gen seccomp - kguardian

Synopsis

Generate Seccomp profiles based on observed syscall usage.

kubectl kguardian gen seccomp [POD_NAME] [flags]
kubectl kguardian gen secp [POD_NAME] [flags]  # Alias

Flags

Flag	Type	Description	Default
`-n, --namespace`	string	Namespace of the pod	Current namespace
`--all`	bool	Generate for all pods in namespace (no `-a` shorthand)	`false`
`-A, --all-namespaces`	bool	Generate for all pods cluster-wide	`false`
`--output-dir`	string	Directory to save profiles	`seccomp-profiles`
`--default-action`	string	Action for unlisted syscalls	`SCMP_ACT_ERRNO`

Default Actions

SCMP_ACT_ERRNO - Return error for unlisted syscalls (recommended)
SCMP_ACT_LOG - Log unlisted syscalls but allow them (audit mode)
SCMP_ACT_KILL - Kill process on unlisted syscall (strictest)

Examples

# Single pod
kubectl kguardian gen seccomp my-app -n prod --output-dir ./seccomp

# All pods with logging for unlisted
kubectl kguardian gen secp --all -n staging --default-action SCMP_ACT_LOG

# Cluster-wide with strict mode
kubectl kguardian gen secp -A --default-action SCMP_ACT_KILL

See Seccomp Profiles for how the profile is derived and how to distribute it.