Block device signature-based integrity protection for containerized applications
Integrity verification of a containerized application using a block device signature is described. For example, a container deployed to a host system is signed with a single block device signature. The operating system of the host system implements an integrity policy to verify the integrity of the container when the container is loaded into memory and when its program code executes. During such events, the operating system verifies whether the block device signature is valid. If the block device signature is determined to be valid, the operating system enables the program code to successfully execute. Otherwise, the program code is prevented from being executed. By doing so, certain program code or processes that are not properly signed are prevented from executing, thereby protecting the host system from such processes. Moreover, by using a single block device signature for a container, the enforcement of the integrity policy is greatly simplified.
1. A method performed by an operating system for enforcing an integrity policy for a container managed by the operating system, comprising:
determining whether a block device signature is associated with a container that packages an application and dependencies that enable the application to execute, the block device signature also associated with the application and the dependencies as a result of being associated with the container;
in response to determining that the block device signature is associated with the container:
determining whether the block device signature is valid;
in response to determining that the block device signature is valid, monitoring initiation of execution of the application and file access operations performed by the application for compliance with the integrity policy; and
in response to determining that the block device signature is invalid, preventing execution of the application; and
in response to determining that a block device signature is not associated with the container, preventing execution of the application of the container.
2. The method of claim 1 , wherein said determining whether a block device signature is associated with a container comprises:
determining whether a mounted file system of the container that is utilized by the application is signed with the block device signature;
in response to determining that the mounted file system is not signed with the block device signature, unmounting the file system, thereby preventing execution of the application; and
in response to determining that the mounted file system is signed with the block device signature and that the block device signature is valid, monitoring initiation of execution of the application and file access operations performed by the application for compliance with the integrity policy.
3. The method of claim 1 , wherein said monitoring comprises:
detecting initiation of execution of the application;
determining whether the application is signed with a valid block device signature;
in response to determining that the application is not signed with a valid block device signature, preventing execution of the application; and
in response to determining that the application is signed with a valid block device signature, enabling execution of the application.
4. The method of claim 1 , wherein said detecting comprises:
hooking a function call that causes the application to execute.
5. The method of claim 1 , wherein said monitoring comprises:
detecting a file access operation with respect to a file of a mounted file system of the container;
determining whether the file is signed with a valid block device signature;
in response to determining that the file is not signed with a valid block device signature, preventing the file access operation from being performed; and
in response to determining that the file is signed with a valid block device signature, enabling the file access operation to be completed.
6. The method of claim 1 , wherein said detecting comprises:
hooking a function call configured to open the file.
7. The method of claim 1 , further comprising:
enabling the application to execute while enabling an audit mode of the integrity policy in which policy violations caused via execution of the application are detected but enforcement of the integrity policy is disabled;
analyzing operations of the application that caused the detected policy violations to determine whether such operations are legitimate;
in response to determining that the operations are legitimate:
updating the integrity policy to support the operations that caused the detected policy violations, thereby causing such operations to be no longer considered policy violations; and
disabling the audit mode; and
in response to determining that the operations are illegitimate, maintaining the integrity policy.
8. A system, comprising:
at least one processor circuit; and
at least one memory that stores program code configured to be executed by the at least one processor circuit, the program code comprising:
a signature checker configured to determine whether a block device signature is associated with a container that packages an application and dependencies that enable the application to execute, the block device signature also associated with the application and the dependencies as a result of being associated with the container, the application of the container being prevented from being executed in response to a determination that the block device signature is not associated with the container;
a signature validator configured to, in response to determining that the block device signature is associated with the container, determine whether the block device signature is valid; and
a monitor configured to:
in response to a determination that the block device signature is valid, monitor initiation of execution of the application and file access operations performed by the application for compliance with an integrity policy; and
in response to a determination that the block device signature is invalid, prevent execution of the application.
9. The system of claim 8 , wherein the signature checker is further configured to:
determine whether a mounted file system of the container that is utilized by the application is signed with the block device signature; and
in response to a determination that the mounted file system is not signed with the block device signature, cause the file system to be unmounted, thereby preventing execution of the application; and
wherein the monitor is further configured to, in response to a determination that the mounted file system is signed with the block device signature and that the block device signature is valid, monitor initiation of execution of the application and file access operations performed by the application for compliance with the integrity policy.
10. The system of claim 8 , wherein the program code further comprises an operation detector configured to detect initiation of execution of the application,
wherein the signature validator is further configured to determine whether the application is signed with a valid block device signature, and
wherein the monitor is further configured to:
in response to a determination that the application is not signed with a valid block device signature, prevent execution of the application; and
in response to a determination that the application is signed with a valid block device signature, enable execution of the application.
11. The system of claim 8 , wherein the operation detector is configured to detect initiation of execution of the application by hooking a function call that causes the application to execute.
12. The system of claim 8 , wherein the program code further comprises an operation detector configured to detect a file access operation with respect to a file of a mounted file system of the container,
wherein the signature validator is further configured to determine whether the file is signed with a valid block device signature, and
wherein the monitor is further configured to:
in response to a determination that the file is not signed with a valid block device signature, prevent the file access operation from being performed; and
in response to a determination that the file is signed with a valid block device signature, enable the file access operation to be completed.
13. The system of claim 8 , wherein the operation detector is configured to detect the file access operation by hooking a function call configured to open the file.
14. The system of claim 8 , wherein the program code further comprises:
a policy enforcer configured to enable the application to execute while enabling an audit mode of the integrity policy in which policy violations caused via execution of the application are detected but enforcement of the integrity policy is disabled; and
an operation analyzer configured to:
analyze operations of the application that caused the detected policy violations to determine whether such operations are legitimate;
in response to a determination that the operations are legitimate:
update the integrity policy to support the operations that caused the detected policy violations, thereby causing such operations to be no longer considered policy violations; and
disable the audit mode; and
in response to a determination that the operations are illegitimate, maintain the integrity policy.
15. A computer-readable storage medium having program instructions recorded thereon that, when executed by at least one processor of a computing device, perform a method, the method comprising:
determining whether a block device signature is associated with a container that packages an application and dependencies that enable the application to execute, the block device signature also associated with the application and the dependencies as a result of being associated with the container;
in response to determining that the block device signature is associated with the container:
determining whether the block device signature is valid;
in response to determining that the block device signature is valid, monitoring initiation of execution of the application and file access operations performed by the application for compliance with the integrity policy; and
in response to determining that the block device signature is invalid, preventing execution of the application; and
in response to determining that a block device signature is not associated with the container, preventing execution of the application of the container.
16. The computer-readable storage medium of claim 15 , wherein said determining whether a block device signature is associated with a container comprises:
determining whether a mounted file system of the container that is utilized by the application is signed with the block device signature;
in response to determining that the mounted file system is not signed with the block device signature, unmounting the file system, thereby preventing execution of the application; and
in response to determining that the mounted file system is signed with the block device signature and that the block device signature is valid, monitoring initiation of execution of the application and file access operations performed by the application for compliance with the integrity policy.
17. The computer-readable storage medium of claim 15 , wherein said monitoring comprises:
detecting initiation of execution of the application;
determining whether the application is signed with a valid block device signature;
in response to determining that the application is not signed with a valid block device signature, preventing execution of the application; and
in response to determining that the application is signed with a valid block device signature, enabling execution of the application.
18. The computer-readable storage medium of claim 15 , wherein said detecting comprises:
hooking a function call that causes the application to execute.
19. The computer-readable storage medium of claim 15 , wherein said monitoring comprises:
detecting a file access operation with respect to a file of a mounted file system of the container;
determining whether the file is signed with a valid block device signature;
in response to determining that the file is not signed with a valid block device signature, preventing the file access operation from being performed; and
in response to determining that the file is signed with a valid block device signature, enabling the file access operation to be completed.
20. The computer-readable storage medium of claim 15 , wherein said detecting comprises:
hooking a function call configured to open the file.