Test-driven Hardening: Crafting Seccomp Profiles within Test Pipeline
summary
Pipeline generates a Seccomp profile by tracing tests: run integration scripts and unit tests (compile tests with go test -c), capture syscalls with strace/perf and a custom tracer Harpoon (ebpf+uprobes) that attaches to function symbols, aggregate syscall lists per test, and build a final profile artifact which is injected into cluster nodes. Demonstrated on the forwardctl repository with high test coverage; process produces reusable Seccomp artifacts and automates profile creation tied to actual exercised code.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:48Code coverage basics
- 2:16What is Seccomp
- 3:18Pipeline vision
- 4:41Tracing with Harpoon
- 8:17Demo tracing
- 10:51Recipe breakdown
- 13:20Building Seccomp profiles
- 14:47Results and recap
related talks
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
20mGenerate seccomp profiles for containers using bpf
31mAutomatic application hardening by leveraging container runtime behavior analysis
39mCustom seccomp Profiles with Inspektor Gadget
26mReinventing Seccomp for Fun and Profiles
10mGenerating seccomp policies with eBPF
34mSeccomp: What Can It Do For You?
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies