seccomp: add a return code to trap to userspace

[sfrench/cifs-2.6.git] / include / uapi / linux / seccomp.h

diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h
index 9efc0e73d50bee2416dc966254c9affbcd7ba413..90734aa5aa3630de48eab60759dc93e7f308ed70 100644 (file)
--- a/include/uapi/linux/seccomp.h
+++ b/include/uapi/linux/seccomp.h
@@ -15,11 +15,13 @@
 #define SECCOMP_SET_MODE_STRICT                0
 #define SECCOMP_SET_MODE_FILTER                1
 #define SECCOMP_GET_ACTION_AVAIL       2
+#define SECCOMP_GET_NOTIF_SIZES                3
 
 /* Valid flags for SECCOMP_SET_MODE_FILTER */
-#define SECCOMP_FILTER_FLAG_TSYNC      (1UL << 0)
-#define SECCOMP_FILTER_FLAG_LOG                (1UL << 1)
-#define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
+#define SECCOMP_FILTER_FLAG_TSYNC              (1UL << 0)
+#define SECCOMP_FILTER_FLAG_LOG                        (1UL << 1)
+#define SECCOMP_FILTER_FLAG_SPEC_ALLOW         (1UL << 2)
+#define SECCOMP_FILTER_FLAG_NEW_LISTENER       (1UL << 3)
 
 /*
  * All BPF programs must return a 32-bit value.
@@ -35,6 +37,7 @@
 #define SECCOMP_RET_KILL        SECCOMP_RET_KILL_THREAD
 #define SECCOMP_RET_TRAP        0x00030000U /* disallow and force a SIGSYS */
 #define SECCOMP_RET_ERRNO       0x00050000U /* returns an errno */
+#define SECCOMP_RET_USER_NOTIF  0x7fc00000U /* notifies userspace */
 #define SECCOMP_RET_TRACE       0x7ff00000U /* pass to a tracer or disallow */
 #define SECCOMP_RET_LOG                 0x7ffc0000U /* allow after logging */
 #define SECCOMP_RET_ALLOW       0x7fff0000U /* allow */
@@ -60,4 +63,35 @@ struct seccomp_data {
        __u64 args[6];
 };
 
+struct seccomp_notif_sizes {
+       __u16 seccomp_notif;
+       __u16 seccomp_notif_resp;
+       __u16 seccomp_data;
+};
+
+struct seccomp_notif {
+       __u64 id;
+       __u32 pid;
+       __u32 flags;
+       struct seccomp_data data;
+};
+
+struct seccomp_notif_resp {
+       __u64 id;
+       __s64 val;
+       __s32 error;
+       __u32 flags;
+};
+
+#define SECCOMP_IOC_MAGIC              '!'
+#define SECCOMP_IO(nr)                 _IO(SECCOMP_IOC_MAGIC, nr)
+#define SECCOMP_IOR(nr, type)          _IOR(SECCOMP_IOC_MAGIC, nr, type)
+#define SECCOMP_IOW(nr, type)          _IOW(SECCOMP_IOC_MAGIC, nr, type)
+#define SECCOMP_IOWR(nr, type)         _IOWR(SECCOMP_IOC_MAGIC, nr, type)
+
+/* Flags for seccomp notification fd ioctl. */
+#define SECCOMP_IOCTL_NOTIF_RECV       SECCOMP_IOWR(0, struct seccomp_notif)
+#define SECCOMP_IOCTL_NOTIF_SEND       SECCOMP_IOWR(1, \
+                                               struct seccomp_notif_resp)
+#define SECCOMP_IOCTL_NOTIF_ID_VALID   SECCOMP_IOR(2, __u64)
 #endif /* _UAPI_LINUX_SECCOMP_H */