Container security enhancement system, method, host and storage medium for a host

Abstract

The application relates to the technical field of container security control, in particular to a container security enhancement system and method of a host and the host, wherein the system comprises: a generation module which generates a unique security namespace of a container before starting the container, names a container security policy file by using the security namespace, maps the namespace information of the established container namespace and the container, and transmits the namespace information to a user space; the user space sets a security context of the container according to the namespace information; a listening module which acquires information from the security context when the container security policy file is modified, determines the modification content of the container security policy file based on the acquired information in the security context, and synchronizes the modification content of the container security policy file to a host security policy file by using the mapping relationship. Therefore, the problems of lack of flexible namespace support, insufficient access control, easy loss of security policy under a privileged container, poor security and the like in the related art are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of container security control, and in particular to a container security enhancement system and method of a host, a host and a storage medium. BACKGROUND

[0002] With the rapid development of cloud computing, container technology has become the core infrastructure of cloud services due to its lightness, efficiency and ease of deployment. However, container processes are exposed to the network and face high security risks. The traditional Linux-based self-access control mechanism has a rough division of permissions, and the root user permission is unlimited, which makes it difficult to effectively prevent unauthorized behavior within the container. In contrast, mandatory access control, with its fine-grained management capabilities, has become an important means to improve container security. SELinux, as a MAC mechanism in the Linux kernel, can achieve fine-grained access control and, combined with the resource isolation characteristics of namespaces, provides a more secure and reliable running environment for containers.

[0003] However, related technologies mostly use a global unified management strategy for the host, which lacks flexibility in customizing individual containers, and in the privileged container mode, the security policy is invalid, resulting in security risks. Although centralized policy management simplifies configuration and maintenance, it also reduces the flexibility of the policy; and disabling SELinux, while reducing configuration complexity, significantly increases the attack surface of the container. SUMMARY

[0004] The present application provides a container security enhancement system and method of a host, a host and a storage medium to solve the problems of lack of flexible namespace support, insufficient access control, invalid security policy in privileged containers, poor security and the like in related technologies.

[0005] The first aspect of the present application provides a container security enhancement system of a host, comprising: a host including a user space and a kernel space, the user space storing a host security policy file, and the kernel space being provided with at least one container and a container security enhancement system, wherein the container security enhancement system comprises: a generation module configured to generate a unique security namespace for the container before starting the container, name the container security policy file using the security namespace, establish a mapping relationship between the container namespace and the namespace information of the container, and pass the namespace information to the user space, and the user space sets the security context of the container according to the namespace information; a listening module configured to obtain information from the security context when the container security policy file is modified, determine the modification content of the container security policy file based on the obtained information in the security context, and synchronize the modification content of the container security policy file to the host security policy file using the mapping relationship.

[0006] Optionally, in an embodiment of the present application, the generating module is configured to: insert an eBPF kernel program at the at least one eBPF tracepoint in the kernel space; and trigger the eBPF kernel program at the start of the container, and obtain the namespace information of the container from the process context of the host by using the eBPF kernel program.

[0007] Optionally, in an embodiment of the present application, the kernel space transmits the namespace information to the user space through a ring buffer.

[0008] Optionally, in an embodiment of the present application, the security context indicates that the container runs in a context of a container process namespace instance type, and enforces a container security policy.

[0009] Optionally, in an embodiment of the present application, the listening module is configured to: insert an eBPF kernel program at the at least one eBPF tracepoint in the kernel space; and trigger the eBPF kernel program when the container security policy file is modified, and obtain information from the security context by using the eBPF kernel program.

[0010] Optionally, in an embodiment of the present application, the information obtained from the security context includes at least one of a file descriptor, a buffer address of the user space, a write byte number, a process ID (Identifier, ID), a process name, and a user ID.

[0011] Optionally, in an embodiment of the present application, the listening module is configured to: filter out a modification process of the container security policy file through the file descriptor; read the written content according to the buffer address of the user space and the write byte number, and determine the modification content of the container security policy file according to the written content.

[0012] An embodiment of a second aspect of the present application provides a host, including: a user space, the user space storing a host security policy file; and a kernel space, the kernel space being provided with at least one container and a container security enhancement system of the host according to the above embodiment.

[0013] An embodiment of a third aspect of the present application provides a container security enhancement method of a host, including the following steps: generating a security namespace unique to a container before starting the container, naming a container security policy file by using the security namespace, mapping a container namespace and namespace information of the container, transmitting the namespace information to a user space, and setting a security context of the container according to the namespace information by the user space; obtaining information from the security context when the container security policy file is modified, determining modification content of the container security policy file based on the information obtained from the security context, and synchronizing the modification content of the container security policy file to a host security policy file by using the mapping relationship.

[0014] Optionally, in an embodiment of the present application, the eBPF kernel program is inserted into the at least one eBPF tracepoint in the kernel space; the eBPF kernel program is triggered when the container is started, and the eBPF kernel program is used to obtain the namespace information of the container from the process context of the host.

[0015] Optionally, in an embodiment of the present application, the kernel space delivers the namespace information to the user space through a ring buffer.

[0016] Optionally, in an embodiment of the present application, the security context indicates that the container runs in a context of a container process namespace instance type, and the container security policy is enforced.

[0017] Optionally, in an embodiment of the present application, the eBPF kernel program is inserted into the at least one eBPF tracepoint in the kernel space; the eBPF kernel program is triggered when the container security policy file is modified, and the eBPF kernel program is used to obtain information from the security context.

[0018] Optionally, in an embodiment of the present application, the information obtained from the security context includes at least one of a file descriptor, a buffer address of the user space, a write byte number, a process ID, a process name, and a user ID.

[0019] Optionally, in an embodiment of the present application, the process that modifies the container security policy file is filtered out through the file descriptor; the written content is read according to the buffer address of the user space and the write byte number, and the modification content of the container security policy file is determined according to the written content.

[0020] An embodiment of the fourth aspect of the present application provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the container security enhancement method of the host as described in the above embodiments.

[0021] Therefore, the present application has the following beneficial effects:

[0022] In the embodiments of the present application, the host includes a user space and a kernel space, the user space stores a host security policy file, and the kernel space is provided with at least one container and a container security enhancement system. The container security enhancement system mainly includes two core modules: a generation module is responsible for automatically generating a security namespace corresponding to the container before the container is started, and using the namespace to name manage the container security policy file, at the same time, establishing a mapping relationship between the container namespace and the container itself namespace information, and transmitting the namespace information to the user space, and the user space sets the security context of the container according to the namespace information, and controls the access permission and behavior of the container. The monitoring module monitors the modification operation of the container security policy file in real time, obtains related information from the security context when the file is changed, accurately identifies the modification content, and synchronizes the changes to the host security policy file through the mapping relationship, so as to ensure that the host and the container security policy are consistent, and improve the overall security protection capability. Therefore, the problems of lack of flexible namespace support, insufficient access control, security policy invalidation under privileged container, poor security and the like in related technologies are solved.

[0023] Additional aspects and advantages of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following and / or can be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0024] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the accompanying drawings, in which:

[0025] Figure 1 An example diagram of a container security enhancement system of a host according to embodiments of the present application;

[0026] Figure 2 A flowchart of a security context generation based on namespace according to embodiments of the present application;

[0027] Figure 3 A flowchart of a Docker container process creation according to embodiments of the present application;

[0028] Figure 4 A flowchart of a file modification in a container according to embodiments of the present application;

[0029] Figure 5 An architecture overview diagram of a SELinux-based container security enhancement device according to embodiments of the present application;

[0030] Figure 6 An example diagram of a host according to embodiments of the present application;

[0031] Figure 7 A flowchart of a container security enhancement method of a host according to embodiments of the present application. DETAILED DESCRIPTION

[0032] Embodiments of the present application are described below in detail, examples of which are shown in the accompanying drawings, in which the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0033] The container security enhancement system, method, host and storage medium of the host of the embodiments of the present application are described below with reference to the accompanying drawings. In view of the problems mentioned in the above background art, the present application provides a container security enhancement system of a host, in which the container security enhancement system mainly includes two core modules: a generation module is responsible for automatically generating a security namespace corresponding to the container before the container is started, and naming management of the container security policy file is performed by using the namespace, and a mapping relationship between the container namespace and the container itself namespace information is established, and the namespace information is transmitted to the user space, and the user space sets the security context of the container according to the namespace information, so as to control the access permission and behavior of the container. The monitoring module monitors the modification operation of the container security policy file in real time, obtains relevant information from the security context when the file is changed, accurately identifies the modification content, and synchronizes the change to the host security policy file through the mapping relationship, so as to ensure that the host and the container security policy are consistent, and improve the overall security protection capability. Thus, the problems of lack of flexible namespace support, insufficient access control, easy loss of security policy under privileged container, poor security and the like in the related art are solved.

[0034] Specifically, the container security enhancement system of a host according to the embodiments of the present application is described with reference to the accompanying drawings.

[0035] Figure 1 is a block schematic diagram of the container security enhancement system of a host according to the embodiments of the present application.

[0036] As shown in Figure 1 , the container security enhancement system 10 of the host includes a generation module 100 and a monitoring module 200.

[0037] The host includes a user space and a kernel space, the user space stores a host security policy file, and the kernel space is provided with at least one container and a container security enhancement system.

[0038] The generating module 100 is configured to generate a unique security namespace for a container before starting the container, name a container security policy file by using the security namespace, establish a mapping relationship between a container namespace and namespace information of the container, and pass the namespace information to a user space, so that the user space sets a security context of the container according to the namespace information. The listening module 200 is configured to acquire information from the security context when the container security policy file is modified, determine modification content of the container security policy file based on the acquired information in the security context, and synchronize the modification content of the container security policy file to a host security policy file by using the mapping relationship.

[0039] The user space is a region in an operating system structure for running normal application programs, and is isolated from a kernel space. The kernel space is a running region of an operating system kernel, is responsible for core functions such as management of system resources, scheduling of processes, and processing of interrupts, and has complete control permission of hardware. The host security policy file is a policy definition file stored in a user space of a host, and is used to constrain access control behaviors of a container and a host process.

[0040] The container security enhancement system is a set of security control mechanisms or components deployed between the kernel space and the user space, and is used to enhance access control, policy isolation, and dynamic security detection capabilities of a container runtime. In an embodiment of the present application, the container is implemented based on Docker technology. The security context is a set of permission identification information specified for a container process, and is used to control access behaviors of the container process in the system. In an embodiment of the present application, the security context is constructed based on a SELinux (Security-Enhanced Linux) security mechanism. SELinux is a security mechanism based on mandatory access control, and is used to control access permissions between processes, files, and resources in the system by defining strict security policies, so as to improve security of the Linux system. The security namespace, in the embodiment, is a logical isolation unit for uniquely creating an identification of a container security policy for each container. The security policy file, in the embodiment, is a rule configuration file used to define and constrain access permissions and operation behaviors of various objects (such as processes, files, and ports) in the system or the container, such as a SELinux policy.

[0041] It can be understood that, in the embodiment of the present application, a unique security namespace is generated for each container, and a mapping relationship with namespace information of the container is established, so that each container has an independent security policy file and an identity. Meanwhile, the listening module 200 can automatically acquire and synchronize modification content to the host security policy file when the container security policy file is modified, so as to ensure consistency and real-time performance of security policies between the container and the host.

[0042] In an embodiment of the present application, the generating module 100 is configured to insert an eBPF kernel program at the at least one eBPF tracepoint in the kernel space, and trigger the eBPF kernel program when the container is started, and obtain the namespace information of the container from the process context of the host by using the eBPF kernel program.

[0043] Wherein, eBPF (Extended Berkeley Packet Filter) is an efficient and secure programmable virtual machine running in the Linux kernel, allowing users to define small programs inserted into the kernel for network packet filtering, monitoring, tracking and security purposes. The tracepoint is a pre-defined event marker point in the kernel, and the program can be mounted with code, such as eBPF program, for real-time monitoring and processing. The eBPF kernel program is a program written with eBPF technology and running in the kernel space, which can efficiently capture and process kernel events to achieve dynamic tracking and security monitoring. The process context is a data structure in the operating system used to describe the state of the process, including process identifier, memory mapping, permission information, namespace, etc. The namespace is a resource isolation mechanism provided by the Linux kernel, and the processes in different namespaces have independent resource views, such as process ID, network, file system, etc., thus realizing the virtualization function of containers.

[0044] It can be understood that by inserting the kernel program at the eBPF tracepoint in the kernel space and triggering the program to obtain the namespace information of the container when the container is started, real-time monitoring of the container process and precise binding of the security context can be achieved, thus effectively ensuring the security isolation between containers.

[0045] As Figure 2 The security context generation process based on the namespace of the embodiment of the present application is shown in the figure. According to the SELinux rule, the custom module must be compiled and loaded into the kernel space to be executed correctly, so before the original input docker run command is executed directly, the process of generating a unique security namespace and loading the corresponding SELinux Policy module is added, and the --security-opt label=type:container_{sec_ns}_t parameter is added to the input docker run command, which is used to specify that the container process runs in a specific security context.

[0046] Specifically, the generating module 100 mainly includes two methods: a container policy framework generation method based on the namespace and a security context generation method based on the namespace.

[0047] In the process of generating the namespace-based container policy framework, the system automatically creates a corresponding policy file under the / etc / selinux folder in the container and initializes a Type Enforcement file container_{sec_ns}_policy.te when the container is created by the sedocker, which serves as a security policy management file in the container and can implement customized policies for the container.

[0048] Specifically, the container creation process is as shown in Figure 3 First, the Docker daemon is started on the local host system; second, the Docker daemon clones a child process and specifies that the child process runs in a namespace different from the local one to achieve isolation; third, the child process sets the running namespace according to the flag bit when cloning and executes the target program; and finally, the target program starts running in an environment isolated from other containers and the local system.

[0049] When a container creates a new process, it will inherit all the namespaces of the parent process by default, or explicitly specify the namespace-related flags through the clone system call (clone()). When these flags are set, the new process will create a completely isolated environment for the corresponding namespace type; the unassigned namespace type will inherit the parent process by default. The embodiments of the present application bind the namespace and the security context based on this principle.

[0050] Based on the above analysis of the container creation process, each container will go through the process of creating a container process using the clone system call by the Docker daemon during creation. Therefore, the tracepoint / syscalls / sys_enter_clone is selected as the hook of the eBPF kernel program in the container security context generation module 100, the process ID namespace information of the container is obtained from the task_struct, and a one-to-one mapping between the process ID namespace information and the security namespace information is created. Subsequently, the corresponding security namespace information of the process ID namespace can be found. The task_struct is a core data structure that describes a process or thread, which can be understood as an object representing a process in the kernel.

[0051] The specific steps of the embodiments of the present application in actual application are as follows:

[0052] (1) Insert the eBPF kernel program at the tracepoint / syscalls / sys_enter_clone hook point in the kernel to listen to the container creation process;

[0053] (2) A unique security namespace is generated before starting the container, and the namespace ID is used to name the security policy of the container;

[0054] (3) The eBPF kernel program is triggered when the container is started, and the process ID namespace information of the container is obtained from the task_struct in the process context.

[0055] In an embodiment of the present application, the kernel space transmits the namespace information to the user space through a ring buffer.

[0056] The ring buffer is a high-efficiency circular queue data structure, and data is written to the tail of the buffer and read from the head. The ring buffer provided by eBPF is one of the mechanisms for communication between user space and kernel space, supports asynchronous and low-latency data transmission, and is commonly used in scenarios such as event logging and state data transmission.

[0057] It can be understood that by using a ring buffer in the kernel space to transmit namespace information to the user space, efficient and low-latency communication between the kernel state and the user state can be achieved, avoiding the performance overhead caused by the traditional system call method. At the same time, the ring buffer has the characteristics of non-blocking and asynchronous reading, which can ensure that the real-time synchronization of namespace information is still stable in the scenario of frequent container creation or frequent namespace changes, improving the overall response capability and scalability of the system.

[0058] In the container creation process, the eBPF kernel program extracts the namespace information of the container from the process context and efficiently and asynchronously transmits the information to the user space through a ring buffer. The user space is a memory area running user application programs and cannot directly operate hardware or kernel resources, and must obtain kernel information through system calls or kernel communication mechanisms.

[0059] In an embodiment of the present application, the security context indicates that the container is running in a context of a container process namespace instance type, and the container security policy is enforced.

[0060] It can be understood that by binding the security context of the container runtime to the namespace instance type, a fine-grained security policy based on the namespace is achieved, allowing each container to run in an independent security domain and avoiding permission confusion and security policy conflicts between different containers. At the same time, the enforcement mode ensures that all container operations strictly follow the predefined security policy, effectively preventing unauthorized access and potential security risks.

[0061] In an embodiment of the present application, the user space constructs a SELinux security context label in the form of label:type:enforcing:container_{pid_ns}_t according to the obtained namespace information, where container_{pid_ns}_t is a unique type type identified by the namespace, used to distinguish the policy domains of different containers. The label indicates that the container will run in the container_{pid_ns}_t type under the SELinux security policy and in the enforcing mode, thereby ensuring that the behavior of the container is controlled by the refined, namespace-level security policy.

[0062] In an embodiment of the present application, the monitoring module 200 is configured to insert an eBPF kernel program at the at least one eBPF tracing point in the kernel space, and trigger the eBPF kernel program when the container security policy file is modified, and obtain information from the security context by using the eBPF kernel program.

[0063] In an embodiment of the present application, the monitoring module 200 is responsible for continuously and real-time monitoring the specified container_{sec_ns}_policy.te file inside the container. If the file is changed, the process of security policy compilation and loading is automatically completed, and the synchronization of the container policy to the host policy is realized.

[0064] The process of container internal file modification is shown in Figure 4 As the container uses the mount namespace to isolate the file system, the container file path is not consistent with the actual path of the host machine. The kernel needs to use the mount namespace mechanism to parse the container path into the real path on the host machine. The mount namespace is one of the container namespace mechanisms, which is used to isolate the file system mount points seen by different processes.

[0065] In an embodiment of the present application, multiple system calls are involved in the file writing process, and the Linux kernel accordingly provides multiple eBPF tracing points related to file writing operations. According to the writing process, the key system calls and their corresponding eBPF tracing points are summarized in Table 1.

[0066] Table 1

[0067]

[0068] Since the modification operation of the container security policy file needs to be monitored, and at the same time, the collection of redundant information needs to be reduced as much as possible, the system call in the writing process needs to be reasonably selected. When the user writes a file, if the O_SYNC or O_DIRECT flag is not set in the open() system call, the newly written data will be temporarily saved in the page cache, and the corresponding page is called a dirty page. At this time, the data will not be immediately written to the disk. The waiting queue bdi_wq and multiple writeback worker threads are designed in the kernel. When certain conditions are met (such as the expiration of the delay time (the default is 5 seconds), insufficient system memory, or the number of dirty pages exceeds the threshold), these threads will be awakened to perform the writeback operation of the dirty page and persist the data to the disk. Although the time window between writing and writing back is short (for example, in the Ext4 file system, due to the enablement of the delay allocation feature, the window can be up to 30 seconds at most), if a system crash or device power failure occurs during this period, data loss may still occur. Therefore, when the reliability of a single file needs to be improved, fsync and fdatasync can be called after writing to achieve synchronization of the file and the data. The bdi_wq and writeback worker threads are core components related to the dirty page writeback mechanism, which are used to manage the asynchronous write operation of the memory page to the disk.

[0069] When monitoring the modification operation of the policy file, if the open() system call is selected as the tracking point, any opening of the file will trigger the monitoring, regardless of whether the data is actually written, thereby generating a large number of redundant checks and being inefficient. The fsync() system call is a kernel timing data disk operation with a certain delay. If this system call is selected as the tracking point, the real-time performance of the monitoring will be affected. Based on the above analysis, the present application selects the eBPF program at the tracepoint / syscalls / sys_enter_write tracking point to efficiently and timely monitor the writing operation of the policy file in the container.

[0070] The specific steps of the embodiment of the present application in actual application are as follows:

[0071] (1) An eBPF kernel program is inserted at the tracepoint / syscalls / sys_enter_write tracking point in the kernel to monitor the modification of the policy file in the container.

[0072] (2) When the policy file in the container is modified, the monitoring program is started, and the key information is obtained from the context.

[0073] (3) By acquiring the key information, the process of modifying the policy file is filtered by using the file descriptor fd, and the written content is read according to the user space buffer address and the number of written bytes; wherein the user space buffer address is a pointer to the user space memory area, storing the data content to be written or read;

[0074] (4) According to the mapping relationship between the container namespace and the namespace information of the container, the content of the policy modification is synchronized to the corresponding policy file of the host, and the compilation and module loading are completed.

[0075] In an embodiment of the present application, the information acquired in the security context includes at least one of the file descriptor, the user space buffer address, the number of written bytes, the process ID, the process name and the user ID.

[0076] Among them, the file descriptor is a non-negative integer identifier assigned by the operating system for each opened file, device or socket, used by the process to reference the target resource when performing read and write system calls, and is an information transmission interface between user space and kernel space for file operation. The number of written bytes indicates the length of the data bytes planned to be written from the user space buffer to the target file or device.

[0077] It can be understood that the embodiments of the present application can accurately capture the write behavior of the policy file in the container, avoid irrelevant operations triggering the monitoring, and effectively improve the accuracy and system efficiency of policy synchronization.

[0078] In the embodiments of the present application, when the policy file in the container is modified, the monitoring program will be triggered, and the monitoring program extracts the following key information from the process context:

[0079] File descriptor (fd): used to identify the target file or device being written;

[0080] User space buffer address (buf): points to the user space memory address of the data to be written;

[0081] Number of written bytes (count): indicates the length of the data to be written;

[0082] Process ID (pid), process name (comm), user ID (uid) and other running environment information.

[0083] Among them, the most critical parameter is the file descriptor fd, which is used to identify the target file of the current write operation, and then to realize the identification and filtering of the write operation involving the SELinux policy file. In the specific implementation process, the parameter information at the system call entry can be obtained based on the trace_event_raw_sys_enter structure provided by the kernel; among them, args[0] in the parameter array args in the structure corresponds to the first parameter of the system call, that is, the file descriptor fd, and by analyzing the parameter, it can be determined whether the current write behavior acts on the target policy file, thereby triggering the corresponding processing logic.

[0084] In an embodiment of the present application, the monitoring module 200 is configured to filter out the modification process of the container security policy file through the file descriptor; read the written content according to the user space buffer address and the write byte number, and determine the modification content of the container security policy file according to the written content.

[0085] It can be understood that by accurately filtering and identifying the modification process of the security policy file in the container, it is ensured that only the effective write operation on the policy file is captured and processed, avoiding irrelevant data interference and resource waste; at the same time, based on the user space buffer address and the write byte number, the actual modification content is read to realize accurate synchronization of policy changes, effectively improve the real-time performance and reliability of the container security policy, and enhance the security protection ability and management efficiency of the overall system.

[0086] By obtaining the key information, the process of modifying the policy file is filtered through the file descriptor fd, and the written content is read according to the user space buffer address and the write byte number; according to the mapping relationship between the container namespace and the namespace information of the container, the policy modification content is synchronized to the corresponding policy file in the host, and the compilation and module loading are completed.

[0087] By obtaining the key information, the process of modifying the policy file is filtered through the file descriptor fd, and the written content is read according to the user space buffer address and the write byte number; according to the mapping relationship between the container namespace and the namespace information of the container, the policy modification content is synchronized to the corresponding policy file in the host, and the compilation and module loading are completed.

[0088] To ensure that the policy changes take effect immediately, the system automatically performs the compilation and module loading process of the policy file after completing the policy content synchronization, thereby realizing efficient synchronization of the policy in the container to the host security policy system, and guaranteeing the persistence, isolation and enforcement ability of the policy.

[0089] In summary, the architecture of the container security enhancement device based on SELinux in the embodiments of the present application is shown in Figure 5 The kernel space of the embodiments of the present application includes a generation module 100 and a listening module 200, which are used to set the security context based on the namespace information when the container is created, and to listen to the modification of the security policy in the container; in the user space, the system includes a security policy loading module, which is used to synchronize the container policy to the host mapping file and load the security module.

[0090] In the kernel space, two kernel module programs are designed using the eBPF technology, which are used to intercept the operation flow at different tracking points in the kernel and perform further processing. The embodiments of the present application combine the security-opt parameter supported by the container natively, use the security namespace information as the unique security context type identifier of each container, and bind the security namespace with the process ID (Identifier, Identifier) namespace of the container runtime, so as to distinguish the security policies of different namespaces.

[0091] In actual application scenarios, the container uses sedocker run to run the container in a protected manner, first generates the corresponding security context and SELinux policy for the container through the generation module 100, and binds the namespace and the policy of the host; when the container policy modification occurs, the container policy listening module 200 listens to the corresponding modification and extracts the incremental modification content; finally, the security policy loading module loads the policy into the kernel space.

[0092] According to the container security enhancement system of the host provided in the embodiments of the present application, the container security enhancement system mainly includes two core modules: the generation module is responsible for automatically generating a security namespace corresponding to the container before the container is started, and uses the namespace to manage the naming of the container security policy file, establishes a mapping relationship between the container namespace and the namespace information of the container itself, and transmits the namespace information to the user space. The user space sets the security context of the container according to the namespace information, realizes the control of the access permission and behavior of the container. The listening module monitors the modification operation of the container security policy file in real time, obtains related information from the security context when the file is changed, accurately identifies the modification content, and synchronizes the changes to the host security policy file through the mapping relationship, so as to ensure that the host and the container security policy are consistent, and improve the overall security protection capability. Thus, the problems of lack of flexible namespace support, insufficient access control, easy loss of security policy in privileged containers, poor security, etc. in related technologies are solved.

[0093] Secondly, Figure 6 A block diagram of a host provided by the embodiments of the present application is shown.

[0094] As shown in Figure 6 The host 20 includes a user space 300 and a kernel space 400.

[0095] The user space 300 stores a host security policy file. The kernel space 400 is provided with at least one container and a container security enhancement system.

[0096] According to the host provided by the embodiments of the present application, the centralized management and execution isolation of the container security policy can be realized. The user space as the centralized storage area of the security policy file facilitates the host to uniformly maintain and update the policy content, and improves the consistency and controllability of the overall policy. The security enhancement system deployed in the kernel space is responsible for real-time monitoring of the security policy change operation in the container, and synchronizes the change content to the host security policy file, so as to ensure that the container behavior is effectively monitored and dynamically responded in the runtime. The isolation and linkage between the container and the host policy are realized, which not only guarantees the security isolation between the containers, but also improves the visibility and control of the host on the security state of the container.

[0097] Figure 7 A flowchart of a container security enhancement method of a host provided by the embodiments of the present application.

[0098] As shown in Figure 7 The container security enhancement method of the host includes the following steps:

[0099] In step S101, a unique security namespace of the container is generated before starting the container. The security namespace is used to name the container security policy file, the mapping relationship between the container namespace and the namespace information of the container is established, the namespace information is transmitted to the user space, and the user space sets the security context of the container according to the namespace information.

[0100] In an embodiment of the present application, an eBPF kernel program is inserted into at least one eBPF tracing point in the kernel space; the eBPF kernel program is triggered when the container is started, and the eBPF kernel program is used to obtain the namespace information of the container from the process context of the host.

[0101] In an embodiment of the present application, the kernel space transmits the namespace information to the user space through a ring buffer.

[0102] In an embodiment of the present application, the security context indicates that the container runs in the context of the container process namespace instance type, and the container security policy is enforced.

[0103] In step S102, information is acquired from the security context when the container security policy file is modified, the modification content of the container security policy file is determined based on the acquired information in the security context, and the modification content of the container security policy file is synchronized to the host security policy file by using the mapping relationship.

[0104] In an embodiment of the present application, the eBPF kernel program is inserted into the at least one eBPF trace point in the kernel space; the eBPF kernel program is triggered when the container security policy file is modified, and information is acquired from the security context by using the eBPF kernel program.

[0105] In an embodiment of the present application, the acquired information in the security context includes at least one of a file descriptor, a buffer address of a user space, a number of written bytes, a process ID, a process name, and a user ID.

[0106] In an embodiment of the present application, the modification process of the container security policy file is filtered out by using the file descriptor; the written content is read according to the buffer address of the user space and the number of written bytes, and the modification content of the container security policy file is determined according to the written content.

[0107] It should be noted that the foregoing explanation and description of the embodiment of the container security enhancement system of the host also apply to the container security enhancement method of the host, which will not be described here again.

[0108] According to the container security enhancement method of the host provided in the embodiments of the present application, a security namespace corresponding to the container is automatically generated before the container is started, the container security policy file is named and managed by using the namespace, a mapping relationship between the container namespace and the namespace information of the container itself is established, and the namespace information is transmitted to the user space. The user space sets the security context of the container according to the namespace information, so as to control the access permission and behavior of the container. The modification operation of the container security policy file is monitored in real time, relevant information is acquired from the security context when the file is changed, the modification content is accurately identified, and the change is synchronized to the host security policy file by using the mapping relationship, so as to ensure that the security policies of the host and the container are consistent and the overall security protection capability is improved. Thus, the problems of lack of flexible namespace support, insufficient access control, easy loss of security policy under a privileged container, poor security, and the like in the related art are solved.

[0109] The embodiments of the present application also provide a computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the container security enhancement method of the host as described above.

[0110] In the description of the application, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the application. In the description of the application, the illustrative description of the above terms is not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or N embodiments or examples. In addition, different embodiments or examples described in the description of the application and the features of different embodiments or examples can be combined and combined by those skilled in the art without contradiction.

[0111] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the application, the meaning of "N" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0112] Any process or method descriptions in flow charts or otherwise described herein can be understood as representing code modules, segments, or portions of code that include one or more executable instructions for implementing specific logic functions (or steps) in the process, and that the various embodiments of the application can include additional or fewer steps or processes in alternative implementations, as will be appreciated by those skilled in the art. The various embodiments of the application can be implemented in hardware, software, firmware, or a combination thereof, as desired.

[0113] It should be understood that parts of the application can be implemented in hardware, software, firmware, or a combination thereof. In the above-described embodiments, the steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. As in another embodiment implemented in hardware, any one or a combination of the following technologies known in the art can be used: discrete logic circuit with logic gate circuit for implementing logic functions on data signals, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array, field programmable gate array, etc.

[0114] Those skilled in the art of the art can understand that the method of implementing the above-mentioned embodiments carries out all or part of the steps, which can be instructed by the program to complete the relevant hardware, and the above-mentioned program can be stored in a computer readable storage medium, which includes one or a combination of the steps of the method embodiment when executed.

[0115] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary and are not to be construed as limiting the present application, and that changes, modifications, substitutions and variations can be made by those skilled in the art without departing from the scope of the present application.

Claims

1. A host-based container security enhancement system, characterized in that, The host includes a user space and a kernel space. The user space stores host security policy files, and the kernel space is configured with at least one container and a container security enhancement system. The container security enhancement system includes: The generation module is used to generate a unique security namespace for the container before starting the container, use the security namespace to name the container security policy file, establish a mapping relationship between the container namespace and the container's namespace information, pass the namespace information to the user space, and the user space sets the container's security context according to the namespace information. A monitoring module is configured to obtain information from the security context when the container security policy file is modified, determine the modified content of the container security policy file based on the information obtained from the security context, and synchronize the modified content of the container security policy file to the host security policy file using the mapping relationship. The information obtained from the security context includes at least one of file descriptor, user space buffer address, number of bytes written, process ID, process name, and user ID.

2. The host container security enhancement system according to claim 1, characterized in that, The generation module is used for: Insert an eBPF kernel-mode program into at least one eBPF trace point in the kernel space; When the container starts, the eBPF kernel-mode program is triggered, and the eBPF kernel-mode program is used to obtain the container's namespace information from the host's process context.

3. The host container security enhancement system according to claim 1, characterized in that, The kernel space transmits the namespace information to the user space through a circular buffer.

4. The host container security enhancement system according to claim 1, characterized in that, The security context indicates that the container is running in a context of the container process namespace instance type, and that container security policies are enforced.

5. The host container security enhancement system according to claim 1, characterized in that, The monitoring module is used for: Insert an eBPF kernel-mode program into at least one eBPF trace point in the kernel space; When the container security policy file is modified, the eBPF kernel-mode program is triggered to obtain information from the security context.

6. The host container security enhancement system according to claim 1, characterized in that, The monitoring module is used for: The modification process of the container security policy file is filtered out by file descriptor; The content to be written is read based on the buffer address in user space and the number of bytes written, and the modified content of the container security policy file is determined based on the content to be written.

7. A host computer, characterized in that, include: User space, which stores host security policy files; A kernel space, wherein the kernel space is provided with at least one container and the container security enhancement system as described in any one of claims 1-6.

8. A method for enhancing container security on a host machine, characterized in that, The method is applied to the container security enhancement system according to any one of claims 1-6, wherein the method includes the following steps: Before starting the container, a unique security namespace is generated for the container. The security namespace is used to name the container security policy file. A mapping relationship between the container namespace and the container's namespace information is established. The namespace information is passed to the user space, and the user space sets the container's security context according to the namespace information. When the container security policy file is modified, information is obtained from the security context, the modified content of the container security policy file is determined based on the information obtained from the security context, and the modified content of the container security policy file is synchronized to the host security policy file using the mapping relationship. The information obtained from the security context includes at least one of file descriptor, user space buffer address, number of bytes written, process ID, process name, and user ID.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed, they implement the host container security enhancement method of claim 8.

Images