<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-runtime-security-profiles
description: >-
  Implement container runtime security profiles using seccomp, AppArmor, and
  SELinux to restrict syscall access, file operations, and process capabilities
  at the kernel level for defense in depth.
domain: cybersecurity
subdomain: container-security
tags:
  - seccomp
  - apparmor
  - selinux
  - runtime-security
  - syscall-filtering
  - defense-in-depth
  - kernel-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Runtime Security Profiles

## Overview

Runtime security profiles restrict what a container process can do at the kernel
level. Seccomp filters syscalls, AppArmor constrains file and network access, and
SELinux enforces mandatory access controls. This skill covers profile creation from
syscall tracing, the Security Profile Operator (SPO) for automated management, and
auditing pod coverage to ensure no workload runs with Unconfined profiles.

Mode: `[MODE: BLUE]` — Defensive kernel-level hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes >= 1.25 with seccomp support | Required |
| AppArmor or SELinux enabled on nodes | Required |
| Security Profile Operator (SPO) for automated profile management | Required |
| strace or sysdig for syscall profiling | Required |

## Key Concepts

### Seccomp Profiles

```json
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64"],
  "syscalls": [
    {
      "names": ["read", "write", "open", "close", "stat", "fstat",
                "mmap", "mprotect", "brk", "exit_group", "futex"],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}
```

### Applying Seccomp to Pods

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/custom-profile.json
  containers:
    - name: app
      image: app:latest
      securityContext:
        allowPrivilegeEscalation: false
        runAsNonRoot: true
```

### AppArmor Profiles

```bash
# Create AppArmor profile
cat > /etc/apparmor.d/container-app <<'EOF'
#include <tunables/global>
profile container-app flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  network inet tcp,
  network inet udp,
  /app/** r,
  /app/bin/* ix,
  deny /etc/shadow r,
  deny /proc/*/mem rw,
  /tmp/** rw,
}
EOF

# Load profile
apparmor_parser -r /etc/apparmor.d/container-app
```

### Security Profile Operator (SPO)

```yaml
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: ProfileRecording
metadata:
  name: record-app
spec:
  kind: SeccompProfile
  recorder: logs
  podSelector:
    matchLabels:
      app: my-app
```

### Syscall Profiling

```bash
# Profile syscalls with strace
strace -f -c -p $(pgrep app) -e trace=all 2>&1 | tail -30

# Profile with sysdig
sysdig -c topscalls container.name=app
```

## Workflow

### Step 1: Audit Profile Coverage

```bash
node scripts/agent.js --audit --namespace production --output /tmp/profile-audit.json
```

### Step 2: Generate Seccomp Profile

```bash
node scripts/agent.js --generate-seccomp --input /tmp/syscall-trace.json \
  --output /tmp/seccomp-profile.json
```

### Step 3: Apply and Test

```bash
kubectl apply -f seccomp-profile.yaml
```

## Detection

```yaml
title: Runtime Security Profiles Detection
id: 16e5c227-6937-488d-8395-b84e5e90d777
status: experimental
description: Detects suspicious activity related to implementing runtime security profiles techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Runtime Security Profiles Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] All production pods have seccomp profiles (RuntimeDefault minimum)
- [ ] AppArmor or SELinux profiles applied to sensitive workloads
- [ ] No pods run with Unconfined seccomp profile
- [ ] Profile violations generate alerts
- [ ] Profiles tested in audit mode before enforcement

## References

- [Kubernetes Seccomp Profiles](https://kubernetes.io/docs/tutorials/security/seccomp/)
- [Security Profile Operator](https://github.com/kubernetes-sigs/security-profiles-operator)
- [AppArmor for Containers](https://kubernetes.io/docs/tutorials/security/apparmor/)
- [CIS Kubernetes Benchmark 5.7 — Seccomp](https://www.cisecurity.org/benchmark/kubernetes)
- [NIST SP 800-190 §4.3.3 — Runtime Profiles](https://csrc.nist.gov/publications/detail/sp/800-190/final)
