A method, system and medium for in-container script execution management

Abstract

The application discloses a kind of container script execution management and control method, system and medium, the container script execution management and control method of the application includes when creating script file in container, the association of script file is established with the parent process of creating script file;When monitoring that the script file in container is executed, it is judged whether the execution program for executing the script file is the parent process of association, if it is established, then allow the script file to be executed, otherwise prohibit the script file to be executed;In addition, it also includes management and control script interpreter, refuses script interpreter to execute the script file created in container.The application can guarantee the security of container by using the association binding of script file and its parent process, while reducing the influence on the operation of container business.

Description

Technical Field

[0001] This invention relates to the field of container security, and specifically to a method, system, and medium for controlling script execution within a container. Background Technology

[0002] Containers are a sandbox technology primarily designed to run applications within an isolated environment, allowing for easy migration to other host machines. Essentially, a container is a special type of process. It uses namespaces, control groups, and chroot techniques to divide resources, files, devices, state, and configurations into an independent space. Container technology has gained popularity among enterprises due to its low resource consumption, fast deployment, and ease of migration. However, with the increasing prevalence of container technology, container security has become a growing concern. Programs written in scripting languages ​​do not require compilation; they can be executed simply by granting the script file the appropriate permissions to a script interpreter. Furthermore, since script files are mostly plain text, attackers can easily encode and obfuscate their content, bypassing detection mechanisms and even manual user intervention. Attacks using script files within containers can disrupt the container's runtime environment or even exploit vulnerabilities or misconfigurations to cause container escape.

[0003] While some script execution control methods exist, they all require processing of the script interpreter, such as adding security tags or logging its path. However, the script interpreter used by containers is contained within the container image. Controlling the execution of script files within a container necessitates processing the script interpreter within that image. This requires processing the script interpreter in each new image creation and manually locating the interpreter's path each time a new image is pulled. As the number of images increases, existing methods become insufficient for controlling the execution of script files within containers. Furthermore, current script execution control methods rely on verifying the tags or metrics of the scripts to be executed; execution is rejected if the criteria are not met, potentially impacting the normal operation of services within the container. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method, system and medium for managing script execution within a container, which aims to ensure container security while reducing the impact on business operations within the container.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] A method for managing script execution within a container includes:

[0007] S101, When creating a script file inside the container, establish an association between the script file and the parent process that created the script file;

[0008] S102, when a script file inside the container is detected to be executed, determine whether the executor of the script file is the associated parent process. If it is, allow the script file to be executed; otherwise, prohibit the script file from being executed.

[0009] Optionally, in step S101, when establishing an association between the script file and the parent process that created the script file, the association information of the parent process refers to the absolute file path of the parent process or the hash value of the absolute file path of the parent process.

[0010] Optionally, when establishing an association between the script file and the parent process that created the script file in step S101, it means recording the association information of the parent process into the extended attributes of the script file to form an association with the parent process that created the script file.

[0011] Optionally, recording the parent process's association information into the script file's extended attributes means recording the parent process's identity information into the script file's extended attributes and adding a non-executable flag to the script file.

[0012] Optionally, before step S101, there is also a step of automatically adding security tags to directories and files in the container image when pulling the container image, and the types of automatically added security tags include: adding a script interpreter tag to the script interpreter file, and adding a parent process tag to all files other than the script interpreter.

[0013] Optionally, the step of automatically adding security tags to directories and files in the container image when pulling the container image involves the container engine obtaining the graphics driver of the downloaded image through the container inspection function after pulling the container image for the container to obtain the corresponding directory, and then calling the kernel function to add security tags to recursively add the corresponding security tags to the obtained directory.

[0014] Optionally, before the step of automatically adding security tags to directories and files in the container image when pulling the container image, the method further includes installing a container patch to modify the container engine, enabling the container engine to add the function of automatically adding security tags to directories and files in the container image when pulling the container image.

[0015] Optionally, the response processing in step S102 when a script file inside the container is detected to be executed includes:

[0016] S201, read the script file and the security flag of the script file's executable program, respectively.

[0017] S202, check the type of security flag of the script file's executor. If it is a script interpreter flag, jump to step S203; if it is a parent process flag, jump to step S204.

[0018] S203, Check the type of security flag for the script file. If it is a non-executable flag, prohibit the execution of the script file; otherwise, allow the execution of the script file and exit.

[0019] S204, check the type of security flag of the script file. If it is a non-executable flag, proceed to step S205; otherwise, allow the script file to be executed and exit.

[0020] S205, check whether the identity information of the parent process and the identity information of the executor executing the script file are consistent in the security flag of the script file. If they are consistent, the script file is allowed to be executed; otherwise, the script file is prohibited from being executed.

[0021] Furthermore, the present invention also provides a system for managing the execution of scripts within a container, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the method for managing the execution of scripts within a container.

[0022] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program, the computer program being programmed or configured by a microprocessor to execute a method for managing script execution within the container.

[0023] Compared with the prior art, the present invention has the following advantages: When creating a script file in a container, the present invention establishes an association between the script file and the parent process that created the script file; when the execution of the script file in the container is detected, it determines whether the execution program executing the script file is the associated parent process. If it is, the script file is allowed to be executed; otherwise, the script file is prohibited from being executed. By utilizing the association between the script file and its parent process, it is possible to reduce the impact on the operation of business within the container while ensuring the security of the container. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the basic process of the method in Embodiment 1 of the present invention.

[0025] Figure 2 This is a schematic diagram of the complete process of the method in Embodiment 2 of the present invention.

[0026] Figure 3 This is a schematic diagram of the response processing when a script file is executed in Embodiment 2 of the present invention. Detailed Implementation

[0027] Example 1:

[0028] like Figure 1 As shown, the method for controlling script execution within a container in this embodiment includes:

[0029] S101, When creating a script file inside the container, establish an association between the script file and the parent process that created the script file;

[0030] S102, when a script file inside the container is detected to be executed, determine whether the executor of the script file is the associated parent process. If it is, allow the script file to be executed; otherwise, prohibit the script file from being executed.

[0031] It should be noted that when establishing the association between the script file and the parent process that created the script file in step S101, the association information of the parent process can be specified as needed. For example, the absolute path of the parent process's file or the hash value of the absolute path of the parent process's file can be used. Since hash values ​​have characteristics such as strong confidentiality and fixed length, this embodiment preferably uses the hash value of the absolute path of the parent process's file. A set of hash values ​​is recorded in the extended attributes of the script file. This hash value is obtained by the kernel function performing a hash operation on the absolute path of its parent process.

[0032] In this embodiment, when establishing the association between the script file and the parent process that created the script file in step S101, it means recording the association information of the parent process into the extended attributes of the script file to form an association with the parent process that created the script file. This method is relatively simple and direct. Alternatively, it is also possible to record the association information of the parent processes of each script file through a dedicated database or file, which can also achieve the same feasible purpose.

[0033] In this embodiment, recording the parent process's association information into the script file's extended attributes means recording the parent process's identity information into the script file's extended attributes.

[0034] Example 2:

[0035] This embodiment is a further extension of Embodiment 1, including an extension of the type of security tag and an extension of the handling method when a script file inside the container is detected to be executed.

[0036] like Figure 2As shown, in this embodiment, before step S101, there is a step of automatically adding security tags to directories and files in the container image when pulling the container image. The types of security tags automatically added include: adding a script interpreter tag to script interpreter files, adding a parent process tag to all files other than the script interpreter, adding a parent process tag to all files in the image except the script interpreter, and adding a script interpreter tag to script interpreter files (such as bash, shell, etc.). Files generated by processes with parent process tags will have a non-executable tag (recording the parent process's association information in the extended attributes of the script file means recording the parent process's identity information in a field different from the security tag in the extended attributes of the script file, and adding a non-executable tag to the script file). Therefore, the security tags used in this embodiment include three types, as shown in Table 1.

[0037] Table 1: Types and descriptions of safety markings.

[0038] Non-executable flag Execution control flags indicate that files with this flag are not executable by default. Script interpreter tags Flags used to set various interpreters (avoiding modification of the source code package) Parent process flag With this marker file, you can execute your own generated sub-files.

[0039] In this embodiment, the step of automatically adding security tags to directories and files in the container image when pulling the container image is to obtain the graph driver of the downloaded image through the container inspection function (docker inspect) after the container engine pulls the container image, obtain the corresponding directory, and then call the function in the kernel to add security tags to the obtained directory recursively.

[0040] In this embodiment, before the step of automatically adding security tags to directories and files in the container image when pulling the container image, the method further includes installing a container patch to modify the container engine, enabling the container engine to add the function of automatically adding security tags to directories and files in the container image when pulling the container image.

[0041] Based on adding a script interpreter flag to script interpreter files and adding a parent process flag to all files other than the script interpreter, this embodiment further includes an extension to the handling method when a script file within a container is detected to be executed. When a script file is executed through a script interpreter, the kernel verifies the security flags of the executor and the script file. If the executor has a script interpreter flag, the execution of the script file with the non-executable flag is refused. When a script file is executed by another process, the kernel verifies the security flags of the executor and the script file. If the executor has a parent process flag, the execution of the script file with the non-executable flag is not directly refused. Instead, the kernel determines whether the hash value recorded in the file extension attribute of the script file matches the hash value of the absolute path of the executor. If they match, execution is allowed. Otherwise, execution is refused. This method ensures that a script file can only be executed by its parent process, and that the security flag attribute of the script file does not change after execution. Therefore, when execution control is enabled, the only way for a script within a container to be executed is through its parent process. Specifically, as shown below... Figure 3 As shown, the response processing in step S102 of this embodiment when a script file inside the container is detected to be executed includes:

[0042] S201, read the script file and the security flag of the script file's executable program, respectively.

[0043] S202, check the type of security flag of the script file's executor. If it is a script interpreter flag, jump to step S203; if it is a parent process flag, jump to step S204.

[0044] S203, check the type of security flag for the script file. If it is a non-executable flag, prohibit the execution of the script file (prevent the script interpreter from executing script files created within the container); otherwise, allow the script file to be executed and exit.

[0045] S204, check the type of security flag of the script file. If it is a non-executable flag, proceed to step S205; otherwise, allow the script file to be executed and exit.

[0046] S205, check whether the identity information of the parent process carried in the security tag of the script file and the identity information of the executor executing the script file (e.g., a hash value in this embodiment) are consistent. If they are consistent, the script file is allowed to be executed; otherwise, the script file is prohibited from being executed.

[0047] Specifically, in this embodiment, the experimental environment uses Kylin Server v10 as the operating system and Docker version 18.09. To verify the effectiveness of script execution control, we wrote a simple test program called `test`, which has two functions: creating script files and executing script files. Adding tags to files within the container primarily aims to patch the container engine so that it can add corresponding security tags to files within the image when pulling the image, avoiding the problem of newly pulled images lacking security tags or the script interpreter within the container not being modified, thus failing to control the execution of scripts within the container. Recording hash values ​​primarily aims to add hash values ​​to files generated by the parent process within the container, ensuring the effectiveness of subsequent execution control. The main purpose of this file execution control is to utilize the security tags and hash values ​​added in the first two steps to control the execution of scripts within the container, improving the security of the container runtime while ensuring the normal operation of business within the container. First, Docker is installed on a physical machine running Kylin Server v10, and patches are installed for Docker. Then, the `docker pull` command is used to pull the CentOS container image. During the pull process, Docker scans the files within the image and adds security tags according to file types.

[0048] For example, when the test program `test` generates a script file `test_script`, the kernel records the hash value of the absolute path of `test` in the file extension attributes of the script file `test_script`. Finally, when the script interpreter `bash` executes the script file `test_script`, the kernel first checks the security flag values ​​of the executor and the script file. Because `bash` carries a script interpreter flag, and the file `test_script`, generated by a program with a parent process flag, carries a non-executable flag, the script file `test_script` will be refused execution. However, when the test program `test` executes the script file `test_script`, the kernel first checks the security flag values ​​of the executor and the script file. `test` carries a parent process flag, and the security flag of `test_script` is non-executable. But because the hash value recorded in the file extension attributes of `test_script` can match the hash value of the absolute path of `test`, the `test` process can execute `test_script`.

[0049] For example, consider a container with three programs: program A, program B, and the script interpreter bash. Program A generates script a1. When pulling the image, programs A and B are marked with their parent process tags, while the script interpreter bash is marked with a script interpreter tag. Program A generates script a1, which has a non-executable tag. When program A executes a1, it first checks the tag on a1, finding it to be non-executable. Then, it compares the parent process information recorded in a1's security extension attributes with the currently executing program. Since it was executed by program A, execution is allowed. Similarly, when program B executes, execution is refused because the parent process information recorded in a1's security extension attributes is inconsistent with the currently executing program. When the script interpreter bash executes a1, it recognizes that the executing program is a script interpreter, and a1 has a non-executable tag, so execution is directly refused without further comparison. The reason for determining whether an executing program is a script interpreter is that the management principle of script interpreters is different from that of general programs. Therefore, in this embodiment, a unique script interpreter tag is added for script interpreters.

[0050] In summary, the method for controlling script execution within containers in this embodiment modifies the container engine to add security tags to files within the container when pulling the container image. This solves the problem of being unable to control script execution within the container due to newly pulled images lacking security tags or the lack of modification to the container's script interpreter. By using a combination of security tags and hash values ​​to control script execution within the container, the normal operation of services within the container is ensured while improving the security of the container runtime. This method verifies the security tags of the container image file and the container's script interpreter, and compares the hash values ​​recorded in the script file's extended attributes to control the execution of script files within the container. Furthermore, when a script file's security tag is invalid, the script file can only be executed by the parent process that generated it, thus ensuring container security while reducing the impact on the operation of services within the container. Simultaneously, this solution modifies the container engine to automatically add appropriate security tags to files within the container image when pulling the image. When a container is run using an image with added security tags, the files in that container will also have security tags, solving the problem of adding security tags to files within the container.

[0051] Furthermore, this embodiment also provides a system for managing the execution of scripts within a container, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the method for managing the execution of scripts within a container.

[0052] In addition, this embodiment also provides a computer-readable storage medium storing a computer program that is programmed or configured by a microprocessor to execute a method for managing script execution within the container.

[0053] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for controlling script execution within a container, characterized in that, include: S101, when creating a script file in the container, establish association information between the script file and the parent process that created the script file. The association information of the parent process refers to the absolute file path of the parent process or the hash value of the absolute file path of the parent process. S102, when a script file inside the container is detected to be executed, determine whether the executor of the script file is the associated parent process. If it is, allow the script file to be executed; otherwise, prohibit the script file from being executed. Before step S101, the process includes automatically adding security tags to directories and files in the container image when pulling the container image. The types of automatically added security tags include: adding a script interpreter tag to script interpreter files, and adding a parent process tag to all files other than the script interpreter. This step involves the container engine, after pulling the container image, obtaining the graphics driver of the downloaded image through a container inspection function to get the corresponding directories, and then recursively adding the corresponding security tags to the obtained directories by calling a kernel function that adds security tags. Before this step, the process also includes installing a container patch to modify the container engine, enabling it to add the function of automatically adding security tags to directories and files in the container image when pulling the container image. The response processing in step S102 when the execution of a script file within the container is detected includes: S201, Read the security flags of the script file and the executable program of the script file respectively; S202, check the type of security flag of the script file's executor. If it is a script interpreter flag, jump to step S203; if it is a parent process flag, jump to step S204. S203, Check the type of security flag for the script file. If it is a non-executable flag, prohibit the execution of the script file; otherwise, allow the execution of the script file and exit. S204, check the type of security flag of the script file. If it is a non-executable flag, proceed to step S205; otherwise, allow the script file to be executed and exit. S205, check whether the identity information of the parent process and the identity information of the executor executing the script file are consistent in the security flag of the script file. If they are consistent, the script file is allowed to be executed; otherwise, the script file is prohibited from being executed.

2. The method for controlling script execution within a container according to claim 1, characterized in that, In step S101, when establishing the association between the script file and the parent process that created the script file, it means recording the association information of the parent process into the extended attributes of the script file to form an association with the parent process that created the script file.

3. The method for controlling script execution within a container according to claim 2, characterized in that, Recording the parent process's association information into the script file's extended attributes means recording the parent process's identity information into the script file's extended attributes and adding a non-executable flag to the script file.

4. A system for managing script execution within a container, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to execute the method for managing in-container script execution as described in any one of claims 1 to 3.

5. A computer-readable storage medium storing a computer program, characterized in that, The computer program is used to be programmed or configured by a microprocessor to execute the method for managing in-container script execution as described in any one of claims 1 to 3.

Images