testing seccomp profiles for cve 2026-31431. needs to be in the k8s kubelet seccomp root: /var/lib/kubelet/seccomp/deny-af-alg.json

beanpod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: no-af-alg
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: deny-af-alg.json
  containers:
    - name: app
      image: coolbeans-image

deny-af-alg.json

{
  "defaultAction": "SCMP_ACT_ALLOW",
  "architectures": [
    "SCMP_ARCH_X86_64",
    "SCMP_ARCH_AARCH64"
  ],
  "syscalls": [
    {
      "names": ["socket"],
      "action": "SCMP_ACT_ERRNO",
      "errnoRet": 1,
      "args": [
        {
          "index": 0,
          "value": 38,
          "op": "SCMP_CMP_EQ"
        }
      ]
    }
  ]
}