Skip to content

Instantly share code, notes, and snippets.

@andrewkroh
Last active April 23, 2018 12:55
Show Gist options
  • Save andrewkroh/d34bfea099ad5e568c61ba5cc6f8bbca to your computer and use it in GitHub Desktop.
Save andrewkroh/d34bfea099ad5e568c61ba5cc6f8bbca to your computer and use it in GitHub Desktop.
Elastic Beat Seccomp Profiles
seccomp:
default_action: errno
syscalls:
- names:
- accept
- accept4
- arch_prctl
- bind
- brk
- clone
- close
- connect
- dup
- epoll_create
- epoll_create1
- epoll_ctl
- epoll_wait
- exit
- exit_group
- fchdir
- fchmod
- fchown
- fcntl
- fdatasync
- flock
- fstat
- fsync
- ftruncate
- futex
- getcwd
- getdents64
- geteuid
- getgid
- getpeername
- getpid
- getrandom
- getrusage
- getsockname
- getsockopt
- gettid
- getuid
- inotify_add_watch
- inotify_init1
- inotify_rm_watch
- ioctl
- kill
- listen
- lseek
- lstat
- madvise
- mincore
- mkdirat
- mmap
- munmap
- open
- openat
- pipe2
- prctl
- pread64
- pselect6
- pwrite64
- read
- readlinkat
- recvfrom
- recvmsg
- renameat
- rt_sigaction
- rt_sigprocmask
- rt_sigreturn
- sched_getaffinity
- sched_yield
- sendfile
- sendmsg
- sendto
- setitimer
- setsockopt
- shutdown
- sigaltstack
- socket
- stat
- tkill
- uname
- unlinkat
- write
- writev
action: allow
---
seccomp:
default_action: errno
syscalls:
- names:
- accept
- accept4
- arch_prctl
- bind
- brk
- clone
- close
- connect
- dup
- epoll_create
- epoll_create1
- epoll_ctl
- epoll_wait
- exit
- exit_group
- fchdir
- fchmod
- fchown
- fcntl
- flock
- fstat
- fsync
- ftruncate
- futex
- getcwd
- getdents64
- geteuid
- getgid
- getpeername
- getpid
- getrandom
- getrusage
- getsockname
- getsockopt
- gettid
- getuid
- ioctl
- kill
- listen
- lseek
- lstat
- madvise
- mincore
- mkdirat
- mmap
- munmap
- open
- openat
- prctl
- pread64
- pselect6
- pwrite64
- read
- readlinkat
- recvfrom
- recvmmsg
- recvmsg
- renameat
- rt_sigaction
- rt_sigprocmask
- rt_sigreturn
- sched_getaffinity
- sched_yield
- sendfile
- sendmmsg
- sendmsg
- sendto
- setitimer
- setsockopt
- shutdown
- sigaltstack
- socket
- stat
- tkill
- uname
- unlinkat
- write
- writev
action: allow
# Filebeat and Packetbeat are the same as libbeat.
seccomp:
default_action: errno
syscalls:
- names:
- accept
- accept4
- arch_prctl
- bind
- brk
- clone
- close
- connect
- dup
- epoll_create
- epoll_create1
- epoll_ctl
- epoll_wait
- exit
- exit_group
- fchdir
- fchmod
- fchown
- fcntl
- flock
- fstat
- fsync
- ftruncate
- futex
- getcwd
- getdents64
- geteuid
- getgid
- getpeername
- getpid
- getrandom
- getrusage
- getsockname
- getsockopt
- gettid
- getuid
- ioctl
- kill
- listen
- lseek
- lstat
- madvise
- mincore
- mkdirat
- mmap
- munmap
- open
- openat
- prctl
- pread64
- pselect6
- pwrite64
- read
- readlinkat
- recvfrom
- recvmsg
- renameat
- rt_sigaction
- rt_sigprocmask
- rt_sigreturn
- sched_getaffinity
- sched_yield
- sendfile
- sendmsg
- sendto
- setitimer
- setsockopt
- shutdown
- sigaltstack
- socket
- stat
- tkill
- uname
- unlinkat
- write
- writev
action: allow
seccomp:
default_action: errno
syscalls:
- names:
- accept
- accept4
- arch_prctl
- bind
- brk
- chdir
- chroot
- clone
- close
- connect
- dup
- dup2
- epoll_create
- epoll_create1
- epoll_ctl
- epoll_wait
- execve
- exit
- exit_group
- fchdir
- fchmod
- fchown
- fcntl
- flock
- fstat
- fsync
- ftruncate
- futex
- getcwd
- getdents64
- geteuid
- getgid
- getpeername
- getpid
- getppid
- getrandom
- getrusage
- getsockname
- getsockopt
- gettid
- getuid
- ioctl
- kill
- listen
- lseek
- lstat
- madvise
- mincore
- mkdirat
- mmap
- mount
- munmap
- open
- openat
- pipe
- pipe2
- prctl
- pread64
- pselect6
- ptrace
- pwrite64
- read
- readlinkat
- recvfrom
- recvmsg
- renameat
- rt_sigaction
- rt_sigprocmask
- rt_sigreturn
- sched_getaffinity
- sched_yield
- sendfile
- sendmsg
- sendto
- setgid
- setgroups
- setitimer
- setpgid
- setsid
- setsockopt
- setuid
- shutdown
- sigaltstack
- socket
- stat
- statfs
- sysinfo
- tkill
- uname
- unlinkat
- unshare
- wait4
- waitid
- write
- writev
action: allow
#!/usr/bin/env bash
set -e
# Execute this on Linux from the elastic/beats directory.
beats="libbeat packetbeat filebeat winlogbeat metricbeat heartbeat auditbeat"
arches="amd64 386"
go get -u github.com/andrewkroh/go2seccomp
for beat in $beats
do
echo Disassembling $beat
cd $beat
for arch in $arches
do
GOARCH=$arch go build
go2seccomp ./$beat ./$beat-seccomp-$arch.json
done
cd ..
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment