SYNOPSIS

       oci-seccomp-bpf-hook prestart [container.json]

DESCRIPTION

       The  oci  hook  oci-seccomp-bpf-hook  generates  seccomp  profiles  by  tracing  the syscalls made by the
       container. The generated profile would whitelist all the syscalls made and blacklist all other syscall.

       The syscalls are traced by launching a binary using the OCI prestart hook.  The  binary  spawns  a  child
       process  which attaches the function enter_trace to the raw_syscalls:sys_enter tracepoint using eBPF. The
       hook buffers all syscalls made by processes  within  the  PID  namespace  of  the  container.   When  the
       container exits, the hook writes out the seccomp profile using all of the syscalls stored in the buffer.

       There are a few limitations to this approach:

       Requires:

       Root privileges (CAP_SYS_ADMIN).  Hook will not work with rootless containers.

       The bcc tool chain and kernel-headers to run. BPF programs must be compiled before running to match the current kernel.

       A container engine that supports OCI Hooks.

       Annotation:

       The oci-seccomp-bpf-hook requires the container be run with the annotation `io.containers.trace-syscall=`. It must include an output file parameter `of:[output file]` This output file must be a absolute path.

       Optionally you can include an input file parameter `if:[input file]` pointing to a previously generated seccomp profile file.  This input file must also be an absolute path.  If specified the oci-seccomp-bpf-hook will read in the input seccomp profile and preload the list of syscalls.

       The profile will be created at the output path provided to the annotation. An input file can be used to create a baseline and newly recorded syscalls will be added to the set and written to the output. If a syscall is blocked in the base profile, then it will remain blocked in the output file even if it is recorded while tracing.

       This annotation can be used directly via container engines like Podman or passed into the container engine by Kubernetes.

EXAMPLES

       sudo podman run --annotation io.containers.trace-syscall="of:/tmp/seccomp-new.json" IMAGE COMMAND

       sudo  podman  run  --annotation io.containers.trace-syscall="if:/tmp/seccomp-origin.json;of:/tmp/seccomp-
       new.json" IMAGE COMMAND

FILES

       OCI hook configuration file for prestart

       /usr/share/containers/oci/hooks.d/oci-seccomp-bpf-hook.json

       /etc/containers/oci/hooks.d/oci-seccomp-bpf-hook.json (Override)

SEE ALSO

       podman(1), seccomp(2), oci-hooks(5)

AUTHORS

       Divyansh Kamboj kambojdivyansh2000@gmail.com ⟨mailto:kambojdivyansh2000@gmail.com⟩

       Valentin Rothberg vrothberg@redhat.com ⟨mailto:vrothberg@redhat.com⟩

       Dan Walsh dwalsh@redhat.com ⟨mailto:dwalsh@redhat.com⟩

systemd                                                OCI                           oci-seccomp-bpf-hook(1)(--)