Container Mutation Detection via Namespace Join and Child Process Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current system monitoring tools fail to detect container mutation events triggered by external system calls that do not involve the assignment of control groups, leading to undetectable changes in container processes.
Innovation Solution
The method involves using external system calls, such as 'setns' and 'exec' functions, to execute processes within existing namespaces, allowing detection of container mutation events by determining container information like ID and name, even when control groups are not assigned.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system monitoring tools use traditional control group assignment methods to detect container processes, then they can identify authorized processes, but they fail to detect mutation events triggered by external system calls that do not involve control group assignment
Solution Approach 1:
The patent segments the detection approach into two independent tracking mechanisms: one for control group assignments and another for namespace operations. By separating these detection paths, the system can independently monitor each method of process execution, ensuring that mutation events through either pathway are captured without relying solely on traditional control group assignment monitoring
Solution Approach 2:
The patent introduces namespace information as an intermediary layer between the host operating system and container processes. By monitoring namespace join operations and tracking processes within namespaces, the system creates an intermediate detection point that captures mutation events before they would otherwise go undetected by traditional control group-based monitoring
2Adaptability or versatility
If the system monitors all system calls to detect container mutations, then detection coverage improves, but system performance and monitoring efficiency deteriorate due to increased overhead
Solution Approach 1:
The patent applies local quality by focusing monitoring efforts specifically on namespace-related system calls (such as join namespace operations) rather than uniformly monitoring all system calls. This targeted approach concentrates detection resources on the specific pathway used by mutation events, maintaining high detection coverage while minimizing unnecessary monitoring overhead on other system operations
Solution Approach 2:
The patent performs preliminary action by establishing namespace tracking and process-parent relationship monitoring in advance. By pre-configuring the namespace detection mechanism and maintaining ready-to-query data structures about namespace memberships and process hierarchies, the system can quickly identify mutation events without performing extensive analysis at the time of each system call, thus reducing real-time monitoring overhead
Data Source
AI summary
A computer-implemented method for determining container information associated with detected container mutation events is disclosed. The computer-implemented method includes: determining that a system call event to a host operating system includes a call to join a namespace and execute a parent process inside the namespace; determining that the namespace is associated with an existing container; responsive to determining that the namespace is associated with an existing container, determining that the system call event further includes a call to execute a child process inside the namespace; and responsive to determining that the system call event further includes a call to execute a child process inside the namespace: designating the child process as a mutation event to the existing container, and determining container information associated with the mutation event to the existing container. A corresponding computer system and computer program product are also disclosed.