Red Hat OpenShift Container Platform

Apply seccomp profiles to a pod

To enforce a recorded or custom seccomp profile on a workload, create a pod that references the profile in its security context.

Procedure

Create a pod object that defines a securityContext:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: Localhost
      localhostProfile: operator/profile1.json
  containers:
    - name: test-container
      image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]

View the profile path of the seccompProfile.localhostProfile attribute by running the following command:

$ oc get seccompprofile profile1 --output wide

Example output

NAME       STATUS     AGE   SECCOMPPROFILE.LOCALHOSTPROFILE
profile1   Installed  14s   operator/profile1.json

View the path to the localhost profile by running the following command:

$ oc get sp profile1 --output=jsonpath='{.status.localhostProfile}'

Example output

operator/profile1.json

Apply the localhostProfile output to the patch file:

spec:
  template:
    spec:
      securityContext:
        seccompProfile:
          type: Localhost
          localhostProfile: operator/profile1.json

Apply the profile to any other workload, such as a Deployment object, by running the following command:
```
$ oc -n my-namespace patch deployment myapp --patch-file patch.yaml --type=merge
```
Example output
```
deployment.apps/myapp patched
```

Verification

Confirm the profile was applied correctly by running the following command:

$ oc -n my-namespace get deployment myapp --output=jsonpath='{.spec.template.spec.securityContext}' | jq .

Example output

{
  "seccompProfile": {
    "localhostProfile": "operator/profile1.json",
    "type": "localhost"
  }
}

Binding workloads to profiles with ProfileBindings

You can use the ProfileBinding resource to bind a security profile to the SecurityContext of a container.

Procedure

To bind a pod that uses a quay.io/security-profiles-operator/test-nginx-unprivileged:1.21 image to the example SeccompProfile profile, create a ProfileBinding object in the same namespace with the pod and the SeccompProfile objects:
```
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: ProfileBinding
metadata:
  namespace: my-namespace
  name: nginx-binding
spec:
  profileRef:
    kind: SeccompProfile
    name: profile
  image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
```
where:

spec.profileRef.kind

Specifies the kind of the profile.

spec.profileRef.name

Specifies the name of the profile.

spec.image

Allows you to enable a default security profile by using a wildcard in the image attribute: image: "*"

Using the image: "*" wildcard attribute binds all new pods with a default security profile in a given namespace.
Label the namespace with enable-binding=true by running the following command:
```
$ oc label ns my-namespace spo.x-k8s.io/enable-binding=true
```

Define a pod named test-pod.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  containers:
  - name: test-container
    image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21

Create the pod:
```
$ oc create -f test-pod.yaml
```
If the pod already exists, you must re-create the pod for the binding to work properly.

Verification

Confirm the pod inherits the ProfileBinding by running the following command:

$ oc get pod test-pod -o jsonpath='{.spec.containers[*].securityContext.seccompProfile}'

Example output

{"localhostProfile":"operator/profile.json","type":"Localhost"}