Seccomp example - Example in Templates Folder

insecure-chart/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: insecure-apps
 description: Intentionally insecure Helm chart for testing purposes
 type: application
-version: 0.1.1
-appVersion: "1.0.0"
+version: 0.1.4
+appVersion: "1.0.4"
 maintainers:
 - email: [email protected]
   name: Latio Tech

insecure-chart/templates/insecure-app-seccomp.yaml

@@ -0,0 +1,97 @@
+kind: SeccompProfile
+apiVersion: spdx.softwarecomposition.kubescape.io/v1beta1
+metadata:
+  name: insecure-app
+  namespace: default
+  creationTimestamp: null
+spec:
+  containers:
+    - name: insecure-app
+      path: default/Deployment-insecure-app-insecure-app.json
+      spec:
+        defaultAction: SCMP_ACT_ERRNO
+        architectures:
+          - SCMP_ARCH_X86_64
+          - SCMP_ARCH_X86
+          - SCMP_ARCH_X32
+        syscalls:
+          - names:
+              - accept4
+              - access
+              - arch_prctl
+              - bind
+              - brk
+              - capget
+              - capset
+              - chdir
+              - clone
+              - close
+              - connect
+              - dup
+              - dup2
+              - epoll_create1
+              - epoll_ctl
+              - epoll_pwait
+              - epoll_wait
+              - execve
+              - exit
+              - exit_group
+              - faccessat2
+              - fcntl
+              - fstat
+              - fstatfs
+              - futex
+              - getcwd
+              - getdents64
+              - getegid
+              - geteuid
+              - getgid
+              - getpid
+              - getppid
+              - getrandom
+              - getsockname
+              - gettid
+              - getuid
+              - ioctl
+              - listen
+              - lseek
+              - lstat
+              - madvise
+              - mmap
+              - mprotect
+              - munmap
+              - nanosleep
+              - newfstatat
+              - openat
+              - pipe2
+              - poll
+              - prctl
+              - pread64
+              - prlimit64
+              - read
+              - readlink
+              - recvfrom
+              - rt_sigaction
+              - rt_sigprocmask
+              - rt_sigreturn
+              - sched_yield
+              - select
+              - sendto
+              - set_robust_list
+              - set_tid_address
+              - setgid
+              - setgroups
+              - setsockopt
+              - setuid
+              - shutdown
+              - sigaltstack
+              - socket
+              - stat
+              - sysinfo
+              - tgkill
+              - umask
+              - uname
+              - wait4
+              - write
+            action: SCMP_ACT_ALLOW
+status: {}

insecure-chart/templates/insecure-app.yaml

@@ -23,7 +23,9 @@ spec:
         - name: AWS_SECRET_ACCESS_KEY
           value: v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5
         securityContext:
-          privileged: true
+          seccompProfile:
+            localhostProfile: default/Deployment-insecure-app-insecure-app.json
+            type: Localhost
         volumeMounts:                   
         - name: docker-socket
           mountPath: /var/run/docker.sock