Restrict the allowed syscalls in seccomp profiles

The Security Profiles Operator does not restrict syscalls in seccomp profiles by default. You can define the list of allowed syscalls in the spod configuration.

Important

The Operator will install only the seccomp profiles, which have a subset of syscalls defined into the allowed list. All profiles not complying with this ruleset are rejected.

When the list of allowed syscalls is modified in the spod configuration, the Operator will identify the already installed profiles which are noncompliant and remove them automatically.
Procedure

  • To define the list of allowedSyscalls, adjust the spec parameter by running the following command:

    $ oc -n openshift-security-profiles patch spod spod --type merge \
    -p '{"spec":{"allowedSyscalls": ["exit", "exit_group", "futex", "nanosleep"]}}'

← Previous: Creating SELinux profiles | ↑ Up: Limit system calls with seccomp and SELinux security profiles | ⌂ Home: Red Hat OpenShift Container Platform | Next: Base syscalls for a container runtime →