From 4a61f763e8686387a6a966f7e7b7cdc211c0bf61 Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Sun, 23 Aug 2026 23:00:02 +0200
Subject: [PATCH] cyberchef: seccompProfile RuntimeDefault in the pod context

Sets seccompProfile.type: RuntimeDefault in the pod security context, so
the container runtime's default syscall filter applies to every container
in the pod. Verified in k3d: /proc/1/status reports Seccomp: 2 (filter
mode) with one filter loaded, and nginx keeps serving the app.

The value lives in the pod context rather than the container context
because it covers init containers and any container added later without
being repeated; a container that needs a different filter can still
override it under securityContext.container, which wins over the pod
value.

Major bump: runtime behavior changes, even though it stays invisible for
this workload.

Refs #84
---
 cyberchef/Chart.yaml             | 2 +-
 cyberchef/templates/_helpers.tpl | 3 ++-
 cyberchef/values.yaml            | 9 +++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml
index 7d10e46..1900968 100644
--- a/cyberchef/Chart.yaml
+++ b/cyberchef/Chart.yaml
@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima
 
 type: application
 
-version: 8.0.0+up11.4.0
+version: 9.0.0+up11.4.0
 appVersion: "11.4.0"
 
 maintainers:
diff --git a/cyberchef/templates/_helpers.tpl b/cyberchef/templates/_helpers.tpl
index 8027859..6144be8 100644
--- a/cyberchef/templates/_helpers.tpl
+++ b/cyberchef/templates/_helpers.tpl
@@ -214,7 +214,8 @@ default probe needs no further context.
 {{- $defaults := dict
       "runAsNonRoot" true
       "runAsUser" 101
-      "runAsGroup" 101 -}}
+      "runAsGroup" 101
+      "seccompProfile" (dict "type" "RuntimeDefault") -}}
 {{- include "cyberchef.defaultedDict" (dict "defaults" $defaults "given" $given "path" "cyberchef.securityContext.pod") -}}
 {{- end -}}
 
diff --git a/cyberchef/values.yaml b/cyberchef/values.yaml
index deebe83..a8d8496 100644
--- a/cyberchef/values.yaml
+++ b/cyberchef/values.yaml
@@ -16,6 +16,15 @@ cyberchef:
       runAsNonRoot: true
       runAsUser: 101
       runAsGroup: 101
+      # RuntimeDefault applies the container runtime's default seccomp filter,
+      # which blocks the syscalls a normal workload never makes. It sits in the
+      # pod context on purpose: from here it covers every container in the pod
+      # including init containers, while a container-level seccompProfile would
+      # have to be repeated for each one (and silently missed on the next one
+      # added). A container that genuinely needs a different filter can still
+      # override it under securityContext.container, which wins over this value.
+      seccompProfile:
+        type: RuntimeDefault
     container:
       allowPrivilegeEscalation: false
       readOnlyRootFilesystem: true