Preventing Privilege Escalation in Kubernetes via eBPF-Based Dynamic Seccomp Profile Generation and Enforcement — code snippets

snippet-1.yaml

apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: ProfileRecording
metadata:
  name: payment-service-recorder
  namespace: core-payments
spec:
  kind: SeccompProfile
  recorder: bpf
  podSelector:
    matchLabels:
      app: payment-service

snippet-2.txt

#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10240);
    __type(key, u64);   // Key: pid_tgid (Process ID + Thread ID)
    __type(value, u32); // Value: Syscall ID
} syscall_events SEC(".maps");

SEC("tracepoint/raw_syscalls/sys_enter")
int trace_sys_enter(struct trace_event_raw_sys_enter *ctx) {
    u64 pid_tgid = bpf_get_current_pid_tgid();
    u32 syscall_id = ctx->id;
    
    // Filter out kernel threads (TGID of 0 indicates a kernel-only thread)
    u64 tgid = pid_tgid >> 32;
    if (tgid == 0) {
        return 0;
    }

    // Capture system calls and store them in the hash map for processing
    bpf_map_update_elem(&syscall_events, &pid_tgid, &syscall_id, BPF_ANY);
    
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

snippet-3.yaml

apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: SeccompProfile
metadata:
  name: payment-service-profile
  namespace: core-payments
spec:
  defaultAction: SCMP_ACT_ERRNO
  architectures:
    - SCMP_ARCH_X86_64
  syscalls:
    - names:
        - accept4
        - epoll_pwait
        - write
        - read
        - close
        - futex
        - rt_sigaction
        - rt_sigreturn
        - brk
        - mmap
        - munmap
        - mprotect
        - clone
        - sigaltstack
        - gettid
        - sysinfo
        - fstat
        - stat
      action: SCMP_ACT_ALLOW

snippet-4.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service
  namespace: core-payments
spec:
  replicas: 3
  selector:
    matchLabels:
      app: payment-service
  template:
    metadata:
      labels:
        app: payment-service
    spec:
      securityContext:
        seccompProfile:
          type: Localhost
          localhostProfile: operator/core-payments/payment-service-profile.json
      containers:
        - name: web-app
          image: internal-registry.net/payments/service:v2.4.1
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 10001
          ports:
            - containerPort: 8080
          resources:
            limits:
              cpu: "1"
              memory: 512Mi
            requests:
              cpu: 100m
              memory: 256Mi

snippet-5.go

package main

import (
	"fmt"
	"syscall"
	"golang.org/x/sys/unix"
)

func main() {
	// Simulate an exploit trying to inject a kernel rootkit via finit_module
	// This system call is blocked by our custom Seccomp profile.
	fd := -1
	param := "malicious_payload"
	flags := 0
	
	err := unix.FinitModule(fd, param, flags)
	if err != nil {
		fmt.Printf("Exploit payload blocked: %v\n", err)
		if err == syscall.EPERM || err == syscall.EACCES {
			fmt.Println("Verification Success: Kernel Seccomp filter caught and denied the syscall.")
		} else {
			fmt.Printf("Unexpected error returned: %v\n", err)
		}
	} else {
		fmt.Println("CRITICAL SECURITY FAILURE: System call succeeded. Seccomp is not enforcing!")
	}
}

snippet-6.yaml

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: seccomp-violations-alert
  namespace: security-monitoring
spec:
  groups:
    - name: seccomp-rules
      rules:
        - alert: ContainerSeccompViolation
          expr: rate(node_seccomp_actions_total{action="errnos"}[5m]) > 0
          for: 1m
          labels:
            severity: critical
            team: secops
          annotations:
            summary: "Critical: Seccomp violation on host node {{ $labels.instance }}"
            description: "Workload container {{ $labels.container }} in namespace {{ $labels.namespace }} executed blocked syscall {{ $labels.syscall }}."