SaTC: TTP: Small: Enhancing Container Security via Fine-Grained System Resource Constraints

Linux容器已经成为一种流行的轻量级虚拟化平台，用于有效的按需计算。它们的使用范围从简单的高性能计算（HPC）集群到完全编排的企业系统。因此，它们已成为攻击者的诱人目标。该项目旨在提高Linux容器及其应用程序的可信度和可靠性。随着对恶意攻击安全性的大幅增强，它可以促进轻量级容器平台的适应，特别是在高性能计算社区，以满足对计算移动性的需求。此外，所开发的技术是通用的，可以很容易地移植或扩展，以保护启用了基本安全原语的其他Linux平台。该项目提供了一个新颖实用的框架，通过实施基于特定容器平台生命周期阶段的动态系统资源约束来增强容器安全性。特别是，由于主机上的所有容器共享相同的操作系统（OS）内核，当一个恶意容器从用户级进程逃逸到OS内核时，所有其他容器也会受到威胁。通过将动态过滤器与Linux内核中现有的安全原语（例如seccomp、capabilities和cgroups）顺利集成，该项目可以显著减少主机操作系统的攻击面。此外，这些增强的安全原语的组合在攻击缓解方面提供了更强大的功能和灵活性。这种安全性增强对用户是透明的，并且开销最小。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Linux containers have become a popular light-weight virtualization platform for effective on-demand computing. Their use ranges from simple high-performance computing (HPC) clusters to fully orchestrated enterprise systems. As such they have become attractive targets for attackers. This project aims at improving the trustworthiness and reliability of the Linux containers and their applications. With the substantial security enhancement against malicious attacks, it could promote the adaptation of the light-weight container platform, particularly, in the HPC community to satisfy the needs on mobility of compute. In addition, the developed techniques are generic and can be easily ported or extended to protect other Linux platforms that have the basic security primitives enabled.This project provides a novel and practical framework to enhance container security via enforcing dynamic system resource constraints based on the lifecycle phases of a particular container platform. Particularly, since the same operating system (OS) kernel is shared among all containers on a host, when one malicious container escapes from the user-level process into the OS kernel, all other containers are compromised too. The project can dramatically reduce the attack surface of the host OS by smoothly integrating dynamic filters with the existing security primitives (e.g., seccomp, capabilities, and cgroups) in Linux kernels. Moreover, the combination of these enhanced security primitives provides more power and flexibility on attack mitigation. This security enhancement is user-transparent and has a minimal overhead.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.