【作者】 郭鑫；

【导师】 李金库； 张明龙；

【作者基本信息】 西安电子科技大学 ， 电子信息硕士（专业学位）， 2024， 硕士

【摘要】 随着云计算平台的快速发展,作为操作系统级虚拟化技术的典型代表,容器技术由于具有启动速度快、环境一致性强、资源利用效率高等优点而得到广泛应用。它的出现改变了多层分布式应用程序的开发和部署流程,但是同时也带来了一些安全隐患。具体来说,在主流的服务器操作系统Linux中,容器使用内核中的命名空间机制实现容器进程的资源隔离,使得每个容器都拥有自己独立的资源视图,包括进程、网络、文件系统等信息。其中,伪文件系统作为Linux用户与内核进行信息交互的主要方式,用于获取内核中的系统信息。但是,由于伪文件系统涉及的资源种类复杂,已有解决方案对于其资源隔离的覆盖度不足,存在大量未使用命名空间分隔的资源内容。当容器中进程通过伪文件系统访问未使用命名空间容器化分隔的宿主机资源时,能够获得宿主机中的共享资源内容,从而导致宿主机的内核信息被泄露。为系统化展现容器伪文件系统中存在的信息泄露问题,本文设计并实现了一种容器伪文件系统隔离性与可利用性分析系统。该系统基于编译器中间代码静态分析技术,通过扫描Linux内核源码中的伪文件注册部分,收集procfs与sysfs伪文件系统中的文件注册信息集合,包括伪文件的注册上下文信息、伪文件路径信息、伪文件读取时所调用的内核回调函数信息、伪文件中输出的内核数据源信息。进而,针对扫描到的每个伪文件对象,该系统分别从回调函数隔离性、数据源隔离性、伪文件内置隔离机制使用情况三个角度判断该伪文件是否被命名空间机制隔离,以及伪文件所输出内核变量的具体隔离情况,从而帮助容器使用者掌握所使用系统内核中可造成系统信息泄露的具体伪文件及相应的数据信息内容。同时,为了从未被隔离的伪文件中找出可发起容器攻击的高价值目标,本文系统在获得未使用Linux命名空间隔离的伪文件信息后,进一步从三类容器攻击行为分析未隔离伪文件的可利用情况,包括内核资源DoS(Denial of Service)攻击,容器同驻判断(即判断多个容器是否运行在同一个宿主机上)以及容器逃逸攻击。本文系统通过匹配未隔离伪文件所暴露共享内核变量的使用情况与三种容器攻击行为在内核中的表现特征,获得容器伪文件系统中可被用于发起以上容器攻击的未隔离伪文件列表,从而为容器用户使用文件屏蔽或其他伪文件保护策略时提供高优先级的目标文件参考。本文基于开源LLVM编译器中的Pass中间代码处理技术实现了对内核代码的隔离性与可利用性分析原型系统,并使用Linux 5.4版本内核源代码作为分析对象,对系统的分析功能进行了测试和结果验证。在测试过程中,分析系统中的各个功能模块均正常运行,并成功得到伪文件隔离性与可利用性分析结果。对于容器中伪文件隔离与否的分析结果,本文系统从内核观测角度进行验证,表明分析所得到的伪文件列表完整,隔离性判断准确。同时,本文基于未隔离伪文件可利用性的分析结果,通过在容器中发起实际攻击,表明分析结果具有攻击可行性。更多还原

【Abstract】 With the rapid development of cloud computing platform,as a typical representative of op-erating system level virtualization technology,container technology has been widely used due to its advantages of fast startup speed,environment consistency,and high resource uti-lization effciency.Its appearance has changed the development and deployment process of multi-tier distributed applications,but it also brings some security risks.Specifcally,in the mainstream server operating system Linux,containers use the namespace mechanism in the kernel to realize the resource isolation of container processes,so that each container has its own independent resource view,including process,network,fle system and other informa-tion.Among them,pseudo-flesystem is used as the main way for Linux users to interact with the kernel for obtaining system information in the kernel.However,due to the complexity of the resources involved in pseudo-flesystems,the coverage of existing solutions for their resource isolation is insuffcient,and there exists a large number of resource contents that are not separated by namespaces.When a process in a container accesses the host resources not separated by namespace containerization through the pseudo-fle system,it can obtain the shared resource contents in the host,which leads to the leakage of kernel information in the host.In order to systematically show the information leakage in container pseudo-flesystems,this paper designs and implements a container pseudo-flesystem isolation and availability analy-sis system.Based on the static analysis technique of compiler intermediate code,the system scans the pseudo-fle registration part of Linux kernel source code and collects the collection of fle registration information in the pseudo-fle systems of procfs and sysfs,including the registration context information of the pseudo-fle,the path information of the pseudo-fle,the information of the kernel callback function called when the pseudo-fle is read,and the infor-mation of the kernel data source outputted from the pseudo-fle.Further,for each pseudo-fle object scanned,the system determines whether the pseudo-fle is isolated by the namespace mechanism and the specifc isolation of the kernel variables output by the pseudo-fle from the three perspectives of isolation of the callback function,isolation of the data source,and the use of the built-in isolation mechanism of the pseudo-fle,so as to help the container user master the specifc pseudo-fles and corresponding data and information contents in the kernel of the system used,which can lead to the leakage of system information.This helps the container user to know the specifc pseudo-fles and corresponding data contents in the kernel that can cause system information leakage.Meanwhile,in order to fnd out the high-value targets that can launch container attacks from the unisolated pseudo-fles,this paper further analyzes the utilization of unisolated pseudo-fles from three types of container attacks after obtaining the information of pseudo-fles that have not been isolated by Linux namespace,including kernel resource DoS(Denial of Service)attacks,container co-location judgments(i.e.,judging whether multiple containers are running on the same host or not),and kernel variable outputs from pseudo-fles.(i.e.,determining whether multiple containers are running on the same host),and container escape attacks.In this paper,the system matches the usage of shared kernel variables exposed by unisolated pseudo-fles with the manifestation characteristics of the three container attacks in the kernel to obtain a list of unisolated pseudo-fles in the container pseudo-fle system that can be used to launch the above container attacks,so as to provide high-priority target fles for the reference of the container users when they use the fle shielding or other pseudo-fle protection strategies.In this paper,we implemented a prototype system to analyze the isolation and availability of kernel code based on the Pass intermediate code processing technology in the open-source LLVM compiler,and tested the analysis function of the system and verifed the results using the Linux version 5.4 kernel source code as the analysis object.During the testing process,all the functional modules in the analysis system run normally,and the pseudo-fle isolation and availability analysis results are successfully obtained.For the analysis results of pseudo-fle isolation or not in the container,the system in this paper verifes from the perspective of kernel observation,which shows that the list of pseudo-fles obtained from the analysis is complete and the isolation judgment is accurate.At the same time,based on the analysis results of unisolated pseudo-fle exploitability,this paper shows that the analysis results have the feasibility of attack by launching an actual attack in the container.更多还原