Detection method for container resource escape defect

Abstract

The invention belongs to the technical field related to computer resource management, and discloses a container resource escape defect detection method, which comprises the following steps: creating a first container and a second container sharing a namespace by using a to-be-detected container creation tool, and obtaining the sum of the current resource record values of the two containers as a reference value; running the test item in the first container; restarting the first container; inquiring whether resources created when the current test item is operated exist in the current namespace or not: if yes, obtaining the sum of the current resource record values of the two containers as a target value, and then deleting the created resources; calculating a difference value between the target value and the reference value, and outputting a detection result reflecting the resource escape degree based on the difference value; and if not, outputting a detection result that the resource escape defect does not exist. Through the method, the container production environment of the shared namespace in a real environment can be simulated, the container tool is detected in advance, and the vulnerability of resource exhaustion in actual application is avoided.

Description

Technical Field

[0001] The present invention belongs to the technical field related to computer resource management, and more specifically, relates to a detection method for container resource escape defects. Background Art

[0002] Container technology has been widely used in many fields, such as cloud computing, edge computing, and autonomous driving. Container technology has two cornerstones: namespace and control group.

[0003] Namespace can isolate a group of processes and maintain resources that are exclusive to this group of processes, isolating them from the global resources in the kernel. For example, the process namespace PID namespace has a set of linked lists that are independent of other PID namespaces. This linked list is only used to maintain all processes belonging to this PID namespace. When the last process in the namespace exits, the namespace will die. At the same time, the kernel will traverse all resources maintained by the namespace and destroy them.

[0004] Cgroup can realize the statistics and restrictions of a group of resources (such as memory, I / O rate, network bandwidth, etc.). When a container is created, the runtime will automatically create a cgroup for the container. When a process is executed in the container, the cgroup of the container itself is used to limit the use of resources by the process.

[0005] When using container technology in practice, problems with abnormal resource consumption may occasionally occur. That is, while the host is running the container service, some resources are gradually consumed, and the host may even crash, but the cgroup resource records of each container are not high. Summary of the invention

[0006] In response to the above defects or improvement needs of the prior art, the present invention provides a detection method for container resource escape defects, the purpose of which is to detect whether there is a problem with the tool before the container creation tool is detected, so as to avoid the vulnerability of resource exhaustion during the use of container technology.

[0007] To achieve the above object, the present invention provides a method for detecting container resource escape defects, which includes:

[0008] Step S1: using a container creation tool to be tested to create a first container and a second container sharing a namespace in the kernel, generating a first control group for limiting resources for the first container, generating a second control group for limiting resources for the second container, obtaining the sum of currently recorded resource amounts of the first control group and the second control group as a reference value, and determining a test item set, wherein the test items in the test item set are system calls adapted to the current namespace;

[0009] Step S2: running an untested test project in the first container for testing, creating resources required by the current test project in the namespace, and recording the created resource amount in the first control group;

[0010] Step S3: restarting the first container, and updating the first control group along with the restarting of the first container;

[0011] Step S4: calling the resource query method of the current test project in the second container to query whether the resources created when running the current test project still exist in the current namespace; if so, executing step S5; if not, outputting the detection result that there is no resource escape defect in the current test project, and executing step S6;

[0012] Step S5: obtaining the sum of the resource amounts currently recorded by the first control group and the second control group as the target value, and then calling the resource deletion method of the current test project to delete the resources created by the current test project; calculating the difference between the target value and the reference value, and outputting a detection result reflecting the degree of resource escape of the current test project based on the difference, wherein the larger the difference, the smaller the degree of resource escape;

[0013] Step S6: Determine whether all test items in the test item set have been tested, if not, jump to step S2, if yes, execute step S7;

[0014] Step S7: End the detection.

[0015] Preferably, in step S5, outputting the resource escape degree of the current test item based on the difference includes:

[0016] Compare the difference with the resource escape threshold of the current test item, if the difference is less than the resource escape threshold, determine it as a severe defect, and output a vulnerability report;

[0017] The vulnerability report includes the current namespace, the resource creation method of the current test project, and the method for the container creation tool to create multiple containers that share the current namespace;

[0018] The resource escape threshold is greater than 80% of the amount of resources created by the current test item.

[0019] Preferably, the test items run in the first container are marked;

[0020] In step S6, it is determined whether all the test items in the test item set have been tested by determining whether there are unmarked test items in the test item set.

[0021] Preferably, when the kernel is divided into multiple namespaces, steps S1 to S7 are performed for each namespace to obtain a detection result of the container resource escape defect of the container creation tool to be detected corresponding to each namespace.

[0022] Preferably, the container creation tool is selected from any one of a docker tool and a podman tool.

[0023] Preferably, the namespace is selected from one or more of a process namespace, an inter-process communication namespace, a network namespace and a mount namespace.

[0024] Preferably, the test items include shmget, semget, and fork.

[0025] The present invention also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0026] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0027] The present invention also provides a computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the steps of any of the above methods are implemented.

[0028] In general, compared with the prior art, the above technical solutions conceived by the present invention mainly have the following beneficial effects:

[0029] The present invention firstly discovers the problem of resources being gradually exhausted when using container technology. The reason is that when multiple containers share a namespace, during the restart of the container, the resources previously created by the container and its cgroup resource record values ​​cannot be destroyed synchronously. Its cgroup resource record values ​​can usually be cleared with the restart of the container, but the resources previously created are likely to still exist in the namespace. This part of the resources is not recorded by the cgroup resource record values, forming escaped resources. As the number of container restarts increases, its escaped resources gradually accumulate, and the resources actually applied for by the container far exceed its cgroup resource record values, resulting in resource exhaustion. Based on the root of the problem found, the present invention designs a detection method for container resource escape defects, which is used to detect the vulnerability of the container creation tool. The tool is used to build two containers with a shared namespace, and one of the containers is used to run the system call, and then restart after creating resources in the namespace. The other container is used to query whether the created resources exist in the namespace. If not, it means that there is no resource escape. If it exists, it is necessary to further compare the difference between the current cgroup resource record value and the initial cgroup resource record value to determine whether the cgroup resource record value records the remaining resources. The resources that are not recorded are escaped resources. The difference can be used to evaluate the degree of resource escape and output the detection result. Through the above method, the container production environment of the shared namespace in the real environment can be simulated, the container creation tool can be detected in advance, and the vulnerability of resource exhaustion in actual application can be avoided. The method does not require modification of the kernel, nor does it rely on a specific container tool. It can be easily used to detect resource theft or exhaustion vulnerabilities in container environments built by different container tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flowchart of the steps of a method for detecting container resource escape defects in one embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0032] When creating multiple containers at the same time, there are two situations: multiple containers share a namespace and do not share a namespace. When containers do not share a namespace, each container has its own namespace and cgroup, and the coordination between its namespace and cgroup is reasonable. The namespace and cgroup will be destroyed synchronously when the container exits. All cgroup resource records and cgroup restrictions applied by the container will disappear with the destruction of the cgroup, and the resources existing in the namespace will also disappear with the destruction of the namespace. When multiple containers share the same namespace, the namespace will not be destroyed when one of the containers exits, because the namespace is still being used by other containers.

[0033] Research has found that when multiple containers share a namespace, the resources created in the namespace before the container exits may still exist in the namespace after the container exits, and the cgroup resource record value of the container may be cleared or reduced due to the exit of the container. That is, the actual resources in the namespace exceed the cgroup resource record value of all containers in the namespace, and the resources not recorded in the cgroup resource are escaped resources. Therefore, with the restart of the container (each restart executes an exit and reconstruction), the escaped resources increase, and the resources actually requested by the container far exceed its cgroup resource record value, resulting in resource exhaustion.

[0034] Based on the above findings, the present invention proposes the following solution.

[0035] like Figure 1 The flowchart is a step flow chart of a method for detecting container resource escape defects in an embodiment of the present invention, which mainly includes steps S1 to S7, and each step is introduced below.

[0036] Step S1: Use the container creation tool to be tested to create a first container and a second container that share a namespace in the kernel, generate a first control group that restricts resources for the first container, generate a second control group that restricts resources for the second container, obtain the sum of the currently recorded resource amounts of the first control group and the second control group as a reference value, determine a test item set, and the test items in the test item set are system calls that are adapted to the current namespace.

[0037] Specifically, the container creation tool may be any container creation tool, such as a commonly used docker tool and a podman tool.

[0038] Specifically, the namespace can be any namespace, such as a process namespace PID namespace, an inter-process communication namespace IPC namespace, a network namespace Network namespace, and a mount namespace Mount namespace.

[0039] For example, in the docker tool, the “--ipc=A” option in the “docker run” command can be used to create a container that shares an IPC namespace with container A. Container A is the first container, and the container that shares the IPC namespace with container A is the second container.

[0040] In the early stage of container creation, although the system call has not been run, it may have occupied certain resources. Therefore, the sum of the current cgroup resource record values ​​of the first container and the second container is obtained as a reference value for subsequent comparison. Among them, the cgroup resource record value of each container records the amount of resources applied by the container, such as memory, I / O rate, and network bandwidth. Each container has a cgroup limit, and its total application amount cannot exceed the cgroup limit.

[0041] Generally, different namespaces match different system calls. Therefore, a test item set may be determined based on the selected namespace. The test items in the test item set are system calls adapted to the current namespace.

[0042] Step S2: Run an untested test project in the first container for testing, create resources required by the current test project in the namespace, and record the created resource amount in the first control group.

[0043] When a system call is run in the first container, the first container will apply for the resources required to run the system call and add them to the namespace. At the same time, the cgroup resource record value of the first container will also be updated to record the amount of resources applied by the first container in real time.

[0044] Step S3: Restart the first container.

[0045] Specifically, each time a container is restarted, it will exit the namespace and rebuild again. It is generally believed that each time a container exits, the cgroup of the container will be destroyed, and the resources and resource record values ​​created by it will be cleared. However, research has found that in actual situations, when a container exits, the cgroup is destroyed, but the resources created by the container in the namespace are suspiciously still left in the namespace. Since the cgroup is destroyed, the cgroup resource record values ​​are cleared, and the remaining resources are escaped resources. For example, the cgroup of the first container limits its application for a maximum of 1GB of memory. After the first restart, the first container creates 0.8GB of memory, and its cgroup resource record value is 0.8GB. During the second restart, the cgroup resource record value is cleared, but the previously created 0.8GB of memory is still in the namespace. After the second restart, it applies for another 0.8GB of memory, and its cgroup resource record value is 0.8GB. However, in fact, the first container creates a total of 1.6GB of memory in the namespace, which exceeds its cgroup limit. As the number of restarts increases, the escaped resources that are not recorded by the cgroup resource record value gradually accumulate, causing kernel resources to be gradually exhausted and cause failures.

[0046] Step S4: Call the resource query method of the current test project in the second container to query whether the resources created when running the current test project still exist in the current namespace; if so, execute step S5; if not, output the detection result that there is no resource escape defect in the current test project, and execute step S6.

[0047] It can be understood that each system call is configured with methods to create its resources, query its resources, and delete its resources. In this step, the resource query method of the current test project is called in the second container to query whether the resources created when running the current test project still exist in the current namespace:

[0048] If it exists, it means that the resources created by the system call of the first container are not destroyed when the first container exits. At this time, it is necessary to continue to perform the subsequent step S5 to determine whether the cgroup resource record value of the first container records this part of the resources;

[0049] If it does not exist, it means that the resources created by the system call when the first container runs are destroyed with the exit of the first container, and there is no resource escape when the first container runs the system call. The detection result that there is no resource escape when the container creation tool to be detected creates the container and runs the system call is output.

[0050] Step S5: Obtain the sum of the currently recorded resource amounts of the first control group and the second control group as the target value, and then call the resource deletion method of the current test project to delete the resources created by the current test project; calculate the difference between the target value and the reference value, and output a detection result reflecting the degree of resource escape of the current test project based on the difference.

[0051] Among them, the larger the difference, the smaller the degree of resource escape.

[0052] Specifically, after the first container is restarted, the sum of the current cgroup resource record values ​​of the first container and the second container is obtained as the target value, and the difference between the target value and the reference value is calculated. If the difference is small, it means that the target value is close to the initial reference value, that is, although there are residual resources of the first container, the cgroup resource record value of the first container is basically not recorded, and the degree of resource escape is relatively serious. If the difference is large, it means that the cgroup resource record value of the first container still records all or most of the residual resources after the restart, and the degree of resource escape is relatively light. Therefore, the detection result reflecting the degree of resource escape of the current test item can be output based on the difference.

[0053] Among them, a resource escape threshold can be set according to actual conditions, and the difference is compared with the resource escape threshold of the current test project. If the difference is less than the resource escape threshold, it is determined to be a severe defect and a vulnerability report is output. The vulnerability report includes the current namespace, the resource creation method of the current test project, and the method for the container creation tool to create multiple containers that share the current namespace. In one embodiment, the resource escape threshold is greater than 80% of the cgroup resource amount created by the current test project.

[0054] Thus, the test of the current test project is completed, and the resource deletion method of the current test project is called to delete the resources created by the current test project, so that the resources in the namespace and the cgroup resource record values ​​are restored to the initial state.

[0055] Step S6: Determine whether all test items in the test item set have been tested. If not, jump to step S2; if yes, execute step S7.

[0056] Step S7: End the detection.

[0057] Specifically, other test items are tested one by one according to the above steps until all items are tested and the test is ended.

[0058] In one embodiment, each tested test item is marked as tested, and whether all test items in the test item set have been tested is determined by determining whether there are unmarked test items in the test item set.

[0059] In one embodiment, when the kernel is divided into multiple namespaces, steps S1 to S7 are performed for each namespace to obtain a detection result of a container resource escape defect of a container creation tool to be detected corresponding to each namespace.

[0060] Example 2

[0061] The present invention also relates to an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0062] The electronic device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The memory may be used to store computer programs and / or modules, and the processor may perform various functions of the electronic device by running or executing computer programs and / or modules stored in the memory, and calling data stored in the memory.

[0063] Example 3

[0064] The present invention also relates to a computer-readable storage medium having a computer program stored thereon, and the computer program implements the steps of the above method when executed by a processor.

[0065] Specifically, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, an internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0066] Example 4

[0067] The embodiment of the present invention provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of the method of the above embodiment of the present invention.

[0068] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. It should be noted that "in one embodiment", "for example", "for example", etc. of the present invention are intended to illustrate the present invention, rather than to limit the present invention.

[0069] The above embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent application. It should be pointed out that, for those of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention.

Claims

1. A method for detecting container resource escape defects, characterized in that: include: Step S1: using a container creation tool to be tested to create a first container and a second container sharing a namespace in the kernel, generating a first control group for limiting resources for the first container, generating a second control group for limiting resources for the second container, obtaining the sum of currently recorded resource amounts of the first control group and the second control group as a reference value, and determining a test item set, wherein the test items in the test item set are system calls adapted to the current namespace; Step S2: running an untested test project in the first container for testing, creating resources required by the current test project in the namespace, and recording the created resource amount in the first control group; Step S3: restarting the first container, and updating the first control group along with the restarting of the first container; Step S4: calling the resource query method of the current test project in the second container to query whether the resources created when running the current test project still exist in the current namespace; if so, executing step S5; if not, outputting the detection result that there is no resource escape defect in the current test project, and executing step S6; Step S5: obtaining the sum of the currently recorded resource amounts of the first control group and the second control group as the target value, and then calling the resource deletion method of the current test item to delete the resources created by the current test item; Calculate the difference between the target value and the reference value, and output a detection result reflecting the degree of resource escape of the current test item based on the difference, wherein the larger the difference is, the smaller the degree of resource escape is; Step S6: Determine whether all test items in the test item set have been tested, if not, jump to step S2, if yes, execute step S7; Step S7: End the detection.

2. The method for detecting container resource escape defects according to claim 1, characterized in that: In step S5, outputting the resource escape degree of the current test item based on the difference includes: Compare the difference with the resource escape threshold of the current test item, if the difference is less than the resource escape threshold, determine it as a severe defect, and output a vulnerability report; The vulnerability report includes the current namespace, the resource creation method of the current test project, and the method for the container creation tool to create multiple containers that share the current namespace; The resource escape threshold is greater than 80% of the amount of resources created by the current test item.

3. The method for detecting container resource escape defects according to claim 1, characterized in that: marking the test items running in the first container; In step S6, it is determined whether all the test items in the test item set have been tested by determining whether there are unmarked test items in the test item set.

4. The method for detecting container resource escape defects as claimed in claim 1, characterized in that: When the kernel is divided into multiple namespaces, steps S1 to S7 are performed for each namespace to obtain a detection result of the container resource escape defect of the container creation tool to be detected corresponding to each namespace.

5. The method for detecting container resource escape defects as claimed in claim 1, characterized in that: The container creation tool is selected from any one of the docker tool and the podman tool.

6. The method for detecting container resource escape defects as claimed in claim 1, characterized in that: The namespace is selected from one or more of a process namespace, an inter-process communication namespace, a network namespace, and a mount namespace.

7. The method for detecting container resource escape defects as claimed in claim 1, characterized in that: The test items include shmget, semget, and fork.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images