landlock-genprof reject
Records an explicit rejection decision on a SecurityProfileProposal
Synopsis
Records an explicit rejection decision on a SecurityProfileProposal. A rejected proposal cannot pass the fail-closed approval validation required by governed apply-proposal; re-run trace and review, then approve the new candidate digest when it is ready.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof reject <proposal> [flags]
Examples
kubectl landlock-genprof reject nginx-demo --reason "syscalls list looks too broad, retrace with more traffic"
Options
-h, --help help for reject
-n, --namespace string Kubernetes namespace (default "default")
--reason string Optional free-text note explaining this decision
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod