Seitan: Syscall Expressive Interpreter, Transformer and Notifier

The seitan project released a framework that filters, transforms and impersonates system calls to reduce privileges in container and virtualisation engines, letting operators replay only the system calls they need instead of running processes as root or granting capabilities. The framework comprises seitan-cooker, which builds a BPF program and a bytecode file called gluten from a recipe of system-call matches and actions; seitan-eater, which loads the BPF program into the kernel and runs the target process, loadable by container engines such as Podman via OCI annotations; and seitan, the supervisor that receives notifications via seccomp_unotify, interprets them per gluten and triggers configured actions. The project's documentation notes it still has rough edges, with no versions or packages yet, and it was presented at DevConf.CZ 2023.

seitan was at seitan-was-at-devconfcz-2023-check-out-the-slides-and-the-recording DevConf.CZ 2023 https://devconfcz2023.sched.com/event/1MYkc/seitan-a-plant-based-recipe-against-syscall-anxiety Check out the slides https://seitan.rocks/static/seitan devconf 2023.pdf and the recording https://seitan.rocks/static/seitan devconf 2023.webm seitan was at seitan is a framework to filter, transform and impersonate system calls, enabling privilege reduction in container and virtualisation engines It allows you to filter and replay only the system calls you need, instead of running things as root, or granting capabilities to processes. - seitan-cooker builds a BPF program and a bytecode file gluten from a recipe with matches on system calls and corresponding actions - seitan-eater loads the BPF program associated to the process context into the kernel, and runs the target process. Container engines such as Podman can directly load this program via OCI annotations instead - seitan is the supervisor, getting notifications via seccomp unotify , interpreting them according to gluten , and triggering the configured actions as a result Note that this project and its documentation still have some rough edges No versions, no packages yet. Do you want to know more? Watch the demos demo-handle-and-impersonate-connect-of-a-target-process-in-several-ways below, ask your questions on the users' list https://lists.seitan.rocks/postorius/lists/seitan-user.seitan.rocks/ , chat https://matrix.to/ / seitan:libera.chat with us. Do you want to contribute? Send patches to the development list https://lists.seitan.rocks/postorius/lists/seitan-dev.seitan.rocks/ ... and chat https://matrix.to/ / seitan:libera.chat with us Demo: handle and impersonate connect of a target process in several ways demo-handle-and-impersonate-connect-of-a-target-process-in-several-ways connect of a target process in several ways Demo: issue mknod on behalf of a Podman container demo-issue-mknod-on-behalf-of-a-podman-container mknod on behalf of a Podman container