A method and system for detecting container escape

Abstract

This application discloses a container escape detection method and system, relating to the field of container escape technology. The container escape detection method includes the following steps: obtaining several device numbers of the device where the root directory of the host machine is located; storing the device numbers in a table to generate a device table; calculating the unique device code of the device where the root directory of the host machine is located based on the device table; if the unique device code and information content match a preset value, querying the container where the process is located and handling the process based on preset handling rules. The technical solution of this application does not depend on the kernel version, does not require recompiling the kernel module, has broad system compatibility, and can be used on all mainstream Linux operating systems. It can identify attackers who are using the sys_mknod function to escape from containers and handle them. It requires fewer hook points, has little impact on system performance, and consumes fewer resources.

Description

Technical Field

[0001] This application belongs to the field of container escape technology, and more specifically, this application relates to a container escape detection method and system. Background Technology

[0002] Containers are a lightweight application and runtime environment packaging technology that allows applications to share CPU, memory, storage, and network resources across the operating system. Currently, Docker is the most widely used container technology. Although Docker itself has built-in Linux security mechanisms such as Seccomp, Capability, and Apparmor, security issues still exist due to Linux kernel vulnerabilities, Docker vulnerabilities, and improper configuration.

[0003] In container scenarios, a common misconfiguration is to add the SYS_ADMIN permission to the container. SYS_ADMIN represents a set of permissions. When a container is granted the SYS_ADMIN permission, it means that the processes in the container have permission to call the sys_mknod function. The sys_mknod function call is often used by attackers to escape from the container, that is, attackers can arbitrarily modify files on the host machine from within the container. Existing escape detection schemes cannot detect this kind of escape. Summary of the Invention

[0004] The purpose of this application is to provide a container escape detection method and system to solve the technical problem in the prior art that it is impossible to detect attackers using the sys_mknod function to escape containers.

[0005] To achieve the above technical objectives, the technical solution adopted in this application is as follows:

[0006] A method for detecting container escape includes the following steps:

[0007] Obtain several device numbers of the device where the root directory of the host machine is located, store the device numbers in a table to generate a device table, detect the process that calls the sys_mknod function and record the information content of the sys_mknod function being called;

[0008] Further detect whether the process is a process inside the container. If the process is a process inside the container, calculate the unique device code of the device where the host root directory is located based on the device table.

[0009] If the unique device code and the information content match a preset value, then the container where the process is located is queried and the process is processed based on preset processing rules.

[0010] Preferably, the process involves obtaining several device numbers of the device where the host machine's root directory is located, and storing these device numbers in a table to generate a device table. This specifically includes the following steps:

[0011] Obtain the major and minor device numbers of the device where the root directory of the host machine is located. The device where the root directory is located has a unique major device number and a unique minor device number.

[0012] The primary device number and the secondary device number are stored in a table in a preset manner to generate a device table.

[0013] Preferably, detecting the process that calls the sys_mknod function and recording the information about the sys_mknod function call specifically includes the following steps:

[0014] Hook the kernel probe point to the sys_mknod function to detect if any process calls the sys_mknod function;

[0015] If any process calls the sys_mknod function, the kernel probe receives and records the information when the sys_mknod function is called, and generates an event log.

[0016] Preferably, further detecting whether the process is a process within a container specifically includes the following steps:

[0017] Obtain the first mnt information of the first process, obtain the second mnt information of the process that called the sys_mknod function, and compare whether the first mnt information and the second mnt information are the same;

[0018] If the first mnt information and the second mnt information are the same, then the process that calls the sys_mknod function is the host process;

[0019] If the first mnt information and the second mnt information are the same, then the process that calls the sys_mknod function is a process within the container.

[0020] Preferably, further detecting whether the process is a process within a container specifically includes the following steps:

[0021] Based on the container management tool, obtain all running containers and the process PID list within the containers, and obtain the PID identifier of the process that called the sys_mknod function;

[0022] Determine whether the PID identifier of the process that calls the sys_mknod function is in the PID list. If the PID identifier is in the PID list, then the process that calls the sys_mknod function is a process within the container.

[0023] Preferably, calculating the unique device code of the device where the host machine's root directory is located based on the device table specifically includes the following steps:

[0024] The first device data is generated by shifting the binary number of the major device number left by 8 bits. The first device data and the minor device number are then XORed to generate the unique device code.

[0025] Preferably, querying the container where the process resides and handling the process based on preset handling rules specifically includes the following steps:

[0026] Run the docker command to query the container where the process resides by its PID identifier;

[0027] The preset handling rules include at least one or more of the following: deleting the process, deleting the container, and pausing the container.

[0028] A container escape detection system includes a main module, a detection module, and a disposal module.

[0029] The main module is used to obtain several device numbers of the device where the root directory of the host machine is located, and to store the device numbers in a table to generate a device table;

[0030] The detection module is used to detect the process that calls the sys_mknod function and record the information content of the sys_mknod function being called. It further detects whether the process is a process inside the container. If the process is a process inside the container, the information content is transmitted to the main module.

[0031] The main module is also used to calculate the unique device code of the device where the host root directory is located based on the device table. If the unique device code and the information content match a preset value, the information content is transmitted to the processing module.

[0032] The processing module is used to query the container where the process is located and process the process based on preset processing rules.

[0033] An electronic device includes a memory and a processor, the memory being used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement a container escape detection method as described above.

[0034] A computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the method described above.

[0035] The beneficial effects provided by this application are as follows:

[0036] 1. This application obtains several device numbers of the device located in the root directory of the host machine, stores the device numbers in a table to generate a device table, calculates the unique device code of the device located in the root directory of the host machine based on the device table, and if the unique device code and information content match the preset value, it queries the container where the process is located and handles the process according to the preset handling rules. The technical solution of this application does not depend on the kernel version, does not require recompiling the kernel module, has wide system compatibility, can be used on all mainstream Linux operating systems, and can identify attackers who are using the sys_mknod function to escape containers and handle them.

[0037] 2. This application hooks the kernel probe point to the sys_mknod function to detect whether any process calls the sys_mknod function. If any process calls the sys_mknod function, the kernel probe point receives and records the information content when the sys_mknod function is called and generates an event log. The technical solution of this application requires fewer hook points, has less impact on system performance, and consumes fewer resources. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a flowchart of a container escape detection method. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0041] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0042] Example 1:

[0043] like Figure 1As shown, this embodiment includes a container escape detection method, comprising the following steps: obtaining several device numbers of the device where the host machine's root directory is located; storing the device numbers in a table to generate a device table; detecting processes that call the sys_mknod function and recording the information content of the sys_mknod function call; further detecting whether the process is a process within a container; if the process is a process within a container, calculating the unique device code of the device where the host machine's root directory is located based on the device table; if the unique device code and the information content match a preset value, querying the container where the process is located and handling the process according to preset handling rules.

[0044] The process involves retrieving several device numbers from the device containing the host machine's root directory and storing these device numbers in a table to generate a device table. Specifically, this includes the following steps: obtaining the major and minor device numbers of the device containing the host machine's root directory. Each device has a unique major device number and a unique minor device number. The major and minor device numbers are then stored in a table using a preset method to generate the device table.

[0045] The command `cat / proc / self / mountinfo` is executed to obtain the major and minor device numbers of the device where the host machine's root directory is located. In this embodiment, the major device number is defined as `maj`, and the minor device number is defined as `min`. The major and minor device numbers are stored in a table using a preset method, denoted as `maj:min`. The device number of the host machine's root directory is 253:0, which means the major device number is 253 and the minor device number is 0.

[0046] The process of detecting and recording the calls to the `sys_mknod` function involves the following steps: hooking a kernel probe point to the `sys_mknod` function to detect if any process is calling it. If any process calls `sys_mknod`, the kernel probe point receives and records the information about the `sys_mknod` function call, generating an event log.

[0047] In this embodiment, the kernel probe point is the perf_event probe point. The perf_event probe point is a probe point that is pre-embedded in the kernel. The perf_event probe point is hooked to the sys_mknod function. When the sys_mknod function is called in the kernel, the execution flow of the perf_event probe point is triggered. The perf_event probe point receives and records the information content when the sys_mknod function is called to generate an event log.

[0048] Further detection of whether a process is within a container includes the following steps: Obtain the first MNT information of the first process, obtain the second MNT information of the process calling the `sys_mknod` function, and compare the first and second MNT information. If the first and second MNT information are the same, then the process calling the `sys_mknod` function is a host process.

[0049] Execute the command `Ls -al / proc / 1 / ns|grep mnt` to obtain the mnt_namespace of the first process. The first process must be a process on the host machine, so the first mnt information of the first process is defined as the mnt information on the host machine.

[0050] Execute the command Ls-al / proc / <pid>The command ` / ns|grep mnt` retrieves the second mnt information of the process that called the `sys_mknod` function. If the second mnt information of any process is the same as the first mnt information of the first process, then the process is a host process; otherwise, the process is a process inside a container.

[0051] Further detection of whether a process is within a container involves the following steps: Using container management tools, obtain a list of all running containers and their respective process IDs (PIDs). Obtain the PID identifier of the process calling the `sys_mknod` function. Determine if the PID identifier of the process calling `sys_mknod` is within the PID list. If it is, then the process calling `sys_mknod` is a process within a container.

[0052] As another implementation, processes within containers are created by container management tools. Executing the command `docker ps -q|xargs -l docker top` retrieves all running containers and a list of process IDs (PIDs) within those containers. It then retrieves the PID identifier of the process that called the `sys_mknod` function. If the PID identifier is in the PID list, the process calling `sys_mknod` is a process within the container. The PID identifier serves as the unique identifier for that process, i.e., its process ID.

[0053] The process of calculating the unique device code of the device located in the root directory of the host machine based on the device table includes the following steps: shifting the major device number left by 8 bits to generate the first device data, and XORing the first device data and the minor device number to generate the unique device code.

[0054] The calculation formula is HostDev = maj << 8 | min, where HostDev represents the unique device code, maj represents the major device number, and min represents the minor device number.

[0055] The information in the event log includes at least the pid identifier, mode identifier, and dev identifier. The pid identifier represents the process ID, the mode identifier represents the index file type, and the dev identifier represents the device number of the device being operated on by the sys_mknod function.

[0056] The system checks if the unique device code and information content match the preset values. If the mode identifier equals 61b6 and the dev identifier equals the unique device code HostDev, it indicates that a process is attempting to mount the device located in the host machine's root directory. This is further restricted to processes within the container. Therefore, it can be determined that a process within the container is attempting to escape by mounting the device located in the host machine's root directory using the sys_mknod function. In other words, an attacker is attempting to escape. The ID of this process is the pid identifier in the event log information.

[0057] The process queries the container where the process resides and handles the process based on preset rules. Specifically, it includes the following steps: running the `docker` command to query the container where the process resides using the PID identifier. The preset handling rules include at least one or more of the following: deleting the process, deleting the container, and pausing the container.

[0058] In this embodiment, the commands `docker ps -q|xargs -l docker top|grep` are executed. <pid>This retrieves the container to which the process represented by the PID identifier belongs.

[0059] Example 2:

[0060] This embodiment includes a container escape detection system, comprising a main module, a detection module, and a disposal module:

[0061] The main module is used to obtain several device numbers of the device located in the root directory of the host machine, and to generate a device table by storing the device numbers in a table.

[0062] The detection module is used to detect processes that call the sys_mknod function and record the information about the sys_mknod function call. It further detects whether the process is a process inside the container. If the process is a process inside the container, the information is transmitted to the main module.

[0063] The main module is also used to calculate the unique device code of the device located in the root directory of the host machine based on the device table. If the unique device code and the information content match the preset values, the information content is transmitted to the processing module.

[0064] The processing module is used to query the container where the process resides and process the process based on preset processing rules.

[0065] The container escape detection system in Embodiment 2 of this specification can be used as described above. Figure 1 The container escape detection method shown is the execution entity, therefore this container escape detection system can realize the method in... Figure 1 The functions implemented are described in detail in Example 1.

[0066] Example 3:

[0067] An electronic device includes a memory and a processor, the memory being used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the container escape detection method described above.

[0068] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the electronic device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0069] A computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the method in Embodiment 1.

[0070] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] This invention is described with reference to flowchart illustrations and / or block diagrams of the method, terminal device (system), and computer program product according to the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0072] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0073] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0074] It should be noted that:

[0075] The phrase "an embodiment" or "an embodiment" used in the specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of this application. Therefore, the phrase "an embodiment" or "an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

[0076] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0077] Furthermore, it should be noted that the shapes and names of the parts and components described in the specific embodiments described in this specification may differ. All equivalent or simple variations made to the structure, features, and principles described in this application are included within the scope of protection of this application. Those skilled in the art to which this application pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, as long as they do not deviate from the structure of this application or exceed the scope defined by the claims, all of which should fall within the scope of protection of this application.< / pid> < / pid>

Claims

1. A method for detecting container escape, characterized in that, Includes the following steps: The process involves obtaining several device numbers from the device where the host machine's root directory is located, storing these device numbers in a table to generate a device table, detecting processes that call the `sys_mknod` function, and recording the information about the `sys_mknod` function call. Specifically, obtaining several device numbers from the device where the host machine's root directory is located and storing these device numbers in a table to generate a device table includes the following steps: obtaining the major device number and minor device number of the device where the root directory is located, where each device has a unique major device number and a unique minor device number; storing the major device number and the minor device number in a table using a preset method to generate a device table. Further detect whether the process is a process inside the container. If the process is a process inside the container, calculate the unique device code of the device where the host root directory is located based on the device table. If the unique device code and the information content match a preset value, then query the container where the process is located and process the process according to the preset processing rules; Further detection of whether the process is a process within a container includes the following steps: Obtain the first mnt information of the first process, obtain the second mnt information of the process that called the sys_mknod function, and compare whether the first mnt information and the second mnt information are the same; If the second mnt information of any process is the same as the first mnt information of the first process, then the process is the host process; otherwise, the process is the process inside the container. Further detection of whether the process is a process within a container includes the following steps: Based on the container management tool, obtain all running containers and the process PID list within the containers, and obtain the PID identifier of the process that called the sys_mknod function; Determine whether the PID identifier of the process that calls the sys_mknod function is in the PID list. If the PID identifier is in the PID list, then the process that calls the sys_mknod function is a process within the container. The unique device code of the device where the host machine's root directory is located is calculated based on the device table, specifically including the following steps: The first device data is generated by shifting the binary number of the major device number left by 8 bits. The first device data and the minor device number are then XORed to generate the unique device code.

2. The container escape detection method as described in claim 1, characterized in that, The process of detecting and recording the calls to the sys_mknod function includes the following steps: Hook the kernel probe point to the sys_mknod function to detect if any process calls the sys_mknod function; If any process calls the sys_mknod function, the kernel probe receives and records the information when the sys_mknod function is called, and generates an event log.

3. The container escape detection method as described in claim 1, characterized in that, The process is queried and disposed of according to preset disposal rules, specifically including the following steps: Run the docker command to query the container where the process resides by its PID identifier; The preset handling rules include at least one or more of the following: deleting the process, deleting the container, and pausing the container.

4. A container escape detection system, characterized in that, It includes a main module, a detection module, and a handling module: The main module is used to obtain several device numbers of the device where the host machine's root directory is located, and to store these device numbers in a table to generate a device table. Specifically, obtaining several device numbers of the device where the host machine's root directory is located and storing these device numbers in a table to generate a device table includes the following steps: obtaining the primary device number and the secondary device number of the device where the host machine's root directory is located, wherein the root directory device has a unique primary device number and the root directory device has a unique secondary device number; storing the primary device number and the secondary device number in a table using a preset method to generate a device table; The detection module is used to detect the process that calls the sys_mknod function and record the information content of the sys_mknod function being called. It further detects whether the process is a process inside the container. If the process is a process inside the container, the information content is transmitted to the main module. The main module is also used to calculate the unique device code of the device where the host root directory is located based on the device table. If the unique device code and the information content match a preset value, the information content is transmitted to the processing module. The processing module is used to query the container where the process is located and process the process based on preset processing rules; Further detection of whether the process is a process within a container includes the following steps: Obtain the first mnt information of the first process, obtain the second mnt information of the process that called the sys_mknod function, and compare whether the first mnt information and the second mnt information are the same; If the second mnt information of any process is the same as the first mnt information of the first process, then the process is the host process; otherwise, the process is the process inside the container. Further detection of whether the process is a process within a container includes the following steps: Based on the container management tool, obtain all running containers and the process PID list within the containers, and obtain the PID identifier of the process that called the sys_mknod function; Determine whether the PID identifier of the process that calls the sys_mknod function is in the PID list. If the PID identifier is in the PID list, then the process that calls the sys_mknod function is a process within the container. The unique device code of the device where the host machine's root directory is located is calculated based on the device table, specifically including the following steps: The first device data is generated by shifting the binary number of the major device number left by 8 bits. The first device data and the minor device number are then XORed to generate the unique device code.

5. An electronic device, characterized in that, The device includes a memory and a processor, the memory being used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement a container escape detection method as described in any one of claims 1 to 3.

6. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 3.

Images