Automated AppArmor Policy Generation from Software Bill of Behavior: A Behavioral Coverage Evaluation Against State-of-the-Art Runtime Profiling : A Kubernetes-based study using Kubescape

Sammanfattning

A recently proposed concept, Software Bill of Behavior (BoB), enables software vendors to generate and distribute behavioral baselines captured during testing. Whether these baselines can serve as a reliable foundation for automated AppArmor policy generation comparable to the current state-of-the-art tool, Bifrost, remains unexplored. This thesis investigates whether runtime behavioral information captured through Kubescape ApplicationProfile and NetworkNeighborhood, the data format underlying BoB profiles, can serve as a foundation for generating AppArmor policies with file system coverage comparable to those produced by Bifrost, a commercial runtime profiling pipeline representing the current state of the art. As part of this thesis, a custom converter (K2A) was implemented that transforms the generated Kubescape ApplicationProfile and NetworkNeighborhood into a valid AppArmor confinement profile. The resulting profile was compared to the Bifrost-generated profile across two representative Kubernetes workloads: an nginx web server and a PostgreSQL database. For directories with observed file access - the metric most accurately reflecting runtime behavior- Jaccard similarity reached 0.760 for nginx and 0.705 for PostgreSQL, with coverage ratios of 82.6% and 97.7%, respectively. The observed differences were traceable to four systematic factors: Kubescape’s reliance on openat() instrumentation, path normalization strategies, symbolic link resolution, and different treatment of failed lookups. Neither pipeline produced profiles deployable in enforce mode without any manual intervention. Bifrost required an Object Identifier-based generalization, without which portability between deployments was broken. The BoB pipeline required targeted instrumentation fixes that are addressable through implementation improvements. The BoB pipeline produced more fine-grained network rules than Bifrost, generating protocol and port-specific rules compared to Bifrost, which allowed access to all networking. These findings suggest that Kubescape-derived profiles have the potential to serve as a credible foundation for automatic AppArmor policy generation and that the remaining gaps reflect implementation-level limitations rather than fundamental constraints of the approach.