Docker容器逃逸防护技术研究

Research on the Escape Protection of Docker Container

Docker的使用越来越普及,但是对于影响Docker安全的容器逃逸问题缺少对应的防护措施.为降低Docker容器逃逸问题所带来的危害,提出CFMAC(containers based on fuzzy mandatory access control)模型对Docker容器进行安全加固.该模型使用强制访问控制限制逃逸后可疑进程的访问,同时为解决强制访问控制中实体安全级别难确定和主观性较强问题,采用模糊聚类分析与风险矩阵分析法相结合,将主客体分为secret,general,public这3个等级,利用LSM(Linux security model)进行安全校验.测试结果表明:该模型可成功限制可疑进程对文件的访问.

Docker is widely used in network application systems.However,there are not enough corresponding protection measures for the relatively low frequency but fatal escape problem.In order to reduce the harm of the docker escape problems,CFMAC(container based on fuzzy mandatory access control)model is proposed to reinforce the security of the Docker container.The model uses mandatory access control to restrict the attacker’s access after Evasion Attacks.As well as,in order to solve the problem of hard to determine the entity security level and strong subjectivity in mandatory access control,fuzzy clustering analysis and risk matrix analysis are combined to divide the subject and object into three levels:secret,general and public,to intercept access and enter security verification by LSM(Linux security model).The test results show that the model can successfully restrict suspicious processes to access files.