Granted Patent B2

US 11,683,311 · App. 15/908,854 · Granted Jun 20, 2023

Inventor: Vikas Goel (Sunnyvale, CA)

Assignee: Veritas Technologies LLC

H04L63/101G06F9/468G06F21/53G06F21/629G06F21/6218

Abstract

Claims (61)

1. A computer-implemented method for running applications on a multi-tenant container platform, at least a portion of the method being performed by a container host computing device comprising at least one processor, the method comprising:

initiating, by an application running in a non-privileged container, a request for a privileged operation;

invoking an interceptor when the requested privileged operation must be sent to a host administrator service;

performing, by the interceptor, a whitelist check of the request;

calling, by the interceptor when the whitelist check succeeds, a container administrator;

initiating, by the container administrator, using a host administrator service socket handle, a connection between the container administrator and the host administrator service when conditions are met for a requested privileged operation; and

sending a request to a container host administrator service with details of the requested operation;

receiving, at the host administrator service on the container host computing device and via the host administrator service socket handle, a request for the privileged operation from the application running in the non-privileged container;

performing a security check of a user associated with the application, wherein performing the security check further comprises issuing the security check results of approval when the user identifier indicates a root user;

comparing, when the security check results in approval, a process identifier of the requested privileged operation against a whitelist of permitted operations to determine if the requested privileged operation from the application running in the non-privileged container is permissible; and

initiating running, when the requested privileged operation is permissible, the requested privileged operation; and

sending, when the requested privileged operation is successfully completed or rejected, a respective response to a container administrator;

wherein the interceptor provides application-specific library interposition to selectively handle system calls that require privilege and intermediation to mediate required privileged operations of applications to reduce security risks of privileged container models.

2. The computer-implemented method of claim 1 , further comprising:

passing the host administrator service socket handle from the container host administrator service to the container.

3. The computer-implemented method of claim 1 , further comprising:

receiving, at an interceptor, a success response; and

sending a notification to the application that the requested privileged operation is successful.

4. The computer-implemented method of claim 1 , further comprising:

displaying, on a user display, an error message when the requested privileged operation fails to successfully execute.

5. The computer-implemented method of claim 1 , wherein the non-privileged container does not include an entire operating system and the non-privileged container executes only the application running in the non-privileged container.

6. A system for running applications on a multi-tenant container platform, the system comprising:

an interceptor module that:

receives the request from the application when the application requests a privileged operation that must be sent to a host administrator service;

performs a whitelist check of the request; and

calls, when the whitelist check succeeds, a container administrator module; and

the container administrator module:

initiates, using a host administrator service socket handle, a connection between the container administrator module and the host administrator service when conditions are met for a requested operation; and

sends a request to the container host administrator service with details of the requested operation;

a receiving module, stored in memory, that receives, at a container host administrator service on a container host computing device and via a host administrator service socket handle, a request for a privileged operation from an application running in a non-privileged container;

a performing module, stored in the memory, that performs a security check of a user associated with the application, wherein performing the security check further comprises issuing the security check results of approval when the user identifier indicates a root user;

a comparing module, stored in the memory, that compares, when the security check results in approval, a process identifier of the requested privileged operation against a whitelist of permitted operations to determine if the requested privileged operation from the application running in the non-privileged container is permissible;

an initiating module, stored in the memory, that initiates running, when the requested privileged operation is permissible, the requested privileged operation; and

at least one physical processor that executes the receiving module, the performing module, the comparing module, and the initiating module;

wherein an ambassador-pattern-like extension to container implementation software is provided by adding an application-specific functionality mediating required privileged operations of applications to reduce security risks that result from privileged container models;

wherein the interceptor provides application-specific library interposition to selectively handle system calls that require privilege and intermediation to mediate required privileged operations of applications to reduce security risks of privileged container models.

7. The system of claim 6 , wherein the container host administrator service passes the host administrator service socket handle to the container.

8. The system of claim 6 , wherein the initiating module sends, when the requested privileged operation is successfully completed or rejected, a respective response to a container administrator module.

9. The system of claim 6 , further comprising an interceptor module that:

receives a success response; and

sends a notification to the application that the requested privileged operation is successful.

10. The system of claim 6 , wherein the initiating module displays, on a user display, an error message when the requested privileged operation fails to successfully execute.

11. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive, at an interceptor, the request from the application when the application requests a privileged operation that must be sent to a host administrator service;

perform, by the interceptor, a whitelist check of the request;

call, by the interceptor when the whitelist check succeeds, a container administrator;

initiate, by the container administrator, using a host administrator service socket handle, a connection between the container administrator and the container host administrator service when conditions are met for a requested operation; and

send a request to the container host administrator service with details of the requested operation;

receive, at a host administrator service on a container host computing device and via a host administrator service socket handle, a request for a privileged operation from an application running in a non-privileged container;

perform a security check of a user associated with the application, wherein performing the security check further comprises issuing the security check results of approval when the user identifier indicates a root user;

compare, when the security check results in approval, a process identifier of the requested privileged operation against a whitelist of permitted operations to determine if the requested privileged operation from the application running in the non-privileged container is permissible; and

initiate running, when the requested privileged operation is permissible, the requested privileged operation;

send, when the requested privileged operation is successfully completed or rejected, a respective response to a container administrator;

wherein an ambassador-pattern-like extension to container implementation software is provided by adding an application-specific functionality mediating required privileged operations of applications to reduce security risks that result from privileged container models;

wherein the interceptor provides application-specific library interposition to selectively handle system calls that require privilege and intermediation to mediate required privileged operations of applications to reduce security risks of privileged container models.

12. The non-transitory computer-readable medium of claim 11 , wherein the computer-executable instructions comprise computer-executable instructions that cause the computing device to:

pass the host administrator service socket handle from the container host administrator service to the container.

13. The non-transitory computer-readable medium of claim 11 , wherein the computer-executable instructions comprise computer-executable instructions that cause the computing device to send, when the requested privileged operation is successfully completed or rejected, a respective response to a container administrator.

14. The non-transitory computer-readable medium of claim 11 , wherein the computer-executable instructions comprise computer-executable instructions that cause the computing device to:

receive, at an interceptor, a success response; and

send a notification to the application that the requested privileged operation is successful.

Assignments (11)

Continuity (1)