Skip to content

Files

Latest commit

guni1192guni1192
Fix readme
Feb 26, 2022
91b3d5d · Feb 26, 2022

History

History
57 lines (40 loc) · 1.33 KB

README.md

File metadata and controls

57 lines (40 loc) · 1.33 KB

Sprofiler

CircleCI

Sprofiler generate seccomp profiles for OCI Container

Requirement

sprofiler-bpf

  • Ubuntu >= 20.10
  • Podman >= 3.0
  • Cgroup v2
  • CONFIG_DEBUG_INFO_BTF=y

Getting Started

Build

sudo apt install libelf-dev libgcc-s1 libbpf-dev clang curl linux-tools-generic linux-tools-common make pkg-config podman
bpftool btf dump file /sys/kernel/btf/vmlinux format c > ./sprofiler/src/bpf/vmlinux.h
cargo libbpf make

Run

# Run container with dynamic analyzer
sudo podman run \
    --annotation "io.sprofiler.output_seccomp_profile_path=$(pwd)/seccomp-profile.json" \
    ghcr.io/sai-lab/hello-c:latest

# Run container enable no-new-privileges with dynamic analyzer 
sudo podman run --security-opt=no-new-privileges \
    --annotation "io.sprofiler.output_seccomp_profile_path=$(pwd)/seccomp-profile.json" \
    ghcr.io/sai-lab/hello-c:latest

# check
sudo podman run --rm --security-opt seccomp=$(pwd)/seccomp-profile.json ghcr.io/sai-lab/hello-c:latest

Testing

cargo libbpf make
sudo -E ./target/debug/sprofiler-test ./integration_test/sprofiler-test.yaml

Vagrant for develop environment

vagrant up --provider=libvirt

License

Apache License Version 2.0