libseccomp_sys/
lib.rs

1// SPDX-License-Identifier: Apache-2.0 or MIT
2//
3// Copyright 2021 Sony Group Corporation
4//
5
6#![allow(non_camel_case_types)]
7#![allow(non_snake_case)]
8
9//! Raw FFI bindings for libseccomp library
10
11use std::os::raw::*;
12
13pub const SECCOMP_MODE_DISABLED: u64 = 0;
14pub const SECCOMP_MODE_STRICT: u64 = 1;
15pub const SECCOMP_MODE_FILTER: u64 = 2;
16
17pub const SECCOMP_SET_MODE_STRICT: u32 = 0;
18pub const SECCOMP_SET_MODE_FILTER: u32 = 1;
19pub const SECCOMP_GET_ACTION_AVAIL: u32 = 2;
20pub const SECCOMP_GET_NOTIF_SIZES: u32 = 3;
21
22pub const SECCOMP_FILTER_FLAG_TSYNC: u32 = 1;
23pub const SECCOMP_FILTER_FLAG_LOG: u32 = 2;
24pub const SECCOMP_FILTER_FLAG_SPEC_ALLOW: u32 = 4;
25pub const SECCOMP_FILTER_FLAG_NEW_LISTENER: u32 = 8;
26pub const SECCOMP_FILTER_FLAG_TSYNC_ESRCH: u32 = 16;
27
28pub const SECCOMP_RET_KILL_PROCESS: u32 = 0x80000000;
29pub const SECCOMP_RET_KILL_THREAD: u32 = 0x00000000;
30pub const SECCOMP_RET_KILL: u32 = SECCOMP_RET_KILL_THREAD;
31pub const SECCOMP_RET_TRAP: u32 = 0x00030000;
32pub const SECCOMP_RET_ERRNO: u32 = 0x00050000;
33pub const SECCOMP_RET_USER_NOTIF: u32 = 0x7fc00000;
34pub const SECCOMP_RET_TRACE: u32 = 0x7ff00000;
35pub const SECCOMP_RET_LOG: u32 = 0x7ffc0000;
36pub const SECCOMP_RET_ALLOW: u32 = 0x7fff0000;
37
38pub const SECCOMP_RET_ACTION_FULL: u32 = 0xffff0000;
39pub const SECCOMP_RET_ACTION: u32 = 0x7fff0000;
40pub const SECCOMP_RET_DATA: u32 = 0x0000ffff;
41
42#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
43#[repr(C)]
44pub struct seccomp_data {
45    pub nr: c_int,
46    pub arch: u32,
47    pub instruction_pointer: u64,
48    pub args: [u64; 6],
49}
50
51#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
52#[repr(C)]
53pub struct seccomp_notif_sizes {
54    pub seccomp_notif: u16,
55    pub seccomp_notif_resp: u16,
56    pub seccomp_data: u16,
57}
58
59#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
60#[repr(C)]
61pub struct seccomp_notif {
62    pub id: u64,
63    pub pid: u32,
64    pub flags: u32,
65    pub data: seccomp_data,
66}
67
68/// Tell the kernel to execute the target's system call
69///
70/// `linux/seccomp.h`:
71///
72/// > Note, the `SECCOMP_USER_NOTIF_FLAG_CONTINUE` flag must be used with caution!
73/// > If set by the process supervising the syscalls of another process the
74/// > syscall will continue. This is problematic because of an inherent TOCTOU.
75/// > An attacker can exploit the time while the supervised process is waiting on
76/// > a response from the supervising process to rewrite syscall arguments which
77/// > are passed as pointers of the intercepted syscall.
78/// > It should be absolutely clear that this means that the seccomp notifier
79/// > _cannot_ be used to implement a security policy! It should only ever be used
80/// > in scenarios where a more privileged process supervises the syscalls of a
81/// > lesser privileged process to get around kernel-enforced security
82/// > restrictions when the privileged process deems this safe. In other words,
83/// > in order to continue a syscall the supervising process should be sure that
84/// > another security mechanism or the kernel itself will sufficiently block
85/// > syscalls if arguments are rewritten to something unsafe.
86/// >
87/// > Similar precautions should be applied when stacking `SECCOMP_RET_USER_NOTIF`
88/// > or `SECCOMP_RET_TRACE`. For `SECCOMP_RET_USER_NOTIF` filters acting on the
89/// > same syscall, the most recently added filter takes precedence. This means
90/// > that the new `SECCOMP_RET_USER_NOTIF` filter can override any
91/// > `SECCOMP_IOCTL_NOTIF_SEND` from earlier filters, essentially allowing all
92/// > such filtered syscalls to be executed by sending the response
93/// > `SECCOMP_USER_NOTIF_FLAG_CONTINUE`. Note that `SECCOMP_RET_TRACE` can equally
94/// > be overriden by `SECCOMP_USER_NOTIF_FLAG_CONTINUE`.
95pub const SECCOMP_USER_NOTIF_FLAG_CONTINUE: u32 = 1;
96
97#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
98#[repr(C)]
99pub struct seccomp_notif_resp {
100    pub id: u64,
101    pub val: i64,
102    pub error: i32,
103    pub flags: u32,
104}
105
106pub const SECCOMP_ADDFD_FLAG_SETFD: u32 = 1;
107pub const SECCOMP_ADDFD_FLAG_SEND: u32 = 2;
108
109#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
110#[repr(C)]
111pub struct seccomp_notif_addfd {
112    pub id: u64,
113    pub flags: u32,
114    pub srcfd: u32,
115    pub newfd: u32,
116    pub newfd_flags: u32,
117}
118
119/// version information
120#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
121#[repr(C)]
122pub struct scmp_version {
123    pub major: c_uint,
124    pub minor: c_uint,
125    pub micro: c_uint,
126}
127
128/// Filter context/handle (`*mut`)
129pub type scmp_filter_ctx = *mut c_void;
130/// Filter context/handle (`*const`)
131pub type const_scmp_filter_ctx = *const c_void;
132
133/// Filter attributes
134#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
135#[repr(C)]
136pub enum scmp_filter_attr {
137    _SCMP_FLTATR_MIN = 0,
138    /// default filter action
139    SCMP_FLTATR_ACT_DEFAULT = 1,
140    /// bad architecture action
141    SCMP_FLTATR_ACT_BADARCH = 2,
142    /// set `NO_NEW_PRIVS` on filter load
143    SCMP_FLTATR_CTL_NNP = 3,
144    /// sync threads on filter load
145    SCMP_FLTATR_CTL_TSYNC = 4,
146    /// allow rules with a -1 syscall
147    SCMP_FLTATR_API_TSKIP = 5,
148    /// log not-allowed actions
149    SCMP_FLTATR_CTL_LOG = 6,
150    /// disable SSB mitigation
151    SCMP_FLTATR_CTL_SSB = 7,
152    /// filter optimization level:
153    /// - 0: currently unused
154    /// - 1: rules weighted by priority and complexity (DEFAULT)
155    /// - 2: binary tree sorted by syscall number
156    SCMP_FLTATR_CTL_OPTIMIZE = 8,
157    /// return the system return codes
158    SCMP_FLTATR_API_SYSRAWRC = 9,
159    _SCMP_FLTATR_MAX,
160}
161
162/// Comparison operators
163#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
164#[repr(C)]
165pub enum scmp_compare {
166    _SCMP_CMP_MIN = 0,
167    /// not equal
168    SCMP_CMP_NE = 1,
169    /// less than
170    SCMP_CMP_LT = 2,
171    /// less than or equal
172    SCMP_CMP_LE = 3,
173    /// equal
174    SCMP_CMP_EQ = 4,
175    /// greater than or equal
176    SCMP_CMP_GE = 5,
177    /// greater than
178    SCMP_CMP_GT = 6,
179    /// masked equality
180    SCMP_CMP_MASKED_EQ = 7,
181    _SCMP_CMP_MAX,
182}
183
184/// Argument datum
185pub type scmp_datum_t = u64;
186
187/// Argument / Value comparison definition
188#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
189#[repr(C)]
190pub struct scmp_arg_cmp {
191    /// argument number, starting at 0
192    pub arg: c_uint,
193    /// the comparison op, e.g. `SCMP_CMP_*`
194    pub op: scmp_compare,
195    pub datum_a: scmp_datum_t,
196    pub datum_b: scmp_datum_t,
197}
198
199/// The native architecture token
200pub const SCMP_ARCH_NATIVE: u32 = 0x0;
201/// The x86 (32-bit) architecture token
202pub const SCMP_ARCH_X86: u32 = 0x40000003;
203/// The x86-64 (64-bit) architecture token
204pub const SCMP_ARCH_X86_64: u32 = 0xc000003e;
205/// The x32 (32-bit x86_64) architecture token
206///
207/// NOTE: this is different from the value used by the kernel because libseccomp need to
208/// be able to distinguish between x32 and x86_64
209pub const SCMP_ARCH_X32: u32 = 0x4000003e;
210pub const SCMP_ARCH_ARM: u32 = 0x40000028;
211pub const SCMP_ARCH_AARCH64: u32 = 0xc00000b7;
212pub const SCMP_ARCH_MIPS: u32 = 0x8;
213pub const SCMP_ARCH_MIPS64: u32 = 0x80000008;
214pub const SCMP_ARCH_MIPS64N32: u32 = 0xa0000008;
215pub const SCMP_ARCH_MIPSEL: u32 = 0x40000008;
216pub const SCMP_ARCH_MIPSEL64: u32 = 0xc0000008;
217pub const SCMP_ARCH_MIPSEL64N32: u32 = 0xe0000008;
218pub const SCMP_ARCH_PPC: u32 = 0x14;
219pub const SCMP_ARCH_PPC64: u32 = 0x80000015;
220pub const SCMP_ARCH_PPC64LE: u32 = 0xc0000015;
221pub const SCMP_ARCH_S390: u32 = 0x16;
222pub const SCMP_ARCH_S390X: u32 = 0x80000016;
223pub const SCMP_ARCH_PARISC: u32 = 0xf;
224pub const SCMP_ARCH_PARISC64: u32 = 0x8000000f;
225pub const SCMP_ARCH_RISCV64: u32 = 0xc00000f3;
226
227pub const SCMP_ACT_MASK: u32 = SECCOMP_RET_ACTION_FULL;
228/// Kill the process
229pub const SCMP_ACT_KILL_PROCESS: u32 = 0x80000000;
230/// Kill the thread
231pub const SCMP_ACT_KILL_THREAD: u32 = 0x00000000;
232/// Kill the thread, defined for backward compatibility
233pub const SCMP_ACT_KILL: u32 = SCMP_ACT_KILL_THREAD;
234/// Throw a `SIGSYS` signal
235pub const SCMP_ACT_TRAP: u32 = 0x00030000;
236/// Notifies userspace
237pub const SCMP_ACT_NOTIFY: u32 = 0x7fc00000;
238pub const SCMP_ACT_ERRNO_MASK: u32 = 0x00050000;
239/// Return the specified error code
240#[must_use]
241pub const fn SCMP_ACT_ERRNO(x: u16) -> u32 {
242    SCMP_ACT_ERRNO_MASK | x as u32
243}
244pub const SCMP_ACT_TRACE_MASK: u32 = 0x7ff00000;
245/// Notify a tracing process with the specified value
246#[must_use]
247pub const fn SCMP_ACT_TRACE(x: u16) -> u32 {
248    SCMP_ACT_TRACE_MASK | x as u32
249}
250/// Allow the syscall to be executed after the action has been logged
251pub const SCMP_ACT_LOG: u32 = 0x7ffc0000;
252/// Allow the syscall to be executed
253pub const SCMP_ACT_ALLOW: u32 = 0x7fff0000;
254
255#[link(name = "seccomp")]
256extern "C" {
257
258    /// Query the library version information
259    ///
260    /// This function returns a pointer to a populated [`scmp_version`] struct, the
261    /// caller does not need to free the structure when finished.
262    pub fn seccomp_version() -> *const scmp_version;
263
264    /// Query the library's level of API support
265    ///
266    /// This function returns an API level value indicating the current supported
267    /// functionality.  It is important to note that this level of support is
268    /// determined at runtime and therefore can change based on the running kernel
269    /// and system configuration (e.g. any previously loaded seccomp filters).  This
270    /// function can be called multiple times, but it only queries the system the
271    /// first time it is called, the API level is cached and used in subsequent
272    /// calls.
273    ///
274    /// The current API levels are described below:
275    /// - 0
276    ///   - reserved
277    /// - 1
278    ///   - base level
279    /// - 2
280    ///   - support for the [`SCMP_FLTATR_CTL_TSYNC`](scmp_filter_attr::SCMP_FLTATR_CTL_TSYNC) filter attribute
281    ///   - uses the [`seccomp(2)`] syscall instead of the [`prctl(2)`] syscall
282    /// - 3
283    ///   - support for the [`SCMP_FLTATR_CTL_LOG`](scmp_filter_attr::SCMP_FLTATR_CTL_LOG) filter attribute
284    ///   - support for the [`SCMP_ACT_LOG`] action
285    ///   - support for the [`SCMP_ACT_KILL_PROCESS`] action
286    /// - 4
287    ///   - support for the [`SCMP_FLTATR_CTL_SSB`](scmp_filter_attr::SCMP_FLTATR_CTL_SSB) filter attrbute
288    /// - 5
289    ///   - support for the [`SCMP_ACT_NOTIFY`] action and notify APIs
290    /// - 6
291    ///   - support the simultaneous use of [`SCMP_FLTATR_CTL_TSYNC`](scmp_filter_attr::SCMP_FLTATR_CTL_TSYNC) and notify APIs
292    ///
293    /// [`seccomp(2)`]: https://man7.org/linux/man-pages/man2/seccomp.2.html
294    /// [`prctl(2)`]: https://man7.org/linux/man-pages/man2/prctl.2.html
295    pub fn seccomp_api_get() -> c_uint;
296
297    /// Set the library's level of API support
298    ///
299    /// This function forcibly sets the API level of the library at runtime.  Valid
300    /// API levels are discussed in the description of the [`seccomp_api_get()`]
301    /// function.  General use of this function is strongly discouraged.
302    pub fn seccomp_api_set(level: c_uint) -> c_int;
303
304    /// Initialize the filter state
305    ///
306    /// - `def_action`: the default filter action
307    ///
308    /// This function initializes the internal seccomp filter state and should
309    /// be called before any other functions in this library to ensure the filter
310    /// state is initialized.  Returns a filter context on success, `ptr::null()` on failure.
311    pub fn seccomp_init(def_action: u32) -> scmp_filter_ctx;
312
313    /// Reset the filter state
314    ///
315    /// - `ctx`: the filter context
316    /// - `def_action`: the default filter action
317    ///
318    /// This function resets the given seccomp filter state and ensures the
319    /// filter state is reinitialized.  This function does not reset any seccomp
320    /// filters already loaded into the kernel.  Returns zero on success, negative
321    /// values on failure.
322    pub fn seccomp_reset(ctx: scmp_filter_ctx, def_action: u32) -> c_int;
323
324    /// Destroys the filter state and releases any resources
325    ///
326    /// - `ctx`: the filter context
327    ///
328    /// This functions destroys the given seccomp filter state and releases any
329    /// resources, including memory, associated with the filter state.  This
330    /// function does not reset any seccomp filters already loaded into the kernel.
331    /// The filter context can no longer be used after calling this function.
332    pub fn seccomp_release(ctx: scmp_filter_ctx);
333
334    /// Merge two filters
335    ///
336    /// - `ctx_dst`: the destination filter context
337    /// - `ctx_src`: the source filter context
338    ///
339    /// This function merges two filter contexts into a single filter context and
340    /// destroys the second filter context.  The two filter contexts must have the
341    /// same attribute values and not contain any of the same architectures; if they
342    /// do, the merge operation will fail.  On success, the source filter context
343    /// will be destroyed and should no longer be used; it is not necessary to
344    /// call [`seccomp_release()`] on the source filter context.  Returns zero on
345    /// success, negative values on failure.
346    pub fn seccomp_merge(ctx_dst: scmp_filter_ctx, ctx_src: scmp_filter_ctx) -> c_int;
347
348    /// Resolve the architecture name to a architecture token
349    ///
350    /// - `arch_name`: the architecture name
351    ///
352    /// This function resolves the given architecture name to a token suitable for
353    /// use with libseccomp, returns zero on failure.
354    pub fn seccomp_arch_resolve_name(arch_name: *const c_char) -> u32;
355
356    /// Return the native architecture token
357    ///
358    /// This function returns the native architecture token value, e.g. `SCMP_ARCH_*`.
359    pub fn seccomp_arch_native() -> u32;
360
361    /// Check to see if an existing architecture is present in the filter
362    ///
363    /// - `ctx`: the filter context
364    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
365    ///
366    /// This function tests to see if a given architecture is included in the filter
367    /// context.  If the architecture token is [`SCMP_ARCH_NATIVE`] then the native
368    /// architecture will be assumed.  Returns zero if the architecture exists in
369    /// the filter, `-libc::EEXIST` if it is not present, and other negative values on
370    /// failure.
371    pub fn seccomp_arch_exist(ctx: const_scmp_filter_ctx, arch_token: u32) -> c_int;
372
373    /// Adds an architecture to the filter
374    ///
375    /// - `ctx`: the filter context
376    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
377    ///
378    /// This function adds a new architecture to the given seccomp filter context.
379    /// Any new rules added after this function successfully returns will be added
380    /// to this architecture but existing rules will not be added to this
381    /// architecture.  If the architecture token is [`SCMP_ARCH_NATIVE`] then the native
382    /// architecture will be assumed.  Returns zero on success, `-libc::EEXIST` if
383    /// specified architecture is already present, other negative values on failure.
384    pub fn seccomp_arch_add(ctx: scmp_filter_ctx, arch_token: u32) -> c_int;
385
386    /// Removes an architecture from the filter
387    ///
388    /// - `ctx`: the filter context
389    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
390    ///
391    /// This function removes an architecture from the given seccomp filter context.
392    /// If the architecture token is [`SCMP_ARCH_NATIVE`] then the native architecture
393    /// will be assumed.  Returns zero on success, negative values on failure.
394    pub fn seccomp_arch_remove(ctx: scmp_filter_ctx, arch_token: u32) -> c_int;
395
396    /// Loads the filter into the kernel
397    ///
398    /// - `ctx`: the filter context
399    ///
400    /// This function loads the given seccomp filter context into the kernel.  If
401    /// the filter was loaded correctly, the kernel will be enforcing the filter
402    /// when this function returns.  Returns zero on success, negative values on
403    /// error.
404    pub fn seccomp_load(ctx: const_scmp_filter_ctx) -> c_int;
405
406    /// Set the value of a filter attribute
407    ///
408    /// - `ctx`: the filter context
409    /// - `attr`: the filter attribute name
410    /// - `value`: the filter attribute value
411    ///
412    /// This function fetches the value of the given attribute name and returns it
413    /// via `value`.  Returns zero on success, negative values on failure.
414    pub fn seccomp_attr_get(
415        ctx: const_scmp_filter_ctx,
416        attr: scmp_filter_attr,
417        value: *mut u32,
418    ) -> c_int;
419
420    /// Set the value of a filter attribute
421    ///
422    /// - `ctx`: the filter context
423    /// - `attr`: the filter attribute name
424    /// - `value`: the filter attribute value
425    ///
426    /// This function sets the value of the given attribute.  Returns zero on
427    /// success, negative values on failure.
428    pub fn seccomp_attr_set(ctx: scmp_filter_ctx, attr: scmp_filter_attr, value: u32) -> c_int;
429
430    /// Resolve a syscall number to a name
431    ///
432    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
433    /// - `num`: the syscall number
434    ///
435    /// Resolve the given syscall number to the syscall name for the given
436    /// architecture; it is up to the caller to free the returned string.  Returns
437    /// the syscall name on success, `ptr::null()` on failure
438    pub fn seccomp_syscall_resolve_num_arch(arch_token: u32, num: c_int) -> *const c_char;
439
440    /// Resolve a syscall name to a number
441    ///
442    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
443    /// - `name`: the syscall name
444    ///
445    /// Resolve the given syscall name to the syscall number for the given
446    /// architecture.  Returns the syscall number on success, including negative
447    /// pseudo syscall numbers (e.g. `__PNR_*`); returns [`__NR_SCMP_ERROR`] on failure.
448    pub fn seccomp_syscall_resolve_name_arch(arch_token: u32, name: *const c_char) -> c_int;
449
450    /// Resolve a syscall name to a number and perform any rewriting necessary
451    ///
452    /// - `arch_token`: the architecture token, e.g. `SCMP_ARCH_*`
453    /// - `name`: the syscall name
454    ///
455    /// Resolve the given syscall name to the syscall number for the given
456    /// architecture and do any necessary syscall rewriting needed by the
457    /// architecture.  Returns the syscall number on success, including negative
458    /// pseudo syscall numbers (e.g. `__PNR_*`); returns [`__NR_SCMP_ERROR`] on failure.
459    pub fn seccomp_syscall_resolve_name_rewrite(arch_token: u32, name: *const c_char) -> c_int;
460
461    /// Resolve a syscall name to a number
462    ///
463    /// - `name`: the syscall name
464    ///
465    /// Resolve the given syscall name to the syscall number.  Returns the syscall
466    /// number on success, including negative pseudo syscall numbers (e.g. `__PNR_*`);
467    /// returns [`__NR_SCMP_ERROR`] on failure.
468    pub fn seccomp_syscall_resolve_name(name: *const c_char) -> c_int;
469
470    /// Set the priority of a given syscall
471    ///
472    /// - `ctx`: the filter context
473    /// - `syscall`: the syscall number
474    /// - `priority`: priority value, higher value == higher priority
475    ///
476    /// This function sets the priority of the given syscall; this value is used
477    /// when generating the seccomp filter code such that higher priority syscalls
478    /// will incur less filter code overhead than the lower priority syscalls in the
479    /// filter.  Returns zero on success, negative values on failure.
480    pub fn seccomp_syscall_priority(ctx: scmp_filter_ctx, syscall: c_int, priority: u8) -> c_int;
481
482    /// Add a new rule to the filter
483    ///
484    /// - `ctx`: the filter context
485    /// - `action`: the filter action
486    /// - `syscall`: the syscall number
487    /// - `arg_cnt`: the number of argument filters in the argument filter chain
488    /// - `...`: [`scmp_arg_cmp`] structs
489    ///
490    /// This function adds a series of new argument/value checks to the seccomp
491    /// filter for the given syscall; multiple argument/value checks can be
492    /// specified and they will be chained together (AND'd together) in the filter.
493    /// If the specified rule needs to be adjusted due to architecture specifics it
494    /// will be adjusted without notification.  Returns zero on success, negative
495    /// values on failure.
496    pub fn seccomp_rule_add(
497        ctx: scmp_filter_ctx,
498        action: u32,
499        syscall: c_int,
500        arg_cnt: c_uint,
501        ...
502    ) -> c_int;
503
504    /// Add a new rule to the filter
505    ///
506    /// - `ctx`: the filter context
507    /// - `action`: the filter action
508    /// - `syscall`: the syscall number
509    /// - `arg_cnt`: the number of elements in the arg_array parameter
510    /// - `arg_array`: array of [`scmp_arg_cmp`] structs
511    ///
512    /// This function adds a series of new argument/value checks to the seccomp
513    /// filter for the given syscall; multiple argument/value checks can be
514    /// specified and they will be chained together (AND'd together) in the filter.
515    /// If the specified rule needs to be adjusted due to architecture specifics it
516    /// will be adjusted without notification.  Returns zero on success, negative
517    /// values on failure.
518    pub fn seccomp_rule_add_array(
519        ctx: scmp_filter_ctx,
520        action: u32,
521        syscall: c_int,
522        arg_cnt: c_uint,
523        arg_array: *const scmp_arg_cmp,
524    ) -> c_int;
525
526    /// Add a new rule to the filter
527    ///
528    /// - `ctx`: the filter context
529    /// - `action`: the filter action
530    /// - `syscall`: the syscall number
531    /// - `arg_cnt`: the number of argument filters in the argument filter chain
532    /// - `...`: [`scmp_arg_cmp`] structs
533    ///
534    /// This function adds a series of new argument/value checks to the seccomp
535    /// filter for the given syscall; multiple argument/value checks can be
536    /// specified and they will be chained together (AND'd together) in the filter.
537    /// If the specified rule can not be represented on the architecture the
538    /// function will fail.  Returns zero on success, negative values on failure.
539    pub fn seccomp_rule_add_exact(
540        ctx: scmp_filter_ctx,
541        action: u32,
542        syscall: c_int,
543        arg_cnt: c_uint,
544        ...
545    ) -> c_int;
546
547    /// Add a new rule to the filter
548    ///
549    /// - `ctx`: the filter context
550    /// - `action`: the filter action
551    /// - `syscall`: the syscall number
552    /// - `arg_cnt`:  the number of elements in the arg_array parameter
553    /// - `arg_array`: array of scmp_arg_cmp structs
554    ///
555    /// This function adds a series of new argument/value checks to the seccomp
556    /// filter for the given syscall; multiple argument/value checks can be
557    /// specified and they will be chained together (AND'd together) in the filter.
558    /// If the specified rule can not be represented on the architecture the
559    /// function will fail.  Returns zero on success, negative values on failure.
560    pub fn seccomp_rule_add_exact_array(
561        ctx: scmp_filter_ctx,
562        action: u32,
563        syscall: c_int,
564        arg_cnt: c_uint,
565        arg_array: *const scmp_arg_cmp,
566    ) -> c_int;
567
568    /// Allocate a pair of notification request/response structures
569    ///
570    /// - `req`: the request location
571    /// - `resp`: the response location
572    ///
573    /// This function allocates a pair of request/response structure by computing
574    /// the correct sized based on the currently running kernel. It returns zero on
575    /// success, and negative values on failure.
576    pub fn seccomp_notify_alloc(
577        req: *mut *mut seccomp_notif,
578        resp: *mut *mut seccomp_notif_resp,
579    ) -> c_int;
580
581    /// Free a pair of notification request/response structures.
582    ///
583    /// - `req`: the request location
584    /// - `resp`: the response location
585    pub fn seccomp_notify_free(req: *mut seccomp_notif, resp: *mut seccomp_notif_resp) -> c_int;
586
587    /// Send a notification response to a seccomp notification fd
588    ///
589    /// - `fd`: the notification fd
590    /// - `resp`: the response buffer to use
591    ///
592    /// Sends a notification response on this fd. This function is thread safe
593    /// (synchronization is performed in the kernel). Returns zero on success,
594    /// negative values on error.
595    pub fn seccomp_notify_receive(fd: c_int, req: *mut seccomp_notif) -> c_int;
596
597    /// Check if a notification id is still valid
598    ///
599    /// - `fd`: the notification fd
600    /// - `id`: the id to test
601    ///
602    /// Checks to see if a notification id is still valid. Returns 0 on success, and
603    /// negative values on failure.
604    pub fn seccomp_notify_respond(fd: c_int, resp: *mut seccomp_notif_resp) -> c_int;
605
606    /// Check if a notification id is still valid
607    ///
608    /// - `fd`: the notification fd
609    /// - `id`: the id to test
610    ///
611    /// Checks to see if a notification id is still valid. Returns 0 on success, and
612    /// negative values on failure.
613    pub fn seccomp_notify_id_valid(fd: c_int, id: u64) -> c_int;
614
615    /// Return the notification fd from a filter that has already been loaded
616    ///
617    /// - `ctx`: the filter context
618    ///
619    /// This returns the listener fd that was generated when the seccomp policy was
620    /// loaded. This is only valid after [`seccomp_load()`] with a filter that makes
621    /// use of [`SCMP_ACT_NOTIFY`].
622    pub fn seccomp_notify_fd(ctx: const_scmp_filter_ctx) -> c_int;
623
624    /// Generate seccomp Pseudo Filter Code (PFC) and export it to a file
625    ///
626    /// - `ctx`: the filter context
627    /// - `fd`: the destination fd
628    ///
629    /// This function generates seccomp Pseudo Filter Code (PFC) and writes it to
630    /// the given fd.  Returns zero on success, negative values on failure.
631    pub fn seccomp_export_pfc(ctx: const_scmp_filter_ctx, fd: c_int) -> c_int;
632
633    /// Generate seccomp Berkley Packet Filter (BPF) code and export it to a file
634    ///
635    /// - `ctx`: the filter context
636    /// - `fd`: the destination fd
637    ///
638    /// This function generates seccomp Berkley Packer Filter (BPF) code and writes
639    /// it to the given fd.  Returns zero on success, negative values on failure.
640    pub fn seccomp_export_bpf(ctx: const_scmp_filter_ctx, fd: c_int) -> c_int;
641}
642
643/// Negative pseudo syscall number returned by some functions in case of an error
644pub const __NR_SCMP_ERROR: c_int = -1;
645pub const __NR_SCMP_UNDEF: c_int = -2;
libseccomp_sys/lib.rs

libseccomp_sys/
lib.rs
