<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Runtime Security Profiles — API Reference

## Seccomp Actions

| Action | Description |
|--------|-------------|
| `SCMP_ACT_ALLOW` | Allow syscall |
| `SCMP_ACT_ERRNO` | Return error code |
| `SCMP_ACT_KILL` | Kill the process |
| `SCMP_ACT_LOG` | Log and allow |
| `SCMP_ACT_TRAP` | Send SIGSYS signal |

## Kubernetes Seccomp Types

| Type | Description |
|------|-------------|
| `RuntimeDefault` | Container runtime default profile |
| `Localhost` | Custom profile from node filesystem |
| `Unconfined` | No seccomp filtering |

## AppArmor Commands

```bash
apparmor_parser -r /etc/apparmor.d/PROFILE
aa-status
aa-complain /etc/apparmor.d/PROFILE
aa-enforce /etc/apparmor.d/PROFILE
```

## Security Profile Operator CRDs

```bash
kubectl get seccompprofiles -A
kubectl get apparmorprofiles -A
kubectl get profilerecordings -A
```

## strace Commands

```bash
strace -f -c -p PID
strace -f -e trace=all -o trace.log -p PID
strace -f -e trace=network -p PID
strace -f -e trace=file -p PID
```
