Skip to content

Commit aa5c1b1

Browse files
StenstromenStenstromen
authored
Merge pull request #19 from Stenstromen/seccomp
Seccomp
2 parents 4610912 + e698470 commit aa5c1b1

File tree

8 files changed

+285
-1
lines changed

8 files changed

+285
-1
lines changed

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
11
/target
2-
.DS_Store
2+
.DS_Store
3+
strace/*.log
4+
strace/strace.log
5+
strace/*.tar

‎strace/Dockerfile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
FROM rust:alpine as builder
2+
WORKDIR /app
3+
COPY . .
4+
RUN apk add --no-cache musl-dev gcc && \
5+
rustup target add x86_64-unknown-linux-musl && \
6+
CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=gcc cargo build --target x86_64-unknown-linux-musl --release
7+
8+
FROM alpine:latest
9+
COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/rustyalias /rustyalias
10+
RUN apk add --no-cache strace
11+
EXPOSE 5053/udp
12+
EXPOSE 5053/tcp
13+
ENV RUST_LOG=info
14+
USER 65534:65534
15+
ENTRYPOINT ["strace", "-f", "-e", "trace=all"]
16+
CMD ["/rustyalias"]

‎strace/Dockerfile.aarch‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
FROM rust:alpine as builder
2+
WORKDIR /app
3+
COPY . .
4+
RUN apk add --no-cache musl-dev gcc && \
5+
rustup target add aarch64-unknown-linux-musl && \
6+
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=gcc cargo build --target aarch64-unknown-linux-musl --release
7+
8+
FROM alpine:latest
9+
COPY --from=builder /app/target/aarch64-unknown-linux-musl/release/rustyalias /rustyalias
10+
RUN apk add --no-cache strace
11+
EXPOSE 5053/udp
12+
EXPOSE 5053/tcp
13+
ENV RUST_LOG=info
14+
USER 65534:65534
15+
ENTRYPOINT ["strace", "-f", "-e", "trace=all"]
16+
CMD ["/rustyalias"]

‎strace/README.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Strace Setup for Seccomp Profile Generation
2+
3+
This directory contains the necessary files to generate a seccomp profile using strace in a kind cluster.
4+
5+
## Prerequisites
6+
7+
- Podman
8+
- kind (Kubernetes in Docker) with experimental Podman provider
9+
- kubectl
10+
11+
## Setup Instructions
12+
13+
### 1. Set the Kind provider to Podman
14+
15+
```bash
16+
export KIND_EXPERIMENTAL_PROVIDER=podman
17+
```
18+
19+
### 2. Build the strace image with Podman
20+
21+
```bash
22+
podman build -t rustyalias-strace:latest -f strace/Dockerfile .
23+
```
24+
25+
### 3. Create the kind cluster
26+
27+
```bash
28+
cd strace
29+
kind create cluster --name rustyalias-strace --config kind-config.yaml
30+
```
31+
32+
### 4. Load the image into kind
33+
34+
Save the image as an OCI archive and load it into the kind cluster:
35+
36+
```bash
37+
# Save the image as an OCI archive
38+
podman save --format oci-archive -o rustyalias-strace.tar rustyalias-strace:latest
39+
40+
# Load the image archive into kind
41+
kind load image-archive rustyalias-strace.tar --name rustyalias-strace
42+
```
43+
44+
### 5. Deploy the application with strace
45+
46+
```bash
47+
kubectl apply -f deployment.yaml
48+
kubectl apply -f service.yaml
49+
```

‎strace/deployment.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: rustyalias
6+
spec:
7+
progressDeadlineSeconds: 10
8+
replicas: 1
9+
revisionHistoryLimit: 1
10+
selector:
11+
matchLabels:
12+
app: rustyalias
13+
strategy:
14+
type: RollingUpdate
15+
template:
16+
metadata:
17+
labels:
18+
app: rustyalias
19+
spec:
20+
automountServiceAccountToken: false
21+
containers:
22+
- env:
23+
- name: RUST_LOG
24+
value: debug
25+
- name: GLUE_NAME
26+
value: ns.addr.se
27+
- name: SOA_NAME
28+
value: ns.addr.se
29+
- name: HOSTMASTER
30+
value: hostmaster.addr.se
31+
- name: GLUE_IP
32+
value: 37.27.198.249
33+
image: localhost/rustyalias-strace:latest
34+
livenessProbe:
35+
tcpSocket:
36+
port: 5053
37+
initialDelaySeconds: 5
38+
periodSeconds: 10
39+
readinessProbe:
40+
tcpSocket:
41+
port: 5053
42+
initialDelaySeconds: 5
43+
periodSeconds: 10
44+
startupProbe:
45+
tcpSocket:
46+
port: 5053
47+
initialDelaySeconds: 1
48+
periodSeconds: 5
49+
failureThreshold: 30
50+
resources:
51+
limits:
52+
cpu: 200m
53+
memory: 32Mi
54+
requests:
55+
cpu: 50m
56+
memory: 16Mi
57+
securityContext:
58+
runAsUser: 65534
59+
runAsGroup: 65534
60+
privileged: false
61+
runAsNonRoot: true
62+
readOnlyRootFilesystem: true
63+
allowPrivilegeEscalation: false
64+
procMount: Default
65+
seccompProfile:
66+
type: Localhost
67+
localhostProfile: profiles/seccomp-profile.json
68+
imagePullPolicy: IfNotPresent
69+
name: rustyalias
70+
ports:
71+
- containerPort: 5053
72+
protocol: UDP
73+
terminationMessagePath: /dev/termination-log
74+
terminationMessagePolicy: File
75+
dnsPolicy: ClusterFirst
76+
restartPolicy: Always
77+
schedulerName: default-scheduler
78+
terminationGracePeriodSeconds: 30

‎strace/kind-config.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kind.x-k8s.io/v1alpha4
2+
kind: Cluster
3+
name: rustyalias-strace
4+
nodes:
5+
- role: control-plane
6+
extraMounts:
7+
- hostPath: ./profiles
8+
containerPath: /var/lib/kubelet/seccomp/profiles
9+
readOnly: false
10+
- role: worker
11+
extraMounts:
12+
- hostPath: ./profiles
13+
containerPath: /var/lib/kubelet/seccomp/profiles
14+
readOnly: false

‎strace/profiles/seccomp-profile.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"defaultAction": "SCMP_ACT_ERRNO",
3+
"architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"],
4+
"syscalls": [
5+
{
6+
"names": [
7+
"accept4",
8+
"arch_prctl",
9+
"bind",
10+
"clock_gettime",
11+
"clone",
12+
"close",
13+
"connect",
14+
"epoll_create1",
15+
"epoll_ctl",
16+
"epoll_pwait",
17+
"eventfd2",
18+
"execve",
19+
"exit_group",
20+
"fcntl",
21+
"fstat",
22+
"fstatfs",
23+
"futex",
24+
"getdents",
25+
"getdents64",
26+
"getpeername",
27+
"getpid",
28+
"getrandom",
29+
"getsockname",
30+
"getsockopt",
31+
"gettid",
32+
"listen",
33+
"madvise",
34+
"mmap",
35+
"mprotect",
36+
"munmap",
37+
"nanosleep",
38+
"openat",
39+
"openat2",
40+
"prctl",
41+
"pread64",
42+
"prlimit64",
43+
"read",
44+
"readdirent",
45+
"rt_sigaction",
46+
"rt_sigprocmask",
47+
"rt_sigreturn",
48+
"sched_getaffinity",
49+
"sched_yield",
50+
"setsockopt",
51+
"sigaltstack",
52+
"socket",
53+
"statx",
54+
"tgkill",
55+
"uname",
56+
"write",
57+
"set_tid_address",
58+
"poll",
59+
"brk",
60+
"ioctl",
61+
"open",
62+
"recvfrom",
63+
"sendto",
64+
"sendmsg",
65+
"sendmmsg",
66+
"recvmsg",
67+
"recvmmsg"
68+
],
69+
"action": "SCMP_ACT_ALLOW"
70+
}
71+
]
72+
}

‎strace/service.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: rustyalias-udp
6+
spec:
7+
internalTrafficPolicy: Cluster
8+
ipFamilies:
9+
- IPv4
10+
ipFamilyPolicy: SingleStack
11+
ports:
12+
- name: dns-udp
13+
protocol: UDP
14+
port: 5053
15+
targetPort: 5053
16+
selector:
17+
app: rustyalias
18+
type: ClusterIP
19+
---
20+
apiVersion: v1
21+
kind: Service
22+
metadata:
23+
name: rustyalias-tcp
24+
spec:
25+
internalTrafficPolicy: Cluster
26+
ipFamilies:
27+
- IPv4
28+
ipFamilyPolicy: SingleStack
29+
ports:
30+
- name: dns-tcp
31+
protocol: TCP
32+
port: 5053
33+
targetPort: 5053
34+
selector:
35+
app: rustyalias
36+
type: ClusterIP

0 commit comments

Comments
 (0)