Enhancing container security by performing container vulnerability reduction based on static and dynamic analysis of dynamically loaded symbols and system call blocking
Systems and methods for enhancing container security are provided by reducing the attack surface. In one example, the exposure of containers to potential security vulnerabilities is reduced by identifying dynamically loaded symbols by an application via performance of static symbol analysis by examining a section of an executable to identify dynamically loaded symbols corresponding to functions contained within shared libraries. Based on a given shared library's usage of functions within standard libraries and a known mapping between functions of standard libraries and system calls, those system calls potentially accessed by the application may be identified and a security policy may be generated and configured for enforcement by a kernel security module to limit system call usage accordingly. Thereafter, the security policy enforced by the kernel security module may be refined based on performance of dynamic symbol analysis to identify system calls that are actually called by the application during runtime.
1 . A method of reducing one or more security vulnerabilities to which an application associated with a container image is exposed, the method comprising:
receiving the container image in which the application and its dependencies, including one or more libraries, are packaged;
prior to execution of the application, identifying a first set of kernel system calls by performing a static analysis of an executable representing the application, wherein the static analysis discovers one or more dynamically loaded symbols corresponding to one or more functions of a shared library of the one or more libraries in which the one or more functions of the shared library depend on respective kernel system calls of the first set of kernel system calls;
creating or updating a security policy based on the first set of kernel system calls;
causing a kernel security module to block those kernel system calls that are not in the first set of kernel system calls during execution of the application by configuring the kernel security module based on the security policy;
during execution of the application, determining a second set of kernel system calls that are actually used by the application, wherein said determining involves observing actual use of one or more dynamically loaded symbols corresponding to the one or more functions of the shared library that ultimately lead to respective kernel system calls of the second set of kernel system calls, and wherein a decision regarding which of the one or more functions ultimately lead to respective kernel system calls of the second set of kernel system calls is arrived at by for each function of the one or more functions by determining a kernel system call of the second set of kernel system calls upon which the function is reliant based on usage by the function of a second set of one or more functions contained within a standard library of the one or more libraries and a known mapping between the second set of one or more functions and the respective kernel system calls;
refining the security policy based on the second set of kernel system calls; and
causing the kernel security module to block those kernel system calls that are not in the second set of kernel system calls during execution of the application by configuring the kernel security module based on the refined security policy.
2 . The method of claim 1 , wherein the one or more dynamically loaded symbols are discovered by parsing and analyzing one or more portions of the executable that contain dynamic linking information.
3 . The method of claim 1 , wherein said determining is performed after a trigger event including one or more of execution of a different workload by the application or expiration of a predetermined or configurable period of time.
4 . The method of claim 1 , wherein the standard library comprises a standard C library.
5 . The method of claim 1 , wherein the kernel security module comprises Security-Enhanced Linux or Application Armor.
6 . The method of claim 1 , wherein the security policy and the refined security policy comprise a syscall policy.
7 . The method of claim 1 , wherein the shared library comprises a shared object file or a dynamic library.
8 . A non-transitory machine readable medium storing instructions, for reducing one or more security vulnerabilities to which an application associated with a container image is exposed, which when executed by one or more processing resources of a system, cause the system to:
receive the container image in which the application and its dependencies, including one or more libraries, are packaged;
prior to execution of the application, identify a first set of kernel system calls by performing a static analysis of an executable representing the application, wherein the static analysis discovers one or more dynamically loaded symbols corresponding to one or more functions of a shared library of the one or more libraries in which the one or more functions of the shared library depend on respective kernel system calls of the first set of kernel system calls;
create or update a security policy based on the first set of kernel system calls;
cause a kernel security module to block those kernel system calls that are not in the first set of kernel system calls during execution of the application by configuring the kernel security module based on the security policy;
during execution of the application, determine a second set of kernel system calls that are actually used by the application, wherein determination of the second set of kernel system calls involves observing actual use of one or more dynamically loaded symbols corresponding to the one or more functions of the shared library that ultimately lead to respective kernel system calls of the second set of kernel system calls, and wherein a decision regarding which of the one or more functions ultimately lead to respective kernel system calls of the second set of kernel system calls is arrived at by for each function of the one or more functions by determining a kernel system call of the second set of kernel system calls upon which the function is reliant based on usage by the function of a second set of one or more functions contained within a standard library of the one or more libraries and a known mapping between the second set of one or more functions and the respective kernel system calls;
refine the security policy based on the second set of kernel system calls; and
cause the kernel security module to block those kernel system calls that are not in the second set of kernel system calls during execution of the application by configuring the kernel security module based on the refined security policy.
9 . The non-transitory machine readable medium of claim 8 , wherein the one or more dynamically loaded symbols are discovered by parsing and analyzing one or more portions of the executable that contain dynamic linking information.
10 . The non-transitory machine readable medium of claim 8 , wherein determination of the second set of kernel system calls is performed after a trigger event including one or more of execution of a different workload by the application or expiration of a predetermined or configurable period of time.
11 . The non-transitory machine readable medium of claim 8 , wherein the standard library comprises a standard C library.
12 . The non-transitory machine readable medium of claim 8 , wherein the kernel security module comprises Security-Enhanced Linux or Application Armor.
13 . The non-transitory machine readable medium of claim 8 , wherein the security policy and the refined security policy comprise a syscall policy.
14 . The non-transitory machine readable medium of claim 11 , wherein the shared library comprises a shared object file or a dynamic library.
15 . A system comprising:
one or more hardware processing resources; and
instructions for reducing one or more security vulnerabilities to which an application associated with a container image is exposed that when executed by the one or more hardware processing resources cause the system to:
receive the container image in which the application and its dependencies, including one or more libraries, are packaged;
prior to execution of the application, identify a first set of kernel system calls by performing a static analysis of an executable representing the application, wherein the static analysis discovers one or more dynamically loaded symbols corresponding to one or more functions of a shared library of the one or more libraries in which the one or more functions of the shared library depend on respective kernel system calls of the first set of kernel system calls;
create or update a security policy based on the first set of kernel system calls;
cause a kernel security module to block those kernel system calls that are not in the first set of kernel system calls during execution of the application by configuring the kernel security module based on the security policy;
during execution of the application, determine a second set of kernel system calls that are actually used by the application, wherein determination of the second set of kernel system calls involves observing actual use of one or more dynamically loaded symbols corresponding to the one or more functions of the shared library that ultimately lead to respective kernel system calls of the second set of kernel system calls, and wherein a decision regarding which of the one or more functions ultimately lead to respective kernel system calls of the second set of kernel system calls is arrived at by for each function of the one or more functions by determining a kernel system call of the second set of kernel system calls upon which the function is reliant based on usage by the function of a second set of one or more functions contained within a standard library of the one or more libraries and a known mapping between the second set of one or more functions and the respective kernel system calls;
refine the security policy based on the second set of kernel system calls; and
cause the kernel security module to block those kernel system calls that are not in the second set of kernel system calls during execution of the application by configuring the kernel security module based on the refined security policy.
16 . The system of claim 15 , wherein the one or more dynamically loaded symbols are discovered by parsing and analyzing one or more portions of the executable that contain dynamic linking information.
17 . The system of claim 15 , wherein determination of the second set of kernel system calls is performed after a trigger event including one or more of execution of a different workload by the application or expiration of a predetermined or configurable period of time.
18 . The system of claim 15 , wherein the standard library comprises a standard C library.
19 . The system of claim 15 , wherein the kernel security module comprises Security-Enhanced Linux or Application Armor.
20 . The system of claim 15 , wherein the security policy and the refined security policy comprise a syscall policy.
21 . The system of claim 15 , wherein the shared library comprises a shared object file or a dynamic library.