Securing Kubernetes Applications by Crafting Custom Seccomp Profiles

on YouTube ↗32m

" summary

Walks through creating a custom seccomp JSON for a real single-container app (kube-rbac-proxy), first by collecting syscalls via auditd log tracing (shows logging is slow and hit by rate limits) and then with eBPF recorder (bpftrace/libbpf based, lower overhead). Builds an allowlist profile of ~25 syscalls, applies it from /var/lib/kubelet/seccomp, and proves the Security Profiles Operator automates recording, converts recordings to CRs and reconciles profiles to all nodes; notes Kubernetes 1.25 seccomp-default status and CICD integration challenges.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 1:09seccomp is a syscall (Linux API) interceptor feature of the Linux Kemel . Can boost application security by limiting the list of allowed syscalls Supports different actions if a syscall rule has been hit
3. 4:11The overall goal is to understand • How seccomp profiles work and which possibilities they allow
4. 7:25syscalls will only get logged if requested • Logging has a high performance impact (blocks the application) • A special seccomp action is available for logging
5. 10:08Finally obtain a list of syscalls: sudo cat /var/log/audit/audit.log
6. 17:34For example, using tools like bpftrace already allows us to collect the required data sudo bpftrace -e 'tracepoint:raw_syscalls:sys_enter
7. 29:11Thoughts on this approach . We mostly get rid of all manual collection obstacles • Gathering all application code paths is the hardest part

" related talks

• 24mEnhancing Kubernetes with the Security Profiles OperatorSascha Grunert, Colleen Murphy · KubeCon + CloudNativeCon Europe 2021
• 40mUsing the EBPF Superpowers To Generate Kubernetes Security PoliciesMauricio Vásquez Bernal, Alban Crequy · KubeCon + CloudNativeCon North America 2022
• 42mImproving Containers Isolation in KubernetesCosmin Cojocar · ContainerCon @ Open Source Summit North America 2023
• 38mContainer Security, capabilities an seccomp profilesMario Vázquez, Alberto Losada Grande · ContainerDays 2022
• 20mGenerate seccomp profiles for containers using bpfDaniel Walsh, Valentin Rothberg, Divyansh Kamboj · DevConf.CZ 2020
• 43mSandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes (Mark Manning)Mark Manning · BSidesSF 2026
• 39mCustom seccomp Profiles with Inspektor GadgetJose Blanquicet · Incontro DevOps Italia 2022
• 31mAutomatic application hardening by leveraging container runtime behavior analysisAmit Schendel · OWASP Global AppSec San Francisco 2024