YAML Profiles

Table of Contents generated with DocToc

• YAML Profiles and Templates
• Create a custom sandbox
  • 1. Generate a profile for your application
  • 2. Save the YAML output
  • 3. Build a sandbox (dtrace script) from a yaml file
  • 4. Run your app in your sandbox

YAML Profiles and Templates

It is very convenient to specify all of you policies, for all of your 3rd party and open source modules, in a single YAML file.

Create a custom sandbox

1. Generate a profile for your application using the tracing script.
2. Create a YAML security profile from your trace.
3. Build a sandbox (dtrace script) from the yaml file
4. Run your app in your sandbox!

1. Generate a profile for your application

dtrace2) ➜  secimport git:(master) ✗ sudo dtrace -s secimport/templates/generate_profile.d -c "python -m http.server"

Serving HTTP on :: port 8000 (http://[::]:8000/) ...

CTRL + C


 Generated syscalls (yaml profile):
    destructive: true
    syscall_allowlist:
        - __mac_syscall
        - __pthread_canceled
        - bind
        - csrctl
        - fgetattrlist
...
        - read
        - ioctl
        - stat64

Done.

2. Save the YAML output

After yout hit CTRL + C, after "Generated syscalls (yaml profile)", the YAML profile is printed.

An example for a template is available in example.yaml.

It should look like this:

# Example yaml file (with example syscalls)

modules:
  requests:
    destructive: true
    syscall_allowlist:
      - write
      - ioctl
      - stat64
  fastapi:
    destructive: true
    syscall_allowlist:
      - bind
      - fchmod
      - stat64
  uvicorn:
    destructive: true
    syscall_allowlist:
      - getpeername
      - getpgrp
      - stat64

Save the output of dtrace into a local YAML file and proceed to step 3.

3. Build a sandbox (dtrace script) from a yaml file

Usage:

python examples/create_profile_from_yaml.py <yaml_template_filename> <sandbox_target_filename>

Example:

python examples/create_profile_from_yaml.py secimport/profiles/example.yaml /tmp/example.d

Or, use the python API:

import secimport, pathlib

template_path = pathlib.Path(secimport.sandbox_helper.PROFILES_DIR_NAME / 'example.yaml')

sandbox_code = secimport.sandbox_helper.build_module_sandbox_from_yaml_template(template_path)

4. Run your app in your sandbox

sudo dtrace -s /tmp/example.d -c "python"

And that's it!