Method, device, storage medium and electronic device for loading kernel extension

Abstract

The embodiment of the specification discloses a method, device, storage medium and electronic equipment for loading a kernel extension program, which sends the kernel extension program to a target security container deployed in a host computer through a controller deployed in the host computer, so that the target security container provides the kernel extension program to a user process in a virtual machine started by the target security container, then loads the kernel extension program through the user process, and if a business program executes to a specific kernel position embedded by at least one hook point corresponding to the kernel extension program, obtains log data generated by the kernel extension program during runtime through a tracking module running in a kernel space, thereby breaking through the limitation of a virtualization layer of the target security container, loading the kernel extension program into a user space, realizing behavior detection and interception in the target security container, and realizing precise control of security containers in a cluster.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, storage medium, and electronic device for loading kernel extension programs. Background Technology

[0002] Security aspects deployed on the host can enable secure observation and interception of malicious files, processes, and networks within the host and runc (a container runtime conforming to the Open Container Initiative) containers. With the development of cloud-native technologies, and considering the security of isolation, more and more vendors are choosing to use rund (a secure container runtime), such as Kata containers (which build a secure container using lightweight virtual machine technology), as their container deployment environment. Rund containers are implemented through virtualization technology and have an independent kernel. The security capabilities of traditional kernel extensions deployed on the host cannot penetrate the virtualization layer of rund containers, thus failing to effectively intercept and audit malicious processes, files, and network access within rund containers, and making it impossible to detect intrusion risks within rund containers. Summary of the Invention

[0003] The purpose of the embodiments in this specification is to provide a method, apparatus, storage medium, and electronic device for loading kernel extension programs.

[0004] This specification provides an embodiment of a method for loading a kernel extension program, the method comprising:

[0005] The kernel extension is sent to the target security container deployed on the host machine by a controller deployed on the host machine, so that the target security container provides the kernel extension to the user-mode process in the virtual machine launched by the target security container;

[0006] The kernel extension program is loaded by the user-mode process, so that the kernel extension module running in the kernel space corresponding to the virtual machine runs the loaded kernel extension program;

[0007] If the business program executes to a specific kernel location where at least one hook point corresponding to the kernel extension is embedded, the tracing module running in the kernel space obtains the log data generated by the kernel extension during runtime, and the tracing module provides the log data to the controller through the user-mode process.

[0008] Furthermore, the step of sending the kernel extension program to the target security container deployed on the host machine via a controller deployed on the host machine includes:

[0009] The system receives user-issued custom rules from a controller deployed on the host machine, and selects target security containers from multiple security containers deployed on the host machine according to the custom rules. The custom rules include kernel extensions.

[0010] The controller sends the kernel extension to the target secure container.

[0011] Furthermore, the custom rules also include application name information and / or application identifier information;

[0012] The step of selecting the target security container from multiple security containers deployed on the host machine according to the custom rule includes:

[0013] Based on the application name information and / or the application identifier information, a target security container is selected from multiple security containers deployed on the host machine.

[0014] Further, the step of sending the kernel extension program to the target secure container deployed on the host machine via a controller deployed on the host machine, so that the target secure container provides the kernel extension program to the user-mode process in the virtual machine started by the target secure container, includes:

[0015] The kernel extension is sent by a controller deployed on the host machine to a virtualization device implemented by a target secure container deployed on the host machine, so that the virtualization device provides the kernel extension to the user-mode process in the virtual machine launched by the target secure container.

[0016] Furthermore, the user-mode process runs in a sidecar container, which is an auxiliary container that runs together with the business container in the user space corresponding to the virtual machine.

[0017] Furthermore, the method also includes: obtaining the first loading status corresponding to the kernel extension program through the user-mode process, and providing the first loading status to the controller.

[0018] Furthermore, the method also includes:

[0019] The controller sends the first uninstallation instruction corresponding to the kernel extension to the target security container, so that the target security container provides the first uninstallation instruction to the user-mode process.

[0020] The user-mode process uninstalls the kernel extension program based on the first uninstallation instruction, causing the kernel extension module to stop running the kernel extension program.

[0021] Furthermore, the method also includes:

[0022] The controller sends the target security rules corresponding to the kernel extension to the target security container, so that the target security container provides the target security rules to the user-space process.

[0023] The user-mode process loads the target security rule into the kernel extension program, so that the kernel extension module embeds the hook point corresponding to the target security rule into a specific kernel location.

[0024] Furthermore, the method also includes: obtaining the second loading status corresponding to the target security rule through the user-mode process, and providing the second loading status to the controller.

[0025] Furthermore, the method also includes:

[0026] The controller sends the second unload instruction corresponding to the target security rule to the target security container, so that the target security container provides the second unload instruction to the user-space process;

[0027] The user-space process uninstalls the target security rule in the kernel extension program based on the second uninstallation instruction, thereby causing the kernel extension module to remove the hook point corresponding to the target security rule from the kernel space.

[0028] This specification also provides an apparatus for loading kernel extension programs, comprising:

[0029] The control module is used to send the kernel extension program to the target security container deployed on the host machine through the controller deployed on the host machine, so that the target security container provides the kernel extension program to the user-mode process in the virtual machine started by the target security container;

[0030] A loading module is used to load the kernel extension program through the user-mode process, so that the kernel extension module running in the kernel space corresponding to the virtual machine runs the loaded kernel extension program;

[0031] The log acquisition module is used to acquire log data generated by the kernel extension program during runtime by a tracing module running in the kernel space if the business program executes to a specific kernel location where at least one hook point corresponding to the kernel extension program is embedded, so that the tracing module provides the log data to the controller through the user-mode process.

[0032] This specification also provides a storage medium storing a computer program adapted to be loaded by a processor and to execute the steps of the method described above.

[0033] This specification also provides an electronic device, including a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method described above.

[0034] This specification also provides a computer program product that stores at least one instruction, characterized in that the at least one instruction, when executed by a processor, implements the steps of the above-described method.

[0035] According to the technical solution of the embodiments of this specification, a controller deployed on the host machine can send a kernel extension program to a target security container deployed on the host machine. The target security container then provides the kernel extension program to a user-space process in a virtual machine started by the target security container. The user-space process loads the kernel extension program, causing a kernel extension module running in the kernel space corresponding to the virtual machine to execute the loaded kernel extension program. If the business program executes to a specific kernel location embedded at least one hook point corresponding to the kernel extension program, a tracing module running in the kernel space obtains the log data generated by the kernel extension program during runtime. The tracing module then provides the log data to the controller through the user-space process. This allows the limitation of the target security container's virtualization layer to be overcome, enabling the kernel extension program to be loaded into the user space, achieving behavior detection and interception within the target security container. Furthermore, the controller can achieve precise control and unified management of security containers within the cluster. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating a method for loading a kernel extension program, provided as an embodiment of this specification.

[0037] Figure 2 This is a schematic diagram of an architecture for loading kernel extension programs in a host machine, provided as an embodiment of this specification.

[0038] Figure 3 This is a schematic diagram of a device for loading kernel extension programs, provided as an embodiment of this specification.

[0039] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0041] Please see Figure 1 This is a flowchart illustrating a method for loading a kernel extension program provided in an embodiment of this specification. In this embodiment, the method for loading a kernel extension program is applied to a device for loading kernel extension programs (hereinafter referred to as a "kernel extension program loading device") or an electronic device equipped with a kernel extension program loading device. The following will focus on... Figure 1 The process shown will be described in detail. The method for loading kernel extension programs may specifically include the following steps:

[0042] S102, the kernel extension program is sent to the target security container deployed on the host machine through the controller deployed on the host machine, so that the target security container provides the kernel extension program to the user-mode process in the virtual machine started by the target security container.

[0043] In some embodiments, the target secure container is a rund container, such as a Kata container. In some embodiments, the host machine can be a physical host or a virtual machine. In some embodiments, multiple secure containers (such as multiple Kata containers) are deployed on the host machine. The virtual machine started on each secure container includes user space and kernel space. After receiving the kernel extension, the controller selects the target secure container corresponding to the kernel extension from the multiple secure containers, so that the virtualization device in the target secure container provides the kernel extension to the user-mode process in the kernel space of the target secure container. In some embodiments, the controller selects the target secure container from the multiple secure containers according to preset rules, or selects the target secure container from the multiple secure containers based on user-defined rules.

[0044] In some embodiments, the controller achieves high-performance communication with user-space processes in the target secure container through the vsock protocol (a virtualization technology provided by the Linux kernel for communication between virtual machines and the host). For example, each Kata container deployed on the host machine includes a virtualization device, virtio-vsock, implemented by the Kata virtualization layer. The controller sends commands or data to the user-space processes through virtio-vsock, and the user-space processes send messages back to the controller through virtio-vsock. Since the communication between the controller and the user-space processes in the secure container does not use a network protocol stack, it does not affect the network performance of the business containers. Furthermore, through the vsock protocol, the controller can directly communicate and control the user-space processes in each secure container running on the node, thereby enabling batch management and control of kernel extensions within secure containers. Compared to the traditional method of writing a user-space loader within the container to load kernel extensions, this solution can more directly and efficiently achieve unified management, control, and distribution of kernel extensions.

[0045] In some embodiments, the controller is used to control the behavior of user-mode processes within the user-mode of the secure container and to detect newly added secure containers. In some embodiments, the user-mode processes are used to listen for signals sent by the controller and to perform functions such as loading and / or unloading kernel extensions, loading and / or unloading rules, and log collection. In some embodiments, the kernel extension is an ebpf (Extended Berkeley Packet Filter) program.

[0046] S104, the kernel extension program is loaded through the user-mode process, so that the kernel extension module running in the kernel space corresponding to the virtual machine runs the loaded kernel extension program.

[0047] As an example, a user-space process is deployed in the user space of a Kata container, and a kernel extension module is deployed in the kernel space. The user-space process is used to load the EBPF program, and the kernel extension module is used to run the EBPF program loaded by the user-space process.

[0048] S106, if the business program executes to a specific kernel location where at least one hook point corresponding to the kernel extension is embedded, the tracing module running in the kernel space obtains the log data generated by the kernel extension during runtime, so that the tracing module provides the log data to the controller through the user-mode process.

[0049] As an example, a kernel extension is used to run the EBPF program loaded by a user-space process. The tracing module records the log data (security detection logs) submitted by the EBPF program. The user-space process running in the user space of the secure container reads the log data from the tracing module and sends the collected log data to the controller. In some embodiments, after reading the log data from the tracing module, the user-space process sends the log data to the controller via the vsock protocol. This method of sending log data to the controller via the vsock protocol avoids sending log information via network protocols, which can reduce the pressure on the network channel within the secure container.

[0050] This application finds that existing technologies typically involve manually loading kernel extensions within a secure container by writing a user-space loader. This method has the following drawbacks: 1) In cloud-native environments, security control policies cannot be distributed in batches according to applications, requiring manual operation, which is inefficient; 2) The user-space loader program runs directly in the user space of the virtual machine, and related resources are not isolated, making the loader operation susceptible to the influence of the virtual machine host or affecting the virtual machine host; 3) The collected security logs need to be sent to the log server via a network protocol stack (such as TCP / IP protocol), which can affect the network fluctuations of the business container. According to the embodiments of this specification, a controller deployed on the host machine can send a kernel extension program to a target security container deployed on the host machine. The target security container then provides the kernel extension program to a user-space process within a virtual machine started by the target security container. The user-space process loads the kernel extension program, causing a kernel extension module running in the kernel space corresponding to the virtual machine to execute the loaded kernel extension program. If a business application executes to a specific kernel location embedded at least one hook point corresponding to the kernel extension program, a tracing module running in the kernel space acquires the log data generated by the kernel extension program during runtime. The tracing module then provides the log data to the controller through the user-space process. This allows the limitations of the target security container's virtualization layer to be overcome, enabling the kernel extension program to be loaded into user space, achieving behavior detection and interception within the target security container. Furthermore, the controller enables precise control and unified management of security containers within the cluster. The user-space process can collect log data from the tracing module deployed in the kernel space and send it to the controller, reducing the pressure on the network channel within the security container.

[0051] In some embodiments, sending the kernel extension program to the target security container deployed on the host machine via a controller deployed on the host machine includes: receiving a user-issued custom rule via the controller deployed on the host machine; selecting the target security container from multiple security containers deployed on the host machine according to the custom rule; wherein the custom rule includes the kernel extension program; and sending the kernel extension program to the target security container via the controller. In some embodiments, different service containers can implement different security rules, and the custom rule includes application-level security rules. For example, a user can specify different security rules for different applications and issue the corresponding security rules to the controller, which parses the security rules and sends them to the corresponding target security container. In some embodiments, the custom rule also includes application name information and / or application identifier information; wherein selecting the target security container from multiple security containers deployed on the host machine according to the custom rule includes: selecting the target security container from multiple security containers deployed on the host machine according to the application name information and / or the application identifier information. In some embodiments, the controller determines the target security container that matches the application name information or the application identifier information using a label selector.

[0052] In some embodiments, sending the kernel extension to a target secure container deployed on the host machine via a controller deployed on the host machine, so that the target secure container provides the kernel extension to a user-space process in a virtual machine started by the target secure container, includes: sending the kernel extension to a virtualization device implemented by the target secure container deployed on the host machine via a controller deployed on the host machine, so that the virtualization device provides the kernel extension to a user-space process in a virtual machine started by the target secure container. As an example, each Kata container deployed on the host machine includes a virtualization device virtio-vsock implemented by the Kata virtualization layer. After determining the target Kata container (i.e., the target secure container), the controller deployed on the host machine sends the kernel extension to the virtio-vsock in the target Kata container, so that the virtio-vsock sends the kernel extension to a user-space process in a virtual machine started by the target Kata container (the user-space process is deployed in the user space of the virtual machine).

[0053] In some embodiments, the user-space process runs in a sidecar container, which is an auxiliary container that runs alongside the application container in the user space corresponding to the virtual machine. The sidecar container enhances or extends the functionality of the application container (i.e., the main application container) by providing additional services or functions (such as logging, detection, security, or data synchronization) without directly modifying the main application code. By running the user-space process in a sidecar container within the virtual machine, isolation between the user-space process and the application container and the host machine can be achieved, thereby enabling better resource control.

[0054] In some embodiments, the method further includes: obtaining a first loading status corresponding to the kernel extension through the user-space process, and providing the first loading status to the controller. The first loading status is used to indicate whether the kernel extension has been successfully loaded. By providing the first loading status to the controller, the controller can understand the loading status in real time, thereby achieving efficient management and effective control of the secure container.

[0055] In some embodiments, the method further includes: sending a first uninstallation instruction corresponding to the kernel extension program to the target security container via the controller, causing the target security container to provide the first uninstallation instruction to the user-space process; causing the user-space process to uninstall the kernel extension program based on the first uninstallation instruction, thereby stopping the kernel extension module from running the kernel extension program. In some embodiments, the controller generates the first uninstallation instruction based on user-issued custom rules. In some embodiments, the first uninstallation instruction may instruct the uninstallation of all or part of the kernel extension program; for example, if the kernel extension program includes 5 hook points, the first uninstallation instruction instructs the uninstallation of the program corresponding to 3 of the hook points. The controller senses the uninstallation status of the kernel extension module to avoid issuing corresponding security rules for already downloaded programs.

[0056] In some embodiments, the method further includes: sending the target security rule corresponding to the kernel extension to the target security container via the controller, so that the target security container provides the target security rule to the user-space process; and loading the target security rule into the kernel extension via the user-space process, so that the kernel extension module embeds the hook point corresponding to the target security rule into a specific kernel location. In some embodiments, the controller generates the target security rule based on user-issued custom rules.

[0057] In some embodiments, the method further includes: obtaining a second loading status corresponding to the target security rule through the user-space process, and providing the second loading status to the controller. The second loading status is used to indicate whether the target security rule has been successfully loaded. Through the second loading status, the controller can understand in real time whether the target security rule has been successfully loaded, thereby further achieving efficient management and effective control of the security container.

[0058] In some embodiments, the method further includes: sending a second uninstallation instruction corresponding to the target security rule to the target security container via the controller, causing the target security container to provide the second uninstallation instruction to the user-space process; and having the user-space process uninstall the target security rule in the kernel extension program based on the second uninstallation instruction, causing the kernel extension module to remove the hook point corresponding to the target security rule from the kernel space. In some embodiments, the controller generates the second uninstallation instruction based on a user-issued custom rule, the second uninstallation instruction being used to indicate the target security rule that needs to be uninstalled.

[0059] In some embodiments, the controller reads user-defined rules and controls user-space processes via command channels to manage kernel extensions, including loading and unloading, and program status awareness (including successful loading, loading failure, successful unloading, and unloading failure), to ensure that the current kernel extension's status is consistent with the rule definition. This allows the controller to manage kernel extensions in batches and selectively.

[0060] Figure 2 This is a schematic diagram illustrating an architecture for loading kernel extension programs in a host machine, provided as an embodiment of this specification. It should be noted that... Figure 2 The host machine shown includes two secure containers, as those skilled in the art should understand. Figure 2 The number of secure containers shown is merely an example and is not a limitation of this specification. In practical applications, multiple secure containers can be deployed on the host machine based on requirements.

[0061] like Figure 2As shown, the host machine includes a controller, secure container K1, and secure container K2. Each secure container includes a virtualization device and a virtual machine. The user space within the virtual machine includes business containers and sidecar containers, with user-mode processes deployed in the sidecar containers. The kernel space within the virtual machine includes kernel extension modules and a tracing module. The controller controls the behavior of user-mode processes within the user space and adds container awareness. The virtualization device, implemented in the secure container virtualization layer, facilitates communication between the host machine and the virtual machine, acting as a bridge between the controller and user-mode processes. In this example, the controller uses the vsock protocol to communicate with the user-mode processes within the secure containers. The user-mode processes run in the sidecar containers, listening for signals from the controller and performing functions such as loading / unloading kernel extensions, loading / unloading rules, and log collection. The kernel extension modules, implemented in the Linux kernel (an operating system), run the kernel extensions loaded by the user-mode processes. The tracing module records the log data submitted by the kernel extensions.

[0062] Figure 2 The links 1-8 shown are explained as follows: 1) Links 1 and 2 are where the controller sends commands and data to the user-mode process; 2) Link 3 is where the user-mode process loads / unloads kernel extensions and issues / deletes security rules to the virtual machine kernel space; 3) Link 4 is where the execution of programs, files, and network activities within the business application reaches the kernel extension hook point; 4) Link 5 is where the log data generated by the kernel extension during runtime is submitted to the tracing module; 5) Link 6 is where the user-mode process reads log data from the tracing module; 6) Links 7 and 8 are links where the user-mode process sends messages back to the controller, including feedback on security logs, rule loading status, and kernel extension loading status.

[0063] Figure 3 This is a schematic diagram of a device for loading a kernel extension program, provided as an embodiment of this specification. This device (hereinafter referred to as "kernel extension program loading device 1") can be implemented as all or part of an electronic device through software, hardware, or a combination of both. According to some embodiments, the kernel extension program loading device 1 includes a control module 11, a loading module 12, and a log acquisition module 13.

[0064] The control module is used to send the kernel extension program to the target security container deployed on the host machine through the controller deployed on the host machine, so that the target security container provides the kernel extension program to the user-mode process in the virtual machine started by the target security container;

[0065] A loading module is used to load the kernel extension program through the user-mode process, so that the kernel extension module running in the kernel space corresponding to the virtual machine runs the loaded kernel extension program;

[0066] The log acquisition module is used to acquire log data generated by the kernel extension program during runtime by a tracing module running in the kernel space if the business program executes to a specific kernel location where at least one hook point corresponding to the kernel extension program is embedded, so that the tracing module provides the log data to the controller through the user-mode process.

[0067] In some embodiments, the control module 11 is used for:

[0068] The system receives user-issued custom rules from a controller deployed on the host machine, and selects target security containers from multiple security containers deployed on the host machine according to the custom rules. The custom rules include kernel extensions.

[0069] The controller sends the kernel extension to the target secure container.

[0070] In some embodiments, the custom rule further includes application name information and / or application identifier information;

[0071] The step of selecting the target security container from multiple security containers deployed on the host machine according to the custom rule includes:

[0072] Based on the application name information and / or the application identifier information, a target security container is selected from multiple security containers deployed on the host machine.

[0073] In some embodiments, the control module 11 is used for:

[0074] The kernel extension is sent by a controller deployed on the host machine to a virtualization device implemented by a target secure container deployed on the host machine, so that the virtualization device provides the kernel extension to the user-mode process in the virtual machine launched by the target secure container.

[0075] In some embodiments, the user-space process runs in a sidecar container, which is an auxiliary container that runs together with the service container in the user space corresponding to the virtual machine.

[0076] In some embodiments, the kernel extension loading device 1 is further configured to: obtain a first loading status corresponding to the kernel extension through the user-mode process, and provide the first loading status to the controller.

[0077] In some embodiments, the kernel extension loading device 1 is further configured to:

[0078] The controller sends the first uninstallation instruction corresponding to the kernel extension to the target security container, so that the target security container provides the first uninstallation instruction to the user-mode process.

[0079] The user-mode process uninstalls the kernel extension program based on the first uninstallation instruction, causing the kernel extension module to stop running the kernel extension program.

[0080] In some embodiments, the kernel extension loading device 1 is further configured to:

[0081] The controller sends the target security rules corresponding to the kernel extension to the target security container, so that the target security container provides the target security rules to the user-space process.

[0082] The user-mode process loads the target security rule into the kernel extension program, so that the kernel extension module embeds the hook point corresponding to the target security rule into a specific kernel location.

[0083] In some embodiments, the kernel extension loading device 1 is further configured to:

[0084] The user-mode process obtains the second loading status corresponding to the target security rule and provides the second loading status to the controller.

[0085] In some embodiments, the kernel extension loading device 1 is further configured to:

[0086] The controller sends the second unload instruction corresponding to the target security rule to the target security container, so that the target security container provides the second unload instruction to the user-space process;

[0087] The user-space process uninstalls the target security rule in the kernel extension program based on the second uninstallation instruction, thereby causing the kernel extension module to remove the hook point corresponding to the target security rule from the kernel space.

[0088] The above-described apparatus embodiments correspond to the method embodiments, and detailed descriptions can be found in the description of the method embodiments section, which will not be repeated here. The apparatus embodiments are derived based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments; detailed descriptions can be found in the corresponding method embodiments.

[0089] This specification also provides a computer storage medium that can store multiple instructions adapted for loading by a processor and executing the methods described in this specification.

[0090] This specification also provides a computer program product that stores at least one instruction, which is loaded by the processor and executes the method described in this specification embodiment.

[0091] The embodiments in this specification also provide Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the above method.

[0092] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0093] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0095] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0096] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0097] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0099] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0100] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for loading a kernel extension, comprising: sending, by a controller deployed in a host machine, a kernel extension to a target security container deployed in the host machine, so that the target security container provides the kernel extension to a user-space process in a virtual machine started by the target security container; loading, by the user-space process, the kernel extension, so that a kernel extension module running in a kernel space corresponding to the virtual machine runs the loaded kernel extension; if a service program executes to a specific kernel location embedded by at least one hook point corresponding to the kernel extension, obtaining, by a tracking module running in the kernel space, log data generated by the kernel extension at runtime, so that the tracking module provides the log data to the controller through the user-space process. 2.The method of claim 1, wherein the sending, by a controller deployed in a host machine, a kernel extension to a target security container deployed in the host machine comprises: receiving, by the controller deployed in the host machine, a custom rule issued by a user, and filtering a target security container from a plurality of security containers deployed in the host machine according to the custom rule, wherein the custom rule comprises the kernel extension; sending, by the controller, the kernel extension to the target security container. 3.The method of claim 2, wherein the custom rule further comprises application name information and / or application identification information; wherein the filtering a target security container from a plurality of security containers deployed in the host machine according to the custom rule comprises: filtering a target security container from a plurality of security containers deployed in the host machine according to the application name information and / or the application identification information. 4.The method of claim 1, wherein the sending, by a controller deployed in a host machine, a kernel extension to a target security container deployed in the host machine, so that the target security container provides the kernel extension to a user-space process in a virtual machine started by the target security container comprises: sending, by a controller deployed in a host machine, a kernel extension to a virtualization device implemented by a target security container deployed in the host machine, so that the virtualization device provides the kernel extension to a user-space process in a virtual machine started by the target security container. 5.The method of claim 4, wherein the user-space process runs in a sidecar container, which is an auxiliary container running together with a service container in a user space corresponding to the virtual machine. 6.The method of claim 1, further comprising: obtaining, by the user-space process, a first loading condition corresponding to the kernel extension, and providing the first loading condition to the controller. 7.The method of claim 1, further comprising: sending, by the controller, a first uninstall instruction corresponding to the kernel extension to the target security container, so that the target security container provides the first uninstall instruction to the user-space process. causing the user mode process to unload the kernel extension program based on the first unloading instruction, causing the kernel extension module to stop running the kernel extension program.

8. The method of claim 1, further comprising: sending, by the controller, the target security rule corresponding to the kernel extension program to the target security container, causing the target security container to provide the target security rule to the user mode process; loading, by the user mode process, the target security rule in the kernel extension program, causing the kernel extension module to embed a hook point corresponding to the target security rule in a specific kernel location.

9. The method of claim 8, further comprising: obtaining, by the user mode process, a second loading condition corresponding to the target security rule, providing the second loading condition to the controller.

10. The method of claim 8, further comprising: sending, by the controller, a second unloading instruction corresponding to the target security rule to the target security container, causing the target security container to provide the second unloading instruction to the user mode process; unloading, by the user mode process, the target security rule in the kernel extension program based on the second unloading instruction, causing the kernel extension module to remove the hook point corresponding to the target security rule from the kernel space.

11. An apparatus for loading a kernel extension program, comprising: a control module configured to send, by a controller deployed in a host machine, a kernel extension program to a target security container deployed in the host machine, causing the target security container to provide the kernel extension program to a user mode process in a virtual machine started by the target security container; a loading module configured to load, by the user mode process, the kernel extension program, causing a kernel extension module running in a kernel space corresponding to the virtual machine to run the loaded kernel extension program; a log obtaining module configured to, if a business program executes to a specific kernel location embedded by at least one hook point corresponding to the kernel extension program, obtain, by a tracking module running in the kernel space, log data generated by the kernel extension program when running, causing the tracking module to provide the log data to the controller by the user mode process.

12. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by a processor to implement the steps of the method of any one of claims 1-10.

13. An electronic device, comprising: comprising: a processor and a memory; wherein the memory stores a computer program, the computer program being adapted to be loaded and executed by the processor to implement the steps of the method of any one of claims 1-10.

14. A computer program product having stored thereon at least one instruction, the computer program product comprising: The at least one instruction is executed by a processor to implement the steps of the method of any one of claims 1-10.

Images