Shim based secure module access

Patent metadata

Field	Value
Publication number	US-12229251-B2
Application number	US-202218083324-A
Country	US
Kind code	B2
Filing date	Dec 16, 2022
Priority date	Dec 16, 2022
Publication date	Feb 18, 2025
Grant date	Feb 18, 2025

Abstract

Systems and methods comprising at least one node comprising an application container; a container image associated with the application container; a static analyzer module deployed to analyze the container image, with instructions configured to autonomously parse, code of an application, during compile time of the application, wherein the application is to be deployed in the application container; determine, based on the parsing, for at least one section of the code, at least one module necessary for execution of the at least one section; annotate, the at least one section of the code, based on the determined at least one module; and inject, at least one wrapper around the at least one section of the code, wherein the wrapper adds at least one restriction to an execution of the at least one section at runtime, wherein the restrictions are based on at least one condition.

First claim

What is claimed is:

1. A system, comprising:
at least one node comprising an application container;
a container image associated with the application container;
a static analyzer module deployed to analyze the container image, with instructions configured to autonomously:
parse, code of an application, during compile time of the application, wherein the application is to be deployed in the application container;
determine, based on the parsing, for at least one section of the code, at least one module necessary for execution of the at least one section;
annotate, the at least one section of the code, based on the determined at least one module; and
inject, at least one wrapper around the at least one section of the code, wherein the wrapper adds at least one restriction to an execution of the at least one section at runtime, wherein the at least one restriction is based on at least one condition.

2. The system of claim 1 , wherein the instructions are further configured to:
determine, for the at least one module, at least one operating system module necessary for execution of the module.

3. The system of claim 2 , wherein the instructions are further configured to:
determine, a condition where the at least one module, accesses, calls, utilizes, or requires the at least one operating system module, wherein the condition can be based on at least one of a time, state, or user permissions.

4. The system of claim 1 , wherein the container image comprises at least one of a base OS layer, an application layer, or a SHIM layer.

5. The system of claim 4 , wherein the SHIM layer is placed between the base OS layer and the application layer to manage access to an operating system module.

6. The system of claim 4 , wherein the SHIM layer implements the at least one restriction at runtime.

7. The system of claim 4 , wherein the SHIM layer is further configured to:
based on the at least one condition being satisfied, undertake at least one of allow access, allow partial access, prevent access, or delay access to an operating system module in the base OS layer by the module in the application layer based on the at least one restriction.

8. The system of claim 4 , wherein the base OS layer is a limited version OS layer.

9. The system of claim 1 , wherein the at least one restriction is enforced based on the at least one condition.

10. The system of claim 9 , wherein the enforcement comprises at least one of preventing execution of the at least one section, delaying execution of the at least one section, or preventing access to an operating system module.

11. The system of claim 1 , wherein the at least one restriction is removed based on the at least one condition.

12. A method, comprising:
parsing, code of an application, during compile time of the application, wherein the application is to be deployed in an application container;
determining, based on the parsing, for at least one section of the code, at least one module necessary for execution of the at least one section;
annotating, the at least one section of the code, based on the determined at least one module; and
injecting, at least one wrapper around the at least one section of the code, wherein the wrapper adds at least one restriction to an execution of the at least one section at runtime, wherein the restrictions are based on at least one condition.

13. The method of claim 12 , further comprising:
determining, for the at least one module, at least one operating system module necessary for execution of the module.

14. The method of claim 13 , further comprising:
generating a SHIM layer to enforce the at least one restriction, wherein the at least one restriction comprises preventing the at least one module from at least one of calling, utilizing, or accessing the at least one operating system module.

15. The method of claim 12 , further comprising:
generating a SHIM layer to manage the at least one restriction at runtime of the application; and
placing the SHIM layer between an application layer and a base OS layer of a container image of the application container.

16. The method of claim 12 , wherein the application container is associated to a container image comprising at least one of a base OS layer, an application layer, or a SHIM layer.

17. The method of claim 12 , wherein a SHIM layer is placed between a base OS layer and an application layer, to manage access to an at least one operating system module, in the base OS layer, based on the at least one restriction.

18. The method of claim 17 , further comprising:
based on the at least one condition being satisfied, undertaking at least one of allow access, allow partial access, prevent access, or delay access to the operating system module in the base OS layer by the module in the application layer based on the at least one restriction.

19. The method of claim 18 , wherein a SHIM layer undertakes the at least one of allow access, allow partial access, prevent access, or delay access to the operating system module in the base OS layer by the module in the application layer based on the at least one restriction.

20. A non-transitory machine readable medium storing code, which when executed by a processor is configured to:
parse, code of an application, during compile time of the application, wherein the application is to be deployed in an application container;
determine, based on the parsing, for at least one section of the code, at least one module necessary for execution of the at least one section;
determine, for the at least one module, at least one operating system module necessary for execution of the module;
annotate, the at least one section of the code, based on the determined at least one module; and
inject, at least one wrapper around the at least one section of the code, wherein the wrapper adds at least one restriction to an execution of the at least one section at runtime, wherein the restrictions are based on at least one condition.

Assignees

• Red Hat Inc

Inventors

• Gallagher Brian
• O'Connor Cathal

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title