Intrusion detection for storage resources provisioned to containers in multi-tenant environments
An apparatus comprises at least one container host device implementing containers for respective tenants of a multi-tenant environment, a storage platform coupled to the container host device and implementing storage resources for utilization by the containers, a container storage controller associated with the container host device, and a storage intrusion detector. The container storage controller is configured to provision portions of the storage resources for respective ones of the containers including for each of the containers at least one storage volume. The storage intrusion detector is configured to detect a condition under which a process not associated with a given one of the containers attempts to access the storage volume provisioned for that container. An alert is generated responsive to the detected condition. The storage intrusion detector may comprise a monitoring component that interacts with a kernel module implemented in kernel space of the container host device operating system.
1. An apparatus comprising:
at least one container host device implementing containers for respective tenants of a multi-tenant environment;
a storage platform coupled to the container host device and implementing storage resources for utilization by the containers;
a container storage controller associated with the container host device; and
a storage intrusion detector;
wherein the containers are implemented utilizing operating system kernel control groups of the container host device;
wherein the container storage controller is configured to provision portions of the storage resources for respective ones of the containers including for each of the containers at least one storage volume;
wherein the storage intrusion detector is configured to detect a condition under which a process not associated with a given one of the containers attempts to access the storage volume provisioned for that container; and
wherein an alert is generated responsive to the detected condition;
the storage intrusion detector comprising:
a monitoring component implemented in user space of an operating system of the container host device; and
a kernel module implemented in kernel space of the operating system of the container host device;
wherein the kernel module is configured to intercept system calls involving reading from or writing to the storage volume of the given container; and
wherein the monitoring component is configured to compare an identifier of the given container to process identifiers associated with a plurality of intercepted system calls, and to generate the alert if at least one of the process identifiers is inconsistent with the identifier of the given container.
2. The apparatus of claim 1 wherein the container host device comprises at least one processor coupled to a memory and wherein at least a portion of one or more of the container storage controller and the storage intrusion detector is implemented by the processor executing software stored in the memory.
3. The apparatus of claim 1 wherein the storage platform comprises at least one of a storage fabric and a storage array.
4. The apparatus of claim 1 wherein the storage intrusion detector is implemented at least in part within the container storage controller.
5. The apparatus of claim 1 wherein the kernel module is implemented at least in part in a system call interface of the kernel space of the operating system of the container host device.
6. The apparatus of claim 1 wherein the kernel module is implemented externally to a system call interface of the kernel space of the operating system of the container host device.
7. The apparatus of claim 1 wherein the kernel module is configured to populate information relating to the intercepted system calls into one or more data structures that are made accessible to the monitoring component.
8. The apparatus of claim 7 wherein the information relating to the intercepted system calls comprises at least one of the process identifiers, one or more file names and a namespace identifier for each of the intercepted system calls.
9. The apparatus of claim 1 wherein the monitoring component determines if at least one of the process identifiers is inconsistent with the identifier of the given container by comparing a namespace identifier associated with the process identifier to a namespace identifier of the given container.
10. The apparatus of claim 1 wherein the container storage controller is implemented at least in part as an application running on the container host device.
11. The apparatus of claim 1 wherein the container storage controller is configured to control starting and stopping of the containers and wherein the storage intrusion detector is started for the given container in conjunction with the starting of that container by the container storage controller.
12. An information processing system comprising the apparatus of claim 1 .
13. A method comprising:
implementing containers for respective tenants of a multi-tenant environment on at least one container host device;
provisioning portions of storage resources of a storage platform for respective ones of the containers including for each of the containers at least one storage volume;
detecting in a storage intrusion detector a condition under which a process not associated with a given one of the containers attempts to access the storage volume provisioned for that container; and
generating an alert responsive to the detected condition;
wherein the containers are implemented utilizing operating system kernel control groups of the container host device;
wherein the implementing, provisioning, detecting and generating are performed by at least one processing device comprising a processor coupled to a memory;
the storage intrusion detector comprising:
a monitoring component implemented in user space of an operating system of the container host device; and
a kernel module implemented in kernel space of the operating system of the container host device;
wherein the kernel module is configured to intercept system calls involving reading from or writing to the storage volume of the given container; and
wherein the monitoring component is configured to compare an identifier of the given container to process identifiers associated with a plurality of intercepted system calls, and to generate the alert if at least one of the process identifiers is inconsistent with the identifier of the given container.
14. The method of claim 13 further comprising providing the alert to the given container.
15. The method of claim 14 wherein at least one of the process identifiers is determined to be inconsistent with the identifier of the given container if a namespace identifier associated with the process identifier does not match a namespace identifier of the given container.
16. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the processing device:
to implement containers for respective tenants of a multi-tenant environment on at least one container host device;
to provision portions of storage resources of a storage platform for respective ones of the containers including for each of the containers at least one storage volume;
to detect in a storage intrusion detector a condition under which a process not associated with a given one of the containers attempts to access the storage volume provisioned for that container; and
to generate an alert responsive to the detected condition;
wherein the containers are implemented utilizing operating system kernel control groups of the container host device;
the storage intrusion detector comprising:
a monitoring component implemented in user space of an operating system of the container host device; and
a kernel module implemented in kernel space of the operating system of the container host device;
wherein the kernel module is configured to intercept system calls involving reading from or writing to the storage volume of the given container; and
wherein the monitoring component is configured to compare an identifier of the given container to process identifiers associated with a plurality of intercepted system calls, and to generate the alert if at least one of the process identifiers is inconsistent with the identifier of the given container.
17. The processor-readable storage medium of claim 16 wherein at least one of the process identifiers is determined to be inconsistent with the identifier of the given container if a namespace identifier associated with the process identifier does not match a namespace identifier of the given container.
18. The processor-readable storage medium of claim 16 wherein the kernel module is implemented at least in part in a system call interface of the kernel space of the operating system of the container host device.
19. The processor-readable storage medium of claim 16 wherein the kernel module is implemented externally to a system call interface of the kernel space of the operating system of the container host device.
20. The processor-readable storage medium of claim 16 wherein the kernel module is configured to populate information relating to the intercepted system calls into one or more data structures that are made accessible to the monitoring component.