seccomp-gen

command module
v1.1.5 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 22, 2021 License: MIT Imports: 15 Imported by: 0

README ¶

seccomp-gen

Go Github All Releases GitHub release License

Docker Secure Computing Profile Generator


Why 🤔

This tool allows you to pipe the output of strace through it and will auto-generate a docker seccomp profile that can be used to only whitelist the syscalls your container needs to run and blacklists everything else.

This adds a LOT of security by drastically limiting your attack surface to only what is needed.

Syscall Arch Supported (so far)

  • SCMP_ARCH_X86
  • SCMP_ARCH_X32

Install

macOS
$ brew install blacktop/tap/seccomp-gen
linux/windows

Download from releases

Getting Started

$ strace -ff curl github.com 2>&1 | scgen -verbose

   • found syscall: execve
   • found syscall: brk
   • found syscall: access
   • found syscall: access
   • found syscall: openat
   • found syscall: fstat
   • found syscall: mmap
   ...
$ ls -lah

-rw-r--r--   1 blacktop  staff   6.7K Dec  1 21:23 seccomp.json
Inside Docker

Create a new Dockerfile

FROM <your>/<image>:<tag>
RUN apt-get update && apt-get install -y strace
CMD ["strace","-ff","/your-entrypoint.sh"]

Build scgen image

$ docker build -t <your>/<image>:scgen .

Generate seccomp profile from docker logs output

docker run --rm --security-opt seccomp=unconfined <your>/<image>:scgen 2>&1 | scgen -verbose

Use your 🆕 seccomp profile

docker run --rm --security-opt no-new-privileges --security-opt seccomp=/path/to/seccomp.json <your>/<image>:<tag>
Know Issue âš 

I have noticed that strace misses things, but if you run with the generate seccomp profile docker should tell you the next syscall it needs by erroring out. Then you can add that one manually and repeat the process.

Credits

TODO

Issues

Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to file an issue

License

MIT Copyright (c) 2018 blacktop

Documentation ¶

The Go Gopher

There is no documentation for this package.

Directories ¶

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL