landlock-genprof explain
Explains why a synthesized candidate’s rules exist
Synopsis
Explains why each rule in a synthesized candidate (see internal/exporter/landlockjson) exists: which rights it carries, the ABI level and minimum kernel version each right actually needs, how confident the synthesis is, and how many observations support it. –path restricts this to a single rule.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof explain --candidate-file <path> [flags]
Examples
kubectl landlock-genprof explain --candidate-file nginx-demo-candidate.json
kubectl landlock-genprof explain --candidate-file nginx-demo-candidate.json --path /etc/nginx
Options
--candidate-file string Path to a candidate JSON file (see internal/exporter/landlockjson) (required)
-h, --help help for explain
--path string Explain only the rule for this path (default: every rule)
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod