Method and apparatus for managing processes in container, computer program product and electronic device

Abstract

The embodiment of the invention discloses a method and device for managing processes in a container, a computer program product and electronic equipment. In one embodiment, a method includes determining, by an eBPF program, whether an executable file of a process is located in a writable layer of a container file system in response to execution of the process. And in response to determining that the executable file of the process is located in the writable layer of the container file system, obtaining a strategy aiming at the container. The method also includes managing execution of the process based on the policy. By means of the method, a user is allowed to expand the security defense function for the kernel by loading and executing the self-defined eBPF program under the condition that the kernel source code is not modified.

Description

Technical Field

[0001] The present disclosure relates to the field of computer security technology, and more particularly, to a method, apparatus, computer program product, and electronic device for managing processes in a container. Background Art

[0002] Malware can steal or tamper with sensitive data on a computer, modify its normal functions, and thus undermine the confidentiality, integrity, and availability of the computer system. Therefore, the detection and interception of malware is a key focus in the field of computer security.

[0003] The security of container runtime involves data protection, attack defense, service continuity assurance, and compliance assurance, and requires the detection and interception of malware during container runtime. Summary of the Invention

[0004] In a first aspect of an embodiment of the present disclosure, a method for managing processes in a container is provided. The method includes, in response to the execution of the process, determining, using an eBPF program, whether the executable file of the process is located in a writable layer of the container file system; in response to determining that the executable file of the process is located in the writable layer of the container file system, obtaining a policy for the container; and managing the execution of the process based on the policy.

[0005] In a second aspect of an embodiment of the present disclosure, a device for managing processes in a container is provided. The device includes an executable file location determination module that, in response to the execution of a process, determines, through an eBPF program, whether the executable file of the process is located in a writable layer of the container file system. A policy acquisition module, in response to determining that the executable file of the process is located in a writable layer of the container file system, acquires a policy for the container. In addition, the device also includes a process management module that manages the execution of the process based on the policy.

[0006] In a third aspect of the disclosed embodiment, a computer program product is provided, comprising a computer program, which implements the method provided according to the first aspect when executed by a processor.

[0007] In a fourth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising one or more processors and a memory associated with the one or more processors, wherein the memory is used to store program instructions, and when the program instructions are read and executed by the one or more processors, the method provided according to the first scheme is executed.

[0008] It should be understood that the contents described in the Summary of the Invention section are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram illustrating an example environment in which various embodiments of the present disclosure may be implemented is shown.

[0011] Figure 2 A flowchart illustrating a method for managing processes in a container according to some embodiments of the present disclosure is shown;

[0012] Figure 3 A schematic diagram illustrating an eBPF program according to some embodiments of the present disclosure is shown;

[0013] Figure 4 An example system diagram illustrating an OverlayFS file system for containers of some embodiments of the present disclosure;

[0014] Figure 5 An example block diagram of an apparatus for managing processes in a container according to some embodiments of the present disclosure is shown;

[0015] Figure 6 A schematic block diagram of an electronic device according to some embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0016] To make the purpose, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0017] The terms "including" and "having" and any variations thereof in this specification and claims and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products or apparatuses. Depending on the context, the word "if" as used herein may be interpreted as "at..." or "when..." or "in response to determining" or "in response to detecting".

[0018] As mentioned above, container runtime security involves data protection, attack defense, service continuity, and compliance assurance. This requires malware detection and interception during container runtime. For example, the Linux operating system implements host security defenses based on the system's kernel modules. However, kernel modules operate at the same privilege level as the operating system, and implementation flaws in kernel modules can impact the entire operating system. Furthermore, kernel modules must be consistent with the operating system version to function properly; otherwise, they will fail to load properly.

[0019] To this end, embodiments of the present disclosure provide a method for managing processes in a container. In this embodiment of the present disclosure, in response to the execution of a process, an eBPF program is used to determine whether the executable file of the process is located in the writable layer of the container file system. Based on this, in response to determining that the executable file of the process is located in the writable layer of the container file system, a risk management policy for the container is obtained. Furthermore, based on the risk management policy, risk management is performed on the process.

[0020] The file system within a container typically adopts a layered structure, primarily consisting of a base image layer, an intermediate layer, and a writable layer. The base image layer is the bottom layer of the container's file system, containing essential operating system files and libraries and typically read-only. The intermediate layer includes application dependencies, configuration files, and more. Each step in the container build generates a new intermediate layer, which is also read-only. The writable layer is the top layer of the container runtime, used to store runtime modifications and temporary data. This layer is writable, and each running container has its own writable layer. The inventors have discovered that malware created by attackers is often installed in the container's writable layer. When a container is running, an attacker can exploit vulnerabilities in the container's business processes to enter the container and create malware (for example, a backdoor or ransomware). Since the writable layer is the only writable part of the container runtime, any runtime modifications are saved in the writable layer, resulting in the attacker's malware being installed in the container's writable layer. In this way, container runtime security defenses can be implemented using the eBPF (Extended Berkeley Packet Filter) program installed in the system kernel. eBPF is a virtual machine technology that runs in the kernel of an operating system. It allows users to extend security defense functions for the kernel by loading and executing customized eBPF programs without modifying the kernel source code.

[0021] Figure 1 1 shows an example environment 100 in which various embodiments of the present disclosure may be implemented. Figure 1As shown, the environment 100 can be any device with computing or processing capabilities. For example, a computing unit can include but is not limited to a personal computer, a server, an embedded device, a mobile device, a supercomputer, an Internet of Things device, a network device, a cloud infrastructure, an industrial control system, a virtualization platform, etc. The method for controlling a process can be executed in the computing unit. Figure 1 As shown, a Linux operating system and a container 120 running on the operating system 110 are installed in the environment 100. The kernel 110 of the operating system has a security module 111 for implementing various computer security models (for example, the security module LSM of the Linux operating system, Linux Security Modules). The kernel 110 of the operating system can load the eBPF program 112 and the risk control strategy 113. When the operating system executes the program, it calls the eBPF program 112 through the security framework, so that the eBPF program 112 can judge whether the execution of the process is safe in combination with the risk control strategy, and feedback to the security module, thereby realizing the security defense of the computer. Since the eBPF program 112 will undergo strict inspection by the kernel 110 during installation, it can better ensure the stability of the operating system. In addition, the eBPF program 112 can also be loaded in different kernels without recompilation, and has good compatibility.

[0022] Figure 2 1 shows a flow chart of a method 200 for managing processes according to some embodiments of the present disclosure. The method 200 may be executed, for example, by an embedded device in the environment 100, or by a computer or other device with computing or processing capabilities. Figure 2 As shown, in box 202, method 200 can determine whether the executable file of the process is located in the writable layer of the container file system through the eBPF program in response to the execution of the process. When executing the program, the operating system will call the process security execution point in the security module. In some embodiments of the present disclosure, the eBPF program is installed into the process execution checkpoint in the security framework of the operating system, which enables the process execution security checkpoint in the security module to call the corresponding eBPF program. In some embodiments of the present disclosure, when calling the eBPF program, the process execution checkpoint of the security module can pass the information of the current process executable file to the eBPF program, and the eBPF program determines whether the executable file is located in the writable layer of the container file system based on the data carried in the file information.

[0023] At block 204, upon determining that the executable file of the process is located in the writable layer of the container file system, method 200 obtains a policy for the container. A container policy refers to a set of rules and configurations used to manage and control the behavior of the container. Container policies may include, but are not limited to, security policies, resource management policies, deployment and operations policies, access control policies, data protection policies, and compliance policies. In some embodiments of the present disclosure, an eBPF program can obtain the container policy and determine whether the execution of the process is safe based on the container policy.

[0024] At block 206, method 200 can manage the execution of the process according to the policy. In some embodiments of the present disclosure, at block 204, it is determined whether the execution of the process complies with the relevant provisions of the container policy according to the container policy: when the execution of the process does not comply with the relevant provisions of the container policy, the process execution is denied by the security module; when the execution of the process complies with the relevant provisions of the container policy, the process execution is not denied by the security module.

[0025] In this way, security defense is implemented based on the eBPF (Extended Berkeley PacketFilter) program installed in the system kernel, allowing users to extend the security defense function of the kernel by loading and executing customized eBPF programs without modifying the kernel source code.

[0026] Figure 3 Schematic diagram 300 of an eBPF program according to some embodiments of the present disclosure is shown. Figure 3 As shown, in some embodiments of the present disclosure, the eBPF program 320 is installed into the process execution checkpoint in the security framework LSM of the Linux operating system, which enables the process execution security checkpoint in the security module to call the corresponding eBPF program 320. Figure 4 An example system diagram of an OverlayFS file system for a container in some embodiments of the present disclosure is shown. OverlayFS (Overlay File System) is a union file system that allows multiple file systems to be stacked together to form a unified file system view. Figure 4As shown, the file system 400 includes an upper layer 420, a lower layer 440, a work directory 430, and a merge directory 410. The upper layer 420 is a writable layer used to store modifications and new files during container runtime. The lower layer is a read-only layer, which usually contains the base image of the container or shared system data. A container can consist of multiple lower layers, such as lower layers 440-1 and 440-2. The work directory 430 is a temporary directory used to store metadata and temporary files generated by the OverlayFS file system when merging file systems. The merge directory 410 is the final file system view seen by the user 411, which merges the contents of the upper and lower layers together.

[0027] At block 322, the Linux operating system can pass information about the executing process to the eBPF program 320, allowing the eBPF program to determine whether the process's executable file is located in the writable layer of the container file system based on the information about the process. In some embodiments of the present disclosure, the eBPF program can obtain the process's executable file path and the file path of the upper layer 420 of the container file system through interfaces and data structures provided by the kernel. By comparing the process's executable file path with the path of the upper layer 410 of the container file system, the eBPF program 320 can determine whether the process's executable file is located in the upper layer 420 of the container file system. In some disclosed embodiments, the Linux operating system can pass the process's executable file path information to the eBPF program when calling the eBPF program 320, and the eBPF program 320 can determine whether the process's executable file is located in the upper layer 420 of the container file system. If it is determined at block 322 that the process's executable file is located in the upper layer 420 of the container file system, the eBPF program 320 proceeds to block 324. If the process executable file is determined to be located in another layer of the container file system, rather than in the upper layer 420 of the container file system, at block 322, the eBPF program 320 returns a zero value, causing the process execution security checkpoint bprm_check_security in the LSM security module to allow execution of the process executable file based on the returned result. If the process executable file is determined to be located in the upper layer 420 of the container file system at block 322, this indicates that the process executable file was created during container runtime and may be malware created by an attacker who entered the container by exploiting a vulnerability in the container's service installation. The eBPF program 320 then proceeds to block 324 to further review whether the execution of the executable file poses a risk.

[0028] At block 324, the eBPF program 320 obtains the policy for the container. In some embodiments of the present disclosure, policy can be delivered using eBPF maps, cgroups (control groups), or userspace programs. eBPF maps provide a flexible data storage and query mechanism, facilitating dynamic policy modification. cgroups are suitable for resource management and policy control. Userspace programs are suitable for delivering simple static policies. Each container runs in an isolated environment, and the container can be identified by querying the relevant namespace. In some embodiments of the present disclosure, the eBPF program 320 obtains the PID namespace and mount namespace of the process. The PID namespace is the isolation of the process ID, and the mount namespace is the isolation of the file system mount. Using the process's PID namespace and mount namespace, the eBPF program 320 can obtain the identifier of the container in which the process resides, thereby determining which container the process belongs to. Based on this, the eBPF program 320 can query the corresponding entry in the eBPF map 330 based on the container identifier. If the corresponding entry exists in the eBPF map, it indicates that a security policy for the container exists, and the process proceeds to block 326. If there is no corresponding entry in the eBPF Map, it means that there is no security policy for the container. The eBPF program 320 returns a zero value, so that the process execution security checkpoint bprm_check_security in the LSM security module releases the execution behavior of the process's executable file based on the returned result.

[0029] At block 326, the eBPF program 320 determines whether the execution of the process's executable file complies with the container's security policy based on the obtained container security policy, thereby determining whether to intercept the process's executable file. In some embodiments of the present disclosure, if the eBPF program 320 determines that the execution of the process's executable file does not comply with the container's security policy, the program proceeds to block 328-2 and returns a non-zero value to the LSM security module 310, intercepting the process's execution. If the eBPF program 320 determines that the execution of the process's executable file complies with the container's security policy, the program proceeds to block 328-1 and returns a zero value to the LSM security module 310, allowing the process's execution to proceed. In some embodiments of the present disclosure, the eBPF program 320 can also audit the process's execution through the audit module 340 if it allows the process to proceed, preventing inadvertent interception of services while ensuring system security. The audit module 340 can detect and record process behavior, for example, system calls executed by the process and their parameters, file read and write operations, network activity, resource usage, permission changes, and time-related events. When potential security threats, abnormal behaviors, and compliance issues are discovered and the executable file of a process needs to be intercepted, the audit module 340 can modify the policy stored in the eBPF Map 330 so that the eBPF Map 330 does not execute the executable file of the process.

[0030] Figure 5 FIG2 shows a block diagram of an apparatus 500 for generating an image according to some embodiments of the present disclosure. The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the apparatus embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Figure 5 As shown, the apparatus 500 includes a location determination module 501, which is configured to determine, in response to the execution of a process, whether the executable file of the process is located in the writable layer of the container file system through an eBPF program. The apparatus 500 also includes a policy acquisition module 502, which is configured to obtain a policy for the container in response to determining that the executable file of the process is located in the writable layer of the container file system. In addition, the apparatus 500 also includes a process management module 503, which is configured to manage the execution of the process based on the policy.

[0031] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted via the computer-readable storage medium. The computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0032] Figure 6 1 shows a block diagram of an electronic device 600 that can implement various embodiments of the present disclosure. Figure 6 As shown, the electronic device 600 includes a processor 610, a disk drive 620, an input / output interface 630, a network interface 640, and a memory 650. The processor 610, the disk drive 620, the input / output interface 630, the network interface 640, and the memory 650 can be communicatively connected via a communication bus 660.

[0033] Among them, the processor 610 can be implemented by a general-purpose CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., to execute relevant programs to implement the technical solutions provided in this application.

[0034] The memory 650 can be implemented in the form of ROM (Read Only Memory), RAM (Read Access Memory), static memory, dynamic storage device, etc. The memory 650 can store an operating system 651 for controlling the operation of the electronic device 600 and a basic input and output system (BIOS) 652 for controlling the low-level operations of the electronic device 600. In addition, a web browser 653, a data storage management system 654, etc. can also be stored. In short, when the technical solution provided in this application is implemented through software or firmware, the relevant program code is stored in the memory 650 and is called and executed by the processor 610.

[0035] The input / output interface 630 is used to connect to an input / output module to implement information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0036] The network interface 640 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0037] The bus 660 comprises a pathway for transmitting information between the various components of the device (eg, the processor 610 , disk drive 620 , input / output interface 630 , network interface 640 , and memory 650 ).

[0038] It should be noted that although the above device only shows the processor 610, disk drive 620, input / output interface 630, network interface 640, memory 650, bus 660, etc., in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will understand that the above device may only include the components necessary to implement the method of the present application, and does not necessarily include all the components shown in the figure.

[0039] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0040] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In addition, although each operation is depicted in a specific order, this should be understood as requiring that such operations be performed in the specific order shown or in a sequential order, or requiring that all illustrated operations be performed to obtain the desired result. In certain environments, multitasking and parallel processing may be advantageous. Likewise, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of separate embodiments may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented in multiple implementations individually or in any suitable subcombination.

[0041] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A method for managing processes in a container, including: In response to execution of the process, determining, by the eBPF program, whether the executable file of the process is located in a writable layer of the container file system; In response to determining that the executable file of the process is located in a writable layer of the container file system, obtaining a policy for the container; as well as Based on the policy, execution of the process is managed.

2. The method according to claim 1 , wherein, in response to execution of a process, determining whether the executable file of the process is located in a writable layer of the container file system comprises: In response to the execution of the process, obtaining path information of the executable file of the process and path information of the writable layer of the container file system; as well as Based on the path information of the executable file information and the path information of the writable layer, it is determined whether the executable file of the process is located in the writable layer of the container file system.

3. The method according to claim 1 , wherein, in response to determining that the executable file of the process is located in a writable layer of the container file system, obtaining the policy for the container comprises: In response to determining that the executable file of the process is located in a writable layer of the container file system, determining a first namespace and a second namespace of the process; Determining a container corresponding to the process based on the first namespace and the second namespace of the process; as well as Gets the policy for the container.

4. The method according to claim 3, wherein obtaining a policy for the container comprises: Obtain a policy for the container through an eBPF Map corresponding to the eBPF program.

5. The method of claim 1 , wherein managing execution of the process based on the policy comprises: Based on the policy, determining whether to intercept the executable file of the process; as well as In response to determining that the executable file intercepts the process, the process is not executed.

6. The method of claim 1 , wherein managing the execution of the process based on the policy further comprises: In response to determining not to intercept the executable file of the process, configuring the process to an audit mode; as well as Execute the process.

7. The method of claim 6, wherein managing the execution of the process based on the policy further comprises: In response to an audit of the process determining that an executable file of the process is intercepted, a policy of the container is modified.

8. Means for managing processes in a container, comprising: a location determination module, in response to the execution of the process, determining, through the eBPF program, whether the executable file of the process is located in a writable layer of the container file system; a policy acquisition module, responsive to determining that the executable file of the process is located in a writable layer of the container file system, acquiring a policy for the container; as well as The process management module manages the execution of the process based on the policy.

9. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 7.

10. Electronic equipment, including: one or more processors, and A memory associated with the one or more processors, the memory being used to store program instructions, wherein when the program instructions are read and executed by the one or more processors, the steps of the method according to any one of claims 1 to 7 are executed.

Images