Container escape defense method, device and storage medium

Abstract

The embodiment of the present invention discloses a container escape defense method, device and storage medium, the method comprising: before the container is started, the corresponding disk volume is allocated according to the container settings, and the disk volume is securely configured; the disk volume after the security configuration is set to read and write mount; after the container is started, the working directory of the container is mounted and associated with the disk volume to prevent the container escape attack from running in the container working directory. When the container is running, the allocated disk volume can prevent key commands and programs from running, and prevent access to device files. The control of the container working directory is achieved by controlling the disk volume, without the need to set a complex security mechanism or monitor the container business, and can achieve a good defense effect against container escape attacks without incurring additional overhead.

Description

Technical Field

[0001] The present invention relates to the field of container technology, and in particular to a container escape prevention method, device and storage medium. Background Art

[0002] Containers are a lightweight virtualization technology that allows multiple isolated applications to run on a single operating system instance. Container technology allows applications and their dependencies to be encapsulated as a unit (container), so that they can run consistently on any platform that supports container technology without being affected by the underlying infrastructure. Containers share the operating system kernel with the host, and different containers can share some system resources, so they are more lightweight and consume fewer resources. The emergence of container technology solves a series of problems existing in traditional deployment methods, making software development and deployment more consistent and efficient. With the popularization of container technology, related security issues have gradually emerged, among which the most noteworthy is container escape. Container escape means that the attacker has obtained the command execution capability under certain permissions in the container by hijacking the containerized business logic or directly controlling it; the attacker uses this command execution capability to obtain the command execution capability under certain permissions on the host where the container is located by some means. Container escape is the most serious security risk, which directly endangers the security of the underlying host and the entire cloud computing system. Once successful, the attacker can execute arbitrary code in the container and even control the entire system.

[0003] In the prior art, the following methods are usually used to solve the container escape problem: by checking the container configuration to ensure that all configuration items meet the security baseline; and when the container is running, the running process and process parameters are checked in real time to promptly detect and defend against escape attacks; use mandatory access control to avoid substantial harm after the container escapes. However, the above methods have their own advantages and disadvantages. Checking the security configuration can defend against most of the container escape vulnerabilities that have been discovered, but it still cannot prevent escape attacks using 0day vulnerabilities; running checks can promptly detect escape attacks and take corresponding defense measures, but it will inevitably generate certain additional overhead, especially when there are a large number of containers; using security mechanisms for defense can effectively defend against most escape vulnerabilities including 0day vulnerabilities, but it is not easy to configure the security mechanism reasonably, and being too strict may affect the normal operation of the business in the container. Summary of the invention

[0004] The embodiments of the present invention provide a container escape defense method, device and storage medium to solve the technical problems in the prior art that the defense against container escape cannot completely prevent escape defense and the defense overhead is too high.

[0005] In a first aspect, an embodiment of the present invention provides a container escape defense method, including:

[0006] Before the container is started, the corresponding disk volume is allocated according to the container settings, and the disk volume is securely configured;

[0007] Perform read-write mount settings for the disk volume after security configuration;

[0008] After the container is started, the working directory of the container is mounted and associated with the disk volume to prevent the container escape attack from running in the working directory of the container.

[0009] In a second aspect, an embodiment of the present invention further provides a container escape prevention device, comprising:

[0010] A setting allocation module is used to allocate corresponding disk volumes according to container settings before the container is started, and to perform security configuration on the disk volumes;

[0011] The read-write mount setting module is used to perform read-write mount settings on the disk volume after security configuration;

[0012] The mount association module is used to mount and associate the working directory of the container with the disk volume after the container is started, so as to prevent the container escape attack from running in the working directory of the container.

[0013] In a third aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute the container escape defense method provided in the above embodiment.

[0014] The container escape defense method, device, and storage medium provided by the embodiments of the present invention are to allocate the corresponding disk volume according to the container settings before the container is started, and to perform security configuration on the disk volume; to perform read-write mount settings on the disk volume after the security configuration; and to mount and associate the working directory of the container with the disk volume after the container is started, so as to prevent the container escape attack from running in the working directory of the container. Before the container runs, the corresponding storage disk volume is set, and the disk volume is processed accordingly in advance. After the container runs, the processed disk volume is associated with the container, so that when the container is running, the allocated disk volume prevents the critical commands and programs from running, and prevents the device files from being accessed. The control of the container working directory is achieved by controlling the disk volume, without the need to set a complex security mechanism or monitor the container business, and can achieve a good defense effect against container escape attacks without incurring additional overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0016] Figure 1 It is a flowchart of a container escape prevention method provided in Embodiment 1 of the present invention;

[0017] Figure 2 is a flow chart of a container escape defense method provided in Embodiment 2 of the present invention;

[0018] Figure 3 It is a schematic diagram of the structure of a container escape protection device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0020] Embodiment 1

[0021] Figure 1 : is a flow chart of a container escape prevention method provided in Embodiment 1 of the present invention. This embodiment is applicable to preventing container escape and reducing security risks. The method can be executed by a container escape prevention device and specifically includes the following steps:

[0022] Step 110: before the container is started, the corresponding disk volume is allocated according to the container settings, and the disk volume is securely configured.

[0023] In this embodiment, before the container is started, the host machine can select a suitable disk volume in the host machine according to the configuration parameters of the container input by the user or obtain the hard disk storage resource information required by the container from the configuration file of the container, and allocate the disk volume to the corresponding container.

[0024] Optionally, in this embodiment, a virtual disk can be created according to the storage requirements of the container settings, and the virtual disk can be used as a disk volume. A virtual disk is a disk in a remote computer that is virtualized in the host machine. When used, it is the same as the container's own hard disk. By using virtual disk management, not only can the impact between containers corresponding to different virtual disks be isolated as much as possible, but also the impact of host machine operations on virtual disks can be avoided, further avoiding the occurrence of container escape.

[0025] After allocating the corresponding disk volume, the allocated disk volume needs to be securely configured to prevent the container from escaping. Exemplarily, the virtual disk can be securely configured using the file system mount setting parameters in the Linux system. Exemplarily, the mount command is used to enable the noexec, nosuid, and nodev security options. The noexec option prevents any program from being executed on this partition. The nosuid option prevents set-user-ID and set-group-ID programs from running on this partition. This avoids the security risks that these programs may bring to the system. The nodev option prevents access to device files. The above settings can be used to improve the security of the allocated disk volumes and reduce the chance of container escape.

[0026] Step 120, read and write mount settings are performed on the disk volume after the security configuration.

[0027] The disk volume after security configuration can be set for read-write mounting according to the role of the container. Exemplarily, for containers that implement simple services, the disk volume can be set to read-only, while for complex services that require interaction, it needs to be set to read-write. Optionally, when using a virtual disk, the security attributes of the virtual disk can be set before the mounting settings are performed. And set the virtual disk to the specified directory of the host machine to facilitate subsequent mounting with the container. Exemplarily, after the virtual disk is created, the security options are configured and configured as "rw noexec nosuid nodev". After configuring the security options, the virtual disk is mounted in the / home / docker_mount / vol1 / directory, and the directory is mounted read-write. Characters or block devices on the file system cannot be read, binary files cannot be executed, and suid cannot be modified.

[0028] Step 130, after the container is started, the working directory of the container is mounted and associated with the disk volume to prevent the container escape attack from running in the working directory of the container.

[0029] After completing the above configuration, the working directory of the container can be mounted and associated with the disk volume. In this embodiment, the working directory can be defined according to the function of the container, and is usually a directory that requires read and write operations. For example, the / var / html / directory of the nginx container can have multiple working directories. After the container is started, the working directory can be mounted and associated with the disk volume through the configuration file corresponding to the container. Make the working directory fall into the disk volume that has been securely configured. Using the above method, the directory that needs to be written in the container is set as the working directory, and it is mounted separately to the disk volume that has been securely configured. The control of the container's working directory is achieved by controlling the disk volume, which has a good defense effect on container escape attacks and does not incur additional overhead.

[0030] This embodiment allocates the corresponding disk volume according to the container settings before the container is started, and performs security configuration on the disk volume; performs read-write mount settings on the disk volume after security configuration; and after the container is started, the working directory of the container is mounted and associated with the disk volume to prevent container escape attacks from running in the working directory of the container. Before the container runs, the corresponding storage disk volume is set, and the disk volume is processed accordingly in advance. After the container runs, the processed disk volume is associated with the container, so that when the container is running, the allocated disk volume prevents key commands and programs from running, and prevents access to device files. The control of the container working directory is achieved by controlling the disk volume, without the need to set up a complex security mechanism or monitor the container business, and can achieve a good defense effect against container escape attacks without incurring additional overhead.

[0031] In a preferred implementation of this embodiment, the allocation of the corresponding disk volume according to the container settings can be specifically optimized as: the same disk volume is allocated according to at least two container settings. With the above method, multiple containers can use the same disk volume after security configuration, reducing the waste of hard disk storage resources.

[0032] Furthermore, the allocation of the corresponding disk volume according to the container setting can be optimized as follows: the allocation of the corresponding first disk volume and the second disk volume according to a container setting, and correspondingly, the mounting and associating of the working directory of the container with the disk volume, can be optimized as follows: mounting and associating the working directory of the container with the first disk volume; and the following steps can be added: pull up the container, and mount and associate the working directory of the container with the first disk volume and the second disk volume. Using the above method, when the capacity of the disk volume allocated for the first time cannot meet the container requirements, an additional disk volume with the same security configuration can be added for it. The purpose of preventing container escape is achieved.

[0033] In addition, in another case, the security configurations of the first disk volume and the second disk volume may be different. The first disk volume uses the file system mount setting parameters in the Linux system to perform security configuration on the virtual disk, and performs comprehensive settings for different possible risks. After the container is running, it may be found that the security configuration of the first disk volume is too strict, making some services unable to be executed. To avoid the above situation, the second disk volume can be securely configured according to the business situation to meet business needs, and the second disk volume and the corresponding directory can be loaded in a suspended manner. While achieving the purpose of defending against container escape, business needs can be met as much as possible.

[0034] Embodiment 2

[0035] Figure 2 It is a flow chart of the container escape defense method provided in the second embodiment of the present invention. This embodiment is optimized based on the above embodiment, and the method can also add the following steps: according to the container configuration file, find the path where the container stores files on the host machine; use security tags to control the directory corresponding to the path.

[0036] See also Figure 2 , the container escape defense method comprises:

[0037] Step 210: Before the container is started, the corresponding disk volume is allocated according to the container settings, and the disk volume is securely configured.

[0038] Step 220, read and write mount settings are performed on the disk volume after the security configuration.

[0039] Step 230: After the container is started, the working directory of the container is mounted and associated with the disk volume to prevent the container escape attack from running in the working directory of the container.

[0040] Step 240, according to the container configuration file, find the path where the container stores files on the host machine.

[0041] In the above steps, the storage area corresponding to the working directory of the container has been securely configured, but there is still an escape risk for the non-working directory. Therefore, in this embodiment, it is necessary to first determine the storage path corresponding to the non-working directory.

[0042] Exemplarily, according to the container configuration file, automatically find the path where the container stores files on the host machine. Exemplarily, it can include: according to the characteristics of the overlayfs mechanism, find the read-write layer of the container; and determine the path where the container stores files on the host machine according to the read-write layer.

[0043] According to the characteristics of the Linux system overlayfs, find out its read-write layer, that is, the diff and merge directories. OverlayFS is a file system service for Linux, which implements a joint mount for other file systems. OverlayFS involves the merging of directory access when two file systems provide directories with the same name. In this way, non-working directories can be found in the host machine. Correspondingly, the non-working directory corresponds to the working directory. All directories in the container except the working directory can be defined as non-working directories. The process in the container only has write permission to the readable and writable layer, and other layer processes are read-only (Read-Only). The read-write layer can be used to find the corresponding directories, that is, the diff and merge directories.

[0044] Step 250: Use security tags to control the directory corresponding to the path.

[0045] For non-working directories, writing should be controlled to prevent the generation of malicious programs or scripts. Use security tags to control these directories. Set the security tags of the diff and merge directories to readonly, that is, add read-only control tags to the directories and the files in the directories. When the container performs write operations in places other than the / var / html / directory, they will be rejected by the read-only security tag. Currently, most attacks require at least write permissions. Restricting write operations on all directories except those defined as working area directories can largely avoid the generation of malicious scripts or software. The permissions of the divided working directories can be customized by users and can be changed at any time. Especially during the operation of the container, the security tags of the non-working directories can still be adjusted in the above way to ensure the normal operation of the container.

[0046] This embodiment adds the following steps: according to the container configuration file, find the path where the container stores files on the host machine; use the security mark to control the directory corresponding to the path. The above method can be used to add read-only control marks to files in paths other than the working directory. When the container performs write operations in places other than the working directory, they will be rejected by the read-only security mark. Since most attacks require at least write permissions, restricting write operations to all directories except those defined as workspace directories can largely avoid the generation of malicious scripts or software. The possibility of defending against container escape is further improved.

[0047] Embodiment 3

[0048] Figure 3 is a schematic diagram of the structure of the container escape protection device provided in the third embodiment of the present invention, see Figure 3 , the container escape protection device comprises:

[0049] A setting allocation module 310 is used to allocate corresponding disk volumes according to container settings before the container is started, and to perform security configuration on the disk volumes;

[0050] The read-write mount setting module 320 is used to perform read-write mount settings on the disk volume after security configuration;

[0051] The mount association module 330 is used to mount and associate the working directory of the container with the disk volume after the container is started, so as to prevent the container escape attack from running in the working directory of the container.

[0052] The container escape defense device provided in this embodiment allocates the corresponding disk volume according to the container settings before the container is started, and performs security configuration on the disk volume; performs read-write mount settings on the disk volume after the security configuration; after the container is started, the working directory of the container is mounted and associated with the disk volume to prevent the container escape attack from running in the working directory of the container. Before the container runs, the corresponding storage disk volume is set, and the disk volume is processed accordingly in advance. After the container runs, the processed disk volume is associated with the container, so that when the container is running, the allocated disk volume prevents key commands and programs from running, and prevents access to device files. The control of the container working directory is achieved by controlling the disk volume, without the need to set a complex security mechanism or monitor the container business, and can achieve a good defense effect against container escape attacks without incurring additional overhead.

[0053] Based on the above embodiments, the configuration allocation module includes:

[0054] A virtual disk creation unit, configured to create a virtual disk according to the storage requirements of the container setting, and to allocate a corresponding disk volume to the container setting using the virtual disk;

[0055] Accordingly, the device further comprises:

[0056] The security attribute setting module is used to set the security attributes of the virtual disk.

[0057] Based on the above embodiments, the device further includes:

[0058] The path search module is used to find the path where the container stores files on the host machine according to the container configuration file;

[0059] The control module is used to control the directory corresponding to the path using the security mark.

[0060] Based on the above embodiments, the path finding module includes:

[0061] A read-write layer finding unit, used to find the read-write layer of the container according to the characteristics of the overlayfs mechanism;

[0062] A path determination unit is used to determine a path for storing files in the container on the host machine according to the read-write layer.

[0063] Based on the above embodiments, the control module includes:

[0064] Add a read-only control mark to the directory and the files in the directory.

[0065] Based on the above embodiments, the configuration allocation module includes:

[0066] The security configuration unit is used to perform security configuration on the virtual disk by using the file system mounting setting parameters in the Linux system.

[0067] Based on the above embodiments, the configuration allocation module includes:

[0068] The first allocation unit is configured to allocate the same disk volume according to at least two container settings.

[0069] Based on the above embodiments, the configuration allocation module includes:

[0070] A second allocation unit is used to allocate the corresponding first disk volume and second disk volume according to a container setting;

[0071] Correspondingly, the mounting association module includes:

[0072] A first mounting association unit, configured to mount and associate the working directory of the container with the first disk volume;

[0073] The device also includes:

[0074] The second mounting association unit is used to pull up the container and mount and associate the working directory of the container with the first disk volume and the second disk volume.

[0075] The container escape defense device provided in the embodiment of the present invention can execute the container escape defense method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0076] Embodiment 4

[0077] Embodiment 4 of the present invention further provides a storage medium containing computer executable instructions, which, when executed by a computer processor, are used to execute any of the container escape defense methods provided in the above embodiments.

[0078] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device.

[0079] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0080] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0081] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or device. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0082] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A container escape defense method, characterized in that: include: Before the container is started, the corresponding disk volume is allocated according to the container settings, and the disk volume is securely configured, wherein the security configuration includes: preventing the execution of any program, preventing the set-user-ID and set-group-ID programs from running, and preventing access to device files; After the disk volume is configured for read and write mounting, it is not possible to read character or block devices on the file system, and it is not possible to execute binary files; After the container is started, the working directory of the container is mounted and associated with the disk volume through the configuration file corresponding to the container to prevent the container escape attack from running in the working directory of the container.

2. The method according to claim 1, characterized in that The allocating corresponding disk volumes according to the container settings includes: Create a virtual disk according to the storage requirements of the container setting, and use the virtual disk as a disk volume corresponding to the container setting; Accordingly, before the working directory of the container is mounted and associated with the disk volume, the method further includes: Security attributes are set for the virtual disk.

3. The method according to claim 1, characterized in that The method further comprises: According to the container configuration file, find the path where the container stores files on the host machine; The directory corresponding to the path is controlled by using security tags.

4. The method according to claim 3, characterized in that The step of searching the path where the container stores files on the host machine according to the container configuration file includes: According to the characteristics of the overlayfs mechanism, find out the read-write layer of the container; The path where the container stores the file on the host machine is determined according to the read-write layer.

5. The method according to claim 4, characterized in that The controlling the directory corresponding to the path by using the security mark includes: Add a read-only control mark to the directory and the files in the directory.

6. The method according to claim 2, characterized in that The step of configuring the disk volume for security includes: The virtual disk is securely configured using file system mount setting parameters in the Linux system.

7. The method according to claim 1, characterized in that The allocating corresponding disk volumes according to the container settings includes: Allocate the same disk volume from at least two container settings.

8. The method according to claim 1, characterized in that The allocating corresponding disk volumes according to the container settings includes: Allocate a corresponding first disk volume and a second disk volume according to a container setting; Correspondingly, the step of mounting and associating the working directory of the container with the disk volume includes: Mounting and associating the working directory of the container with the first disk volume; The method further comprises: The container is launched, and a working directory of the container is mounted and associated with the first disk volume and the second disk volume.

9. A container escape protection device, characterized in that: include: A setting allocation module is used to allocate the corresponding disk volume according to the container setting before the container is started, and to perform security configuration on the disk volume. The security configuration includes: preventing the execution of any program, preventing the set-user-ID and set-group-ID programs from running, and preventing access to device files; The read-write mount setting module is used to set the read-write mount of the disk volume after security configuration. It cannot read characters or block devices on the file system and cannot execute binary files. The mount association module is used to mount and associate the working directory of the container with the disk volume through the configuration file corresponding to the container after the container is started, so as to prevent the container escape attack from running in the working directory of the container.

10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions are used to execute the container escape defense method as described in any one of claims 1 to 8 when executed by a computer processor.

Images