Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Proposal: Allow spoc to simultaneously record different profile types. #2255

Closed
mhils opened this issue May 13, 2024 · 2 comments · Fixed by #2260
Closed

Proposal: Allow spoc to simultaneously record different profile types. #2255

mhils opened this issue May 13, 2024 · 2 comments · Fixed by #2260
Labels
kind/feature Categorizes issue or PR as related to a new feature.

Comments

@mhils
Copy link
Contributor

mhils commented May 13, 2024

What would you like to be added:

spoc currently has --type and --output-file options for the profile that should be recorded. This means we cannot easily record Seccomp and AppArmor profiles at the same time: it's either --type seccomp or --type apparmor. It would be useful if we could record both AppArmor and Seccomp profiles at the same time. This requires some changes to the CLI interface:

  1. Option A: Add dedicated --apparmor, --apparmor-raw, --seccomp, ... options. A user could run 
    spoc --apparmor-raw apparmor-profile.yaml --seccomp seccomp-profile.yml ...
    to record both Seccomp and AppArmor profiles simultaneously. This would break the existing command line interface.
  2. Option B: Make --type support new "combined" types such as apparmor,seccomp or simply a new meta type all. A user could run 
    spoc --type all --output-file profile.yaml ...
    to record both Seccomp and AppArmor CRD profiles simultaneously. We're limited to a single (combined) outfile.

Any thoughts/opinions? :)
@mhils mhils added the kind/feature Categorizes issue or PR as related to a new feature. label May 13, 2024
@saschagrunert
Copy link
Member

@mhils thank you for the feature proposal! I think Option B would be great to have. 👍

@ccojocar
Copy link
Contributor

I also vote for option B. Having for type the values as seccomp,apparmor,all, sounds the easiest to me without any backward compatibility impact.

@mhils mhils mentioned this issue May 14, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/feature Categorizes issue or PR as related to a new feature.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Refactor BPF recorder to enable simultaneous profile recording mhils/security-profiles-operator
3 participants
@ccojocar @saschagrunert @mhils