CME-602

seccomp-bpf Profile (Container Default)

Harden OS/Kernel Unquantified evidence Preventive

Description

Applies the default OCI/Docker/Podman seccomp-bpf profile which blocks ~44 dangerous syscalls including kexec_load, mount, reboot, and others. Basis for container isolation.

CVSS Vector Impacts

Metric	Transition	Rationale
Scope (S)	C → U	Blocked syscalls prevent container escape via kernel
Attack Complexity (AC)	L → H	Many kernel exploit primitives require blocked syscalls

CWE Relationships

CWE-78 CWE-119 CWE-269

Verification

Verify container runtime has seccomp profile applied

$ podman inspect <container> | grep -A5 SecurityOpt
# Expected: seccomp

Platform: linux

$ kubectl get pod <pod> -o jsonpath='{.spec.securityContext.seccompProfile.type}'
# Expected: RuntimeDefault

Platform: kubernetes

Remediation

kubernetes Kubernetes Pod seccomp RuntimeDefault profile


kubectl patch deployment <deployment> -n <namespace> --type=merge -p '{"spec":{"template":{"spec":{"securityContext":{"seccompProfile":{"type":"RuntimeDefault"}}}}}}'
kubectl label namespace <namespace> pod-security.kubernetes.io/enforce=restricted --overwrite

linux Podman/Docker default seccomp profile enforcement


podman run --security-opt seccomp=/usr/share/containers/seccomp.json <image>
grep -q 'seccomp_profile.*=.*""' /etc/containers/containers.conf 2>/dev/null && sed -i 's|seccomp_profile.*=.*""|seccomp_profile = "/usr/share/containers/seccomp.json"|' /etc/containers/containers.conf || echo 'Default seccomp profile already active'