kubearmor / KubeArmor

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (BPF-LSM, AppArmor).
https://kubearmor.io/
Apache License 2.0
1.45k stars 335 forks source link

mount procfs instead of using hostpid #1688

Open daemon1024 opened 6 months ago

daemon1024 commented 6 months ago

Feature Request

KubeArmor needs access to host's procfs to stich container and real time process information we get from eBPF.

Is your feature request related to a problem? Please describe the use case.

Sharing pid ns with host is more risky than just accessing procfs.

Describe the solution you'd like

Related #1186

yp969803 commented 1 month ago

@daemon1024 is the issue open to work?

daemon1024 commented 1 month ago

Yes @yp969803

yp969803 commented 1 month ago

/assign