System call policies for containers

Patent metadata

Field	Value
Publication number	US-10650138-B2
Application number	US-201715417955-A
Country	US
Kind code	B2
Filing date	Jan 27, 2017
Priority date	Jan 27, 2017
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

First claim

What is claimed is:

1. A method performed in a system comprising a hardware processor, comprising:
providing, by a container platform, a plurality of containers for running respective types of applications, wherein each respective container of the plurality of containers has a metadata record that specifies an application type of an application that is run in the respective container;
receiving, by the container platform, a data structure specifying system call policies for corresponding application types;
initializing different counters associated with corresponding containers of the plurality of containers;
in response to a system call from an application in a first container of the plurality of containers, querying, by the container platform, the data structure to determine a policy of the system call policies to apply to the first container based on a first application type in the metadata record of the first container; and
implementing, by a kernel, the policy for the first container to allow or deny permission for the system call by the application running in the first container based on a comparison of the system call to the policy and based on a first counter associated with the first container, the first counter being part of the different counters.

2. The method of claim 1 , wherein the data structure is structured as an ontology.

3. The method of claim 1 , wherein the data structure classifies system calls into a set of system call categories, and wherein the policy specifies a permission for a first system call category of the set of system call categories, the first system call category comprising plural different system calls.

4. The method of claim 3 , wherein the policy comprises a first relationship specifying that the first application type is prohibited from performing the first system call category of the set of system call categories, and a second relationship specifying that the first application type is permitted to perform a given system call within the first system call category, the second relationship in the policy overriding the first relationship.

5. The method of claim 1 , wherein the implementing of the policy includes:
creating a technical policy instruction that includes a JavaScript Object Notation (JSON) object specifying a permission for the system call based on the policy; and
applying the technical policy instruction to the first container responsive to executing the first container.

6. The method of claim 1 , comprising assigning the metadata record to the respective container responsive to creating or executing the respective container.

7. The method of claim 1 , wherein each respective counter of the different counters tracks a respective number of system calls made by the application running in a corresponding container of the plurality of containers.

8. The method of claim 7 , wherein each respective counter of the different counters is included in the corresponding container of the plurality of containers.

9. The method of claim 7 , wherein each respective counter of the different counters is included in a virtual filesystem associated with the corresponding container of the plurality of containers.

10. A non-transitory computer-readable storage medium comprising instructions that when executed cause a system to:
identify metadata of a container running an application, wherein the metadata includes an application type of the application;
determine a policy for the container from a data structure based on the application type in the metadata of the container, wherein the data structure maps permissions for system calls to application types and classifies the system calls into a set of system call categories, and wherein the policy comprises a first relationship specifying that the application type is prohibited from performing a first system call category of the set of system call categories, and a second relationship specifying that the application type is permitted to perform a given system call within the first system call category, the second relationship in the policy overriding the first relationship;
apply the policy to allow or deny the application permission to perform a system call within the first system call category based on a comparison of the system call to the policy, wherein the policy specifies that the system call is permitted to be performed a non-zero number of times, wherein the container is part of a plurality of containers running respective applications of different application types;
initialize different counters in runtime environments of corresponding containers of the plurality of containers, the different counters for tracking non-zero numbers of times that system calls are permitted to be performed by the applications of the different application types running in the corresponding containers of the plurality of containers; and
responsive to the system call, check the counter in the runtime environment of the container to determine whether the system call is permitted to be performed.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the instructions that cause the system to apply the policy include instructions to:
create a technical policy instruction that includes a JavaScript Object Notation (JSON) object that specifies a permission for the system call based on the policy; and
apply the technical policy instruction to the container responsive to executing the container.

12. The non-transitory computer-readable storage medium of claim 10 , wherein the data structure is structured as an ontology.

13. The non-transitory computer-readable storage medium of claim 10 , wherein the policy is implemented as a Linux secure computing mode policy.

14. A computing system comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions executable on the processor to: provide a plurality of containers for running respective types of applications, wherein each respective container of the plurality of containers has a metadata record that specifies an application type of an application that is run in the respective container;
initialize different counters associated with corresponding containers of the plurality of containers, the different counters for tracking non-zero numbers of times that system calls are permitted to be performed by the applications of the different application types running in the corresponding containers of the plurality of containers;
in response to a system call from an application in a first container of the plurality of containers, determine a policy to apply to the first container based on a first application type in the metadata record of the first container; and
implement the policy for the first container and check a first counter associated with the first container, to permit the first container and the application running in the first container to perform the system call.

15. The computing system of claim 14 , wherein the instructions are executable on the processor to:
receive a data structure that specifies permissions for system call policies for the different application types; and
query the data structure based on the application type in the metadata record of the first container to determine the policy.

16. The computing system of claim 15 , wherein the data structure is structured as an ontology.

17. The computing system of claim 15 , wherein the data structure classifies system calls into a set of system call categories, and wherein the policy specifies a permission for a first system call catego

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• D'Errico Michela
• Ehrenhart Leon Frank
• Dalton Chris I
• Wray Michael John
• Pearson Siani
• Heinze Dennis

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F16/245

  Query processing · CPC title

• G06F2221/033

  Test or assess software · CPC title