Enhancing container security by performing container vulnerability reduction based on library and/or function removal and system call blocking
Systems and methods for enhancing container security are provided. In one example, exposure of a containerize application to potential security vulnerabilities is reduced by identifying dynamically loaded symbols by the application via performance of static and/or dynamic symbol analysis to identify dynamically loaded symbols that are potentially and/or actually used, respectively, and that correspond to functions contained within shared libraries. Based on a shared library's usage of functions within a standard library and a known mapping between functions of the standard library and system calls, those system calls potentially and actually accessed by the application may be identified and a security policy may be generated and configured for enforcement by a kernel security module to limit system call usage accordingly. Additionally, removal of files or functions of libraries that are deemed unnecessary for proper execution of the applications may be performed to reduce the footprint of the application.
1 . A method of reducing one or more security vulnerabilities to which an application associated with a first container image is exposed, the method comprising:
receiving the first container image in which the application and its dependencies, including one or more libraries, are packaged;
prior to execution of the application in a production environment, identifying a first set of libraries or functions of the one or more libraries that are not used by the application by performing one or more of:
static analysis of an executable representing the application; and
dynamic monitoring of the application as the application is run in a build environment;
generating a second container image in which the application and its dependencies are packaged that excludes the identified first set of libraries or functions;
deploying a container based on the second container image within the production environment; and
causing a kernel security module to block one or more kernel system calls during execution of the application in the production environment based on identification of one or more dynamically loaded symbols corresponding to one or more functions of the one or more libraries.
2 . The method of claim 1 , wherein at least a first kernel system call of the one or more kernel system calls represents a kernel system call that might or might not be used by the application, wherein the method further comprises identifying a first subset of the one or more dynamically loaded symbols during the static analysis, wherein the first subset of the one or more dynamically loaded symbols correspond to one or more functions of a first set of functions contained within a first shared library of the one or more libraries.
3 . The method of claim 2 , wherein the one or more functions ultimately lead to respective kernel system calls of the one or more kernel system calls.
4 . The method of claim 2 , wherein the one or more dynamically loaded symbols are identified by parsing and analyzing one or more portions of the executable that contain dynamic linking information.
5 . The method of claim 2 , further comprising:
creating or updating a security policy based at least on the first kernel system call; and
wherein said causing a kernel security module to block one or more kernel system calls comprises configuring the kernel security module based on the security policy.
6 . The method of claim 5 , wherein at least a second kernel system call of the one or more kernel system calls represents a kernel system call that is actually used by the application, wherein the method further comprises identifying a second subset of the one or more dynamically loaded symbols during a dynamic analysis, and wherein the second subset of the one or more dynamically loaded symbols correspond to one or more functions of a second set of functions contained within the first shared library or a second shared library of the one or more libraries.
7 . The method of claim 6 , further comprising:
refining the security policy based at least on the second kernel system call; and
wherein said causing a kernel security module to block one or more kernel system calls further comprises configuring the kernel security module based on the refined security policy.
8 . The method of claim 7 , wherein the security policy and the refined security policy comprise a syscall policy.
9 . The method of claim 6 , wherein the first shared library and the second shared library comprise one or more of a shared object file and a dynamic library.
10 . The method of claim 1 , wherein at least one kernel system call of the one or more kernel system calls represents a kernel system call that is actually used by the application, wherein the method further comprises identifying the one or more dynamically loaded symbols by performing a dynamic analysis including monitoring events that occur during the execution of the application in the production environment, and wherein the one or more dynamically loaded symbols correspond to one or more functions of a set of functions contained within a shared library of the one or more libraries.
11 . A non-transitory machine readable medium storing instructions for reducing one or more security vulnerabilities to which an application associated with a first container image is exposed, which when executed by one or more processing resources of a system, cause the system to:
receive the first container image in which the application and its dependencies, including one or more libraries, are packaged;
prior to execution of the application in a production environment, identify a first set of libraries or functions of the one or more libraries that are not used by the application by performing one or more of:
static analysis of an executable representing the application; and
dynamic monitoring of the application as the application is run in a build environment;
generate a second container image in which the application and its dependencies are packaged that excludes the identified first set of libraries or functions;
deploy a container based on the second container image within the production environment; and
cause a kernel security module to block one or more kernel system calls during execution of the application in the production environment based on identification of one or more dynamically loaded symbols corresponding to one or more functions of the one or more libraries.
12 . The non-transitory machine readable medium of claim 11 , wherein at least a first kernel system call of the one or more kernel system calls represents a kernel system call that might or might not be used by the application, wherein the instructions further cause the system to identify a first subset of the one or more dynamically loaded symbols during the static analysis, wherein the first subset of the one or more dynamically loaded symbols correspond to one or more functions of a first set of functions contained within a first shared library of the one or more libraries.
13 . The non-transitory machine readable medium of claim 12 , wherein the one or more functions ultimately lead to respective kernel system calls of the one or more kernel system calls.
14 . The non-transitory machine readable medium of claim 12 , wherein the one or more dynamically loaded symbols are identified by parsing and analyzing one or more portions of the executable that contain dynamic linking information.
15 . The non-transitory machine readable medium of claim 12 , wherein the instructions further cause the system to:
create or update a security policy based at least on the first kernel system call; and
wherein the kernel security module is caused to block the one or more kernel system calls by configuring the kernel security module based on the security policy.
16 . The non-transitory machine readable medium of claim 15 , wherein at least a second kernel system call of the one or more kernel system calls represents a kernel system call that is actually used by the application, wherein the instructions further cause the system to identify a second subset of the one or more dynamically loaded symbols during a dynamic analysis, and wherein the second subset of the one or more dynamically loaded symbols correspond to one or more functions of a second set of functions contained within the first shared library or a second shared library of the one or more libraries.
17 . The non-transitory machine readable medium of claim 16 , wherein the instructions further cause the system to:
refine the security policy based at least on the second kernel system call; and
wherein the kernel security module is caused to block the one or more kernel system calls by configuring the kernel security module based on the refined security policy.
18 . The non-transitory machine readable medium of claim 17 , wherein the security policy and the refined security policy comprise a syscall policy.
19 . The non-transitory machine readable medium of claim 16 , wherein the first shared library and the second shared library comprise one or more of a shared object file and a dynamic library.
20 . The non-transitory machine readable medium of claim 11 , wherein at least one kernel system call of the one or more kernel system calls represents a kernel system call that is actually used by the application, wherein the instructions further cause the system to identify the one or more dynamically loaded symbols by performing a dynamic analysis including monitoring events that occur during the execution of the application in the production environment, and wherein the one or more dynamically loaded symbols correspond to one or more functions of a set of functions contained within a shared library of the one or more libraries.
21 . A system comprising:
one or more hardware processing resources; and
instructions for reducing one or more security vulnerabilities to which an application associated with a first container image is exposed that when executed by the one or more hardware processing resources cause the system to:
receive the first container image in which the application and its dependencies, including one or more libraries, are packaged;
prior to execution of the application in a production environment, identify a first set of libraries or functions of the one or more libraries that are not used by the application by performing one or more of:
static analysis of an executable representing the application; and
dynamic monitoring of the application as the application is run in a build environment;
generate a second container image in which the application and its dependencies are packaged that excludes the identified first set of libraries or functions;
deploy a container based on the second container image within the production environment; and
cause a kernel security module to block one or more kernel system calls during execution of the application in the production environment based on identification of one or more dynamically loaded symbols corresponding to one or more functions of the one or more libraries.
22 . The system of claim 21 , wherein at least a first kernel system call of the one or more kernel system calls represents a kernel system call that might or might not be used by the application, wherein the instructions further cause the system to identify a first subset of the one or more dynamically loaded symbols during the static analysis, wherein the first subset of the one or more dynamically loaded symbols correspond to one or more functions of a first set of functions contained within a first shared library of the one or more libraries.
23 . The system of claim 22 , wherein the one or more functions ultimately lead to respective kernel system calls of the one or more kernel system calls.
24 . The system of claim 22 , wherein the one or more dynamically loaded symbols are identified by parsing and analyzing one or more portions of the executable that contain dynamic linking information.
25 . The system of claim 22 , wherein the instructions further cause the system to:
create or update a security policy based at least on the first kernel system call; and
wherein the kernel security module is caused to block the one or more kernel system calls by configuring the kernel security module based on the security policy.
26 . The system of claim 25 , wherein at least a second kernel system call of the one or more kernel system calls represents a kernel system call that is actually used by the application, wherein the instructions further cause the system to identify a second subset of the one or more dynamically loaded symbols during a dynamic analysis, and wherein the second subset of the one or more dynamically loaded symbols correspond to one or more functions of a second set of functions contained within the first shared library or a second shared library of the one or more libraries.
27 . The system of claim 26 , wherein the instructions further cause the system to:
refine the security policy based at least on the second kernel system call; and
wherein the kernel security module is caused to block the one or more kernel system calls by configuring the kernel security module based on the refined security policy.
28 . The system of claim 27 , wherein the security policy and the refined security policy comprise a syscall policy.
29 . The system of claim 26 , wherein the first shared library and the second shared library comprise one or more of a shared object file and a dynamic library.
30 . The system of claim 21 , wherein at least one kernel system call of the one or more kernel system calls represents a kernel system call that is actually used by the application, wherein the instructions further cause the system to identify the one or more dynamically loaded symbols by performing a dynamic analysis including monitoring events that occur during the execution of the application in the production environment, and wherein the one or more dynamically loaded symbols correspond to one or more functions of a set of functions contained within a shared library of the one or more libraries.