Documentation
¶
Overview ¶
Package seccomp provides seccomp profile management.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateProfilePath ¶
GenerateProfilePath returns the path for a container's seccomp profile.
func SaveProfile ¶
SaveProfile saves a seccomp profile to a JSON file.
Types ¶
type ArgRule ¶
type ArgRule struct {
Index uint `json:"index"`
Value uint64 `json:"value"`
ValueTwo uint64 `json:"valueTwo,omitempty"`
Op string `json:"op"`
}
ArgRule defines argument filtering for syscalls.
type Profile ¶
type Profile struct {
DefaultAction string `json:"defaultAction"`
Architectures []string `json:"architectures,omitempty"`
Syscalls []SyscallRule `json:"syscalls,omitempty"`
Flags []string `json:"flags,omitempty"`
}
Profile represents a seccomp security profile.
func DefaultProfile ¶
func DefaultProfile() *Profile
DefaultProfile returns the default Doki seccomp profile. This blocks dangerous syscalls while allowing normal container operation. Updated to include AF_ALG block per CVE-2026-31431.
func LoadProfile ¶
LoadProfile loads a seccomp profile from a JSON file.
func PrivilegedProfile ¶
func PrivilegedProfile() *Profile
func UnconfinedProfile ¶
func UnconfinedProfile() *Profile
func (*Profile) FilterAllowed ¶
FilterAllowed returns only the allowed syscalls from a profile.
func (*Profile) FilterBlocked ¶
FilterBlocked returns only the blocked syscalls from a profile.
type SyscallRule ¶
type SyscallRule struct {
Names []string `json:"names"`
Action string `json:"action"`
Args []ArgRule `json:"args,omitempty"`
}
SyscallRule defines allowed/blocked syscalls.
Source Files
Click to show internal directories.
Click to hide internal directories.