32 {
122    IOW::<T>(SECCOMP_IOC_MAGIC, nr)
123}
124
125#[must_use]
126#[inline]
127pub const fn SECCOMP_IOWR<T>(nr: u32) -> u32 {
128    IOWR::<T>(SECCOMP_IOC_MAGIC, nr)
129}
130
131/// Flags for seccomp notification fd ioctl.
132pub const SECCOMP_IOCTL_NOTIF_RECV: u32 = SECCOMP_IOWR::<seccomp_notif_t>(0);
133
134pub const SECCOMP_IOCTL_NOTIF_SEND: u32 = SECCOMP_IOWR::<seccomp_notif_resp_t>(1);
135
136pub const SECCOMP_IOCTL_NOTIF_ID_VALID: u32 = SECCOMP_IOR::<u64>(2);
nc/platform/linux-types/uapi/linux/seccomp.rs

nc/platform/linux-types/uapi/linux/
seccomp.rs
