Container escape detection method, program product, electronic device and storage medium

Abstract

The present application discloses a container escape detection method, program product, electronic device and storage medium, which are applied to the field of computer security technology. In order to solve the problems in related technologies such as large system performance overhead, poor detection real-time performance and difficulty in meeting the requirements of high concurrency and high performance scenarios, the method includes: when a file read and write operation is detected in the system in kernel state, determining the main process of the current operation file; when it is determined that the main process belongs to a container process, judging whether the current operation file belongs to a container; when the current operation file does not belong to a container, judging whether the file system to which the current operation file belongs belongs to a host file system; when it is determined that the file system to which the current operation file belongs belongs to a host file system, determining that the operation behavior of the file read and write operation has a container escape risk; this method is conducive to reducing system performance overhead, improving detection real-time performance, and better meeting the requirements of high concurrency and high performance scenarios.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a container escape detection method, program product, electronic device, and storage medium. Background Art

[0002] Container technology is increasingly being used in modern cloud computing environments. The core of container technology relies on the Linux kernel's namespace mechanism to achieve resource isolation. Container escape is a common security threat. Attackers exploit vulnerabilities or misconfigurations to access host resources from within the container, severely threatening system security. Existing container escape detection methods typically rely on user-mode tools or file system checks, which suffer from high system performance overhead and poor real-time detection, making them difficult to meet the demands of high-concurrency and high-performance scenarios.

[0003] It can be seen that how to reduce system performance overhead and improve detection real-time performance to better meet the needs of high concurrency and high performance scenarios is a problem that technical personnel in this field need to solve. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a container escape detection method, computer program product, electronic device, and computer-readable storage medium, which can detect container escape behavior in kernel state, thereby reducing system performance overhead, improving detection real-time performance, and better meeting the needs of high concurrency and high performance scenarios.

[0005] To solve the above technical problems, an embodiment of the present application provides a container escape detection method, comprising:

[0006] When a file read or write operation is detected in the kernel state, the main process currently operating the file is determined;

[0007] If it is determined that the main process belongs to the container process, determine whether the current operation file belongs to the container;

[0008] If the currently operated file does not belong to the container, determine whether the file system to which the currently operated file belongs belongs to the host file system;

[0009] When it is determined that the file system to which the currently operated file belongs belongs to the host file system, it is determined that the operation behavior of the file read and write operation has the risk of container escape.

[0010] The present application also provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned container escape detection method when executed by a processor.

[0011] The present application also provides an electronic device, comprising:

[0012] Memory for storing computer programs;

[0013] A processor is used to execute a computer program to implement the steps of the container escape detection method as described above.

[0014] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned container escape detection method are implemented.

[0015] It can be seen from the above technical solutions that the beneficial effects of this application are:

[0016] The present application provides a container escape detection method, comprising: determining, when a file read or write operation is detected in the system in kernel state, the main process of the current file operation; when it is determined that the main process belongs to a container process, judging whether the current file operation belongs to the container; when the current file operation does not belong to the container, judging whether the file system to which the current file operation belongs belongs to the host file system; when it is determined that the file system to which the current file operation belongs belongs to the host file system, determining that the operation behavior of the file read or write operation has a container escape risk.

[0017] Through this application, since this application directly detects the file read and write operations in the system in the kernel state, and when a file read and write operation is detected in the system, the main process of the current operation file is determined, and then it is further determined whether the main process belongs to a container process. If the main process does not belong to a container process, if the file system to which the current operation file belongs belongs to the host file system, it can be determined that the operation behavior of the file read and write operation has a container escape risk. By directly detecting file read and write operations in the kernel state, this application can reduce system performance overhead, and can capture and analyze file read and write operations in real time when they occur, can quickly determine whether there is a container escape risk, improve detection real-time performance, and help better meet the needs of high concurrency and high performance scenarios.

[0018] Therefore, it is possible to solve the technical problems of large system performance overhead, poor detection real-time performance, and difficulty in meeting the requirements of high concurrency and high-performance scenarios, thereby achieving the technical effect of reducing system performance overhead, improving detection real-time performance, and better meeting the requirements of high concurrency and high-performance scenarios.

[0019] In addition, the present application also provides a corresponding computer program product, electronic device and computer-readable storage medium for the container escape detection method, which further makes the method more practical. The computer program product, electronic device and computer-readable storage medium have corresponding advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 A flowchart of a container escape detection method provided in an embodiment of the present application;

[0022] Figure 2 A diagram of a container escape detection architecture provided in an embodiment of the present application;

[0023] Figure 3 A flowchart of another container escape detection method provided in an embodiment of the present application;

[0024] Figure 4 This is a structural diagram of a container escape detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] The terms "including" and "having," as used in the specification and accompanying drawings of this application, and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements and may include steps or elements that are not listed.

[0027] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0028] Next, a container escape detection method provided by an embodiment of the present application is described in detail. Figure 1 This is a flowchart of a container escape detection method provided in an embodiment of the present application, which includes the following contents from S110 to S140.

[0029] S110: When a file read or write operation is detected in the kernel state, a main process currently operating the file is determined.

[0030] It should be noted that, in this embodiment, the file read and write operations in the system can be captured directly in the kernel state. If a file read and write operation is detected in the system, the main process currently operating the file can be obtained.

[0031] In practical applications, the eBPF (Extended Berkeley Packet Filter) program can be used to directly capture file read and write events in kernel mode, avoiding the need to mount hooks in kernel modules, significantly improving detection efficiency and stability (e.g. Figure 2 For example, the Linux Security Module (LSM) hook type in eBPF technology can be used to detect and protect against container escapes. The LSM file open (file_open) hook can be mounted in the eBPF program to monitor file read and write operations in kernel mode. When a file read or write event is detected in the system, the kernel triggers the hook and executes the eBPF program to perform the container escape detection process described in this application.

[0032] S120: When it is determined that the main process belongs to the container process, determine whether the current operation file belongs to the container.

[0033] It is understandable that only processes running in containers are likely to escape from the container. Therefore, in this application, after determining the main process of the current operation file, it is possible to further determine whether the main process belongs to the container process, that is, to determine whether the main process is running in the container. If it is determined that the main process is running in the container, it is possible to further determine whether the current operation file belongs to the container, that is, to determine whether the current operation file is in the container. Of course, if it is determined that the subject process does not belong to the container process, it means that the main process does not have the risk of container escape.

[0034] S130: If the currently operated file does not belong to the container, determine whether the file system to which the currently operated file belongs belongs to the host file system.

[0035] It should be noted that in this application, when it is determined that the current operation file does not belong to the container, in order to accurately detect whether the operation behavior of the file read and write operation has the risk of container escape, it can be further determined whether the file system to which the current operation file belongs belongs to the host file system.

[0036] S140: When it is determined that the file system to which the currently operated file belongs is a host file system, it is determined that the operation behavior of the file read and write operation has a container escape risk.

[0037] That is, if the file system to which the currently operated file belongs belongs to the host file system, it means that the read and write operations of the file have the risk of container escape, thereby achieving rapid and accurate detection of container escape.

[0038] It can be seen that in this application, the file read and write operations in the system are directly detected in the kernel state, and when a file read and write operation is detected in the system, the main process of the current operating file is determined, and then it is further determined whether the main process belongs to a container process. If the main process does not belong to a container process, if the file system to which the current operating file belongs belongs to the host file system, it can be determined that the operation behavior of the file read and write operation has a container escape risk. By directly detecting file read and write operations in the kernel state, the present application can reduce system performance overhead, and can capture and analyze file read and write operations in real time when they occur, can quickly determine whether there is a container escape risk, improve detection real-time performance, and help better meet the needs of high concurrency and high performance scenarios.

[0039] The following is a further explanation and introduction of the technical solution, please refer to Figure 3 .

[0040] In one embodiment, when it is determined in S120 that the main process belongs to a container process, before determining whether the current operation file belongs to a container, the method may further include:

[0041] Get the namespace information of the subject process;

[0042] Determine whether the namespace information is the preset namespace information. If so, determine that the main process does not belong to the container process; if not, determine that the main process belongs to the container process.

[0043] It should be noted that in order to accurately determine whether the main process of the current operating file belongs to the container process, the preset namespace information assigned by default when the kernel starts can be pre-set. During the container escape detection process, after determining the main process of the current operating file, the namespace information of the main process can be obtained, and then further determined whether the namespace information is the preset namespace information. For example, the preset namespace information assigned by default when the kernel starts can be PROC_PID_INIT_INO. After obtaining the namespace information of the main process, the namespace information of the main process is compared with the preset namespace information. If the two are inconsistent, it means that the main process belongs to the container process. If the two are consistent, it means that the main process does not belong to the container process.

[0044] In one embodiment, the process of obtaining the namespace information of the subject process may include:

[0045] Get the process structure information of the main process;

[0046] Read the namespace information field from the process structure information;

[0047] Get the namespace information of the subject process from the namespace information field.

[0048] In practical applications, in order to accurately obtain the namespace information of the main process and improve detection accuracy, the eBPF auxiliary function bpf_get_current_task() can be used to obtain the process structure information (that is, the task_struct structure) corresponding to the main process of the current operation file, and the namespace information field (that is, the nsproxy field) in the process structure information task_struct can be read through the BPF_CORE_READ() auxiliary function to obtain the namespace information of the process.

[0049] The namespace information is stored in the task_struct->nsproxy field, and the namespace information field nsproxy points to a field structure (that is, the struct nsproxy structure). The field structure contains various types of namespaces (such as PID namespace, network namespace, etc.). Among them, the PID namespace is the key information, so the PID namespace can be obtained from the namespace information field in actual applications.

[0050] That is, after obtaining the PID namespace, the PID namespace can be compared with the preset namespace information PROC_PID_INIT_INO. If the two are inconsistent, it means that the main process belongs to the container process, and subsequent judgment is performed.

[0051] In one embodiment, the process of determining whether the current operation file belongs to a container in S120 may include:

[0052] Get the root directory index node value of the main process;

[0053] Get the root directory index node value of the current operation file;

[0054] Determine whether the root directory index node value of the main process is equal to the root directory index node value of the current operation file;

[0055] When the root directory index node value of the main process is equal to the root directory index node value of the current operation file, it is determined that the current operation file belongs to the container;

[0056] When the root directory index node value of the subject process is not equal to the root directory index node value of the current operation file, it is determined that the current operation file does not belong to the container.

[0057] It should be noted that to further accurately distinguish between in-container behavior and container escape behavior, you can obtain the root directory index node value of the main process (also known as the main process's root directory inode value) and the root directory index node value of the current operation file (also known as the root directory inode value of the current operation file). Then, compare the root directory inode value of the main process with the root directory inode value of the current operation file. If the two are equal, the current operation file belongs to the container, which means that the behavior is in the container, and the behavior detection for the current operation file can be terminated. If the root directory inode value of the main process and the root directory inode value of the current operation file are not equal, the current operation file does not belong to the container, preliminarily determining that there may be a container escape risk, and further detection can be carried out.

[0058] In one embodiment, the process of obtaining the root directory index node value of the subject process includes:

[0059] Determine whether the kernel has enabled the process file system function;

[0060] When the kernel has enabled the process file system function, the memory management structure information of the main process is obtained through the process structure information of the main process;

[0061] Determine file structure information based on memory management structure information;

[0062] Obtain the path information of the main process based on the file structure information;

[0063] Determine the root directory of the main process based on the path information of the main process;

[0064] When the kernel does not enable the process file system function, obtain the memory mapping area list of the main process;

[0065] By traversing the memory mapping area linked list, the file information corresponding to the code segment of the main process is obtained;

[0066] Determine the root directory of the main process based on file information;

[0067] After the root directory is determined, the corresponding root directory index node value is obtained according to the file tree structure of the root directory.

[0068] It can be understood that in order to accurately obtain the root directory index node value of the main process in this embodiment, it is possible to first determine whether the kernel has enabled the process file system function. For example, it is possible to determine whether the kernel has enabled the process file system function (that is, the PROC_FS function) by obtaining the process structure information (task_struct) of the main process. If the kernel has enabled the PROC_FS function, the memory management structure information mm_struct of the process can be read through the process structure information. Since the exe_file field in the mm_struct is a file structure (that is, a file structure), the path information of the main process can be obtained through the exe_file field in the memory management structure information. After obtaining the path information, the root directory of the main process can be determined according to the path information, and the file tree structure corresponding to the root directory can be obtained, so that the directory index node value corresponding to the root directory can be obtained through the file tree structure.

[0069] Of course, if the kernel does not enable the PROC_FS function, the mapping table (mmap) pointer can be determined from the process's memory management structure information mm_struct. The mapping table pointer points to the process's memory mapping area list, so the memory mapping area list can be obtained through the mapping table pointer. Then, by traversing the memory mapping area list, the file corresponding to the code segment (VM_EXECUTABLE) corresponding to the main process can be determined, and the root directory of the main process can be determined by further traversing the file tree structure dentry of the file. After determining the root directory, the inode value of the root directory can be further obtained through the file tree structure dentry of the root directory, that is, calling BPF_CORE_READ(dentry,d_inode,i_ino).

[0070] In one embodiment, the process of obtaining the root directory index node value of the current operation file may include:

[0071] Get the context file structure information corresponding to the current operation file;

[0072] Read the file tree information of the current operation file through the context file structure information;

[0073] Determine the root directory of the current operation file based on the file tree information;

[0074] According to the root directory of the current operation file, obtain the root directory index node value corresponding to the current operation file.

[0075] It can be understood that in order to accurately obtain the root directory index node value of the current operation file in this application, the file tree information dentry of the current operation file can be read according to the context file structure information (that is, the context struct file) corresponding to the current operation file, and then the root directory of the current operation file can be determined in a step-by-step upward manner. Then, BPF_CORE_READ(dentry, d_inode, i_ino) can be called to read the inode value of the root directory.

[0076] In one embodiment, the process of determining whether the file system to which the currently operated file belongs belongs to the host file system in S130 may include:

[0077] Get the root directory index node value of the host machine;

[0078] Determine whether the root directory index node value of the current operation file is equal to the root directory index node value of the host machine;

[0079] When the root directory index node value of the current operation file is equal to the root directory index node value of the host machine, it is determined that the file system to which the current operation file belongs belongs to the host machine file system.

[0080] It should be noted that in order to accurately identify whether the file system to which the current operation file belongs belongs to the host file system in this embodiment, the root directory index node value of the host can be further obtained. For example, when the file_open hook of LSM detects that a file read or write operation occurs in the system in kernel state, the kernel triggers the hook and executes the eBPF program (that is, when the program starts) to obtain the root directory index node value of the host. The root directory index node value of the current operation file is then compared with the root directory index node value of the host. If the root directory index node value of the current operation file is equal to the root directory index node value of the host, it means that the file system to which the current operation file belongs belongs to the host file system, and it can be determined that the container has escaped. In this application, by comparing the root directory index node value of the current operation file with the root directory index node value of the host, it is possible to accurately determine whether the file system to which the current operation file belongs belongs to the host file system, which is conducive to improving detection accuracy.

[0081] In one embodiment, the method may further include:

[0082] If the root directory index node value of the current operation file is not equal to the root directory index node value of the host machine, determine whether the root directory index node value of the current operation file is equal to 1;

[0083] When the root directory index node value of the current operation file is equal to 1, obtain the device number of the file system to which the current operation file belongs;

[0084] Get the device number information of all file systems on the host;

[0085] Match the device number of the file system to which the current operation file belongs with the device number information of all file systems on the host machine;

[0086] If there is a device number consistent with the device number of the file system to which the currently operated file belongs in the device number information of all file systems on the host machine, it is determined that the file system to which the currently operated file belongs belongs to the host machine file system.

[0087] It is understood that in this application, if it is determined that the root directory index node value of the current operation file is not equal to the root directory index node value of the host machine, it is possible to further determine whether the root directory index node value of the current operation file is equal to 1. If the root directory index node value of the current operation file is equal to 1, it can be preliminarily determined that the root directory of the current operation file belongs to a child file system, and it is necessary to further determine whether the root directory of the current operation file belongs to a container. The device number of the file system to which the current operation file belongs can be obtained, wherein the context file structure information corresponding to the current operation file (i.e., the context struct file structure) can be first obtained, and then the mount point information (struct vfsmount) of the current operation file can be read from the context file structure information corresponding to the current operation file. The root mount point information can also be obtained based on the mount point information (struct vfsmount), and the super block information (struct super_block) can be obtained based on the mount point information (struct vfsmount), thereby determining the device number of the file system to which the current operation file belongs based on the super block information.

[0088] Furthermore, after obtaining the device number of the file system to which the current operation file belongs, the device number information of all file systems on the host can be further obtained. For example, the system can be restarted, and when the system restarts, the eBPF program can be used to execute a command in user mode (such as findmnt-o TARGET, SOURCE, FSTYPE, MAJ: MIN) to collect the device number information of all file systems on the host and record it in the eBPF map. In kernel mode, the eBPF map can be used to query whether the device number of the file system to which the current operation file belongs matches the device number information of all file systems on the host. In other words, whether the device number information of all file systems on the host contains a device number that is consistent with the device number of the file system to which the current operation file belongs. If the device number information of all file systems on the host contains a device number that is consistent with the device number of the file system to which the current operation file belongs, it can be determined that the file system to which the current operation file belongs belongs to the host file system, and it can be determined that the file read and write operations have a container escape risk.

[0089] In one embodiment, after determining that the file read and write operations have a container escape risk, the method may further include:

[0090] According to the different risk levels of the pre-set host directories, the target risk level of the relevant directories of the operation behavior is determined.

[0091] It should be noted that to reduce the false alarm rate, host directories can be pre-classified according to the severity of the escape and risk levels can be set for the classified host directories. This allows us to further determine the target risk level for the directory associated with the file read / write operation, if it is determined that the operation poses a container escape risk. This allows us to determine whether to intercept the operation based on the target risk level. In practical applications, even after determining that a file read / write operation poses a container escape risk, we can still intercept the operation.

[0092] Furthermore, when the target risk level reaches a preset interception level, the operation behavior that poses a risk of container escape can be intercepted.

[0093] That is, when it is determined that the operation behavior corresponding to the file read and write operation has the risk of container escape, it is possible to further determine whether the target risk level of the corresponding related directory has reached the preset interception level, or determine whether the risk coefficient corresponding to the target risk level has reached the preset risk coefficient, and then use the LSM hook mechanism to intercept the relevant operations to prevent the container escape behavior from posing a threat to system security.

[0094] In other words, the application uses the LSM hook mechanism to intercept behaviors that pose escape risks, which can effectively prevent container escape behaviors from threatening system security, and through direct interception in the kernel state, avoids the risk of user-state tools being bypassed or tampered with.

[0095] In one embodiment, different risk levels of the host directory may include no risk level, low risk level, medium risk level, and high risk level. The risk level determination method of the host directory may be divided as follows.

[0096] In practice, you can set the risk level of the container's internal file system to no risk; set the risk level of directories corresponding to critical system configuration files, critical device files, or critical kernel information to high risk; set the risk level of directories containing user data, temporary files, or service data to medium risk; and set the risk level of directories used to store applications, library files, or installed software to low risk. Furthermore, you can set corresponding risk factors for different risk levels, for example, a risk factor of 0% for no risk, >80% for high risk directories, >50% for medium risk directories, and >20% for low risk directories.

[0097] In other words, some file systems within the container can be whitelisted, with a risk level of zero and a risk coefficient of 0%. Because some file systems within the container share the same file system with the host, you can add a file system whitelist to the eBPF map, such as / etc / hosts within the container, to filter out false positives.

[0098] Critical system configuration files, device files, or kernel information related directories can be set to high-risk directories with a risk factor greater than 80%. For example, directories like / etc, / boot, and / dev can be set to high-risk directories because malicious exploitation of these directories could cause system crashes, data leaks, or complete loss of control. Therefore, they are designated as high-risk directories.

[0099] Directories containing user data, temporary files, or service data can be designated as medium-risk, with a risk factor greater than 50%. Examples include directories like / home, / root, and / var. Malicious exploitation of these directories could lead to data leakage or service interruption, but the impact on overall system stability is minimal. Therefore, these directories are designated as medium-risk.

[0100] You can set the risk level of directories used to store applications, library files, or installed software to low risk, with a risk factor of >20%. For example, directories like / usr and / opt have minimal impact on system stability, but if maliciously exploited, they could cause applications to malfunction.

[0101] In actual applications, users can set up various monitoring directories, as well as the risk level and risk coefficient corresponding to each directory, according to actual needs, thereby greatly improving detection efficiency and effectively reducing false alarm rates. It should be noted that this application, by combining eBPF technology and LSM hook mechanism, can be more efficient, accurate, and more real-time when performing melt escape detection. It can also reduce system overhead during the detection process. Its flexibility and comprehensiveness can be applied to a variety of application scenarios, effectively improving system security while reducing performance impact.

[0102] In other words, in this application, by directly capturing file read and write events in kernel state through eBPF technology, the context switch between user state and kernel state can be effectively avoided, which significantly reduces performance overhead. In addition, by processing events in kernel state, container escape detection can be completed efficiently, which is more suitable for high concurrency and high performance scenarios. This application can capture and analyze file read and write events in real time when they occur, and quickly determine whether there is a risk of container escape. Through real-time detection, it can effectively respond to dynamically changing container environments, promptly discover and intercept potential escape behaviors, and in the detection process, it combines the namespace information of the main process, the root directory inode value, and the file system device number, etc., to accurately distinguish between container behavior and container escape behavior. Through multi-level detection, it can effectively avoid misjudgment or false judgment that may be caused by a single judgment condition.

[0103] In addition, it should be noted that the operation of the eBPF program has minimal impact on system performance and is suitable for resource-constrained environments. By working in collaboration between user mode and kernel mode, the data collection and processing burden of the kernel mode is reduced, further reducing system overhead. It can also support dynamic loading and unloading of eBPF programs, and can flexibly adjust detection strategies according to actual needs. It stores host file system information through the eBPF map, supports dynamic updates and expansions, and is conducive to adapting to complex file system environments. During use, this application can not only detect container escape behaviors (such as access to the host file system), but also identify abnormal operations of the sub-file system within the container. Through a multi-level analysis mechanism, it covers a variety of possible container escape scenarios, thereby improving the comprehensiveness of detection.

[0104] In practical applications, the detection method in this application can be combined with other security mechanisms (such as auditing and intrusion detection systems) to further enhance the security of the system. Based on the flexible programming capabilities of eBPF, it can be expanded to support more detection scenarios and security policies.

[0105] It's also worth noting that in practice, eBPF programs can be dynamically loaded into the running kernel without restarting the system or modifying kernel code, reducing deployment and maintenance complexity. The collaborative working mode between user mode and kernel mode simplifies system configuration and is suitable for large-scale distributed environments.

[0106] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0107] The embodiment of the present application also provides a container escape detection device, see Figure 4 , Figure 4 This is a structural diagram of a container escape detection device provided in this application, which may include:

[0108] The first determining module 11 is used to determine the main process currently operating the file when a file read or write operation is detected in the system in the kernel state;

[0109] A first judgment module 12 is used to judge whether the current operation file belongs to the container when it is determined that the main process belongs to the container process;

[0110] The second judgment module 13 is used to judge whether the file system to which the current operation file belongs belongs to the host file system when the current operation file does not belong to the container;

[0111] The second determining module 14 is configured to determine whether the file read and write operations have a container escape risk when it is determined that the file system to which the currently operated file belongs belongs to the host file system.

[0112] In one embodiment, the method comprises:

[0113] The acquisition module is used to obtain the namespace information of the main process;

[0114] A third judging module is configured to judge whether the namespace information is the preset namespace information, and if so, trigger the third determining module; if not, trigger the fourth determining module;

[0115] A third determination module is used to determine whether the main process belongs to the container process;

[0116] The fourth determination module is used to determine whether the main process belongs to the container process.

[0117] In one embodiment, the acquisition module includes:

[0118] A first acquiring unit is used to acquire process structure information of a main process;

[0119] A second obtaining unit is used to read the namespace information field from the process structure information;

[0120] The third acquiring unit is configured to acquire the namespace information of the subject process from the namespace information field.

[0121] In one embodiment, the first judgment module 12 includes:

[0122] The fourth obtaining unit is used to obtain the root directory index node value of the main process;

[0123] A fifth obtaining unit is used to obtain the root directory index node value of the current operation file;

[0124] The first judging unit is used to judge whether the root directory index node value of the main process is equal to the root directory index node value of the current operation file;

[0125] a first determining unit, configured to determine that the current operation file belongs to a container when the root directory index node value of the main process is equal to the root directory index node value of the current operation file;

[0126] The second determining unit is configured to determine that the current operation file does not belong to the container when the root directory index node value of the main process is not equal to the root directory index node value of the current operation file.

[0127] In one embodiment, the fourth obtaining unit includes:

[0128] The first judgment subunit is used to judge whether the kernel has enabled the process file system function;

[0129] The first acquisition subunit is configured to acquire the memory management structure information of the subject process through the process structure information of the subject process when the process file system function of the kernel is enabled;

[0130] A first determining subunit is configured to determine file structure information based on the memory management structure information;

[0131] The second acquisition subunit is used to obtain the path information of the main process according to the file structure information;

[0132] The second determining subunit is used to determine the root directory of the main process according to the path information of the main process;

[0133] The third acquisition sub-unit is used to obtain the memory mapping area linked list of the main process when the process file system function is not enabled in the kernel;

[0134] The fourth acquisition sub-unit is used to obtain file information corresponding to the code segment of the main process by traversing the memory mapping area linked list;

[0135] The third determining subunit is used to determine the root directory of the main process according to the file information;

[0136] The fifth obtaining subunit is used to obtain the corresponding root directory index node value according to the file tree structure of the root directory after determining the root directory.

[0137] In one embodiment, the fifth obtaining unit includes:

[0138] A sixth obtaining subunit, configured to obtain context file structure information corresponding to the current operation file;

[0139] A seventh acquisition subunit is used to read the file tree information of the current operation file through the context file structure information;

[0140] A fourth determining subunit is used to determine the root directory of the current operation file according to the file tree information;

[0141] The eighth obtaining subunit is used to obtain the root directory index node value corresponding to the current operation file according to the root directory of the current operation file.

[0142] In one embodiment, the second judgment module 13 includes:

[0143] A sixth obtaining unit, configured to obtain a root directory index node value of the host machine;

[0144] The second judgment unit is used to judge whether the root directory index node value of the current operation file is equal to the root directory index node value of the host machine;

[0145] The third determining unit is configured to determine that the file system to which the current operating file belongs belongs to the host file system when the root directory index node value of the current operating file is equal to the root directory index node value of the host.

[0146] In one embodiment, the device may further include:

[0147] a third determining unit, configured to determine whether the root directory index node value of the current operation file is equal to 1 when the root directory index node value of the current operation file is not equal to the root directory index node value of the host machine;

[0148] A seventh obtaining unit, configured to obtain a device number of a file system to which the current operation file belongs when the root directory index node value of the current operation file is equal to 1;

[0149] An eighth obtaining unit, configured to obtain device number information of all file systems on the host machine;

[0150] A matching unit, used to match the device number of the file system to which the current operation file belongs with the device number information of all file systems on the host machine;

[0151] The fourth determining unit is configured to determine that the file system to which the currently operated file belongs belongs to the host file system if the device number information of all file systems on the host machine contains a device number that is consistent with the device number of the file system to which the currently operated file belongs.

[0152] In one embodiment, the seventh obtaining unit includes:

[0153] A ninth obtaining subunit, configured to obtain context file structure information corresponding to the current operation file;

[0154] a tenth obtaining subunit, configured to read mount point information of the current operation file from context file structure information corresponding to the current operation file;

[0155] The eleventh obtaining sub-unit is used to obtain super block information according to the mount point information;

[0156] The fifth determining subunit is used to determine the device number of the file system to which the current operation file belongs according to the super block information.

[0157] In one embodiment, the device further comprises:

[0158] The fifth determining module is used to determine the target risk level to which the directory related to the operation behavior belongs according to different risk levels of the pre-set host directory.

[0159] In one embodiment, the device further comprises:

[0160] The interception module is used to intercept operational behaviors that pose a risk of container escape when the target risk level reaches a preset interception level.

[0161] In one embodiment, the different risk levels of the host directory include no risk level, low risk level, medium risk level, and high risk level.

[0162] For the description of the features in the embodiments corresponding to the container escape detection device in this application, please refer to the relevant description of the embodiments corresponding to the container escape detection method, and will not be repeated here.

[0163] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above-mentioned container escape detection method embodiments.

[0164] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the steps of any of the above-mentioned container escape detection method embodiments when run.

[0165] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0166] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned container escape detection method embodiments are implemented.

[0167] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned container escape detection method embodiments are implemented.

[0168] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0169] The above describes in detail the container escape detection method, computer program product, electronic device, and computer-readable storage medium provided by this application. This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is intended only to facilitate understanding of the method and core concepts of this application. It should be noted that those skilled in the art may make various improvements and modifications to this application without departing from the principles of this application, and such improvements and modifications also fall within the scope of protection of the claims of this application.

Claims

1. A container escape detection method, characterized in that: The method is implemented when an extended Berkeley packet filter program is executed, wherein the extended Berkeley packet filter program is equipped with a file opening hook of a kernel security module, and the method includes: The file open hook in the extended Berkeley packet filter program is used to monitor the file read and write operations in the kernel state. When the kernel state detects that a file read and write operation occurs in the system, the main process currently operating the file is determined. If it is determined that the main process belongs to a container process, determining whether the current operation file belongs to a container; If the currently operated file does not belong to a container, determining whether the file system to which the currently operated file belongs belongs to a host file system; When it is determined that the file system to which the currently operated file belongs belongs to the host file system, it is determined that the operation behavior of the file read and write operation has a container escape risk; wherein: When it is determined that the main process belongs to a container process, before determining whether the current operation file belongs to a container, the method further includes: Obtaining namespace information of the subject process; Determine whether the namespace information is preset namespace information. If so, determine that the main process does not belong to a container process; if not, determine that the main process belongs to a container process.

2. The container escape detection method according to claim 1, characterized in that: Obtain the namespace information of the subject process, including: Obtaining process structure information of the main process; Reading a namespace information field from the process structure information; The namespace information of the subject process is obtained from the namespace information field.

3. The container escape detection method according to claim 1, characterized in that: Determining whether the current operation file belongs to a container includes: Obtaining the root directory index node value of the main process; Obtain the root directory index node value of the current operation file; Determine whether the root directory index node value of the main process is equal to the root directory index node value of the current operation file; When the root directory index node value of the main process is equal to the root directory index node value of the current operation file, determining that the current operation file belongs to a container; When the root directory index node value of the main process is not equal to the root directory index node value of the current operation file, it is determined that the current operation file does not belong to a container.

4. The container escape detection method according to claim 3, characterized in that: Obtaining the root directory index node value of the main process, including: Determine whether the kernel has enabled the process file system function; When the kernel has enabled the process file system function, obtaining the memory management structure information of the main process through the process structure information of the main process; Determining file structure information according to the memory management structure information; Acquire path information of the main process according to the file structure information; Determining the root directory of the main process according to the path information of the main process; When the kernel does not enable the process file system function, obtaining a memory mapping area linked list of the subject process; Obtaining file information corresponding to the code segment of the main process by traversing the memory mapping area linked list; Determine the root directory of the main process according to the file information; After the root directory is determined, a corresponding root directory index node value is obtained according to the file tree structure of the root directory.

5. The container escape detection method according to claim 3, characterized in that: Obtain the root directory index node value of the current operation file, including: Get the context file structure information corresponding to the current operation file; Read the file tree information of the current operation file through the context file structure information; Determine the root directory of the current operation file according to the file tree information; According to the root directory of the current operation file, a root directory index node value corresponding to the current operation file is obtained.

6. The container escape detection method according to claim 3, characterized in that: Determining whether the file system to which the currently operated file belongs belongs to the host file system includes: Get the root directory index node value of the host machine; Determine whether the root directory index node value of the current operation file is equal to the root directory index node value of the host machine; When the root directory index node value of the current operation file is equal to the root directory index node value of the host machine, it is determined that the file system to which the current operation file belongs belongs to the host machine file system.

7. The container escape detection method according to claim 6, characterized in that: Also includes: If the root directory index node value of the current operation file is not equal to the root directory index node value of the host machine, determining whether the root directory index node value of the current operation file is equal to 1; When the root directory index node value of the current operation file is equal to 1, obtaining the device number of the file system to which the current operation file belongs; Get the device number information of all file systems on the host; Matching the device number of the file system to which the currently operated file belongs with the device number information of all file systems on the host machine; If there is a device number consistent with the device number of the file system to which the currently operated file belongs in the device number information of all file systems on the host machine, it is determined that the file system to which the currently operated file belongs belongs to the host machine file system.

8. The container escape detection method according to claim 7, characterized in that: Obtain the device number of the file system to which the currently operated file belongs, including: Get the context file structure information corresponding to the current operation file; Reading the mount point information of the current operation file from the context file structure information corresponding to the current operation file; Obtain super block information according to the mount point information; The device number of the file system to which the currently operated file belongs is determined according to the super block information.

9. The container escape detection method according to any one of claims 1 to 8, characterized in that: After determining that the file read and write operations pose a container escape risk, the following steps are also included: According to different risk levels of pre-set host directories, a target risk level to which the relevant directories of the operation behavior belong is determined.

10. The container escape detection method according to claim 9, characterized in that: Also includes: When the target risk level reaches a preset interception level, the operation behavior with the risk of container escape is intercepted.

11. The container escape detection method according to claim 9, characterized in that: The different risk levels of the host directory include no risk level, low risk level, medium risk level and high risk level.

12. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the container escape detection method according to any one of claims 1 to 11 are implemented.

13. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the container escape detection method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the container escape detection method according to any one of claims 1 to 11.

Images