Analysis of Linux Container-based Security Mechanisms

点击翻译按钮获取中文摘要

Virtual machines (VMs) and hypervisors are typically relied on to achieve isolation between mutually hostile or untrustworthy applications. In recent times, the phenomenal growth of cloud computing and data centers lead to renewed interest in OS-based, lightweight isolation mechanisms due to their superior performance. This research will first identify key differences (from a security perspective) in existing virtualization technologies based on traditional hypervisors (e.g., virtual machines), and operating systems (e.g., Linux containers). We will then perform a security analysis of different OS-level virtualization mechanisms, with the focus on Linux containers. Particularly, we would like to understand how containerization could be attacked and how its security could be improved in order to build a more secure isolation technique for multi-tenant, untrusted environment, specifically for data center operations. We will analyze the limits of resource isolation provided by Linux containers, and consider the following attack avenues: exploiting shared hardware resources that are not isolated by containers (e.g., processor cache, memory, input/output devices); and exploitation of known Linux kernel vulnerabilities that may allow a malicious application to breakout of the confinement of a container. We will then outline some recommendations on how the identified limitations (if any) can be alleviated for a safer cloud computing environment, which is the primary goal of our industry partner, Huawei Canada. We will consult with our contacts at Huawei, and seek their feedback in all steps of this project. Results from our analysis is expected to help Huawei in choosing OS-based isolation mechanisms for their data center environment.