Process processing method and device, computer equipment and program product

Abstract

The present specification provides a process processing method, which, after a first system call for switching a target process is received, acquires a pointer pointing to a second structure from a first structure of a namespace of the target process in a case where a first parameter of a namespace type to be switched by the first system call is a first set value. The first structural body is used for recording basic information of the namespace, and the second structural body is used for recording the namespace to which the target process belongs. And finally, switching the target process to all namespaces recorded in the second structural body according to the pointer. Through the mutual cooperation of the first set value and the pointer, a mechanism for ensuring the consistency switching of the namespace is provided, so as to prevent the container escape caused by the incomplete namespace switching. And moreover, switching of multiple namespaces is completed in one-time system calling, so that compared with the scheme of the related technology, the system calling times are reduced, race conditions are avoided, and the overhead caused by multiple times of system calling is reduced.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer application technology, and in particular, to a process processing method, apparatus, computer equipment, and program product. Background Art

[0002] In computer devices, a container is a lightweight virtualization technology that can package applications and their dependencies together to form a portable, self-contained operating environment. Container tools are software tools used to develop, build, deploy, and manage containerized applications.

[0003] Container tools often need to interact with containers, and generally the container tools complete the interaction process through the process of interacting with the container in the host machine. In the prior art, during the interaction between the container tool and the container, there are problems such as container escape and host machine security. Summary of the invention

[0004] In view of this, one or more embodiments of the present specification provide a process processing method, apparatus, computer device, and program product.

[0005] According to a first aspect of one or more embodiments of this specification, a process processing method is proposed, including:

[0006] Receiving a first system call for switching a namespace of a target process, wherein the first system call has a first parameter for indicating a type of namespace to be switched;

[0007] If the value of the first parameter is a first set value indicating all related namespaces, a first structure of the namespace associated with the target process is obtained, and a second structure pointed to is determined using the variable value of the target member variable in the first structure as a pointer; the first structure is used to record basic information of the namespace, and the second structure is used to record the namespace to which the target process belongs;

[0008] The target process is switched to each namespace recorded in the second structure.

[0009] According to a second aspect of one or more embodiments of this specification, a process processing device is provided, including:

[0010] A system call receiving module, configured to receive a first system call for switching a namespace of a target process, wherein the first system call has a first parameter for indicating a type of namespace to be switched;

[0011] A structure determination module, configured to obtain a first structure of the namespace associated with the target process if the value of the first parameter is a first set value indicating all related namespaces, and determine a second structure pointed to by using the variable value of the target member variable in the first structure as a pointer; the first structure is used to record basic information of the namespace, and the second structure is used to record the namespace to which the target process belongs;

[0012] A namespace switching module is used to switch the target process to each namespace recorded in the second structure.

[0013] According to a third aspect of the embodiments of this specification, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the above-mentioned process processing method is implemented.

[0014] According to a fourth aspect of the embodiments of this specification, a computer device is provided, the computer device comprising:

[0015] processor;

[0016] a memory for storing processor-executable instructions;

[0017] The processor implements the above process processing method by running the executable instructions.

[0018] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, and when the computer program product is executed by a processor, the process processing method described above is implemented.

[0019] This specification provides a process processing method. After receiving a first system call for switching a target process, when the first parameter of the first system call indicating the namespace type to be switched is a first set value, a pointer to a second structure is obtained from the first structure of the namespace of the target process. The first structure is used to record basic information of the namespace, and the second structure is used to record the namespace to which the target process belongs. Finally, according to the pointer, the target process is switched to all the namespaces recorded in the second structure. Through the mutual cooperation of the first set value and the above-mentioned pointer, a mechanism is provided to ensure the consistent switching of the namespace to prevent the escape of the container caused by the incomplete namespace switching. Moreover, the switching of multiple namespaces is completed in one system call, which reduces the number of system calls compared to the solutions of the related art, avoids race conditions, and reduces the overhead caused by multiple system calls.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0022] Figure 1 It is a schematic diagram of the architecture of the container in the related technology shown in this specification.

[0023] Figure 2 It is a flowchart of a process processing method shown in this specification according to an exemplary embodiment.

[0024] Figure 3 It is a flowchart of a first system call shown in this specification according to an exemplary embodiment.

[0025] Figure 4 It is a flowchart of a second system call shown in this specification according to an exemplary embodiment.

[0026] Figure 5 It is a block diagram of a process processing device shown in this specification according to an exemplary embodiment.

[0027] Figure 6 It is a hardware structure diagram of a computer device shown in this specification according to an exemplary embodiment. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0029] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0030] Containers are a lightweight virtualization technology that encapsulates applications and their dependencies (such as configuration files, libraries, and frameworks). Through containers, you can easily and conveniently build an application process runtime environment without modifying the host configuration, and run the container in the runtime environment. Through container encapsulation, the container running inside the container and the host can be isolated, making it impossible for the container to access the host.

[0031] like Figure 1 As shown, Figure 1 The diagram shows the architecture of the container. From the bottom to the top, there are the host hardware resources (such as CPU, hard disk, and network), the host software system (operating system), the container engine, and the container. The container engine is responsible for creating, running, stopping, and deleting containers. The container encapsulates the application itself and the dependencies required by the application (such as bins / libs shown in the figure).

[0032] A container tool is a tool used to develop, build, deploy, and manage containerized applications, such as Docker, Podman, Kubernetes, etc. The container engine and container tool depend on each other.

[0033] Container tools often need to interact with containers frequently. In actual applications, it is found that in applications such as continuous integration and continuous delivery / continuous deployment of containers, this interactive process has become the main target for attackers to escape from containers. The attacker mentioned here is the initiator of the container.

[0034] Next, we will analyze how attackers can escape from containers. For easier understanding, we will explain the interaction between container tools and containers.

[0035] The process of interaction between the container tool and the container is generally as follows: the container tool creates a process for interaction between the container and the container tool as the host (hereinafter referred to as the interaction process for the convenience of explanation), the container tool requests access to the container environment, and the host responds to the request and uses the host's interaction process to access the untrusted container environment.

[0036] Although the container cannot access the host machine, an attacker may embed a malicious payload in the container (for example, embed a malicious executable code snippet in the library) and induce the interactive process to execute the malicious payload. Since the interactive process is a process of the host machine, the execution result of the malicious payload will act on the host machine, which will cause the container to escape, that is, the attacker will penetrate horizontally from the container environment to the host machine and perform unauthorized operations. In addition, since the interactive process is a process of the host machine and can access the host machine's files, the container may also steal the host machine's files through the interactive process.

[0037] In the related art, in order to prevent the container from escaping, the interactive process is generally switched to the namespace where the container is located to ensure that the impact generated during the access to the container only acts on the container environment.

[0038] Specifically, namespace is a set of isolation mechanisms provided by the Linux kernel that can encapsulate a set of system resources into a separate environment. By switching the interactive process to a namespace, the system resources that the interactive process can access are limited to the environment of the namespace. By switching the interactive process to a specific namespace, the system resources that the interactive process can access are limited.

[0039] In the related technology, switching the interactive process to a namespace cannot completely avoid the container escape problem.

[0040] Specifically, there are multiple namespaces in the related art, and the multiple namespaces are used to encapsulate different types of system resources, such as namespaces for isolating process IDs, namespaces for isolating files, etc. The specific multiple namespaces will be described in detail later, and will not be repeated here.

[0041] After observing the process of interactive processes switching to namespaces, we found that for performance reasons, container tools usually do not switch interactive processes to all namespaces where containers are located.

[0042] Specifically, in the related art, namespace switching is generally achieved through a specific system call, hereinafter referred to as the first system call. The first system call is used to switch the process to an existing namespace, but only one namespace can be switched at a time. In the above scenario, if the interactive process is switched to all types of namespaces to which the interactive process belongs, the first system call needs to be called multiple times. During this process, race conditions may occur and it is vulnerable to attacks. Moreover, each system call needs to switch from user mode to kernel mode, resulting in a large overhead. As a result, in the related art, all namespaces are generally not switched due to factors such as performance control. However, incomplete namespace switching will still cause information leakage in the host machine, and attackers in the container can escape the container through the namespace that the interactive process has not entered.

[0043] In order to solve the above problem, the present specification improves the original first system call. Specifically, in the first parameter of the first system call, an additional possible value is provided: a first setting value, which can indicate that the target process is switched to all namespaces in one system call.

[0044] However, simply increasing the first setting value cannot complete the switching of all namespaces. Specifically, the first system call can generally only access the file corresponding to one namespace. However, the file corresponding to the namespace in the kernel does not store the association relationship between all namespaces in the system (for example, they are associated with the same process). The structure stored in the file corresponding to one namespace accessed by the first system call alone cannot complete the synchronous switching of the mutually related namespaces.

[0045] In view of the above problem, in order to enable the system to know all the namespaces of the target process during the execution of the first system call, a pointer to a second structure is added to the first structure storing basic information of the namespace, and the second structure is used to record all the namespaces to which the target process belongs. In this way, when the first parameter takes the first set value, the second structure recording the namespaces to which the target process belongs can be obtained through the pointer, and the process of switching the target process to all namespaces is completed based on the second structure.

[0046] It can be seen that, through the cooperation between the first set value and the above pointer, a mechanism is provided to ensure the consistency of the container namespace switching at the kernel level, so as to prevent the container from escaping due to incomplete namespace switching. In addition, multiple namespace switching is completed in one system call, which reduces the number of system calls compared to the solutions of related technologies, avoids race conditions, and reduces unnecessary overhead caused by multiple system calls.

[0047] Next, a process processing method provided in this specification will be described in detail.

[0048] The improvement of the method provided in this specification is reflected in two aspects. The first aspect is the extension of the existing structure and system call parameters. The second aspect is the optimization method performed when switching namespaces based on the extension of the first aspect.

[0049] First, the extension of the existing structure and system call parameters is described. For ease of understanding, the namespace, several structures and system calls involved in this specification are introduced here.

[0050] First, introduce various namespaces:

[0051] 1. PID Namespace: One of the namespaces in the Linux kernel, used to isolate process IDs. In a PIDNamespace, the PID of a process starts at 1, and it can only see processes in the same namespace and its own child processes. Different namespaces have a parent-child relationship and are organized in a tree structure. The parent namespace can see the processes in the child namespace, but the processes in the child namespace cannot perceive the existence of the parent namespace, so they cannot affect the processes in the parent namespace.

[0052] 2. Mount Namespace: One of the namespaces in the Linux kernel, it is an important part of the container file system isolation mechanism. It provides a method to isolate file system mount points so that each container has its own independent file system environment.

[0053] 3. Network Namespace: One of the namespaces in the Linux kernel, used to isolate network resources. Each Network Namespace has its own network device, IP address, routing table, / proc / net directory, port number, etc. Each Network Namespace will have a loopback device (there will be no other network devices), so users need to make their own network configuration in it.

[0054] 4. IPC Namespace: One of the namespaces in the Linux kernel, used to isolate resources for inter-process communication. There are many types of inter-process communication under Linux (such as sockets, shared memory, Posix message queues, and SystemV IPC, etc.). The resources used for inter-process communication in each IPC namespace are not visible to processes in other IPC namespaces.

[0055] 5. UTS Namespace: One of the namespaces in the Linux kernel, used to isolate host names and domain names.

[0056] 6. User Namespace: One of the namespaces in the Linux kernel, used to isolate user IDs and group IDs, that is, the user and group IDs of the process in the UserNamespace can be different from their user IDs and group IDs in the host. User Namespace can ensure that after the root user in the container escapes to the host, he has only ordinary user permissions and cannot perform privileged operations.

[0057] A system call is a way for a user space program to request an operating system kernel service. A system call can be generated in response to a command line input by a user in a user space program. For example, a user can input a command line, or content similar to a command line, through an interface provided by a user space program. The user space program initiates a system call based on the content input by the user and executes the user's command. In addition, a system call can also be generated by a user space program itself, for example, a system call can be initiated in a specific situation based on the user's operating status or operating logic.

[0058] The first system call is used to call a thread to move to a structure of an existing namespace. In a Linux system, the system call may be setns(). In the related art, the system call generally includes two parameters, which are referred to as the first parameter and the second parameter in this application.

[0059] The first parameter is used to indicate the type of namespace to be switched. The possible parameter value can be a specific namespace type. Generally, it can only take one specific value. In setns() of Linux system, this parameter can be 'nstype', which is a parameter of int type. The possible parameter value can be any of the following identifiers: CLONE_NEWIPC, CLONE_NEWNET, etc. CLONE_NEWNET can indicate switching to the namespace Network Namespace that encapsulates network resources, and CLONE_NEWIPC can indicate switching to the namespace IPC Namespace that encapsulates IPC resources.

[0060] The second parameter is used to indicate the file object representing the namespace in the kernel. Since there may be multiple namespaces of each type, the file object can be used to determine which namespace is specifically indicated. In addition, since this parameter indicates a file object of a certain namespace, the data corresponding to the specifically indicated namespace can be obtained through this parameter, such as the first structure mentioned later. It should be noted that the first structure may also be referred to as the first type of structure in this specification, which represents a certain type of structure, and each namespace may correspond to a first structure.

[0061] In setns() of the Linux system, the second parameter may be 'fd', which is a parameter of int type. In a specific implementation, it may be a file descriptor.

[0062] In the related art, the type of the namespace corresponding to the file indicated by the second parameter needs to be the same as the content in the first parameter. For example, if the first parameter is CLONE_NEWNET, then the second parameter needs to reference the network namespace.

[0063] It can be seen from the above description that, due to the restrictions of the first parameter and the second parameter, each first system call in the related art can only switch the process to one namespace.

[0064] Based on this, this specification expands the first parameter. In addition to the parameter values ​​mentioned above, the first parameter can also be a first setting value, and the first setting value indicates that the process is switched to all related namespaces of the process. Through the first parameter, the system can determine that the process needs to be switched to all namespaces in one system call.

[0065] In this specification, the first setting value may be specifically referred to as “CLONE_ALLNS”.

[0066] In addition, for the value of the second parameter when the first parameter is the first setting value. In the related art, when the first parameter is 0, the second parameter can indicate any type of namespace file. Therefore, the properties of the first setting value in this specification are similar to the properties of the parameter value 0. When the first parameter is the first setting value, similar to the value 0, the second parameter can indicate any type of namespace file.

[0067] As described above, when the first parameter takes the first set value, since the second parameter can only indicate a file in one namespace, it is impossible to obtain other namespaces associated with the target process based on the file object in one namespace indicated by the second parameter, and thus it is impossible to switch the process to all associated namespaces in one first system call. Therefore, correspondingly, the method of this specification also expands the member variables in the first structure.

[0068] The first structure may be a structure that records basic information of a namespace, and is a common data structure included in all namespaces. For example, the first structure may be ns_common.

[0069] In the first structure, a target member variable is added, and the target member variable is a pointer type. The default value of the target member variable is empty (such as "NULL"). When the various namespaces to which the process belongs are related to each other, the value of the target member variable can be a pointer to the second structure.

[0070] The second structure may be a structure used to record and manage the namespace to which the process belongs. It should be noted that the second structure may also be referred to as a second-type structure, which refers to a specific type of structure that each process may have. Unless otherwise specified, the second structure referred to in this specification generally refers to: the second structure of the target process.

[0071] In the Linux system, the second structure may be nsproxy, and correspondingly, the target member variable may be a variable of the struct*nsproxy type. The target member variable may be named ns_proxy.

[0072] Since the first structure is a common data structure included in all namespaces, the above extension ensures that no matter which namespace the second parameter points to, the corresponding pointer data pointing to the second structure can be found in the file indicated by the second parameter. Thus, the second structure is obtained, and the namespaces of the process are determined, so that the process can be switched to all the namespaces in one first system call.

[0073] In addition to the extensions mentioned above, the present specification may also extend the parameters of the second system call to facilitate adding a pointer to the target member variable of the first structure. Of course, the extension of the second system call does not limit the present specification.

[0074] The second system call is used to create a process, for example, it can be used to create the above-mentioned interactive process. The second system call has a third parameter, and the third parameter can at least indicate the type of namespace created for the interactive process. For example, in the Linux system, when applied to the container scenario, the second system call can be clone(), and the third parameter can be 'flags'. 'flags' is used to specify the behavior when creating a process, and different specific behaviors can be indicated by different parameter values. For example, multiple type identifiers can be used to indicate the type of namespace created for the process. Specifically, if 'flags' contains identifiers such as _CLONE_NEWIPC, CLONE_NEWPID, CLONE_NEWUSER, CLONE_NEWNS_, clone() will create a new namespace for the newly created process and add the newly created process to these namespaces.

[0075] In order to facilitate setting each namespace to be associated with each other (i.e., synchronous switching is required) while creating the target process, the possible parameter values ​​of the third parameter are expanded. The possible parameter value is newly expanded: the second setting value. When the third parameter includes the second setting value, each namespace can be set to be associated with each other, and then the pointer to the second structure can be recorded in the target member variable of the first structure of each newly created namespace.

[0076] As for the specific presentation of the second setting value, it can be the same as the first setting value, such as “CLONE_ALLNS.” Of course, the second setting value can also be different from the first setting value, and this specification does not limit this.

[0077] In addition, for the second structure, in order to conveniently determine whether various namespaces are related to each other through the second structure, a second member variable can be added to the second structure, and the second member variable can indicate whether various namespaces recorded in the second structure are related to each other.

[0078] For example, the second member variable can be a member variable of bool type, and the default value can be "false", which indicates that they are not related to each other. When the third parameter of the second system call includes the second set value (of course, the second member variable can also be modified through other system calls or possible means), the second member variable can be modified to "true", which can indicate that the various namespaces (PID, UTS, IPC, MNT, Network, User, Cgroup, etc.) recorded in the nsproxy instance owned by the current process are related to each other, that is, when switching to any of the namespaces, other types of namespaces must also be switched synchronously. The second member variable can be named ns_cascade.

[0079] Of course, the second member variable can also be of other types, and the above example does not limit this specification. For example, the second member variable is of int type, and the default value is 0, indicating that the namespaces are not associated with each other. When it is 1, it indicates that the namespaces are associated with each other.

[0080] After explaining the possible extensions to the structure and system calls, the specific implementation of this method will be described next. Figure 2 As shown, Figure 2 A flow chart of a process processing method is shown, comprising:

[0081] Step 101: Receive a first system call for switching a target process's namespace.

[0082] The first system call has a first parameter for indicating the type of namespace to be switched.

[0083] The method can be applied to a Linux system, and specifically, the method can be executed by a kernel of a Linux system. When implemented, the method can be applied to a Linux operating system in the form of a patch. In addition, the specific description of the first system call and the first parameter is detailed in the previous text, and will not be repeated here.

[0084] As for the application scenarios of this method, the method can be applied to container scenarios, and the corresponding target process is the interactive process mentioned above, that is, the target process is the host process used to realize the interaction between the container tool and the container.

[0085] When applied to container scenarios, container tools (Docker, Podman, Kubernetes, etc.) can be implemented by modifying the first system call parameters when applying the method provided in this specification. The method shown in this specification can also be implemented by using a third system call to achieve efficient and secure interaction between container tools and containers, avoiding container escape vulnerabilities during the interaction process. Among them, the third system call refers to a mechanism that allows a process to register a user space callback function to handle system calls. Specifically, the third system call can be: prctl system call. Furthermore, the above-mentioned mechanism can specifically be the PR_SET_SYSCALL_USER_DISPATCH mechanism.

[0086] As mentioned above, if the process has an incomplete namespace switch, it will cause the container to escape, threatening the security of the host. Therefore, this method can be used to avoid container escape. Of course, this example does not limit this specification. If there are other scenarios where all namespaces need to be switched in one system call, this method can also be used in other scenarios to complete the namespace switch.

[0087] The first system call may be a system call initiated by a user space program to the system, for example, in a container scenario, it may be a system call initiated by a container tool to the system. Receiving the first system call is to receive a request initiated by the user space program.

[0088] As for how the user space program generates the first system call, it can be a command input by a user received according to a specific interface. The command can be in the form of a first system call, or a specific command can be encapsulated as a specific interactive control in a user-oriented interface, and the user can send the command by interacting with the control. The user space program can initiate the first system call according to the command. In the above case, the first parameter and the second parameter that may be included in the first system call are also provided by the user through the interface.

[0089] In addition, as mentioned above, the system call may also be automatically called by the user space program according to the current state. In this case, the user space program may detect that there is a need to switch the target process to all namespaces to which it belongs, and automatically call the system call including the first parameter and the corresponding second parameter. In the above case, the first parameter is set to the first setting value, and the second parameter may be a file object of any namespace to which the determined target process belongs.

[0090] Step 103, if the first parameter value is a first set value indicating all related namespaces, obtain a first structure of the namespace associated with the target process, and use the variable value of the target member variable in the first structure as a pointer to determine the second structure pointed to.

[0091] The first structure is used to record basic information of a namespace, and the second structure is used to record the namespace to which the target process belongs.

[0092] Specifically, after receiving the first system call, it can be determined whether it is necessary to switch to all associated namespaces based on whether the first parameter of the first system takes the first set value. When it is determined that switching is required, a pointer to the second structure is obtained from the first structure of the associated namespace, and the data in the second structure is obtained according to the pointer. The second structure stores information about various namespaces of the target process. Through the second structure, information that cannot be directly obtained from the parameters of the first system call can be obtained, that is, which namespaces are associated with the target process, thereby switching the target process to all namespaces in one system call.

[0093] Next, step 103 will be described in detail. The specific description of the first structure, the first set value, the target member variable and the second structure is as described above, which will not be repeated here.

[0094] In step 103, it is first determined whether the value of the first parameter is the first set value. If so, it is determined that the various namespaces of the target process are related to each other and need to be switched synchronously. Then the execution logic mentioned in step 103 will be executed.

[0095] If not, the original execution logic of the first system call is executed, that is, only the namespace of the value type corresponding to the first parameter is switched. In other words, if the value of the first parameter is a first type namespace, the target process is switched to the first type namespace. In this way, the goal to be achieved by the method provided in this specification is achieved without changing the original function of the first system call.

[0096] Wherein, when the first system call has a second parameter, obtaining the first structure of the namespace associated with the target process may be to obtain the first structure of the namespace corresponding to the file in the namespace pointed to by the second parameter from the file.

[0097] Specifically, the first system call has a second parameter for indicating a file object representing a namespace; obtaining the first structure of the namespace associated with the target process includes: calling a first system function, and obtaining the first structure according to the value of the second parameter.

[0098] As mentioned above, a target member variable is added to the first structure. When various namespaces of the target process are interrelated, a pointer to the second structure is recorded in the target member variable. Therefore, a pointer as a variable value can be obtained from the target member variable, and the second structure can be obtained based on the pointer.

[0099] Among them, for the specific method of obtaining the target member variable, it can be to use the first system function for obtaining the content of the namespace to obtain the first structure object instance indicated in the parameter value of the second parameter. Combined with the specific example given above, the first system function can be get_proc_ns(), which can obtain the ns_common object instance in the namespace structure instance according to the second parameter 'fd', and obtain the variable value of the target member variable.

[0100] In this way, without changing the number and type of parameters of the original first system call and without adding new parameters (such as adding parameters for recording the file identifier of the second structure in the first system call), the first structure is obtained using the content indicated by the existing parameters, thereby achieving the purpose of the method in this specification with a small amount of improvement.

[0101] In addition, in some cases, the first parameter takes the first set value, but the variable value of the target member variable of the first structure may not be a pointer. Therefore, after obtaining the first structure, it can be determined whether the variable value of the target member variable is empty. If the variable value is empty, the original execution logic of the first system call is executed, that is, only the target process is switched to the namespace corresponding to the file indicated by the second variable. If the variable value of the target member variable is not empty, continue to obtain the second structure.

[0102] In other words, determining the second structure pointed to includes: judging whether the variable value of the target member variable is empty; if it is not empty, determining the variable value as a pointer, and obtaining the second structure pointed to by the pointer.

[0103] Step 105: Switch the target process to each namespace recorded in the second structure.

[0104] Specifically, after determining that the target process needs to be switched to all namespaces according to step 103 and obtaining the respective namespaces of the target process, the target process can be switched to the respective namespaces recorded in the second structure, thereby completing the unified synchronous switching of the namespaces in one system call.

[0105] Among them, as for the specific switching means, the second structure can be used as a parameter of the function for switching namespaces to complete the switching of the namespace of the target process, so that the target process is switched to a set of namespaces cascaded in the second structure instance.

[0106] In a specific implementation, the function for switching namespaces here may be switch_task_namespace().

[0107] In addition, as described above, a second member variable may be added to the second structure to record whether the namespaces in the second structure are related to each other. In this case, in order to ensure the accuracy of the switching, step 105 may include: obtaining the variable value of the second member variable recorded in the second structure, and when the variable value is a third set value, switching the target process to each namespace recorded in the second structure.

[0108] The third setting value indicates that each namespace is related to each other, which is true or 1 in the above specific example. That is, the target process will be switched to each namespace recorded in the second structure only when the variable value of the second member variable in the second structure indicates that each namespace is related to each other.

[0109] The above description of the second member variable does not limit the present specification. The method of the present specification can also be executed when the second member variable does not exist.

[0110] Next, we will use the specific examples given above to illustrate the execution logic of the first system call. Figure 3 As shown, Figure 3 A flow chart showing the execution logic of the first system call.

[0111] First, the user state initiates a system call setns(int fd, int nstype), which is the first system call. Int indicates the type of the parameter values ​​of the two parameters, fd indicates the second parameter, and nstype indicates the first parameter.

[0112] After receiving the system call, the kernel state will obtain the first structure, that is, struct ns_common*ns = get_proc_ns(fd). Struct indicates that the following ns_common*ns data is the first structure, ns_common*ns is the first structure of a namespace, and get_proc_ns is the auxiliary function mentioned above, which is used to obtain the specific content in the second parameter fd. Through this auxiliary function, the first structure can be obtained according to the file identifier in the second parameter.

[0113] Next, it can be determined whether the target member variable is not empty and whether the value of the first parameter is the first set value. If the target member variable is not empty and the value of a parameter is the first set value, the second structure is obtained, otherwise the original execution logic of the first system call is executed. That is, when ns.ns_proxy! = NULL && nstype = CLONE_ALLNS, the second member variable struct nsproxy*new_nsproxy = ns.ns_proxy is obtained according to the value of the target member variable.

[0114] It should be noted that the specific example given here is to judge the target member variable and the value of the first parameter together. The above provides another specific example, that is, first determine whether the value of the first parameter is the first set value, then obtain the target member variable and determine whether the target member variable is empty. Both examples can be used as implementation methods in this specification, as long as it is finally achieved: obtaining the second structure when the first parameter is the first set value and the target member variable is not empty, it can be used as a specific implementation method of this specification.

[0115] Finally, when all namespaces need to be switched, switch_task_namespaces(new_nsproxy) is called to switch the target process to all namespaces in the second structure new_nsproxy.

[0116] In addition, as for how to fill in the target member variable and the second member variable as a pointer and a third set value respectively, they can be modified according to a specific system call that can modify the structure content of a namespace or a process.

[0117] In addition, in order to more easily implement the modification, the second system call for creating a new process can also be optimized, and the target member variable and the second member variable can be modified to corresponding values ​​while creating a new target process and its corresponding namespace. The above-mentioned optimized second system call will be described below.

[0118] Specifically, if Figure 4 As shown, before receiving the system call, you can also:

[0119] First, a second system call for creating a target process is received. Correspondingly, the operation in the user state is to initiate the second system call.

[0120] The second system call has a third parameter, whose value includes a plurality of type identifiers and a second setting value; the second setting value indicates that the namespaces of the plurality of type identifiers are set to be associated with each other.

[0121] The third parameter value of the second system call may indicate the type of namespace to be created. When the third parameter value includes the second setting value, it may indicate that the created namespaces are set to be associated with each other.

[0122] As described above, the second system call may be clone, and the third parameter may be flag, which may represent an operation that needs to be performed synchronously when clone is executed.

[0123] For example, the second system call may be: clone(CLONE_NEWPID|...|CLONE_ALLNS), which indicates that when creating the target process, a namespace of the PID type is created, and each created namespace is set to be associated with each other. Here, CLONE_NEWPID, etc. is one of the several type identifiers.

[0124] Second, create a number of namespaces corresponding to the number of type identifiers for the target process, and record the number of namespaces in the second structure.

[0125] Correspondingly, after the process is created in response to the second system call, several namespaces corresponding to the type identifiers may also be created for the target process. The information of these namespaces will be stored in the second structure (such as nsproxy) instance of the newly created process.

[0126] Third, in the first structures corresponding to the plurality of namespaces respectively, the variable value of the target member variable is set to a pointer pointing to the second structure.

[0127] The first and second steps are similar to the implementation methods in the related art, except that the second system call adds a possible parameter value of the third parameter of the second system call. When the third parameter value includes the second set value, what is different from the implementation method of the second system call in the related art is that the variable value of the target member variable will be set as a pointer to the second structure in the first structures corresponding to the newly created namespaces.

[0128] The second setting value is used to indicate that the namespaces of several type identifiers are set to be mutually associated. In this way, when the target process needs to be switched to mutually associated namespaces, the pointers stored in the first structure corresponding to each namespace can be used to conveniently switch the target process to several mutually associated namespaces.

[0129] In addition, when the third parameter includes the second set value, compared with the implementation method of the second system call in the related art, the following may also be performed:

[0130] Fourth, the second member variable in the second structure is set to a third set value, which is used to indicate that the namespaces recorded in the second structure are associated with each other.

[0131] Since the second setting value indicates that several namespaces are set to be associated with each other, when the second system is called, the second member variable in the second structure can also be set to a third setting value indicating that various namespaces are associated with each other, so that when the first system is called, the correctness of the execution of the first system is increased by the third setting value. In this way, when the target member variable in the first structure is filled with wrong data, such as a pointer to the second structure corresponding to another process, the first system call cannot be completed, thereby ensuring the correctness of the first system call.

[0132] As described above, the second member variable may be the member variable ns_cascade extended in the second structure, and the third setting value may be "true" or 1, etc., which is not limited in this specification.

[0133] It should also be noted that the step executed in the fourth step may not be executed when the third parameter of the second system call includes the second set value, or may be executed under the triggering of other conditions. In other words, the target member variable of the first structure and the second member variable in the second structure may not be modified together.

[0134] From the above introduction, it can be seen that in the related technology, switching a process to a container environment requires multiple calls to the system call setns() at the user level to complete. This process requires multiple executions of system calls, which has a large performance overhead, and there are race conditions between multiple calls to setns() that can be exploited by attackers.

[0135] This specification proposes a namespace synchronization switching scheme based on the system call setns() extension. Since each namespace in the Linux kernel in the related art exists independently, the namespaces that constitute the container environment are not cascaded with each other. The method provided in this specification associates the various namespaces that constitute the container at the kernel level, and at the same time extends the existing system call setns() for namespace switching to add support for cascaded namespace synchronization switching, and provides a corresponding system call interface to the user space. This enables the external process of the container to efficiently switch to the multiple namespaces where the container is located in an atomic manner (that is, there is no time interval between switching to each namespace). The method provided in this specification can switch the target process to multiple cascaded namespaces in a first system call.

[0136] This method has the following advantages: First, it reduces the overall performance overhead. A single system call can complete the cascade switching of multiple namespaces, and the related extensions have little impact on the performance of the kernel. The performance overhead introduced is less than 1 millisecond, which is negligible.

[0137] Second, security is improved. It can avoid container escape problems caused by incomplete namespace switching and security issues caused by race conditions during non-atomic switching.

[0138] Third, it has good compatibility. The expansion and modification of the existing kernel data structure and functions by this solution will not affect its original usage.

[0139] Fourth, it is easy to use. In the container scenario, the container tool can use the method provided in this specification by simply modifying the system call parameters.

[0140] Corresponding to the embodiments of the aforementioned method, this specification also provides embodiments of an apparatus and a computer device to which it is applied.

[0141] like Figure 5 As shown, Figure 5 is a block diagram of a process processing device according to an exemplary embodiment of the present specification, the device comprising:

[0142] The system call receiving module 410 is used to receive a first system call for switching a namespace of a target process, wherein the first system call has a first parameter for indicating a type of namespace to be switched;

[0143] The structure determination module 420 is used to obtain a first structure of the namespace associated with the target process if the first parameter value is a first set value indicating all related namespaces, and determine a second structure pointed to by using the variable value of the target member variable in the first structure as a pointer; the first structure is used to record basic information of the namespace, and the second structure is used to record the namespace to which the target process belongs;

[0144] The namespace switching module 430 is used to switch the target process to each namespace recorded in the second structure.

[0145] In an optional implementation, the namespace switching module 430 is further configured to: if the value of the first parameter is a first type namespace, switch the target process to the first type namespace.

[0146] In an optional implementation, the first system call has a second parameter for indicating a file object representing a namespace; the structure determination module 420 is specifically used to call the first system function and obtain the first structure according to the value of the second parameter.

[0147] In an optional implementation, the structure determination module 420 is specifically used to determine whether the variable value of the target member variable is empty; if it is not empty, determine the variable value as a pointer, and obtain the second structure pointed to by the pointer.

[0148] In an optional embodiment, the device also includes a second system call module 400 (not shown in the figure), which is used to receive a second system call for creating a target process; the second system call has a third parameter, whose value includes several type identifiers and a second set value; the second set value indicates that the namespaces of the several type identifiers are set to be associated with each other; several namespaces corresponding to the several type identifiers are created for the target process, and the several namespaces are recorded in the second structure; in the first structures corresponding to the several namespaces respectively, the variable value of the target member variable is set to a pointer to the second structure.

[0149] In an optional implementation, the second system call module 400 is further used to set the second member variable in the second structure to a third set value, so as to indicate that the namespaces recorded in the second structure are associated with each other.

[0150] In an optional implementation, the namespace switching module 430 is specifically used to obtain the variable value of the second member variable recorded in the second structure, and when the variable value is a third set value, switch the target process to each namespace recorded in the second structure.

[0151] In an optional implementation, the method is applied to a Linux operating system, the first system call is setns(), the second system call is clone(), the first structure is ns_common, and the second structure is nsproxy.

[0152] In an optional implementation, the target process is a host process used to implement interaction between the container tool and the container.

[0153] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0154] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0155] like Figure 6 As shown, Figure 6 A hardware structure diagram of a computer device where the process processing device of the embodiment is located is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0156] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification. The processor implements the above method by running executable instructions.

[0157] The memory 1020 for storing processor executable instructions can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020.

[0158] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0159] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0160] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0161] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0162] The embodiments of this specification also provide a computer program product, which implements the above-mentioned process processing method when executed by a processor.

[0163] The embodiments of the present specification also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned process processing method is implemented.

[0164] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0165] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0166] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0167] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

Claims

1. A process processing method, comprising: Receiving a first system call for switching a namespace of a target process, wherein the first system call has a first parameter for indicating a type of namespace to be switched; If the value of the first parameter is a first set value indicating all related namespaces, a first structure of the namespace associated with the target process is obtained, and a second structure pointed to is determined using the variable value of the target member variable in the first structure as a pointer; the first structure is used to record basic information of the namespace, and the second structure is used to record the namespace to which the target process belongs; The target process is switched to each namespace recorded in the second structure.

2. The method according to claim 1, wherein: Also includes: If the first parameter value is a first type namespace, the target process is switched to the first type namespace.

3. The method according to claim 1, wherein: The first system call has a second parameter for indicating a file object representing a namespace; the obtaining of a first structure of a namespace associated with the target process includes: The first system function is called, and the first structure is obtained according to the value of the second parameter.

4. The method according to claim 1, wherein: The second structure to be pointed to includes: Determine whether the variable value of the target member variable is empty; If it is not empty, the variable value is determined as a pointer, and the second structure pointed to by the pointer is obtained.

5. The method according to claim 1, wherein: Before receiving the first system call for switching the namespace of the target process, the method further includes: receiving a second system call for creating a target process; the second system call has a third parameter, whose value includes a plurality of type identifiers and a second setting value; the second setting value indicates that the namespaces of the plurality of type identifiers are set to be associated with each other; Creating a number of namespaces corresponding to the number of type identifiers for the target process, and recording the number of namespaces in the second structure; In the first structures respectively corresponding to the plurality of namespaces, the variable value of the target member variable is set to a pointer pointing to the second structure.

6. The method according to claim 5, wherein: The step of recording the plurality of namespaces in the second structure includes: The second member variable in the second structure is set to a third set value to indicate that the namespaces recorded in the second structure are associated with each other.

7. The method according to claim 6, wherein: Switching the target process to each namespace recorded in the second structure includes: The variable value of the second member variable recorded in the second structure is obtained, and when the variable value is a third set value, the target process is switched to each namespace recorded in the second structure.

8. The method according to claim 5, wherein: The method is applied to a Linux operating system, the first system call is setns(), the second system call is clone(), the first structure is ns_common, and the second structure is nsproxy.

9. The method according to claim 1, wherein: The target process is a host process used to implement interaction between the container tool and the container.

10. A process processing device, comprising: A system call receiving module, configured to receive a first system call for switching a namespace of a target process, wherein the first system call has a first parameter for indicating a type of namespace to be switched; A structure determination module, configured to obtain a first structure of the namespace associated with the target process if the value of the first parameter is a first set value indicating all related namespaces, and determine a second structure pointed to by using the variable value of the target member variable in the first structure as a pointer; the first structure is used to record basic information of the namespace, and the second structure is used to record the namespace to which the target process belongs; A namespace switching module is used to switch the target process to each namespace recorded in the second structure.

11. A computer program product, wherein when the computer program product is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

12. A computer device comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 9 by running the executable instructions.

Images