Container security method and apparatus

Abstract

The embodiment of the present application provides a kind of container security protection method and device, it is related to security protection technical field, wherein method includes: when detecting that target process operates target file, the process identifier PID namespace and mounting namespace of the target process are acquired;The kernel module determines that the target process is the process in container when being based on the PID namespace and the mounting namespace, the name of the container and the file path of the target file are acquired, and the name of the container and the file path are sent to the disinfection module;The disinfection module reads the target file based on the name of the container and the file path, and determines whether the target file is safe.The disinfection module of the present application reads the target file in container based on the name of the container and file path, and then the security detection of the target file in container can be realized.

Description

Technical Field

[0001] This invention relates to the field of safety protection technology, and in particular to a container safety protection method and device. Background Technology

[0002] With the continuous development of information technology, human society is becoming increasingly information-driven, and the entire society is becoming more and more dependent on network information, thus making network security increasingly important. Therefore, it is necessary to perform security checks on every file.

[0003] In existing technologies, when a process is detected to be operating on a file, information such as the process identifier, process name, and absolute file path is obtained. This information is then transmitted to the antivirus program via a shared queue. The antivirus program reads the file at the absolute file path based on the process identifier, process name, and absolute file path, and performs security checks on the read file.

[0004] However, in the aforementioned existing technologies, the obtained absolute file path is relative to the root directory of the global namespace. When file operations within the container are hijacked by hook functions in the kernel, the absolute file path is relative to the root directory of the container's own isolated mount namespace, not relative to the root directory of the global namespace. Therefore, when querying files within the container based on the currently obtained absolute file path, the query will fail, and the files within the container cannot be obtained, thus making it impossible to achieve secure detection of files within the container. Summary of the Invention

[0005] To address the problems in the prior art, embodiments of the present invention provide a container safety protection method and apparatus.

[0006] Specifically, the embodiments of the present invention provide the following technical solutions:

[0007] In a first aspect, embodiments of the present invention provide a container security protection method applied to an electronic device, the electronic device including a kernel module and an antivirus module, the method comprising:

[0008] When the kernel module detects that the target process is operating on the target file, it obtains the process identifier (PID) namespace and mount namespace of the target process.

[0009] When the kernel module determines that the target process is a process inside a container based on the PID namespace and the mount namespace, it obtains the name of the container and the file path of the target file, and sends the name of the container and the file path to the antivirus module.

[0010] The antivirus module reads the target file based on the container name and the file path, and determines whether the target file is safe.

[0011] Furthermore, before the kernel module determines that the target process is a process within a container based on the PID namespace and the mount namespace, and obtains the name of the container and the file path of the target file, the method further includes:

[0012] The kernel module determines whether the target process is a process within a container based on the PID namespace and the mounted namespace.

[0013] Furthermore, the kernel module determines whether the target process is a process within a container based on the PID namespace and the mounted namespace, including:

[0014] The kernel module determines whether the PID namespace of the target process is the same as the global PID namespace, and determines whether the mount namespace of the target process is the same as the global mount namespace.

[0015] When the kernel module determines that the target process is a process within the container, and that the target process's PID namespace is different from the global PID namespace, and the target process's mount namespace is different from the global mount namespace, the kernel module determines that the target process is a process within the container.

[0016] When the kernel module determines that the target process is not a process within the container, it determines that the target process is not a process within the container if the target process's PID namespace is the same as the global PID namespace, and / or the target process's mount namespace is the same as the global mount namespace.

[0017] Furthermore, the antivirus module reads the target file based on the container name and the file path, including:

[0018] The antivirus module calls the container file reading function in the kernel module and inputs the name of the container and the file path into the container file reading function.

[0019] The antivirus module reads the target file through the container file reading function.

[0020] Furthermore, the antivirus module reads the target file through the container file reading function, including:

[0021] The antivirus module uses the container file reading function to determine the processes in the process list that match the name of the container, and identifies the processes that match the name of the container as reference processes; the process list stores the name of the container to which each process belongs;

[0022] The antivirus module obtains the root directory of the reference process through the container file reading function; the root directory of the reference process is a directory relative to the mount namespace of the reference process; the root directory of the reference process is the same as the root directory of the target process.

[0023] The antivirus module reads the target file based on the root directory of the reference process and the file path using the container file reading function.

[0024] Furthermore, the antivirus module reads the target file based on the root directory of the reference process and the file path using the container file reading function, including:

[0025] The antivirus module calls the application programming interface (API) function through the container file reading function, inputting the root directory of the reference process and the file path into the API function, and then opens and reads the target file through the API function.

[0026] Secondly, embodiments of the present invention also provide a container safety protection device, comprising:

[0027] The first acquisition module is used to acquire the process identifier (PID) namespace and mount namespace of the target process when it is detected that the target process is operating on the target file.

[0028] The second acquisition module is used to acquire the name of the container and the file path of the target file through the kernel module when the kernel module determines that the target process is a process inside the container based on the PID namespace and the mount namespace, and send the name of the container and the file path to the detection module.

[0029] The detection module is used to read the target file based on the name of the container and the file path, and determine whether the target file is safe.

[0030] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the container security protection method as described in the first aspect.

[0031] Fourthly, embodiments of the present invention also provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the container security protection method as described in the first aspect.

[0032] Fifthly, embodiments of the present invention also provide a computer program product having executable instructions stored thereon, which, when executed by a processor, cause the processor to implement the steps of the container security protection method described in the first aspect.

[0033] The container security protection method and apparatus provided in this invention, when detecting that a target process is operating on a target file, the kernel module determines whether the target process is a process inside a container based on the target process's PID namespace and mount namespace. If the target process is determined to be a process inside a container, it means that the target file being run by the target process is a file inside the container. At this time, the obtained container name and target file path are sent to the antivirus module, which reads the target file inside the container based on the container name and file path, thereby enabling security detection of the target file inside the container. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is one of the flowcharts illustrating the container safety protection method provided in this embodiment of the invention;

[0036] Figure 2 This is a second schematic flowchart of the container safety protection method provided in this embodiment of the invention;

[0037] Figure 3 This is a schematic diagram of the container safety protection device provided in an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] Figure 1This is one of the flowcharts illustrating a container security protection method provided in this embodiment of the invention, applied to an electronic device. The electronic device includes a kernel module and an antivirus module. The kernel module is located in the kernel layer of the electronic device's operating system, and the antivirus module is located in the application layer of the electronic device's operating system. The operating system of the electronic device can be a Linux operating system, such as... Figure 1 As shown, the container safety protection method includes the following steps:

[0041] Step 101: When the kernel module detects that the target process is operating on the target file, it obtains the process identifier (PID) namespace and mount namespace of the target process.

[0042] The PID namespace is used to isolate the PID space of a process, so that the PIDs of processes in different PID namespaces can be repeated without affecting each other; the mount namespace is used to isolate mount information. In different mount namespaces, the system has its own independent Virtual File System (VFS) directory tree and mount point information.

[0043] For example, a pre-stored process list contains the descriptor of each process. The process descriptor is a defined structure through which all relevant information about the process can be maintained and managed. When the kernel module detects that a target process is opening, closing, or reading / writing a target file, it retrieves the target process's descriptor from the process list. From the descriptor, it obtains the target process's PID namespace and mount namespace. In the Linux operating system, the PID namespace can be represented as `PID namespace`, and the mount namespace as `Mnt namespace`.

[0044] Step 102: When the kernel module determines that the target process is a process inside a container based on the PID namespace and the mount namespace, it obtains the name of the container and the file path of the target file, and sends the name of the container and the file path to the antivirus module.

[0045] For example, when the kernel module obtains the PID namespace and mount namespace of the target process, it can determine whether the target process is a process inside a container or not based on these names. If it determines that the target process is an inside a container, it means that the target file operated on by the target process is a file inside the container. At this point, the kernel module intercepts the kernel's native system call functions for opening, reading, and writing target files. It can obtain the file path of the target file from the parameters of the system call functions and obtain the Uts_namespace.hostname of the target process from the target process's descriptor. Uts_namespace.hostname is the name of the container to which the target process belongs. Finally, it sends the name of the container to which the target process belongs and the file path of the target file to the antivirus module.

[0046] The Uts_namespace is used to isolate the hostname and the NIS domainname. Each process running in the Uts namespace has its own independent hostname and Network Information Service (NIS) and they do not affect each other; the hostname is the name of the container.

[0047] It should be noted that when the kernel module determines that the target process is a process inside the container based on the PID namespace and the mounted namespace, it can also obtain the identifier and name of the target process and send them to the antivirus module. This allows the antivirus module to determine the type of process currently operating on the target file based on the identifier and name of the target process.

[0048] Step 103: The antivirus module reads the target file based on the name of the container and the file path, and determines whether the target file is safe.

[0049] The antivirus module is equipped with antivirus software, which is a type of software used to eliminate computer threats such as computer viruses, Trojan horses, and malicious software.

[0050] For example, when the kernel module obtains the name of the container to which the target process belongs and the file path of the target file, it transmits this information, including the container name and the file path, to the application-layer antivirus module via a shared queue. Upon receiving this information, the antivirus module parses the container name and executes container antivirus path reading of the target file. Specifically, it reads the target file based on the parsed container name and file path, performs a virus scan, and determines whether the target file is safe based on the scan results. If the virus scan result is negative, the target file is safe; if the virus scan result is positive, the target file is unsafe. In this case, the presence of viruses can be displayed to facilitate user detection and removal of viruses within the target file.

[0051] It should be noted that when the antivirus module receives the identifier of the target process, the name of the target process, and the file path of the target file but does not receive the name of the container, it means that the target file is not a file inside the container. At this time, the normal antivirus path is executed to read the target file. The specific reading process can be referred to the existing technology, and will not be described in detail here.

[0052] The container security protection method provided in this embodiment of the invention, when detecting that a target process is operating on a target file, the kernel module determines whether the target process is a process inside a container based on the target process's PID namespace and mount namespace. When it is determined that the target process is a process inside a container, it means that the target file being run by the target process is a file inside the container. At this time, the obtained container name and target file path are sent to the antivirus module, which reads the target file inside the container based on the container name and file path, thereby enabling security detection of the target file inside the container.

[0053] Optionally, Figure 2 This is a second schematic flowchart of the container safety protection method provided in this embodiment of the invention, as shown below. Figure 2 As shown, prior to step 102, the container safety protection method further includes the following steps:

[0054] Step 104: The kernel module determines whether the target process is a process within a container based on the PID namespace and the mounted namespace.

[0055] Specifically, the kernel module determines whether the PID namespace of the target process is the same as the global PID namespace, and determines whether the mount namespace of the target process is the same as the global mount namespace.

[0056] When the kernel module determines that the target process is a process within the container, and that the target process's PID namespace is different from the global PID namespace, and the target process's mount namespace is different from the global mount namespace, the kernel module determines that the target process is a process within the container.

[0057] When the kernel module determines that the target process is not a process within the container, it determines that the target process is not a process within the container if the target process's PID namespace is the same as the global PID namespace, and / or the target process's mount namespace is the same as the global mount namespace.

[0058] For example, when the kernel module obtains the PID namespace and mount namespace of the target process, it compares the target process's PID namespace with the global PID namespace and the target process's mount namespace with the global mount namespace. If the target process's PID namespace and the global PID namespace are the same, and / or the target process's mount namespace and the global mount namespace are the same, it means that the target process is not a process inside the container, and the target file is a file in the global namespace or another file. If the target process's PID namespace and the global PID namespace are different, and the target process's mount namespace and the global mount namespace are also different, it means that the target process is a process inside the container, and the target file is a file inside the container.

[0059] The container security protection method provided in this embodiment of the invention determines whether the target process is a process inside the container by comparing the PID namespace of the target process with the global PID namespace and the mount namespace of the target process with the global mount namespace, thereby realizing the identification of files inside the container.

[0060] Optionally, step 103 above can be implemented in the following ways:

[0061] The antivirus module calls the container file reading function in the kernel module and inputs the name of the container and the file path into the container file reading function.

[0062] The antivirus module reads the target file through the container file reading function.

[0063] For example, when the antivirus module obtains the name of the container to which the target process belongs and the file path of the target file, it calls the container file reading function in the kernel module and passes the name of the container to which the target process belongs and the file path of the target file into the container file reading function to read the target file.

[0064] Optionally, the antivirus module can read the target file through the container file reading function in the following ways:

[0065] The antivirus module uses the container file reading function to determine the processes in the process list that match the name of the container, and identifies the processes that match the name of the container as reference processes; the process list stores the name of the container to which each process belongs;

[0066] The antivirus module obtains the root directory of the reference process through the container file reading function; the root directory of the reference process is a directory relative to the mount namespace of the reference process; the root directory of the reference process is the same as the root directory of the target process.

[0067] The antivirus module reads the target file based on the root directory of the reference process and the file path using the container file reading function.

[0068] For example, the antivirus module uses a container file reading function to traverse a pre-stored list of processes, reading the `Uts_namespace.hostname` from each process descriptor in the list. It then compares each `Uts_namespace.hostname` with the name of the received container. If a `Uts_namespace.hostname` matches the name of the received container, the process corresponding to that `Uts_namespace.hostname` is identified as the reference process. Since both the reference process and the target process are processes under the name of the received container, it can be determined that they belong to the same container. Therefore, the root directory of the reference process is the same as the root directory of the target process. Obtaining the root directory of the reference process is equivalent to obtaining the root directory of the target process. The specific root directory of the reference process can be obtained from its descriptor. For example, the root directory of the reference process might be `Mnt_namespace.root`, which is the directory relative to the mounted namespace of the reference process.

[0069] The container security protection method provided in this embodiment of the invention involves the antivirus module calling the container file reading function in the kernel module. The container file reading function determines the reference process inside the container based on the container name, obtains the root directory of the reference process, and then reads the target file inside the container based on the root directory of the reference process and the file path of the target file.

[0070] Optionally, the antivirus module reads the target file based on the root directory and file path of the reference process using the container file reading function, which can be implemented in the following ways:

[0071] The antivirus module calls the Application Programming Interface (API) function through the container file reading function, inputting the root directory of the reference process and the file path into the API function, and opens and reads the target file through the API function.

[0072] For example, when the antivirus module obtains the root directory of the reference process, it also obtains the root directory of the target process. At this point, it calls the API function provided by the native kernel, passing the root directory of the reference process and the file path of the target file to the API function. Based on the API function, it opens and reads the target file, and sends the read target file back to the application-layer antivirus module. The antivirus module then uses its antivirus program to perform a security check on the target file, thereby achieving virus detection and removal of the target file within the container. The specific method for the API function to read the target file can be found in existing technologies, and will not be elaborated upon here.

[0073] The container security protection method provided in this invention adds real-time monitoring and protection for file operations within containers, based on the traditional Linux antivirus's ability to only monitor and protect files outside the container in real time. This expands the protection scope of the antivirus module and further improves file security.

[0074] Figure 3 This is a schematic diagram of the container safety protection device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the container safety protection device includes a first acquisition module 301, a second acquisition module 302, and a detection module 303; wherein:

[0075] The first acquisition module 301 is used to acquire the process identifier (PID) namespace and mount namespace of the target process when it is detected that the target process is operating on the target file.

[0076] The second acquisition module 302 is used to acquire the name of the container and the file path of the target file through the kernel module when the kernel module determines that the target process is a process inside the container based on the PID namespace and the mount namespace, and send the name of the container and the file path to the detection module.

[0077] The detection module 303 is used to read the target file based on the name of the container and the file path, and to determine whether the target file is safe.

[0078] The container security protection device provided in this embodiment of the invention, when detecting that a target process is operating on a target file, the kernel module determines whether the target process is a process inside a container based on the target process's PID namespace and mount namespace. When it is determined that the target process is a process inside a container, it means that the target file being run by the target process is a file inside the container. At this time, the obtained container name and target file path are sent to the antivirus module, which reads the target file inside the container based on the container name and file path, thereby enabling security detection of the target file inside the container.

[0079] Based on any of the above embodiments, the device further includes:

[0080] The determination module is used to determine whether the target process is a process within a container based on the PID namespace and the mounted namespace.

[0081] Based on any of the above embodiments, the determining module is specifically used for:

[0082] Determine whether the PID namespace of the target process is the same as the global PID namespace, and determine whether the mount namespace of the target process is the same as the global mount namespace.

[0083] When it is determined that the PID namespace of the target process is different from the global PID namespace, and the mount namespace of the target process is different from the global mount namespace, the target process is determined to be a process within the container.

[0084] If the PID namespace of the target process is the same as the global PID namespace, and / or the mount namespace of the target process is the same as the global mount namespace, then the target process is determined not to be a process within the container.

[0085] Based on any of the above embodiments, the detection module 303 is specifically used for:

[0086] The container file reading function in the kernel module is invoked, and the name of the container and the file path are input into the container file reading function;

[0087] The target file is read using the container file reading function.

[0088] Based on any of the above embodiments, the detection module 303 is specifically used for:

[0089] The process that matches the name of the container in the process list is determined by the container file reading function, and the process that matches the name of the container is determined as the reference process; the process list stores the name of the container to which each process belongs;

[0090] The root directory of the reference process is obtained through the container file reading function; the root directory of the reference process is a directory relative to the mount namespace of the reference process; the root directory of the reference process is the same as the root directory of the target process.

[0091] The container file reading function reads the target file based on the root directory of the reference process and the file path.

[0092] Based on any of the above embodiments, the detection module 303 is specifically used for:

[0093] The application programming interface (API) function is called by the container file reading function, and the root directory of the reference process and the file path are input into the API function. The target file is then opened and read by the API function.

[0094] Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute the following method: when the kernel module detects that the target process is operating on the target file, it obtains the process identifier (PID) namespace and mount namespace of the target process;

[0095] When the kernel module determines that the target process is a process inside a container based on the PID namespace and the mount namespace, it obtains the name of the container and the file path of the target file, and sends the name of the container and the file path to the antivirus module.

[0096] The antivirus module reads the target file based on the container name and the file path, and determines whether the target file is safe.

[0097] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0098] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, the computer program being executed by a processor, the computer being able to execute the container security protection method provided by the above methods, the method including: when the kernel module detects that the target process is operating on the target file, it obtains the process identifier PID namespace and mount namespace of the target process;

[0099] When the kernel module determines that the target process is a process inside a container based on the PID namespace and the mount namespace, it obtains the name of the container and the file path of the target file, and sends the name of the container and the file path to the antivirus module.

[0100] The antivirus module reads the target file based on the container name and the file path, and determines whether the target file is safe.

[0101] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the container security protection method provided by the above methods, the method comprising: when the kernel module detects that a target process is operating on a target file, obtaining the process identifier (PID) namespace and mount namespace of the target process;

[0102] When the kernel module determines that the target process is a process inside a container based on the PID namespace and the mount namespace, it obtains the name of the container and the file path of the target file, and sends the name of the container and the file path to the antivirus module.

[0103] The antivirus module reads the target file based on the container name and the file path, and determines whether the target file is safe.

[0104] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0105] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A container safety protection method, characterized in that, Applied to an electronic device, the electronic device including a kernel module and an antivirus module, the method includes: When the kernel module detects that the target process is operating on the target file, it obtains the process identifier (PID) namespace and mount namespace of the target process. When the kernel module determines that the target process is a process inside a container based on the PID namespace and the mount namespace, it obtains the name of the container and the file path of the target file, and sends the name of the container and the file path to the antivirus module. The antivirus module reads the target file based on the container name and the file path, and determines whether the target file is safe. The antivirus module reads the target file based on the container name and the file path, including: The antivirus module calls the container file reading function in the kernel module and inputs the name of the container and the file path into the container file reading function. The antivirus module uses the container file reading function to determine the processes in the process list that match the name of the container, and identifies the processes that match the name of the container as reference processes; the process list stores the name of the container to which each process belongs; The antivirus module obtains the root directory of the reference process through the container file reading function; the root directory of the reference process is a directory relative to the mount namespace of the reference process; the root directory of the reference process is the same as the root directory of the target process. The antivirus module reads the target file based on the root directory of the reference process and the file path using the container file reading function.

2. The container safety protection method according to claim 1, characterized in that, Before the kernel module determines that the target process is a process within a container based on the PID namespace and the mount namespace, and before obtaining the container name and the file path of the target file, the method further includes: The kernel module determines whether the target process is a process within a container based on the PID namespace and the mounted namespace.

3. The container safety protection method according to claim 2, characterized in that, The kernel module determines whether the target process is a process within a container based on the PID namespace and the mounted namespace, including: The kernel module determines whether the PID namespace of the target process is the same as the global PID namespace, and determines whether the mount namespace of the target process is the same as the global mount namespace. When the kernel module determines that the target process is a process within the container, and that the target process's PID namespace is different from the global PID namespace, and the target process's mount namespace is different from the global mount namespace, the kernel module determines that the target process is a process within the container. When the kernel module determines that the target process is not a process within the container, it determines that the target process is not a process within the container if the target process's PID namespace is the same as the global PID namespace, and / or the target process's mount namespace is the same as the global mount namespace.

4. The container safety protection method according to any one of claims 1-3, characterized in that, The antivirus module reads the target file based on the root directory of the reference process and the file path using the container file reading function, including: The antivirus module calls the application programming interface (API) function through the container file reading function, inputting the root directory of the reference process and the file path into the API function, and then opens and reads the target file through the API function.

5. A container safety protection device, characterized in that, include: The first acquisition module is used to acquire the process identifier (PID) namespace and mount namespace of the target process when it is detected that the target process is operating on the target file. The second acquisition module is used to acquire the name of the container and the file path of the target file through the kernel module when the kernel module determines that the target process is a process inside the container based on the PID namespace and the mount namespace, and send the name of the container and the file path to the detection module. The detection module is used to read the target file based on the name of the container and the file path, and determine whether the target file is safe; The detection module is specifically used for: The container file reading function in the kernel module is invoked, and the name of the container and the file path are input into the container file reading function; The process that matches the name of the container in the process list is determined by the container file reading function, and the process that matches the name of the container is determined as the reference process; the process list stores the name of the container to which each process belongs; The root directory of the reference process is obtained through the container file reading function; the root directory of the reference process is a directory relative to the mount namespace of the reference process; the root directory of the reference process is the same as the root directory of the target process. The container file reading function reads the target file based on the root directory of the reference process and the file path.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the container security protection method as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the container security protection method as described in any one of claims 1 to 4.

8. A computer program product having executable instructions stored thereon, characterized in that, When executed by the processor, this instruction causes the processor to implement the container security protection method as described in any one of claims 1 to 4.

Images