WO2023103992A1 - 容器运行方法、装置、电子设备和存储介质 - Google Patents

容器运行方法、装置、电子设备和存储介质 Download PDF

Info

Publication number
WO2023103992A1
WO2023103992A1 PCT/CN2022/136683 CN2022136683W WO2023103992A1 WO 2023103992 A1 WO2023103992 A1 WO 2023103992A1 CN 2022136683 W CN2022136683 W CN 2022136683W WO 2023103992 A1 WO2023103992 A1 WO 2023103992A1
Authority
WO
WIPO (PCT)
Prior art keywords
container
permission set
minimum
permission
running
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/136683
Other languages
English (en)
French (fr)
Inventor
冉小凯
蒋学鑫
杨洋
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to EP22903414.5A priority Critical patent/EP4435641A4/en
Publication of WO2023103992A1 publication Critical patent/WO2023103992A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45575—Starting, stopping, suspending or resuming virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the embodiments of the present application relate to the field of computer processing technology, and in particular, to a container operation method, device, electronic equipment, and storage medium.
  • Container technology refers to effectively dividing the resources of a single operating system into isolated groups, so as to better balance conflicting resource usage requirements among isolated groups. That is, resource isolation is generated to solve the problem of multiple operating system/application stacks.
  • Privileged containers (containers in privileged mode) have almost all system permissions, and can directly modify host operating parameters, use system memory and CPU resources without restriction, access and modify host sensitive data, and delete host key files. Privileged containers have access to the global resources of the system, which also breaks the original design intention of container technology: resource isolation, that is, containers can only access local resources in the container namespace. Therefore, privileged containers running abnormally will pose a major threat to system security.
  • the main purpose of the embodiments of the present application is to provide a container running method, reclaim redundant permissions of privileged containers, and ensure the security of system resources.
  • the embodiment of the present application provides a method for running a container, including: obtaining the minimum permission set required for running the container; starting the container in a non-privileged mode, and passing the minimum permission set to the container as a parameter; For the original process, the minimum permission set is used as the permission set of the original process.
  • the embodiment of the present application also provides a container running system, including: an acquisition module, used to obtain the minimum permission set required for container operation; a transfer module, used to start the container in non-privileged mode, and set the minimum permission The set is passed to the container as a parameter; the startup module is used to start the original process of the container, and the minimum permission set is used as the permission set of the original process.
  • an embodiment of the present application further provides an electronic device, including: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores information that can be used by the at least one processor An instruction executed by a processor, the instruction is executed by the at least one processor, so that the at least one processor can execute the above container running method.
  • an embodiment of the present application further provides a computer-readable storage medium storing a computer program, and implementing the above container running method when the computer program is executed by a processor.
  • a method for running a container For a privileged container, filter out the minimum permission set required for the normal operation of the container, start the container in non-privileged mode, and pass the minimum permission set to the container as a parameter. After the original process of the container, the container has only the permissions in the least privilege set. In this way, unnecessary permissions are deleted, privileged containers are converted into non-privileged containers, and threats to system security caused by abnormal operation of privileged containers are reduced.
  • FIG. 1 is a flow chart of a container running method provided in an embodiment of the present application
  • Fig. 2 is a flowchart of a container operating device provided in an embodiment according to the present application
  • Fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
  • An embodiment of the present application relates to a method for running a container.
  • the specific process is shown in FIG. 1, at least including the following steps:
  • Step 101 obtaining the minimum permission set required for container operation
  • Step 102 start the container in non-privileged mode, and pass the minimum permission set to the container as a parameter
  • Step 103 start the original process of the container, and use the minimum permission set as the permission set of the original process.
  • step 101 the minimum permission set required for the container to run is obtained. Since the container is created to complete or realize the corresponding business, the minimum permission set required for the container to run is also the minimum permission required for the normal operation of the business.
  • obtaining the minimum permission set required for the container to run includes: initializing the minimum permission set of the container to be empty, and running the container in a non-privileged mode; Request permission from the system for performing privileged operations, add the requested permission to the minimum permission set, and grant the requested permission to the container to ensure the normal operation of the container; after meeting the preset initialization end conditions , shut down the running of the container, and output the minimum permission set.
  • the container is run in non-privileged mode, that is, the container cannot implement privileged operations at the beginning. Since the minimum permission set of the container is cleared at the beginning, the container does not have any permissions to perform privileged operations; but there are corresponding needs to complete when the container is generated.
  • the system will still request the permission to realize the privileged operation of the business, and the system will grant the corresponding permission to the container according to the request, so that the container can continue to request other permissions, and add the permission granted by the system to the current
  • the container's minimum privilege set gradually enriched with the contents of the container's minimum privilege set.
  • the running of the container is closed, and the final minimum permission set output will be obtained.
  • the normal running of the container may mean that the process of the container making the permission request runs normally.
  • the preset initialization termination condition includes: all the permissions requested by the container are within the minimum permission set.
  • the judging method that the permissions requested by the container are all within the minimum permission set for example, during the process of N consecutive requests for permissions (N is not less than the preset first threshold), the requested permissions are all within the minimum permission set, Then it is judged that the permissions requested by the container are all within the minimum permission set; or, in the process of continuously requesting permissions for not less than the preset second threshold, the requested permissions are all within the minimum permission set, then it is judged that the permissions requested by the container are within the least privilege set.
  • the system enables the permission testing function, that is, pre-processes the container permission request, starts the container in a non-privileged mode, and after startup, the container tries to call a privileged operation, that is, the permission for the system to request a privileged operation; the system Determine the requesting container according to the received request process, and obtain the container information.
  • the permission testing function that is, pre-processes the container permission request
  • starts the container in a non-privileged mode and after startup, the container tries to call a privileged operation, that is, the permission for the system to request a privileged operation
  • the system Determine the requesting container according to the received request process, and obtain the container information.
  • the preset end condition of initialization is for example: adding the requested permission to the minimum permission set until the service corresponding to the container is implemented, wherein the service corresponding to the container is generated when the container is established. Since there is a service that needs to be implemented when the container is generated (that is, the service corresponding to the container), the requested permission has been added to the minimum permission set until it is detected that the service that needs to be implemented is normally executed for the first time, and the current container request is determined. Permissions are all within the least set of permissions. If there are multiple stages of the business to be executed, and the permissions required for each stage are not completely consistent, the corresponding initialization end condition is that the multiple stages need to be traversed, and it is determined that the multiple stages are running normally.
  • the business corresponding to the container is running; for example, if there are three stages, it is necessary to determine that the permissions requested by the current container are all within the minimum permission set after the three stages are all executed normally for the first time.
  • the conditions for detecting whether the business is running here support preset and customization.
  • granting the permissions requested by the container is mainly to obtain the minimum permission set, that is, it is not a permanent grant of permissions.
  • the minimum permission set is formed and output, the permissions granted to the current container will be withdrawn. That is to say, the requested permissions are temporarily granted to the container.
  • the minimum permission set in the privileged container information includes the permission, and if not, the permission is temporarily granted to the container, and the permission is placed in the minimum permission set.
  • the necessary permissions for the container have been obtained, that is, the necessary permissions for the normal operation of the container are all within the minimum permission set, then the generation of the minimum permission set has been completed, and the obtained minimum permission Sets can be exported.
  • the above-mentioned temporary granting of container permissions refers to granting permissions during the process of generating but not completing the minimum permission set before the minimum permission set is output.
  • step 102 the container is started in a non-privileged mode, and the minimum permission set is passed to the container as a parameter. That is, after obtaining the minimum permission set, the container is restarted in a non-privileged mode, and the container initially runs in a state that does not have any permission for privileged operations.
  • the minimum permission set obtained in step 101 is used as a parameter to give the current container, that is, the container can obtain the permissions in the above minimum permission set. Prevent containers from obtaining unnecessary permissions, thereby threatening the security of other data in the system.
  • step 103 the original process of the container is started, and the minimum permission set is used as the permission set of the original process.
  • Start the container according to the original process of the container that is, the container runs according to the business that needs to be realized originally, and has the permissions obtained in the minimum permission set during the running process.
  • the container runs in the first state. The first state is only used to obtain the minimum permission set, and does not actually perform business operations.
  • the second state is usually the actual execution of business, for example, it can be called the production state; in addition, the operating environment of the first state and the second state is not limited, and the first state and the second state can run in the same environment, or run in different environments; the switching between the first state and the second state can be triggered according to preset transition conditions, such as the generation or transfer of the minimum permission set, or receiving a manual input switching command, or manually pressing the switch button etc.
  • starting the original process of the container takes the minimum permission set as the permission set of the original process, including: mapping the system tool to the space of the container; running the system tool as the initialization process of the container, and using the minimum permission set as the system tool The permission set of the container; start the original process of the container through the system tool, and inherit the permission set of the system tool to the permission set of the original process.
  • start the container in non-privileged mode pass the minimum permission set to the container as a parameter, that is, give the container the permission of the minimum permission set; use the mapping method to map the system tool to the container space, and run the system tool as the container.
  • the system tool receives the minimum permission set passed by the container, and uses the permission set to set its own permission set, such as using the minimum permission set as its own permission set; the system tool calls the execution file to start the original process of the container, according to the permission inheritance rules , the permission set of the system tool becomes the permission set of the execution file of the original process of the container through inheritance, that is, the minimum permission set is the permission set of the execution file of the original process of the container; the original process of the container obtains the minimum permission required for normal operation Set, during the running of the container, non-essential permissions are deleted, that is, the container does not have non-essential permissions during the running process, which is used to limit the data acquisition permissions of the container and improve the security of other data in the system.
  • the system tools include: capinit tool.
  • this embodiment provides a two-level system tool capinit, which accepts the minimum permission set passed when starting the container, and passes the minimum permission set to the original process of the container, that is, to the business process in the container, For example: capinit receives a minimum permission set as a runtime parameter; use the permission setting (setcap) command to give the capinit tool CAP_SETPCAP permission, and CAP_SETPCAP is the ability to transfer capabilities to other processes and delete other processes. At this time, even ordinary users can run capinit. You can change your own permissions; capinit uses the minimum set of permissions passed when starting the container to elevate its ambient (ambient) permissions; capinit calls the execution file (execve) to start the container process.
  • the system tool when the system tool is the capinit tool, after obtaining the minimum permission set required for the container to run, for example: start the container in non-privileged mode, pass the minimum permission set as a parameter to the current container; use the mapped
  • the method maps capinit to the container space, and runs capinit to complete the initialization process of the container; the capinit tool accepts the minimum permission set passed by the container, and uses the permission set to set its own ambient permission set, for example, combining its own ambient permission set with the minimum permission set Set to be consistent; the capinit tool calls execve to start the original process of the container.
  • the ambient permission set of capinit becomes the effective permission set of the original process of the container through inheritance.
  • the effective permission set of the original process of the container changes to To be consistent with the least privilege set.
  • the original process of the container obtains the minimum permission set required for normal operation, and the non-essential permissions of the original privileged container are deleted, preventing the container from requesting unnecessary data without restrictions, and improving the security of data in the system.
  • a method for running a container is provided.
  • the minimum permission set required for the normal operation of the container is screened out, and the container is given the minimum permission set necessary to delete the non-essential permission without making a container image.
  • convert the privileged container into a non-privileged container and reduce the threat to system security caused by the abnormal operation of the privileged container.
  • FIG. 1 is the The schematic diagram of the container operating device described in the embodiment.
  • Obtaining module 201 configured to obtain the minimum permission set required for container operation
  • the delivery module 202 is used to start the container in non-privileged mode, and pass the minimum permission set to the container as a parameter;
  • the starting module 203 is configured to start the original process of the container, and the minimum permission set is used as the permission set of the original process.
  • obtaining the minimum permission set required for the container to run includes: initializing the minimum permission set of the container to be empty, and running the container in a non-privileged mode; during the running of the container, obtaining In the non-privileged mode, the container requests the permission from the system to perform privileged operations, and adds the requested permission to the minimum permission set, grants the requested permission to the container, and ensures the normal operation of the container; After the initialization end condition of , the running of the container is closed, and the minimum permission set is output.
  • the preset initialization termination condition includes: all the permissions requested by the container are within the minimum permission set.
  • the preset initialization end condition includes: adding the requested permission to the minimum permission set until the service corresponding to the container is implemented, wherein the service corresponding to the container is generated when the container is established.
  • start the original process of the container use the minimum permission set as the permission set of the original process, for example: map the system tool into the space of the container; run the system tool as the initialization process of the container, use the minimum permission set as the system tool The permission set of the container; start the original process of the container through the system tool, and inherit the permission set of the system tool to the permission set of the original process.
  • the system tools include: capinit tool.
  • a container running device For a privileged container, the minimum permission set required for the normal operation of the container is screened out, and the minimum permission set is given to the container without the need to create a container image, and unnecessary permissions are deleted. , convert the privileged container into a non-privileged container, and reduce the threat to system security caused by the abnormal operation of the privileged container.
  • this embodiment is a system embodiment corresponding to the above method embodiment, and this embodiment can be implemented in cooperation with the above method embodiment.
  • the relevant technical details and technical effects mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition.
  • the relevant technical details mentioned in this embodiment can also be applied in the above embodiments.
  • modules involved in this embodiment are logical modules.
  • a logical unit can be a physical unit, or a part of a physical unit, or multiple physical units. Combination of units.
  • units that are not closely related to solving the technical problem proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.
  • FIG. 3 Another embodiment of the present application relates to an electronic device, as shown in FIG. 3 , including: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301; wherein, the memory 302 stores Instructions that can be executed by the at least one processor 301, the instructions are executed by the at least one processor 301, so that the at least one processor 301 can execute the container running methods in the foregoing embodiments.
  • the memory and the processor are connected by a bus
  • the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors and various circuits of the memory together.
  • the bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein.
  • the bus interface provides an interface between the bus and the transceivers.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium.
  • the data processed by the processor is transmitted on the wireless medium through the antenna, further, the antenna also receives the data and transmits the data to the processor.
  • the processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory can be used to store data that the processor uses when performing operations.
  • Another embodiment of the present application relates to a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • a storage medium includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Programmable Controllers (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例涉及计算机处理技术领域，特别涉及一种容器运行方法、装置、电子设备和存储介质。其中，容器运行方法，包括：获取容器运行所需的最小权限集；以非特权模式启动容器，并将最小权限集作为参数传递给容器；启动容器的原始进程，以最小权限集作为原始进程的权限集。

Description

容器运行方法、装置、电子设备和存储介质
相关申请
本申请要求于2021年12月07号申请的、申请号为202111484516.4的中国专利申请的优先权。
技术领域
本申请实施例涉及计算机处理技术领域，特别涉及一种容器运行方法、装置、电子设备和存储介质。
背景技术
容器技术是指，有效的将单个操作系统的资源划分到孤立的组中，以便更好的在孤立的组之间平衡有冲突的资源使用需求。也就是产生资源隔离，用于解决多操作系统/应用程序堆栈的问题。
而特权容器(特权模式的容器)几乎拥有系统全部权限，可以直接修改主机运行参数，不受限制的使用系统内存、CPU资源，访问、修改主机敏感数据，删除主机关键文件。特权容器拥有对系统全局资源的访问权限，也打破了容器技术的设计初衷：资源隔离，即容器只能访问容器命名空间内的局部资源。因此，运行异常的特权容器将对系统安全构成重大威胁。
发明内容
本申请实施例的主要目的在于提出一种容器运行方法，回收特权容器的多余权限，保障系统资源的安全性。
为实现上述目的，本申请实施例提供了一种容器运行方法，包括：获取容器运行所需的最小权限集；以非特权模式启动容器，并将最小权限集作为参数传递给容器；启动容器的原始进程，以最小权限集作为原始进程的权限集。
为实现上述目的，本申请实施例还提供一种容器运行系统，包括：获取模块，用于获取容器运行所需的最小权限集；传递模块，用于以非特权模式启动容器，并将最小权限集作为参数传递给容器；启动模块，用于启动容器的原始进程，以最小权限集作为原始进程的权限集。
为实现上述目的，本申请实施例还提供了一种电子设备，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述的容器运行方法。
为实现上述目的，本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现上述的容器运行方法。
本申请实施例中，提供了一种容器运行方法，对于特权容器，筛选出容器正常运行所需最小权限集，以非特权模式启动容器，将所述最小权限集作为参数传递给容器，在启动容器的原始进程后，容器仅具有最小权限集中的权限。从而删除了非必须权限，将特权容器转换 为非特权容器，降低特权容器运行异常对系统安全的威胁。
附图说明
图1是根据本申请一个实施例中所提供的容器运行方法的流程图；
图2是根据本申请一个实施例中所提供的容器运行装置的流程图；
图3是根据本申请一个实施例中提供的一种电子设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请的一个实施例涉及一种容器运行方法，具体流程如图1所示，至少包括以下步骤：
步骤101，获取容器运行所需的最小权限集；
步骤102，以非特权模式启动容器，并将最小权限集作为参数传递给容器；
步骤103，启动容器的原始进程，以最小权限集作为原始进程的权限集。
下面对本实施例的容器运行方法的实现细节进行具体的说明，以下内容仅为方便理解提供的实现细节，并非实施本方案的必须。
在步骤101中，获取容器运行所需的最小权限集。由于容器的产生是为了完成或实现相应业务，容器运行所需的最小权限集也就是该业务正常运作所需的最小权限。
在一个例子中，获取容器运行所需的最小权限集，包括：将容器的最小权限集初始化为空，并将容器运行在非特权模式下；在容器的运行过程中，获取容器在非特权模式下向系统请求的用于进行特权操作的权限，并将请求的权限加入最小权限集，赋予所述容器所述请求的权限，保证所述容器的正常运行；在满足预设的初始化结束条件后，关闭容器的运行，输出最小权限集。其中，将容器运行在非特权模式下，即容器最开始无法实现特权操作，由于最开始将容器的最小权限集清空，容器不具备任何进行特权操作的权限；但容器在生成时存在对应需要完成的业务，所以在运行过程中仍然会向系统请求实现该业务的特权操作的权限，系统根据请求赋予容器相应的权限，使得容器能够继续进行其他权限的请求，并将系统赋予的该权限加入当前容器的最小权限集，逐渐充实容器的最小权限集的内容。在满足预设的初始化结束条件后，关闭容器的运行，将得到的最终的最小权限集输出。此处容器的正常运行可以是容器进行权限请求的过程正常运行。
在一个例子中，预设的初始化结束条件包括：容器请求的权限均处于最小权限集内。其中，对于容器请求的权限均处于最小权限集内的判断方式，例如为连续N次请求的权限(N不小于预设的第一阈值)过程中，所请求的权限均在最小权限集内，则判断容器请求的权限均处于最小权限集内；或，对权限连续请求的时间不小于预设的第二阈值的过程中，所请求的权限均在最小权限集内，则判断容器请求的权限均处于最小权限集内。
在一个具体实现中，首先系统开启权限测调功能，即为容器权限的请求做好预处理，以 非特权模式启动容器，启动后容器尝试调用特权操作，即对于系统请求特权操作的权限；系统根据所收到的请求进程确定进行请求的容器，并获取容器信息，在收到权限请求时，判断容器信息中的最小权限集是否包含该权限，若不包含，则将该请求权限加入最小权限集，并继续接收容器的下一次权限请求；若包含，则接收容器的下一次特权请求，在连续请求次数不小于第一阈值的过程中，所有请求的权限均在最小权限集内，或连续请求时长不小于第二阈值的过程中，所有请求的权限均在最小权限集内，则判断容器所需的权限均处于最小权限集内，当前最小权限集为最终的最小权限集，可输出。
在另一个例子中，预设的初始化结束条件还例如：将请求的权限加入所述最小权限集，直到容器对应的业务实现运行，其中，所述容器对应的业务在所述容器建立时产生。由于容器在生成时存在需要实现的业务(即容器对应的业务)，在一直在向最小权限集中加入请求的权限，直到检测到所需要实现的业务首次正常执行的情况下，判定当前容器请求的权限均处于最小权限集内。该需要执行的业务若存在多个阶段，每个阶段所需的权限不完全一致，则对应的初始化结束条件是需要遍历所述多个阶段，检测到所述多个阶段均正常运行，才判定所述容器对应的业务实现运行；例如存在三个阶段，则需要这三个阶段首次均实现正常执行后，判定当前容器所请求的权限均在最小权限集内。此处的检测业务是否实现运行的条件支持预设及自定义。
此外，赋予容器请求的权限，主要是为了获取最小权限集，即并不是永久赋予权限，当最小权限集形成并输出后，当前容器被赋予的权限会被收回。也就是说所请求的权限是暂时的赋予容器。
在一个具体实现中，在收到权限请求时，判断特权容器信息中的最小权限集是否包含该权限，若不包含，则临时赋予容器该权限，且将该权限置入最小权限集中。当容器所需要实现的业务正常运行时，表示容器所必要的权限均已获取，也就是容器正常运行的必要权限均处于最小权限集内，则已完成最小权限集的生成，所获取的最小权限集可输出。上述临时赋予容器权限，指的是在最小权限集输出之前，在最小权限集正在进行生成但未完成的过程中赋予权限。在容器对应的业务能够正常执行时判断最小权限集获取成功，不需要设置阈值判断最小权限集是否已完成获取，减少需要实施的准备工作，并且直接由业务的执行状况判断，所获取的最小权限集更准确，提升用户体验。
在步骤102中，以非特权模式启动容器，并将最小权限集作为参数传递给容器。即，在获取最小权限集后，以非特权模式重新启动容器，容器初始运行于不具有任何特权操作的权限的状态下。此时，将步骤101获取的最小权限集作为参数，赋予当前容器，即，容器能够获取上述最小权限集中的权限。避免容器获取非必要权限，从而威胁到系统中其他数据的安全。
在步骤103中，启动容器的原始进程，以最小权限集作为原始进程的权限集。按照容器的原始进程启动容器，即容器按照原需要实现的业务运行，在运行过程中具有所获取的最小权限集中的权限。其中，在上述获取最小权限集时，容器运行于第一状态，该第一状态只用于获取最小权限集，不实际进行业务运行，例如可称为测试状态；在本步骤中，启动后容器运行于第二状态，第二状态通常为实际执行业务，例如可称为生产状态；此外，第一状态与第二状态的运行环境并不进行限定，第一状态和第二状态可运行于同一环境中，或者运行在不同环境中；第一状态与第二状态的切换可以根据预设转换条件触发，例如最小权限集的生 成或传递，或接到人工输入的转换指令，或人为按动转换按钮等。
在一个例子中，启动容器的原始进程，以最小权限集作为原始进程的权限集，包括：将系统工具映射到容器的空间内；运行系统工具作为容器的初始化进程，将最小权限集作为系统工具的权限集；通过系统工具启动容器的原始进程，并将系统工具的权限集继承给原始进程的权限集。具体地，用非特权模式启动容器，将最小权限集作为参数传递给容器，也就是为容器赋予最小权限集中的权限；使用映射的方式将系统工具映射到容器的空间，运行系统工具作为容器的初始化进程；系统工具接收容器传递的最小权限集，并使用该权限集设置自己的权限集，例如将最小权限集作为自己的权限集；系统工具调用执行文件启动容器的原始进程，根据权限继承规则，系统工具的权限集通过继承的方式成为容器的原始进程的执行文件的权限集，即最小权限集作为容器的原始进程的执行文件的权限集；容器的原始进程获取正常运行所需的最小权限集，容器在运行过程中，非必须权限被删除，即容器在运行过程中不具备非必须权限，用于限制容器的数据获取权限，提高系统中其他数据的安全性。
在一个例子中，系统工具包括：capinit工具。具体地，本实施例提供一个二级制系统工具capinit，该工具接受启动容器时传递的最小权限集，并将该最小权限集传递给容器的原始进程，也就是传递给容器内的业务进程，例如：capinit接收一个最小权限集作为运行时参数；使用权限设置(setcap)命令赋予capinit工具CAP_SETPCAP权限，CAP_SETPCAP为允许向其他进程转移能力以及删除其他进程的能力，此时即使普通用户运行capinit，也可以变更自己的权限；capinit使用启动容器时传递的最小权限集提升自己的环境(ambient)权限；capinit调用执行文件(execve)启动容器进程。
在一个具体实现过程中，当系统工具为capinit工具时，再获取容器运行所需的最小权限集之后，例如：用非特权模式启动容器，将最小权限集作为参数传递给当前容器；使用映射的方式将capinit映射到容器空间，运行capinit以完成容器的初始化进程；capinit工具接受容器传递的最小权限集，并使用该权限集设置自己的ambient权限集，例如将自己的ambient权限集与最小权限集设置为一致；capinit工具调用execve启动容器的原始进程，根据权限继承规则，capinit的ambient权限集通过继承的方式成为容器的原始进程的effective权限集，例如，该容器的原始进程的effective权限集变为与最小权限集一致。从而容器的原始进程获取到正常运行所需的最小权限集，原特权容器的非必须权限被删除，避免容器无限制的请求非必要的数据，提高了系统中数据的安全性。
本实施方式中，提供了一种容器运行方法，对于特权容器，筛选出容器正常运行所需最小权限集，并在无需制作容器镜像的情况下，赋予容器必须的最小权限集合，删除非必须权限，将特权容器转换为非特权容器，降低特权容器运行异常对系统安全的威胁。
本申请的另一个实施例涉及一种容器运行装置，下面对本实施例的调度系统的细节进行具体的说明，以下内容仅为方便理解提供的实现细节，并非实施本例的必须，图2是本实施例所述的容器运行装置的示意图，包括：
获取模块201，用于获取容器运行所需的最小权限集；
传递模块202，用于以非特权模式启动容器，并将最小权限集作为参数传递给容器；
启动模块203，用于启动容器的原始进程，以最小权限集作为原始进程的权限集。
对于获取模块201，在一个例子中，获取容器运行所需的最小权限集，包括：将容器的最小权限集初始化为空，并将容器运行在非特权模式下；在容器的运行过程中，获取容器在 非特权模式下向系统请求的用于进行特权操作的权限，并将请求的权限加入最小权限集，赋予所述容器所述请求的权限，保证所述容器的正常运行；在满足预设的初始化结束条件后，关闭容器的运行，输出最小权限集。
在一个例子中，预设的初始化结束条件包括：容器请求的权限均处于最小权限集内。
在另一个例子中，预设的初始化结束条件包括：将所述请求的权限加入所述最小权限集，直到容器对应的业务实现运行，其中，容器对应的业务在容器建立时产生。
对于启动模块203，启动容器的原始进程，以最小权限集作为原始进程的权限集，例如：将系统工具映射到容器的空间内；运行系统工具作为容器的初始化进程，将最小权限集作为系统工具的权限集；通过系统工具启动容器的原始进程，并将系统工具的权限集继承给原始进程的权限集。
在一个例子中，系统工具包括：capinit工具。
本实施方式中，提供了一种容器运行装置，对于特权容器，筛选出容器正常运行所需最小权限集，并在无需制作容器镜像的情况下，赋予容器必须的最小权限集合，删除非必须权限，将特权容器转换为非特权容器，降低特权容器运行异常对系统安全的威胁。
不难发现，本实施例为与上述方法实施例对应的系统实施例，本实施例可以与上述方法实施例互相配合实施。上述实施例中提到的相关技术细节和技术效果在本实施例中依然有效，为了减少重复，这里不再赘述。相应地，本实施例中提到的相关技术细节也可应用在上述实施例中。
值得一提的是，本实施例中所涉及到的各模块均为逻辑模块，在实际应用中，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施例中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施例中不存在其它的单元。
本申请另一个实施例涉及一种电子设备，如图3所示，包括：至少一个处理器301；以及，与所述至少一个处理器301通信连接的存储器302；其中，所述存储器302存储有可被所述至少一个处理器301执行的指令，所述指令被所述至少一个处理器301执行，以使所述至少一个处理器301能够执行上述各实施例中的容器运行方法。
其中，存储器和处理器采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器。
处理器负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储处理器在执行操作时所使用的数据。
本申请另一个实施例涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程 序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施方式是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (9)

  1. 一种容器运行方法，包括：
    获取容器运行所需的最小权限集；
    以非特权模式启动所述容器，并将所述最小权限集作为参数传递给所述容器；
    启动所述容器的原始进程，以所述最小权限集作为所述原始进程的权限集。
  2. 根据权利要求1所述的容器运行方法，其中，所述获取容器运行所需的最小权限集，包括：
    将所述容器的最小权限集初始化为空，并将所述容器运行在非特权模式下；
    在所述容器的运行过程中，获取所述容器在所述非特权模式下向系统请求的用于进行特权操作的权限，并将所述请求的权限加入所述最小权限集，赋予所述容器所述请求的权限，保证所述容器的正常运行；
    在满足预设的初始化结束条件后，关闭所述容器的运行，输出所述最小权限集。
  3. 根据权利要求2所述的容器运行方法，其中，所述预设的初始化结束条件包括：
    所述容器请求的权限均处于所述最小权限集内。
  4. 根据权利要求2所述的容器运行方法，其中，所述预设的初始化结束条件包括：
    将所述请求的权限加入所述最小权限集，直到所述容器对应的业务实现运行，其中，所述容器对应的业务在所述容器建立时产生。
  5. 根据权利要求1至4中任一项所述的容器运行方法，其中，所述启动所述容器的原始进程，以所述最小权限集作为所述原始进程的权限集，包括：
    将系统工具映射到所述容器的空间内；
    运行所述系统工具作为所述容器的初始化进程，将所述最小权限集作为所述系统工具的权限集；
    通过所述系统工具启动所述容器的原始进程，并将所述系统工具的权限集继承给所述原始进程的权限集。
  6. 根据权利要求5所述的容器运行方法，其中，所述系统工具包括：capin it工具。
  7. 一种容器运行装置，包括：
    获取模块，用于获取容器运行所需的最小权限集；
    传递模块，用于以非特权模式启动所述容器，并将所述最小权限集作为参数传递给所述容器；
    启动模块，用于启动所述容器的原始进程，以所述最小权限集作为所述原始进程的权限集。
  8. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至6中任一项所述的容器运行方法。
  9. 一种计算机可读存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现权利要求1至6中任一项所述的容器运行方法。
PCT/CN2022/136683 2021-12-07 2022-12-05 容器运行方法、装置、电子设备和存储介质 Ceased WO2023103992A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22903414.5A EP4435641A4 (en) 2021-12-07 2022-12-05 Container operation method and apparatus, electronic device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111484516.4 2021-12-07
CN202111484516.4A CN116302298A (zh) 2021-12-07 2021-12-07 容器运行方法、装置、电子设备和存储介质

Publications (1)

Publication Number Publication Date
WO2023103992A1 true WO2023103992A1 (zh) 2023-06-15

Family

ID=86729617

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/136683 Ceased WO2023103992A1 (zh) 2021-12-07 2022-12-05 容器运行方法、装置、电子设备和存储介质

Country Status (3)

Country Link
EP (1) EP4435641A4 (zh)
CN (1) CN116302298A (zh)
WO (1) WO2023103992A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116737445A (zh) * 2023-08-14 2023-09-12 南京翼辉信息技术有限公司 一种利用伪容器实现资源隔离的控制方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160366104A1 (en) * 2015-06-11 2016-12-15 International Business Machines Corporation Container-based system administration
CN106845183A (zh) * 2017-01-24 2017-06-13 郑州云海信息技术有限公司 一种应用容器引擎管理方法及系统
CN109802955A (zh) * 2018-12-29 2019-05-24 360企业安全技术(珠海)有限公司 权限控制方法及装置、存储介质、计算机设备
CN113065108A (zh) * 2021-04-16 2021-07-02 支付宝(杭州)信息技术有限公司 用户权限的管理、应用运行方法及装置
CN113221103A (zh) * 2021-05-08 2021-08-06 山东英信计算机技术有限公司 一种容器安全防护方法、系统及介质
CN113672974A (zh) * 2021-07-29 2021-11-19 北京奇艺世纪科技有限公司 权限管理方法、装置、设备及存储介质

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104462970B (zh) * 2014-12-17 2017-06-16 中国科学院软件研究所 一种基于进程通信的Android应用程序权限滥用检测方法
US9954950B2 (en) * 2015-12-23 2018-04-24 Intel Corporation Attestable information flow control in computer systems
US11683311B2 (en) * 2018-03-01 2023-06-20 Veritas Technologies Llc Systems and methods for running applications on a multi-tenant container platform
US11822676B2 (en) * 2019-06-25 2023-11-21 Vmware, Inc. Determination of a minimal set of privileges to execute a workflow in a virtualized computing environment
CN111078367A (zh) * 2019-12-23 2020-04-28 北京云联万维技术有限公司 一种请求处理方法、装置、电子设备和存储介质
CN111259412B (zh) * 2020-01-09 2023-12-05 远景智能国际私人投资有限公司 权限控制方法、装置、计算机设备及存储介质
US10747875B1 (en) * 2020-03-19 2020-08-18 Cyberark Software Ltd. Customizing operating system kernels with secure kernel modules

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160366104A1 (en) * 2015-06-11 2016-12-15 International Business Machines Corporation Container-based system administration
CN106845183A (zh) * 2017-01-24 2017-06-13 郑州云海信息技术有限公司 一种应用容器引擎管理方法及系统
CN109802955A (zh) * 2018-12-29 2019-05-24 360企业安全技术(珠海)有限公司 权限控制方法及装置、存储介质、计算机设备
CN113065108A (zh) * 2021-04-16 2021-07-02 支付宝(杭州)信息技术有限公司 用户权限的管理、应用运行方法及装置
CN113221103A (zh) * 2021-05-08 2021-08-06 山东英信计算机技术有限公司 一种容器安全防护方法、系统及介质
CN113672974A (zh) * 2021-07-29 2021-11-19 北京奇艺世纪科技有限公司 权限管理方法、装置、设备及存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116737445A (zh) * 2023-08-14 2023-09-12 南京翼辉信息技术有限公司 一种利用伪容器实现资源隔离的控制方法
CN116737445B (zh) * 2023-08-14 2023-10-27 南京翼辉信息技术有限公司 一种利用伪容器实现资源隔离的控制方法

Also Published As

Publication number Publication date
EP4435641A4 (en) 2024-12-18
EP4435641A1 (en) 2024-09-25
CN116302298A (zh) 2023-06-23

Similar Documents

Publication Publication Date Title
US9026712B2 (en) USB device control using endpoint type detection during enumeration
US8863232B1 (en) System for and methods of controlling user access to applications and/or programs of a computer
KR101279717B1 (ko) 복합 자원 관리기
US8583888B2 (en) Method to qualify access to a block storage device via augmentation of the device'S controller and firmware flow
US5566326A (en) Copy file mechanism for transferring files between a host system and an emulated file system
KR20220093379A (ko) 제1 운영 체제가 제2 운영 체제의 리소스에 액세스하기 위한 방법 및 장치
CN110134446B (zh) 启动pcie设备扫描的方法
CN112528288A (zh) 可信应用的运行方法、信息处理和内存分配方法及装置
RU2358309C2 (ru) Система для обеспечения переходов между режимами работы устройства
KR20140066718A (ko) 애플리케이션용 선택적 파일 액세스 기법
CN110659101A (zh) 提供具有基于能力的安全性的函数级隔离的技术
WO2022237624A1 (zh) 内存分配方法、装置和系统
US11361081B2 (en) Secure boot method for terminal device, terminal device and medium
US10628611B2 (en) Exclusive execution environment within a system-on-a-chip computing system
KR102874623B1 (ko) 능력 관리 방법 및 컴퓨터 장치
CN116257364A (zh) 系统间的资源占用方法、装置、存储介质及电子装置
US9176713B2 (en) Method, apparatus and program storage device that provides a user mode device interface
CN111666579A (zh) 计算机设备及其访问控制方法和计算机可读介质
US20250028552A1 (en) Inter-application communication method and apparatus, storage medium, and program product
WO2021077917A1 (zh) 内存配置方法、装置及存储介质
US8732811B2 (en) Systems and methods for implementing security services
WO2023103992A1 (zh) 容器运行方法、装置、电子设备和存储介质
US9684525B2 (en) Apparatus for configuring operating system and method therefor
CN113138845A (zh) 指纹识别方法、装置、终端及存储介质
CN117668940A (zh) 设备管控方法、电子设备及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22903414

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022903414

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022903414

Country of ref document: EP

Effective date: 20240620

NENP Non-entry into the national phase

Ref country code: DE