| 引用本文: | 李志,夏书婷,李圣杰,刘维杰,王振辰,金海.容器文件系统隔离增强机制.软件学报,2026,37(3):1427-1446 |
| |
|
| |
|
|
| 本文已被：浏览 745次 下载 1875次 |
码上扫一扫！ |
|
|
| 容器文件系统隔离增强机制 |
|
李志1,2,3,4, 夏书婷1,2,3,4, 李圣杰1,2,3,4, 刘维杰5, 王振辰1,2,3,4, 金海1,2,6,7
|
|
1.大数据技术与系统国家地方联合工程研究中心, 湖北 武汉 430074;2.服务计算技术与系统教育部重点实验室, 湖北 武汉 430074;3.大数据安全湖北省工程研究中心, 湖北 武汉 430074;4.华中科技大学 网络空间安全学院, 湖北 武汉 430074;5.南开大学 密码与网络空间安全学院, 天津 300071;6.集群与网格计算湖北省重点实验室, 湖北 武汉 430074;7.华中科技大学 计算机科学与技术学院, 湖北 武汉 430074
|
|
| 摘要: |
| 随着容器技术的广泛应用, 容器技术的安全性和隔离性受到广泛关注. 目前, 各类容器工具中长期存在大量容器逃逸漏洞, 其中由于容器文件系统隔离不足导致的安全漏洞已成为占比较大的一类安全威胁. 此类漏洞允许攻击者在容器与宿主机交互时操纵容器内文件路径解析过程或窃取宿主机中文件描述符来实施容器逃逸. 各容器工具社区虽实践了多种修复方法, 但仍无法彻底消除此类漏洞, 甚至因修复不彻底而引入了多个同类的新漏洞. 为彻底消除此类漏洞, 需从内核层面完善容器文件系统隔离机制. 因此提出了一种细粒度容器文件系统隔离增强机制, 将容器文件系统隔离从原有仅隔离文件系统挂载点扩展到inode级别. 该机制将对容器内文件的inode进行标识, 以区分容器与宿主机的文件对象, 继而基于标识设计并实施容器与宿主机间的访问控制, 以完成对容器与宿主机间文件系统隔离的增强. 实验结果表明该机制能够有效阻止所有文件系统相关的容器逃逸漏洞, 引入的平均开销低于2%, 且远低于容器工具提供的漏洞补丁带来的开销. |
| 关键词: 容器安全 漏洞修复 容器隔离 文件系统隔离 容器逃逸 |
| DOI：10.13328/j.cnki.jos.007507 |
| 分类号:TP316 |
| 基金项目:国家自然科学基金(62202191) |
|
| Isolation Enhancement Mechanism for Container File System |
|
LI Zhi1,2,3,4, XIA Shu-Ting1,2,3,4, LI Sheng-Jie1,2,3,4, LIU Wei-Jie5, WANG Zhen-Chen1,2,3,4, JIN Hai1,2,6,7
|
|
1.National Engineering Research Center for Big Data Technology and System, Wuhan 430074, China;2.Key Laboratory of Services Computing Technology and System, Ministry of Education, Wuhan 430074, China;3.Hubei Engineering Research Center on Big Data Security, Wuhan 430074, China;4.School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China;5.College of Cryptology and Cyber Science, Nankai University, Tianjin 300071, China;6.Cluster and Grid Computing Lab, Wuhan 430074, China;7.School of Computer Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China
|
| Abstract: |
| With the widespread application of container technology, the security and isolation of containers have attracted significant attention. Currently, a large number of container escape vulnerabilities persist in various container tools, with the security vulnerabilities due to inadequate container file system isolation becoming a type of security threat that occupies a significant proportion. This kind of vulnerability allows attackers to manipulate file path resolution processes within containers or steal file descriptors from the host machine during interactions between containers and the host machine. Although multiple fix methods have been practiced by various container tool communities, these vulnerabilities cannot be thoroughly eliminated, and even new similar vulnerabilities are introduced due to the incomplete fix. It is necessary to improve container file system isolation mechanisms at the kernel level to thoroughly eliminate these vulnerabilities. Therefore, this study proposes a fine-grained isolation enhancement mechanism for container file systems, which extends container file system isolation from merely isolating file system mount points to the inode level. This mechanism involves marking the inode of files within containers to distinguish the file objects of containers and the host machine, followed by designing and implementing access control between containers and the host machine based on these markings to enhance file system isolation between containers and the host machine. Experimental results demonstrate that this mechanism can effectively prevent all file system-related container escape vulnerabilities, and the introduced average overhead is less than 2%, significantly lower than the overhead introduced by vulnerability patches provided by container tools. |
| Key words: container security vulnerability fix container isolation filesystem isolation container escape |
|
|
|
|
