seccomp

Documentation

Index

• Constants
• type Seccomp
  • func New() *Seccomp
  • func (a *Seccomp) Audit(resource k8stypes.Resource, _ []k8stypes.Resource) ([]*kubeaudit.AuditResult, error)

Constants

const (
	// SeccompAnnotationMissing occurs when there are no seccomp annotations (pod nor container level)
	SeccompAnnotationMissing = "SeccompAnnotationMissing"
	// SeccompDeprecatedPod occurs when the pod-level seccomp annotation is set to a deprecated value
	SeccompDeprecatedPod = "SeccompDeprecatedPod"
	// SeccompDisabledPod occurs when the pod-level seccomp annotation is set to a value which disables seccomp
	SeccompDisabledPod = "SeccompDisabledPod"
	// SeccompDeprecatedContainer occurs when the container-level seccomp annotation is set to a deprecated value
	SeccompDeprecatedContainer = "SeccompDeprecatedContainer"
	// SeccompDisabledContainer occurs when the container-level seccomp annotation is set to a value which disables seccomp
	SeccompDisabledContainer = "SeccompDisabledContainer"
)

const (
	// ContainerAnnotationKeyPrefix represents the key of a seccomp profile applied to one container of a pod
	ContainerAnnotationKeyPrefix = apiv1.SeccompContainerAnnotationKeyPrefix
	// PodAnnotationKey represents the key of a seccomp profile applied to all containers of a pod
	PodAnnotationKey = apiv1.SeccompPodAnnotationKey
	// ProfileRuntimeDefault represents the default seccomp profile used by container runtime
	ProfileRuntimeDefault = apiv1.SeccompProfileRuntimeDefault
	// ProfileNamePrefix is the prefix for a custom seccomp profile
	ProfileNamePrefix = "localhost/"
	// DeprecatedProfileRuntimeDefault represents the default seccomp profile used by docker.
	// This is now deprecated and should be replaced by SeccompProfileRuntimeDefault
	DeprecatedProfileRuntimeDefault = apiv1.DeprecatedSeccompProfileDockerDefault
)

const Name = "seccomp"

Types

type Seccomp

type Seccomp struct{}

Seccomp implements Auditable

func New

func New() *Seccomp

func (*Seccomp) Audit

func (a *Seccomp) Audit(resource k8stypes.Resource, _ []k8stypes.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that Seccomp is enabled for all containers