seccomp
int seccomp;
if (init_data.seccomp) {
if (!init_data.seccomp)
if (init_data.seccomp) {
if (!init_data.seccomp) {
.seccomp = using_seccomp,
seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode);
atomic_read(&p->seccomp.filter_count));
struct seccomp seccomp;
static inline int seccomp_mode(struct seccomp *s)
static inline int seccomp_mode(struct seccomp *s)
} seccomp;
.seccomp = { .filter_count = ATOMIC_INIT(0) },
p->seccomp = current->seccomp;
if (p->seccomp.mode != SECCOMP_MODE_DISABLED)
WARN_ON_ONCE(tsk->seccomp.filter);
tsk->seccomp.filter = NULL;
if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED ||
info->seccomp.ret_data = child->ptrace_message;
return offsetofend(struct ptrace_syscall_info, seccomp.ret_data);
current->seccomp.mode = SECCOMP_MODE_DEAD;
int mode = current->seccomp.mode;
current->seccomp.mode = SECCOMP_MODE_DEAD;
int mode = current->seccomp.mode;
return current->seccomp.mode;
for (cur = current->seccomp.filter; cur; cur = cur->prev) {
SYSCALL_DEFINE3(seccomp, unsigned int, op, unsigned int, flags,
if (task->seccomp.mode != SECCOMP_MODE_FILTER) {
orig = task->seccomp.filter;
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
f = READ_ONCE(task->seccomp.filter);
READ_ONCE(current->seccomp.filter);
if (current->seccomp.mode && current->seccomp.mode != seccomp_mode)
task->seccomp.mode = seccomp_mode;
if (thread->seccomp.mode == SECCOMP_MODE_DISABLED ||
(thread->seccomp.mode == SECCOMP_MODE_FILTER &&
is_ancestor(thread->seccomp.filter,
caller->seccomp.filter)))
if (READ_ONCE(tsk->seccomp.filter) == NULL)
orig = tsk->seccomp.filter;
tsk->seccomp.filter = NULL;
__seccomp_filter_release(thread->seccomp.filter);
smp_store_release(&thread->seccomp.filter,
caller->seccomp.filter);
atomic_set(&thread->seccomp.filter_count,
atomic_read(&caller->seccomp.filter_count));
if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)
for (walker = current->seccomp.filter; walker; walker = walker->prev)
filter->prev = current->seccomp.filter;
current->seccomp.filter = filter;
atomic_inc(¤t->seccomp.filter_count);
struct seccomp_filter *orig = tsk->seccomp.filter;
COND_SYSCALL(seccomp);
return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
if (seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes) < 0) {
return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
FIXTURE_VARIANT_ADD(TRACE_syscall, seccomp) {
ret = seccomp(-1, 0, &prog);
ret = seccomp(SECCOMP_SET_MODE_STRICT, -1, NULL);
ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, &prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, -1, &prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, NULL);
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
ret = seccomp(SECCOMP_SET_MODE_STRICT, 0, NULL);
ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, flags, &self->apply_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,
#ifndef seccomp
ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER,
EXPECT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
return seccomp(SECCOMP_SET_MODE_FILTER, flags, &prog);
EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
EXPECT_EQ(seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog), 0);
ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &allow_prog);
ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
seccomp(SECCOMP_SET_MODE_FILTER, 0, prog)) {
ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));