Generating seccomp policies with eBPF
summary
An eBPF gadget inside inspector-gadget captures every syscall a pod makes and emits a concrete seccomp profile that can be stored in the trace status or pushed into the Security Profiles Operator as an external resource. Demo traces a Flask+uWSGI Python app, shows small profiles from a single request and many more syscalls when capturing pod startup or running bash, generates a profile with defaultAction=Errno, and blocks unexpected syscalls; prototype works but remains experimental.
AI-written summary · about
related talks
39mCustom seccomp Profiles with Inspektor Gadget
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
20mGenerate seccomp profiles for containers using bpf
26mReinventing Seccomp for Fun and Profiles
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
28mBringing the power of eBPF tools to your k8s web UI
20mSecimport: Tailor-Made eBPF Sandbox for Python Applications
30mPod Security as an Afterthought