Identifying container file events for providing container security
A method of providing security for containers executing on a physical host machine is provided. The method receives a notification of a file access request. The notification includes a path in a file system of the host machine being accessed by a process. From the path, the method determines whether the file access event is for accessing a location in the file system to which container file systems are mapped. The method identifies a namespace of the process using the identification of the process included in the file path. The method determines the process is a container when the namespace belongs to a service that is used to implement containers on the host machine. The method sends the identifier of the container, the identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.
1. A method of providing security for containers executing in guest virtual machines (VMs) on a physical host machine, the method comprising:
receiving a notification of a file access request, the notification comprising a path in a file system of the host machine being accessed by a process;
based on the path, determining whether the file access event is for accessing a location in the file system that includes volumes to which the containers have access, wherein the volumes to which containers have access are determined using a mapping of the container file system to the file system of the host machine being accessed by the process;
in response to determining that the file access event is for accessing a location in the file system to which the containers have access, identifying a namespace of the process using an identification of the process included in the file path;
determining the process is a container when the namespace belongs to a service implementing containers on the host machine; and
sending an identifier of the container, an identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.
2. The method of claim 1 further comprising:
registering to a file system event monitor service to receive notification of file access requests, said registering comprising sending a list of at least one of a file, a directory, and a disk mount for which file access requests to be monitored,
wherein the notification of the file access request is received from the file system event monitor.
3. The method of claim 1 wherein identifying the namespace comprises using the identification of the process included in the file path to search the file system for the namespace associated with the identification of the process.
4. The method of claim 1 , wherein sending the identifier of the container and the file path to a set of security applications comprises determining that the container is in a list of live containers.
5. The method of claim 4 further comprising:
adding an identification of each container that is powered up inside a guest VM to the list of live containers; and
removing an identification of each container that is powered off inside a guest VM from the list of live containers.
6. The method of claim 1 , wherein a container is a self-contained execution environment that shares a kernel of the host machine's operating system.
7. The method of claim 1 , wherein receiving the notification, determining whether the file access event is for accessing the location in the file system, identifying the namespace, determining the process is a container, and the sending are performed by a file introspection agent executing in a user space of the host machine inside the guest VM.
8. The method of claim 1 further compromising:
receiving a verdict from at least one of the security applications regarding the file access request, the verdict determined based on a scan of a file, a directory, or a disk mount to which access is requested; and
allows or denying the access based on the received verdict.
9. A non-transitory machine readable medium storing a program for providing security for containers executing in guest virtual machines (VMs) on a physical host machine, the program executable by a processing unit, the program comprising sets of instructions for:
receiving a notification of a file access request, the notification comprising a path in a file system of the host machine being accessed by a process;
determining, based on the path, whether the file access event is for accessing a location in the file system that includes volumes to which the containers have access, wherein the volumes to which containers have access are determined using a mapping of the container file system to the file system of the host machine being accessed by the process;
in response to determining that the file access event is for accessing a location in the file system to which the containers have access, identifying a namespace of the process using an identification of the process included in the file path;
determining the process is a container when the namespace belongs to a service implementing containers on the host machine; and
sending an identifier of the container, an identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.
10. The non-transitory machine readable medium of claim 9 , the program further comprising a set of instructions for:
registering to a file system event monitor service to receive notification of file access requests, said registering comprising sending a list of at least one of a file, a directory, and a disk mount for which file access requests to be monitored,
wherein the notification of the file access request is received from the file system event monitor.
11. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for identifying the namespace comprises a set of instructions for using the identification of the process included in the file path to search the file system for the namespace associated with the identification of the process.
12. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for sending the identifier of the container and the file path to a set of security applications comprises a set of instructions for determining that the container is in a list of live containers.
13. The non-transitory machine readable medium of claim 9 , wherein a container is a self-contained execution environment that shares a kernel of the host machine's operating system.
14. The non-transitory machine readable medium of claim 9 , wherein the receiving the notification, determining whether the file access event is for accessing the location in the file system, identifying the namespace, determining the process is a container, and the sending are performed by a file introspection agent executing in a user space of the host machine inside the guest VM.
15. A system comprising:
a set of processing unit; and
a non-transitory machine readable medium storing a program for providing security for containers executing in guest virtual machines (VMs) on a physical host machine, the program executable by a processing unit, the program comprising sets of instructions for:
receiving a notification of a file access request, the notification comprising a path in a file system of the host machine being accessed by a process;
determining, based on the path, whether the file access event is for accessing a location in the file system that includes volumes to which containers have access, wherein the volumes to which the containers have access are determined using a mapping of the container file system to the file system of the host machine being accessed by the process;
in response to determining that the file access event is for accessing a location in the file system to which the containers have access, identifying a namespace of the process using an identification of the process included in the file path;
determining the process is a container when the namespace belongs to a service implementing containers on the host machine; and
sending an identifier of the container, an identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.
16. The system of claim 15 , the program further comprising a set of instructions for:
registering to a file system event monitor service to receive notification of file access requests, said registering comprising sending a list of at least one of a file, a directory, and a disk mount for which file access requests to be monitored,
wherein the notification of the file access request is received from the file system event monitor.
17. The system of claim 15 , wherein the set of instructions for identifying the namespace comprises a set of instructions for using the identification of the process included in the file path to search the file system for the namespace associated with the identification of the process.
18. The system of claim 15 , wherein the set of instructions for sending the identifier of the container and the file path to a set of security applications comprises a set of instructions for determining that the container is in a list of live containers.
19. The system of claim 15 , wherein a container is a self-contained execution environment that shares a kernel of the host machine's operating system.
20. The system of claim 15 , wherein the receiving the notification, determining whether the file access event is for accessing the location in the file system, identifying the namespace, determining the process is a container, and the sending are performed by a file introspection agent executing in a user space of the host machine inside the guest VM.