Devconf.cz 2023

Privilege separation in containers and virtual machines is an essential security factor for the execution of untrusted workloads. Security-relevant actions are typically mediated and performed by privileged components, on behalf of applications.

There is currently no common framework to describe these actions and security constraints, across virtualisation and container stacks.
Seitan (early development) opts for a unified, declarative, auditable approach over the imperative model found in existing solutions, using system calls as abstraction for access to privileged resources, leveraging BPF and seccomp notifiers.

Cluster administrators describe filtered system calls in a JSON recipe, associating them with privileged operations. The supervisor evaluates seccomp notifications against a bytecode with matches and corresponding actions.

In this talk, we’ll write (and test!) example JSON recipes.

With Seitan you can bake any recipe to suit your taste!