text: /*
   * seccomp example for x86 (32-bit and 64-bit) with BPF macros
   *
   * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
   * Authors:
   *  Will Drewry <wad@chromium.org>
   *  Kees Cook <keescook@chromium.org>
   *
   * Use of this source code is governed by a BSD-style license that can be
   * found in the LICENSE file.
   */
  #ifndef SECCOMP_BPF_H_
  #define SECCOMP_BPF_H_
  
  #define _GNU_SOURCE 1
  #include <stdio.h>
  #include <stddef.h>
  #include <stdlib.h>
  #include <errno.h>
  #include <signal.h>
  #include <string.h>
  #include <unistd.h>
  
  #include <sys/prctl.h>
  #ifndef PR_SET_NO_NEW_PRIVS
  # define PR_SET_NO_NEW_PRIVS 38
  #endif
  
  #include <linux/unistd.h>
  #include <linux/audit.h>
  #include <linux/filter.h>
  #ifdef HAVE_LINUX_SECCOMP_H
  # include <linux/seccomp.h>
  #endif
  #ifndef SECCOMP_MODE_FILTER
  # define SECCOMP_MODE_FILTER2 /* uses user-supplied filter. */
  # define SECCOMP_RET_KILL0x00000000U /* kill the task immediately */
  # define SECCOMP_RET_TRAP0x00030000U /* disallow and force a SIGSYS */
  # define SECCOMP_RET_ALLOW0x7fff0000U /* allow */
  struct seccomp_data {
      int nr;
      __u32 arch;
      __u64 instruction_pointer;
      __u64 args[6];
  };
  #endif
  #ifndef SYS_SECCOMP
  # define SYS_SECCOMP 1
  #endif
  
  #define syscall_nr (offsetof(struct seccomp_data, nr))
  #define arch_nr (offsetof(struct seccomp_data, arch))
  
  #if defined(__i386__)
  # define REG_SYSCALLREG_EAX
  # define ARCH_NRAUDIT_ARCH_I386
  #elif defined(__x86_64__)
  # define REG_SYSCALLREG_RAX
  # define ARCH_NRAUDIT_ARCH_X86_64
  #else
  # warning "Platform does not support seccomp filter yet"
  # define REG_SYSCALL0
  # define ARCH_NR0
  #endif
  
  #define VALIDATE_ARCHITECTURE \
      BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \
      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
  
  #define EXAMINE_SYSCALL \
      BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr)
  
  #define ALLOW_SYSCALL(name) \
      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
  
  #define KILL_PROCESS \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
  
  #define TRACE_PROCESS \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP)
  
  #endif /* _SECCOMP_BPF_H_ */
  