Seccomp profile
General information
A Seccomp profile is a Linux kernel security mechanism that restricts access to specific system calls from a container. In Kubernetes, Seccomp profiles can be used to strengthen security when running pods.
Seccomp profiles let developers define a list of allowed system calls and their parameters, which helps prevent potential system vulnerabilities. This mechanism supports more secure runtime environments for applications.
A profile defines the following actions:
SCMP_ACT_ERRNO: blocks system calls, similar to a deny list. If a system call is on this list, it is not executed and the process receives an error.SCMP_ACT_ALLOW: allows system calls, similar to an allow list. If a system call is on this list, it is executed.SCMP_ACT_LOG: allows the system call but records it in a log file.
The defaultAction parameter defines the default action for system calls not specified in the Seccomp profile. Calls that are not on the allow or deny lists are logged by default.
You can view blocking or audit logs on the node where the Pod runs, in /var/log/messages or /var/log/syslog, by searching for the keyword SECCOMP.
For more information, see the official Kubernetes documentation and the Linux manual page.
Creating a Seccomp profile
Seccomp profiles are created in the cluster using the NCI resource. You can create an NCI by applying a manifest or in Administration → Node configuration. Create an NCI object, select kubernetes.io/os: linux in the node selector, choose Files and directories in Configurable sections, create a directory, then place the profile configuration file in it.
For more information, see NCI configuration.
Example NCI that creates a test profile with allow and deny lists
apiVersion: node.shturval.tech/v1beta2
kind: NodeConfigItem
metadata:
name: seccomp-profile
spec:
files:
- group: root
mode: "0644"
owner: root
path: /var/lib/kubelet/seccomp/
type: directory
- content: |-
{
"defaultAction": "SCMP_ACT_LOG",
"architectures": [
"SCMP_ARCH_X86_64",
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
],
"syscalls": [
{
"names": [
"arch_prctl",
"sched_yield",
"futex",
"write",
"mmap",
"exit_group",
"madvise",
"rt_sigprocmask",
"getpid",
"gettid",
"tgkill",
"rt_sigaction",
"read",
"getpgrp"
],
"action": "SCMP_ACT_ALLOW"
},
{
"names": [
"add_key",
"keyctl",
"ptrace"
],
"action": "SCMP_ACT_ERRNO"
}
]
}
group: root
mode: "0644"
owner: root
path: /var/lib/kubelet/seccomp/myprofile.json
type: file
nodeconfigselector:
kubernetes.io/os: linux
priority: 100
Running workloads with a Seccomp profile
When creating a workload, specify the profile in the container specification securityContext block.
Example
apiVersion: v1
kind: Pod
metadata:
labels:
run: nettool
name: nettool
namespace: namespacename
spec:
containers:
- image: r.shturval.tech/network-multitool:alpine-extra
name: nettool
resources: {}
securityContext:
seccompProfile:
type: Localhost
localhostProfile: myprofile.json
dnsPolicy: ClusterFirst
restartPolicy: Always
Note: You cannot apply a Seccomp profile to a container running with privileged: true set in securityContext.