CKSKubernetes 1.35

Exercises

Exercise: block mkdir with a seccomp profile

updated 2026-10-22 by seed

Host: worker (root) + controlplane · Time: 10 min · Domain: System Hardening

Task

  • Write a seccomp profile that returns EPERM for mkdir and mkdirat.
  • Put it where the kubelet expects it.
  • Apply it to container tester in a Pod in namespace prod; the Pod must run.

Acceptance criteria

  • kubectl exec -n prod tester-pod -- mkdir /tmp/x → Operation not permitted.
  • kubectl exec -n prod tester-pod -- ls / still works.
  • /proc/self/status shows Seccomp: 2.

Solution

sudo mkdir -p /var/lib/kubelet/seccomp/profiles
sudo tee /var/lib/kubelet/seccomp/profiles/mkdir-deny.json >/dev/null <<'EOF'
{
  "defaultAction": "SCMP_ACT_ALLOW",
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"],
  "syscalls": [
    {"names": ["mkdir", "mkdirat"], "action": "SCMP_ACT_ERRNO"}
  ]
}
EOF
    securityContext:
      seccompProfile:
        type: Localhost
        localhostProfile: profiles/mkdir-deny.json

Validate the JSON before applying: python3 -m json.tool /var/lib/kubelet/seccomp/profiles/mkdir-deny.json.
A malformed profile prevents the container from starting.