The securityContext field in a pod specification allows you to define privilege and access control settings for a pod or container.
Seccomp profiles enhance security by allowing you to explicitly define which kernel system calls a containerized workload is permitted to make.
AppArmor provides mandatory access control by defining profiles that restrict application capabilities like file reads, writes, and network access.
SELinux uses a labeling system to enforce mandatory access control policies, providing granular control over process and object interactions.
The Security Profiles Operator simplifies the management and distribution of seccomp, AppArmor, and SELinux profiles across all nodes in a Kubernetes cluster.
A live demonstration shows how a seccomp profile can block the `memfd_create` system call to prevent a fileless malware execution attack.
This demo illustrates how the Security Profiles Operator uses a `ProfileBinding` to automatically apply a seccomp profile to workloads based on their image.
A practical demonstration shows how SELinux denies access by default and how to use audit logs and tools like `audit2allow` to diagnose and create new policies.
The speakers answer audience questions about applying AppArmor profiles, the nature of fileless malware, discovering system calls, and the role of eBPF.
42:45Marc Nimmerrichter
46:36Andrew Martin
33:20Aarno Aukia
42:25Madhu Akula
29:34Reto Kaeser
58:52Davide Imola
23:08Rico Komenda
44:30Milecia McGregor
Jobs that call for the skills explored in this talk.
smartclip Europe GmbH
Hamburg, Germany
Mittwald CM Service GmbH & Co. KG
Espelkamp, Germany
Rocken AG
Rocken AG