Container System Call Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing sandbox environments face challenges in securely managing system calls from applications, as they can be exploited for malicious activities or lead to kernel crashes, and existing solutions lack flexibility in enforcing tailored security policies for different application types.
Innovation Solution
A container platform that provides a policy data structure to define permitted and prohibited system calls based on application types, limiting the number of system call executions to prevent malicious behavior, and interacts with the kernel to enforce these policies using technical policy instructions, such as JSON objects for seccomp secure computing mode.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system calls are allowed freely in container environments, then application functionality is maintained, but security vulnerabilities and kernel crashes increase
Solution Approach 1:
The patent segments system call management by creating distinct policy sets for different application types (web servers, databases, etc.). Each container is assigned a specific policy based on its application type, dividing the monolithic system call control into granular, type-specific policies. This segmentation allows tailored security rules for each application category while maintaining overall system stability.
Solution Approach 2:
The patent implements preliminary action by establishing system call policies before containers are created or executed. The container platform pre-defines policy data structures that specify permitted and prohibited system calls for each application type. When a container is instantiated, the appropriate policy is automatically applied in advance, preventing malicious activities before they can occur.
2Reliability
If customized security policies are enforced for each application type, then security is improved, but policy management complexity increases
Solution Approach 1:
The patent applies universality by creating a standardized policy data structure that serves multiple application types. The same policy framework and enforcement mechanism are universally applied across web servers, databases, and other containerized applications. This multi-functional approach allows customized security for each application type while using a single, manageable policy management system.
Solution Approach 2:
The patent utilizes parameter changes by modifying the policy data structure to include application-type-specific parameters. The policy definition includes parameters such as permitted system call sets, prohibited system call sets, and execution limits that vary based on application type. This allows tailored security policies for different applications while maintaining a unified policy management approach through structured parameter variation.
3Reliability
If system call execution is limited to prevent malicious behavior, then security is enhanced, but application functionality may be restricted
Solution Approach 1:
The patent applies local quality by tailoring system call permissions to the specific needs of each application type. Web servers receive policies that permit network-related system calls, while databases receive policies that permit storage-related system calls. This localized approach ensures that each container has the necessary functionality for its specific purpose while maintaining security through type-appropriate restrictions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.