Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

landlock-genprof trace

Starts a training run on a target pod and generates least-privilege security profiles

Synopsis

Starts a training run on a target pod and generates least-privilege security profiles.

Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.

landlock-genprof trace [flags]

Examples

  # Minimal run — filesystem-only profile (PodLock LandlockProfile), the one mandatory artifact
  kubectl landlock-genprof trace --pod nginx-demo --namespace default \
    --binary /usr/sbin/nginx --duration 60s

  # Also generate every optional artifact this run's training observed
  kubectl landlock-genprof trace --pod nginx-demo --namespace default \
    --binary /usr/sbin/nginx --duration 60s \
    --network-out --seccomp-out --capabilities-out --security-context-out \
    --report-out --patched-manifest-out --seccomp-profile-out

  # Restart the target first, so the tracer also catches startup-only
  # activity (bind(), config/log file opens) — see docs/usage/target-restart.md
  kubectl landlock-genprof trace --pod nginx-demo --namespace default \
    --binary /usr/sbin/nginx --duration 60s --restart --seccomp-profile-out

  # Accumulate this run into cross-run Confidence instead of a single-run estimate
  kubectl landlock-genprof trace --pod nginx-demo --namespace default \
    --binary /usr/sbin/nginx --duration 60s --history

Options

      --binary string                               Path of the main binary observed, e.g. /usr/sbin/nginx (required) — filters events to this process, see docs/usage.md for why
      --candidate-out verify[="-"]                  Output file for the raw, uncollapsed Landlock candidate (default <pod>-candidate.json); this is what verify reads — see internal/exporter/landlockjson. Carries rights (e.g. TRUNCATE) the LandlockProfile YAML above can't represent at all
      --capabilities-out string[="-"]               Output file for a capabilities add/drop fragment (default <pod>-capabilities.yaml); not a standalone resource, see docs/usage.md
  -c, --container string                            Target container (deduced if the pod has only one)
  -d, --duration duration                           Training run duration (default 1m0s)
      --events-out synthesize --events-file[="-"]   Output file for the raw captured events (default <pod>-events.json); this is what synthesize --events-file reads to re-run synthesis offline, without re-tracing — see internal/evidence
  -h, --help                                        help for trace
      --history                                     Accumulate this run into a TrainingHistory resource for cross-run confidence. Requires additional RBAC — see docs/usage.md
  -n, --namespace string                            Kubernetes namespace (default "default")
      --network-out string[="-"]                    Output file for a generated NetworkPolicy (default <pod>-networkpolicy.yaml); skipped if no network activity was observed
  -o, --out string                                  Output file for the generated LandlockProfile (default: <pod>-profile.yaml)
      --patched-manifest-out string[="-"]           Output file for a ready-to-apply manifest with securityContext merged in (default <identity>-patched.yaml); requires deploy/rbac-patched-manifest.yaml, see docs/usage.md
  -p, --pod string                                  Target pod name (required)
      --report-out string[="-"]                     Output file for a combined Markdown review report (default <pod>-report.md); always written when passed, works standalone — see docs/usage.md
      --restart                                     Restart the pod right before tracing, to catch startup-time activity. Disruptive — requires deploy/rbac-restart.yaml, see docs/usage.md
      --seccomp-out string[="-"]                    Output file for a generated seccomp profile (default <pod>-seccomp.json); skipped if no syscalls observed. Disruptive if misapplied — see docs/usage.md
      --seccomp-profile-out string[="-"]            Output file for an SPO SeccompProfile resource wrapping the seccomp profile (default <pod>-seccompprofile.yaml); requires security-profiles-operator, see docs/usage.md
      --seccomp-source string                       Where seccomp authority comes from: "internal" (this tool observes syscalls and synthesizes the profile) or "spo" (import a security-profiles-operator SeccompProfile as derived policy). Never auto-detected — see docs/adr/0008 (default "internal")
      --security-context-out string[="-"]           Output file for a composed securityContext fragment (default <pod>-securitycontext.yaml), combining capabilities + seccomp profile — see docs/usage.md
      --spo-import-mode string                      SPO provenance contract: strong-lineage or merged-provenance. Never selected by fallback (default "strong-lineage")
      --spo-profile string                          Name of the SPO-generated SeccompProfile to import (cluster-scoped, so no namespace). Required with --seccomp-source=spo
      --spo-recording string                        Name of the SPO ProfileRecording that produced the source profile, in the target namespace. Required with --seccomp-source=spo; the source is named, never guessed
      --spo-recording-namespace string              Source ProfileRecording namespace; required for merged-provenance because source and target are independent

SEE ALSO

  • landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod