Application management and control method for multi-namespace scene

Abstract

The invention relates to a multi-namespace scene-oriented application management and control method, which relates to the field of computer technology, and comprises the following steps of: when multiple namespaces are created, generating IDs of the multiple namespaces and names of the multiple namespaces, recording a corresponding relationship, setting a management and control strategy for the multi-namespace application, and importing the management and control strategy into a strategy module; the method comprises the following steps: expanding a process security mark, adding an ID (Identity) of a multi-namespace, modifying the ID of the multi-namespace corresponding to a process in the multi-namespace from 0 to a value of the ID of the multi-namespace during starting, judging whether the ID of the multi-namespace recorded in the process mark is 0 or not when an application program is executed, determining an execution permission based on whether the ID of the multi-namespace recorded in the process mark is 0 or not, and when the application program is networked, executing the multi-namespace according to the execution permission. Judging whether the multi-namespace ID of the networking program is 0 or not, determining the networking permission based on whether the multi-namespace ID is 0 or not, judging whether the multi-namespace ID in the process mark of the process is 0 or not when the process needs to be killed, and determining the anti-killing permission of the process based on whether the multi-namespace ID is 0 or not.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an application management and control method for a multi-namespace scenario. Background Art

[0002] With the development of computer cloud computing technology, cloud computing has gradually become the mainstream and is chosen by more and more users as the primary computing and storage method. The underlying layer of cloud computing is mainly based on Docker containers and other technologies that use namespace isolation to divide resources, files, devices, status, and configuration into an independent space. Although container programs run in an isolated space, there are also various security issues such as container escape, which can damage the system and threaten system security.

[0003] The existing mandatory access control method divides the related objects including processes and files in the system into two types: subject and object, sets corresponding tags for the subject and object, and then customizes specific mandatory access control rules to restrict the subject's operations on the object. This security method requires setting specific tags on the mounted files after the container file system is mounted before the container runs. It requires additional operations to mark the container file system, and it is necessary to set different tags for different files according to the customized policy. It is necessary to record the correspondence between files and tags, which makes the whole process more complicated. And after modifying the policy, it may be necessary to restart the container to take effect. Summary of the invention

[0004] To solve the above problems, the present invention provides an application management method for a multi-namespace scenario, which adopts the following technical solutions: An application management and control method for a multi-namespace scenario includes: When creating multiple namespaces, calling a multiple namespace engine module to generate IDs and multiple namespace names of the multiple namespaces and recording a correspondence between the IDs of the multiple namespaces and the multiple namespace names, the multiple namespace engine module being located at the application layer; After the multi-namespace is created, the user sets a control policy for the multi-namespace application in the multi-namespace, and the multi-namespace engine module imports the created control policy into the policy module based on the corresponding relationship, and the policy module is located in the kernel layer; Extend the process security tag and add the ID of the multiple namespaces; When the multi-namespace is started, the multi-namespace engine module is called to modify the multi-namespace ID corresponding to the process in the multi-namespace from a default value to the value of the ID of the multi-namespace, wherein each process has a corresponding process tag, the process tag includes the multi-namespace ID, and the default value of the multi-namespace ID in the process tag is 0; When an application is executed, determine whether the multi-namespace ID recorded in the process tag of the process corresponding to the application is 0, and determine whether the permission control module needs to call the management and control policy to determine the execution permission of the application based on whether it is 0; When an application needs to be connected to the Internet, determine whether the multi-namespace ID recorded in the process tag of the process corresponding to the connected program is 0, and determine whether the permission control module needs to call the management and control policy to determine the application's Internet access permission based on whether it is 0; When there is a process that needs to be killed, it is determined whether the multi-namespace ID recorded in the process tag of the process is 0, and based on whether it is 0, it is determined whether the permission control module needs to call the management and control policy to determine the anti-killing permission of the application.

[0005] In another possible implementation, the multiple namespaces are distinguished by multiple namespace names at the application layer, and the multiple namespaces are distinguished by multiple namespace IDs at the kernel layer. The control policy includes a control object, which is the ID or multiple namespace name of the multiple namespace to be controlled. The control policy created by the multiple namespace engine module is imported into the policy module based on the corresponding relationship, including: Based on the correspondence, the multi-namespace engine module converts the control object recorded in the control policy from a multi-namespace name to a multi-namespace ID, obtains the converted control policy, and imports the converted control policy into the policy module.

[0006] In another possible implementation, the policy module saves the received control policy through the policy library, and determines whether the permission control module needs to call the control policy to determine the execution permission of the application program based on whether the value is 0, including: If it is 0, it is determined that the application does not belong to the application in the multiple namespaces, and the execution permission of the application is determined through the application execution control process defined by the system; If it is not 0, the application is determined to be a multi-namespace application, and the policy module queries the policy library to see whether there is a control policy corresponding to the application: if so, the permission control module calls the control policy to determine the execution permission of the application; if not, the permission control module directly determines that the execution permission of the application is allowed.

[0007] In another possible implementation, the policy module saves the received control policy through the policy library, and determines whether the permission control module needs to call the control policy to determine the network permission of the application program based on whether it is 0, including: If it is 0, it is determined that the application does not belong to the application in the multiple namespaces, and the network permission of the application is determined through the application network control process defined by the system; If it is not 0, the application is determined to be a multi-namespace application, and the policy module queries the policy library to see whether there is a management policy corresponding to the application: if so, the permission control module calls the management policy to determine the application's networking permission; if not, the permission control module directly determines that the application's networking permission is to allow networking.

[0008] In another possible implementation, the policy module saves the received control policy through the policy library, and determines whether the permission control module needs to call the control policy to determine the anti-killing permission of the application program based on whether the value is 0, including: If it is 0, it is determined that the process does not belong to the process in the multi-namespace, and the anti-killing permission of the application is determined through the process anti-killing process defined by the system; If it is not 0, it is determined that the process is a process of a multi-namespace application, and the policy module queries the policy library to see whether there is a control policy corresponding to the process: if so, the permission control module calls the control policy to determine the anti-kill permission of the process; if not, the permission control module directly determines that the anti-kill permission of the application is to allow it to be killed.

[0009] In summary, this application includes the following beneficial technical effects: By using policies to perform fine-grained security control on applications in multi-namespace scenarios, the security mechanism and specific control policies are separated, and the application control requirements in different scenarios can be achieved by modifying the control policies. The control policies are simple and can be flexibly configured as needed, which not only brings security but also provides flexible control capabilities. In addition, only the subject is marked, and no mark is set for the controlled object. There is no need to maintain the file object mark, which is more concise and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 This is an application management and control framework diagram for a multi-namespace scenario in an embodiment of the present application.

[0011] Figure 2 It is a schematic diagram of an application management and control execution process in a multi-namespace scenario in an embodiment of the present application.

[0012] Figure 3 It is a schematic diagram of the application management and control networking processing flow in a multi-namespace scenario in an embodiment of the present application.

[0013] Figure 4 It is a schematic diagram of the application control process anti-killing processing flow in a multi-namespace scenario in an embodiment of the present application. DETAILED DESCRIPTION

[0014] The present application is further described in detail below in conjunction with the accompanying drawings.

[0015] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0016] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0017] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0018] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0019] The present application embodiment provides an application management method for a multi-namespace scenario, such as Figure 1 As shown, the method is implemented by four parts: a multi-namespace engine module, a multi-namespace application, a policy module, and a permission control module. The multi-namespace engine module is located at the application layer and is connected to the multi-namespace and policy module. It is used to record the relationship between the ID of the created multi-namespace and the multi-namespace name, and based on the multi-namespace ID tag and the ID of the multi-namespace application corresponding to the multi-namespace, import the control policy into the policy module and set it to its process security domain; The policy module is located in the kernel layer and is connected to the multi-namespace engine module and the permission control module. It is used to receive the control policy imported by the multi-namespace engine module, and query, update and provide the control policy to the permission control module when making policy judgment or policy setting; The permission control module is located in the kernel layer and is connected to the policy module. It is used to call the control policy provided by the policy module and control the execution, networking and whether the process of the application can be killed based on the control policy.

[0020] The specific implementation of this method is as follows: Step S101, when creating multiple namespaces, calling a multiple namespace engine module to generate multiple namespace IDs and multiple namespace names and record the correspondence between the multiple namespace IDs and the multiple namespace names, the multiple namespace engine module being located at the application layer.

[0021] For the embodiments of the present application, since multi-namespace scenarios commonly include containers such as Docker and sandboxes, the Docker container is used as an example here for ease of understanding. When the Docker command is used to create a Docker container, the multi-namespace engine module is called to generate the ID (container ID) and container name of the Docker container.

[0022] Since the container name that is easy to read and understand is displayed at the user application layer, and the container ID that is easy to process and has better performance is used at the kernel layer, the multi-namespace engine module in this application also has the function of recording the correspondence between the container ID and the container name, so that the container name can be found through the container ID or the container ID can be found through the container name.

[0023] Step S102, after the multi-namespace is created, the user sets a management and control policy for the multi-namespace application in the multi-namespace, and the multi-namespace engine module imports the created management and control policy into the policy module based on the corresponding relationship. The policy module is located in the kernel layer.

[0024] For the embodiments of the present application, continuing with the above example, after the docker container is created, the user sets a control policy for the application in the docker container. The control policy includes four parts: control object, control type, controlled object and permission. Among them, the control object is the container ID / container name of the container to be controlled, the control type is one of application execution control, application networking control and process anti-killing, the controlled object is the Jedi path of the file or directory inside the container, and the permission is one of allow and deny. That is, at the application layer, the control object recorded in the control policy is the container name, and at the kernel layer, the container ID needs to be used. Therefore, when the multi-namespace engine module imports the created control policy into the policy module, it is necessary to first convert the container name of the control object recorded in the control policy into the corresponding container ID based on the corresponding relationship to obtain the converted control policy, and then import the converted control policy into the policy module.

[0025] Step S103, extending the process tag and adding the ID of multiple namespaces.

[0026] For the embodiment of the present application, continuing with the above example, in order to distinguish which container the process generated by the application at runtime belongs to, the process tag is extended and a multi-namespace ID is added, that is, a multi-namespace ID is added to each process, and the default value of the multi-namespace ID is 0.

[0027] Step S104, when the multi-namespace is started, the multi-namespace engine module is called to modify the multi-namespace ID corresponding to the process in the multi-namespace from the default value to the value of the multi-namespace ID, wherein each process has a corresponding process tag, and the process tag includes the multi-namespace ID.

[0028] For the embodiments of the present application, continuing with the above example, when the docker container is started, the multi-namespace engine module is called to modify the multi-namespace ID of the init process of the docker container from the default value 0 to the container ID of the docker container. Since the child process will inherit the security domain data of its parent process, and all processes in the docker container are descendants of the init process, that is, at this time, the multi-namespace IDs corresponding to all processes in the docker container are the container ID, which indicates that all processes belong to this docker container. The multi-namespace ID in the process tag of the process can be used to know which container the process belongs to.

[0029] Step S105, when an application is executed, determine whether the multi-namespace ID recorded in the process tag of the process corresponding to the application is 0, and based on whether it is 0, determine whether the permission control module needs to call the management policy to determine the execution permission of the application.

[0030] For the embodiment of the present application, the above example is continued. Figure 2 As shown in the figure, it is the application management execution control processing flow of the multi-namespace scenario. When an application is executed, it is determined whether the multi-namespace ID recorded in the process tag of the process corresponding to the application is 0. When it is 0, it means that the process corresponding to the application does not belong to the process in the docker container. The execution permission of the application is determined through the application execution control flow defined by the system (corresponding to Figure 2), and when it is not 0, it means that the process corresponding to the application belongs to the process in the docker container. Since the policy module saves the received control policy through the policy library, the policy module queries from the policy library whether there is a control policy corresponding to the application (the control object of the control policy corresponding to the application is the container ID, the control type is execution control, and the controlled object is the absolute path of the executed file in the container). When it is, the permission control module determines the execution permission of the application according to the control policy, that is, the permission control module determines whether the execution permission allows the program to execute or denies the program to execute according to the permission recorded in the control policy, and when it is not, the permission control module directly determines that the execution permission of the application is to allow the program to execute.

[0031] Step S106, when there is an application that needs to connect to the Internet, determine whether the multi-namespace ID recorded in the process tag of the process corresponding to the connected program is 0, and based on whether it is 0, determine whether the permission control module needs to call the management and control policy to determine the application's networking permissions.

[0032] For the embodiment of the present application, the above example is continued. Figure 3 The figure shows the application management and networking control processing flow in the multi-namespace scenario. When an application needs to be connected to the Internet, it is determined whether the multi-namespace ID recorded in the process tag of the process corresponding to the application is 0. If it is 0, it means that the process corresponding to the application does not belong to the process in the docker container. The application networking control flow defined by the system is used to determine the application's networking permissions (corresponding to Figure 3 ), and when it is not 0, it means that the process corresponding to the application belongs to the process in the docker container. Since the policy module saves the received control policy through the policy library, the policy module queries from the policy library whether there is a control policy corresponding to the application (the control object of the control policy corresponding to the application is the container ID, the control type is network control, and the controlled object is the absolute path of the networked program in the container). When it is, the permission control module determines the network permission of the application according to the control policy, that is, the permission control module determines whether the network permission allows the program to connect to the Internet or denies the program to connect to the Internet according to the permission recorded in the control policy. When it is not, the permission control module directly determines that the network permission of the application is to allow the program to connect to the Internet.

[0033] Step S107, when there is a process that needs to be killed, determine whether the multi-namespace ID recorded in the process tag of the process is 0, and based on whether it is 0, determine whether the permission control module needs to call the management and control policy to determine the anti-killing permission of the application.

[0034] For the embodiment of the present application, the above example is continued. Figure 4 The figure shows the process of application control and anti-killing in multi-namespace scenarios. When killing a process, it is determined whether the multi-namespace ID recorded in the process tag of the process is 0. If it is 0, it means that the process corresponding to the application does not belong to the process in the docker container. The system-defined application process anti-killing process is used to determine the application's anti-killing permissions (corresponding to Figure 4 ), and when it is not 0, it means that the process belongs to the process in the docker container. Since the policy module saves the received control policy through the policy library, the policy module queries from the policy library whether there is a control policy corresponding to the process (the control object of the control policy corresponding to the process is the container ID, the control type is process anti-killing, and the controlled object is the absolute path of the program file of the killed process in the container). When it is, the permission control module determines the anti-killing permission of the process according to the control policy, that is, the permission control module determines whether the anti-killing permission allows the process to be killed or refuses to be killed according to the permission recorded in the control policy. When it is not, the permission control module directly determines that the anti-killing permission of the process is to allow the process to be killed.

[0035] This application uses policies to perform fine-grained security control on applications in multi-namespace scenarios, separates security mechanisms from specific control policies, and can achieve application control requirements in different scenarios by modifying control policies. The control policy is simple and can be flexibly configured as needed, which brings security and provides flexible control capabilities. In addition, only the subject is marked, and no mark is set for the controlled object. There is no need to maintain the file object mark, which is more concise and efficient.

[0036] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0037] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An application management and control method for a multi-namespace scenario, characterized in that: include: When creating multiple namespaces, calling a multiple namespace engine module to generate IDs and multiple namespace names of the multiple namespaces and recording a correspondence between the IDs of the multiple namespaces and the multiple namespace names, the multiple namespace engine module being located at the application layer; After the multi-namespace is created, the user sets a control policy for the multi-namespace application in the multi-namespace, and the multi-namespace engine module imports the created control policy into the policy module based on the corresponding relationship, and the policy module is located in the kernel layer; Extend the process security tag and add the ID of the multiple namespaces; When the multi-namespace is started, the multi-namespace engine module is called to modify the multi-namespace ID corresponding to the process in the multi-namespace from a default value to the value of the ID of the multi-namespace, wherein each process has a corresponding process tag, the process tag includes the multi-namespace ID, and the default value of the multi-namespace ID in the process tag is 0; When an application is executed, determine whether the multi-namespace ID recorded in the process tag of the process corresponding to the application is 0, and determine whether the permission control module needs to call the management and control policy to determine the execution permission of the application based on whether it is 0; When an application needs to be connected to the Internet, determine whether the multi-namespace ID recorded in the process tag of the process corresponding to the connected program is 0, and determine whether the permission control module needs to call the management and control policy to determine the application's Internet access permission based on whether it is 0; When there is a process that needs to be killed, it is determined whether the multi-namespace ID recorded in the process tag of the process is 0, and based on whether it is 0, it is determined whether the permission control module needs to call the management and control policy to determine the anti-killing permission of the application.

2. According to the application management method for multiple namespace scenarios according to claim 1, it is characterized in that: The multiple namespaces are distinguished by the multiple namespace names at the application layer, and are distinguished by the multiple namespace IDs at the kernel layer. The control strategy includes a control object, which is the ID or multiple namespace name of the multiple namespace to be controlled. The control strategy created by the multiple namespace engine module is imported into the policy module based on the corresponding relationship, including: Based on the correspondence, the multi-namespace engine module converts the control object recorded in the control policy from a multi-namespace name to a multi-namespace ID, obtains the converted control policy, and imports the converted control policy into the policy module.

3. According to the application management method for multiple namespace scenarios according to claim 1, it is characterized in that: The policy module saves the received control policy through the policy library, and determines whether the permission control module needs to call the control policy to determine the execution permission of the application program based on whether the value is 0, including: If it is 0, it is determined that the application does not belong to the application in the multiple namespaces, and the execution permission of the application is determined through the application execution control process defined by the system; If it is not 0, the application is determined to be a multi-namespace application, and the policy module queries the policy library to see whether there is a control policy corresponding to the application: if so, the permission control module calls the control policy to determine the execution permission of the application; if not, the permission control module directly determines that the execution permission of the application is allowed.

4. According to the application management method for multiple namespace scenarios according to claim 1, it is characterized in that: The policy module saves the received control policy through the policy library, and determines whether the control policy needs to be called by the permission control module to determine the network permission of the application program based on whether the value is 0, including: If it is 0, it is determined that the application does not belong to the application in the multiple namespaces, and the network permission of the application is determined through the application network control process defined by the system; If it is not 0, the application is determined to be a multi-namespace application, and the policy module queries the policy library to see whether there is a management policy corresponding to the application: if so, the permission control module calls the management policy to determine the application's networking permission; if not, the permission control module directly determines that the application's networking permission is to allow networking.

5. According to the application management method for multiple namespace scenarios according to claim 1, it is characterized in that: The policy module saves the received control policy through the policy library, and determines whether the permission control module needs to call the control policy to determine the anti-killing permission of the application program based on whether the value is 0, including: If it is 0, it is determined that the process does not belong to the process in the multi-namespace, and the anti-killing permission of the application is determined through the process anti-killing process defined by the system; If it is not 0, it is determined that the process is a process of a multi-namespace application, and the policy module queries the policy library to see whether there is a control policy corresponding to the process: if so, the permission control module calls the control policy to determine the anti-kill permission of the process; if not, the permission control module directly determines that the anti-kill permission of the application is to allow it to be killed.

Images