landlock-genprof verify
Checks a synthesized Landlock candidate against a target kernel’s ABI level
Synopsis
Checks every rule in a synthesized Landlock candidate (see internal/exporter/landlockjson) against a target kernel’s Landlock ABI level — reports which rules need a right the target kernel doesn’t support, and at which ABI level that right actually exists. –kernel defaults to the local host’s, matching doctor/abi check. –output sarif renders findings as a SARIF 2.1.0 log instead of text, for CI dashboards (GitHub Code Scanning and similar) that already know how to annotate it — the exit-code contract (0/2/3) is unchanged either way.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof verify --candidate-file <path> [flags]
Examples
kubectl landlock-genprof verify --candidate-file nginx-demo-candidate.json
kubectl landlock-genprof verify --candidate-file nginx-demo-candidate.json --kernel 5.19
kubectl landlock-genprof verify --candidate-file nginx-demo-candidate.json --output sarif > verify.sarif
Options
--candidate-file string Path to a candidate JSON file (see internal/exporter/landlockjson)
-h, --help help for verify
--kernel string Kernel version to verify against (e.g. 6.2); defaults to the local host's
--output string Output format: text or sarif (default "text")
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod