Containers system auditing through system call emulation

Patent metadata

Field	Value
Publication number	US-12332995-B2
Application number	US-202017079200-A
Country	US
Kind code	B2
Filing date	Oct 23, 2020
Priority date	Oct 23, 2020
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

Embodiments of the present disclosure provide a substitute audit log for use by applications in the user-space of a host operating system to write audit information. When a container makes a system call attempting to write audit information to an audit log of the kernel, the kernel may utilize a predefined set of instructions indicating how to detect such system calls and how such system calls are to be modified so as to reroute the system call to an unprivileged socket. The kernel write the audit information of the system call to an unprivileged socket that is connected to a substitute audit log. A container management program monitoring the unprivileged socket may write the audit information to the substitute log which is defined in container specific directories of the container.

First claim

What is claimed is:

1. A method comprising:
detecting a system call attempting to write information to an audit log of a kernel, wherein the system call originates from a container;
creating a socket pair in response to detecting the system call, wherein each socket of the socket pair represents an endpoint of a virtual connection and wherein a second socket of the socket pair is an unprivileged socket and is a different type of socket from a socket initially used by the system call when attempting to write the information to the audit log of a kernel;
connecting a first socket of the socket pair to the container;
modifying, by a processing device, the system call to reroute the system call to the second socket of the socket pair, wherein the second socket is connected to a substitute log that is to receive information intended for the audit log;
writing the information to the second socket of the socket pair; and
in response to detecting that the information has been written to the second socket of the socket pair, writing the information directly from the second socket to the substitute log, wherein the substitute log is defined within one or more directories specific to the container.

2. The method of claim 1 , wherein detecting the system call comprises:
determining that the system call is attempting to create a netfilter socket to communicate with the audit log of the kernel.

3. The method of claim 1 , further comprising:
defining a secure computing mode (seccomp) profile comprising a set of rules for filtering system calls from the container, wherein the set of rules comprises rules instructing the kernel to change arguments of the system call to connect the system call to the second socket of the socket pair; and
providing the seccomp profile to the kernel.

4. The method of claim 3 , wherein modifying the system call comprises:
changing the arguments of the system call to connect the system call to the second socket of the socket pair based on the seccomp profile, wherein the container operates as if it is connected to the audit log of the kernel.

5. The method of claim 4 , further comprising:
monitoring the second socket of the socket pair using a management program, wherein the management program writes the information to the substitute log in response to detecting that the information has been written to the second socket of the socket pair.

6. The method of claim 1 , wherein container tools access the information from the substitute log on an ad-hoc basis.

7. A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
detect a system call attempting to write information to an audit log of a kernel, wherein the system call originates from a container;
create a socket pair in response to detecting the system call, wherein each socket of the socket pair represents an endpoint of a virtual connection and wherein a second socket of the socket pair is an unprivileged socket and is a different type of socket from a socket initially used by the system call when attempting to write the information to the audit log of a kernel;
connect a first socket of the socket pair to the container;
modify the system call to reroute the system call to the second socket of the socket pair, wherein the second socket is connected to a substitute log that is to receive information intended for the audit log;
write the information to the second socket of the socket pair; and
in response to detecting that the information has been written to the second socket of the socket pair, write the information directly from the second socket to the substitute log, wherein the substitute log is defined within one or more directories specific to the container.

8. The system of claim 7 , wherein to detect the system call, the processing device is to:
determine that the system call is attempting to create a netfilter socket to communicate with the audit log of the kernel.

9. The system of claim 7 , wherein the processing device is further to:
define a secure computing mode (seccomp) profile comprising a set of rules for filtering system calls from the container, wherein the set of rules comprises rules instructing the kernel to change arguments of the system call to connect the system call to the second socket of the socket pair; and
provide the seccomp profile to the kernel.

10. The system of claim 9 , wherein to modify the system call, the processing device is to:
change, using the kernel, the arguments of the system call to connect the system call to the second socket of the socket pair based on the seccomp profile, wherein the container operates as if it is connected to the audit log of the kernel.

11. The system of claim 10 , wherein the processing device is further to:
monitor the second socket of the socket pair using a management program, wherein the management program writes the information to the substitute log in response to detecting that the information has been written to the second socket of the socket pair.

12. The system of claim 7 , wherein container tools access the information from the substitute log on an ad-hoc basis.

13. A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:
detect a system call attempting to write information to an audit log of a kernel, wherein the system call originates from a container;
create a socket pair in response to detecting the system call, wherein each socket of the socket pair represents an endpoint of a virtual connection and wherein a second socket of the socket pair is an unprivileged socket and is a different type of socket from a socket initially used by the system call when attempting to write the information to the audit log of a kernel;
connect a first socket of the socket pair to the container;
modify, by the processing device, the system call to reroute the system call to the second socket of the socket pair, wherein the second socket is connected to a substitute log that is to receive information intended for the audit log;
writing the information to the second socket of the socket pair; and
in response to detecting that the information has been written to the second socket of the socket pair, write the information directly from the second socket to the substitute log, wherein the substitute log is defined within one or more directories specific to the container.

14. The non-transitory computer-readable medium of claim 13 , wherein to detect the system call, the processing device is to:
determine that the system call is attempting to create a netfilter socket to communicate with the audit log of the kernel.

15. The non-transitory computer-readable medium of claim 13 , wherein the processing device is further to:
define a secure computing mode (seccomp) profile comprising a set of rules for filtering system calls from the container, wherein the set of rules comprises rules instructing the kernel to change arguments of the system call to connect the system call to the second socket of the socket pair; and
provide the seccomp profile to the kernel.

16. The non-transitory computer-readable medium of claim 15 , wherein to modify the system call, the processing device is to:
change, using the kernel, the arguments of the system call to connect the system call to the second socket of the socket pair based on the seccomp profile, wherein the container operates as if it is connected to the audit log of the kernel.

17. The system of claim 16 , wherein

Assignees

• Red Hat Inc

Inventors

• Scrivano Giuseppe
• Walsh Daniel

Classifications

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title