seitan is a framework to filter, transform and impersonate system calls,
enabling privilege reduction in container and virtualisation engines
It allows you to filter and replay only the system calls you need, instead of
running things as root, or granting capabilities to processes.
seitan-cooker
builds a BPF program and a
bytecode file (gluten) from a recipe with matches on system calls and
corresponding actionsseitan-eater
loads the BPF program
associated to the process context into the kernel, and runs the target
process. Container engines such as Podman can directly load this program via
OCI annotations insteadseitan
is the supervisor, getting
notifications via seccomp_unotify
,
interpreting them according to gluten, and triggering the configured
actions as a result
Note that this project and its documentation still have some rough edges! No versions, no packages yet.
Do you want to know more?
Watch the
demos below, ask your questions on the
users'
list,
chat with us.
Do you want to contribute?
Send patches to the development
list...
and chat with us!
