A method and system for detecting and blocking container escape in Linux operating system

Abstract

This invention discloses a method and system for detecting and blocking container escape in a Linux operating system. The method includes: inserting a probe into a kernel function via the perf_event function of a user-space module, the kernel function including the fork function and the sys_execve function; obtaining the execution behavior of the kernel function through the probe and obtaining the process ID of the current process; constructing a first namespace set for the current process and establishing a mapping relationship between the process ID and the first namespace; based on the execution status of the current process, obtaining a shell process that creates a bounce due to a namespace change through the probe, obtaining the shell process through the kernel function and obtaining a second namespace set and its corresponding parent process, as well as a namespace set with PID 1; sending the corresponding parent process namespace set, the second namespace set, and the namespace set with PID 1 to an observation module for comparison and judgment, determining whether container escape exists based on the comparison result, and killing the container escape program.

Description

Technical Field

[0001] This invention relates to technologies related to the Linux operating system, and in particular to a method and system for detecting and blocking container escape in the Linux operating system. Background Technology

[0002] Current solutions for container escape detection are primarily based on kernel-level detection. This leads to issues of low compatibility, high invasiveness, and low portability. When the target machine uses a different kernel version, certain kernel features become unusable. Furthermore, when the program needs to be deployed on other machines, it must be compiled for that kernel version, further reducing portability. Additionally, current detection solutions are mostly host-oriented, resulting in very low detection rates for container attacks. This means that most current defense systems offer virtually no protection against container attacks, which are highly dangerous. Once an attacker successfully escapes a container, they can directly harm the host machine and potentially compromise cluster security. Summary of the Invention

[0003] One of the objectives of this invention is to provide a method and system for detecting and blocking container escape in a Linux operating system. The method and system use the perf_event framework in the monitor module to install probes on specified functions and sense the running status of the specified functions. By setting a container escape detection method, it determines whether the sensed specified functions meet the container escape criteria. If they do, the program is killed.

[0004] Another objective of this invention is to provide a method and system for detecting and blocking container escape in the Linux operating system. The method and system employ a combination of user-space probes and user-space observation, which eliminates the need for interception at the Linux operating system kernel level. This eliminates the need to obtain kernel version and core data, reduces intrusion into the Linux operating system, and improves security performance.

[0005] Another objective of this invention is to provide a method and system for detecting and blocking container escape in the Linux operating system. The method and system utilize user-space probes and user-space observations for container escape detection and blocking, eliminating the need to develop container escape and blocking programs for different kernel versions during kernel version changes in the Linux operating system, thus reducing portability costs. Furthermore, in user-observation mode, locating detection problems is easier than in kernel mode, without requiring compilation of specific kernels.

[0006] To achieve at least one of the above-mentioned objectives, the present invention further provides a method for detecting and blocking container escape in a Linux operating system, the method comprising:

[0007] Probes are inserted into core functions, including the fork and sys_execve functions, through the perf_event function of the user-space module.

[0008] The probe is used to obtain the execution behavior of the core function and the process ID of the current process.

[0009] Construct the first namespace set of the current process and establish a mapping relationship between the process ID and the first namespace;

[0010] Based on the current execution status of the process, the SHELL process that creates a bounce due to the namespace change is obtained through the detection. The SHELL process is obtained through the core function, along with the second namespace set and the corresponding parent process, as well as the namespace set with pid 1.

[0011] According to a preferred embodiment of the present invention, if the current process is running, and the current process calls the fork function, the probe is executed, and the probe records the process ID of the current process and the namespace set of the current process.

[0012] According to another preferred embodiment of the present invention, after obtaining the process ID of the current process, a mapping relationship between the process ID and the first namespace is further constructed using a key-value pair method, and a mapping table is generated.

[0013] According to another preferred embodiment of the present invention, if the namespace in the current process changes when the current process executes the vulnerable program, the SHELL process is detected and obtained when it is hooked by the core function sys_execve, and the second namespace set of the SHELL process is further obtained.

[0014] According to another preferred embodiment of the present invention, when obtaining the second namespace set, the parent process of the SHELL process is also obtained, and the process ID of the parent process of the SHELL process is further obtained. The obtained process ID of the parent process of the SHELL process is queried in the mapping table to obtain the corresponding third namespace set of the parent process of the SHELL process. The second namespace set of the SHELL process, the third namespace set of the parent process of the SHELL process, and the namespace set with pid 1 are sent to the observation module. The observation module determines whether the current process has escaped from the container.

[0015] According to another preferred embodiment of the present invention, when the observation module obtains the second namespace set of the SHELL process, the third namespace set of the SHELL process's parent process, and the namespace set with pid 1, if the third namespace set of the SHELL process's parent process is different from the second namespace set of the SHELL process, and the second namespace set of the SHELL process is the namespace set with pid 1, then it determines that the current process has container escape and blocks the current process from running.

[0016] To achieve at least one of the above-mentioned objectives, the present invention further provides a container escape detection and blocking system for a Linux operating system, wherein the system executes the above-mentioned container escape detection and blocking method for a Linux operating system.

[0017] The present invention further provides a computer-readable storage medium storing a computer program, the computer program being executable by a processor to perform the above-described container escape detection and blocking method for a Linux operating system. Attached Figure Description

[0018] Figure 1 The diagram shows a flowchart of a container escape detection and blocking method for a Linux operating system according to the present invention. Detailed Implementation

[0019] The following description is intended to disclose the present invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art. The basic principles of the invention defined in the following description can be applied to other embodiments, modifications, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the invention.

[0020] It is understood that the term "a" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element can be one, while in another embodiment, the number of the element can be multiple, and the term "a" should not be understood as a limitation on the number.

[0021] Please combine Figure 1This invention discloses a method and system for detecting and blocking container escape in the Linux operating system. The following explanation is provided regarding the method and system: Linux perf_event debugging technology is a lightweight probe technique designed by kernel developers to facilitate tracking the execution state of system functions. The fork and execve functions are core functions in the Linux kernel state; all program execution within the system requires these two functions. In certain container escape attack methods, running a program is necessary to complete the container escape. Linux namespaces encapsulate and isolate global system resources, allowing processes in different namespaces to have independent global system resources. Changing system resources in one namespace only affects processes in that namespace and has no impact on processes in other namespaces. In Docker, namespaces are used for resource isolation. User-space modules, which are non-kernel modules and do not participate in kernel compilation, can obtain kernel-related data through perf_event debugging technology. User-space modules can install probes in a specified function list using perf_event debugging technology, thereby obtaining the behavior of the corresponding functions. The monitor module can obtain behavioral data of relevant functions, and further determine whether the current process has container escape behavior based on its own set processing logic, and perform process blocking operations.

[0022] Specifically, the present invention preferably uses the perf_event debugging technique to attach probes to the core functions fork and execve. These probes can obtain behavioral data of the two core functions during program execution. If the current process P runs, the current program will call the fork function, at which point the probe is executed. The probe will record the process ID (pid) of the current process P, further obtain the first namespace set S1 of the current process, establish a key-value mapping relationship between the current process ID and the first namespace set S1, and generate a mapping table for subsequent table lookup operations. Here, key-value pairs are key-value pairs, where key is the key name and value is the key value. By using the current process ID as the key name, the key value of the first namespace set S1 under the corresponding key name can be found.

[0023] If the current process P executes the exploit, its first namespace set S1 will change. The current process P then creates a reverse shell process P2. When P2 is created, it can be detected by the kernel function `sys_execve` during hooking. Furthermore, a probe mounted using the `perf_event` debugging technique obtains the second namespace set S2 of the shell process P2 and its parent process L2. The process name (pid2) of the parent process L2 is then obtained. A lookup in the mapping table using the parent process L2's process name yields the third namespace set S3 of the parent process L2, and the namespace set with pid 1 is also obtained. The second namespace set of the shell process, the third namespace set of the parent process, and the namespace set with pid 1 are then sent to the observation module. The observation module then uses its own set of judgment conditions to determine whether the current process has experienced container escape.

[0024] When the observation module acquires the second namespace set S2 of the SHELL process, the third namespace set S3 of the SHELL process's parent process, and the namespace set with PID 1, if it determines that the third namespace set S3 of the SHELL process's parent process is different from the second namespace set S2 of the SHELL process, and the second namespace set S2 of the SHELL process (as a child process) is the same as the namespace set with PID 1, it can be determined that a container escape phenomenon exists, and further calls the relevant functions to perform a process blocking operation. The process blocking method can be any of the existing technologies, and this invention does not limit it.

[0025] It should be noted that this invention utilizes user-space probes and observation modules to perform inspections in a non-kernel-intercepting manner. This eliminates the need to obtain the kernel version number for corresponding program development and avoids compiling specific kernels, thereby reducing kernel intrusions and improving system security. It also facilitates program portability in user space and the localization of problems detected in user space, reducing the cost of manual inspection.

[0026] In particular, according to embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), it performs the functions defined in the methods of this application. It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wire segments, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless segments, wire segments, optical fibers, RF, etc., or any suitable combination thereof.

[0027] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0028] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are merely examples and do not limit the present invention. The purpose of the present invention has been fully and effectively achieved. The functions and structural principles of the present invention have been shown and explained in the embodiments. Without departing from the stated principles, the implementation of the present invention may have any variations or modifications.

Claims

1. A method for detecting and blocking container escape in a Linux operating system, characterized in that, The method includes: Probes are inserted into core functions, including the fork and sys_execve functions, through the perf_event function of the user-space module; The probe is used to obtain the execution behavior of the core function and the process ID of the current process. Construct the first namespace set of the current process and establish a mapping relationship between the process ID and the first namespace set; Based on the current process execution status, the SHELL process that creates a bounce due to namespace changes is detected. The core function is used to obtain the SHELL process, the second namespace set and the corresponding parent process, as well as the namespace set with pid 1. The corresponding SHELL process parent process namespace set, second namespace set and namespace set with pid 1 are sent to the observation module for comparison and judgment. Based on the comparison results, it is determined whether the current process has container escape, and the container escape process is blocked. Specifically, if the namespace of the current process changes while executing the vulnerable program, the SHELL process is detected and obtained when hooked by the core function sys_execve, and the second namespace set of the SHELL process is further obtained. Simultaneously, the parent process of the SHELL process is obtained, and its process ID is further obtained. Based on the obtained process ID of the parent process, a mapping table is consulted to obtain the corresponding third namespace set of the parent process. The second namespace set of the SHELL process, the third namespace set of the parent process, and the namespace set with PID 1 are then sent to the observation module, which determines whether the current process has experienced container escape.

2. The method for detecting and blocking container escape in a Linux operating system according to claim 1, characterized in that, If the current process is running, and the current process calls the fork function, then the probe is executed, and the probe records the process ID of the current process and the namespace set of the current process.

3. The method for detecting and blocking container escape in a Linux operating system according to claim 1, characterized in that, After obtaining the process ID of the current process, a mapping relationship between the process ID and the first namespace set is further constructed using key-value pairs, and a mapping table is generated.

4. The method for detecting and blocking container escape in a Linux operating system according to claim 1, characterized in that, When the observation module obtains the second namespace set of the SHELL process, the third namespace set of the SHELL process's parent process, and the namespace set with pid 1, if the third namespace set of the SHELL process's parent process is different from the second namespace set of the SHELL process, and the second namespace set of the SHELL process is the namespace set with pid 1, then it determines that the current process has container escape and blocks the current process from running.

5. A container escape detection and blocking system for a Linux operating system, characterized in that, The system executes a container escape detection and blocking method for a Linux operating system as described in any one of claims 1-4.

6. A computer-readable storage medium, characterized in that, A computer-readable storage medium stores a computer program that can be executed by a processor as described in any one of claims 1-4, a method for detecting and blocking container escape in a Linux operating system.

Images