Zhi Li
ABSTRACT
Filesystem isolation enforced by today's container technology has been found to be less effective in the presence of host-container interactions increasingly utilized by container tools. This weakened isolation has led to a type of path misresolution (Pamir) vulnerabilities, which have been considered to be highly risky and continuously reported over the years. In this paper, we present the first systematic study on the Pamir risk and the existing fixes to related vulnerabilities. Our research reveals that in spite of significant efforts being made to patch vulnerable container tools and address the risk, the Pamir vulnerabilities continue to be discovered, including a new vulnerability (CVE-2023-0778) we rediscovered from patched software. A key insight of our study is that the Pamir risk is inherently hard to prevent at the level of container tools, due to their heavy reliance on third-party components. While security inspections should be applied to all components to mediate host-container interactions, third-party component developers tend to believe that container tools should perform security checks before invoking their components, and are therefore reluctant to patch their code with the container-specific protection. Moreover, due to the large number of components today's container tools depend on, re-implementing all of them is impractical.
Our study shows that kernel-based filesystem isolation is the only way to ensure isolation always in place during host-container interactions. In our research, we design and implement the first such an approach that extends the filesystem isolation to dentry objects, by enforcing access control on host-container interactions through the filesystem. Our design addresses the fundamental limitation of one-way isolation characterizing today's container, uses carefully-designed policies to ensure accurate and comprehensive interaction control, and implants the protection into the right kernel location to minimize the performance impact. We verify our approach using model checking, which demonstrates its effectiveness in eliminating the Pamir risk. Our evaluation further shows that our approach incurs negligible overheads, vastly outperforming all existing Pamir patches, and maintains compatibility with all mainstream container tools. We have released our code and filed a request to incorporate our technique into the Linux kernel.
- Add continuous integration to your container builds. https://learn.microsoft. com/en-us/azure-sphere/app-development/continuous-integration.Google Scholar
- Auto-reloading for /etc/nsswitch.conf. https://sourceware.org/bugzilla/show_ bug.cgi?id=12459.Google Scholar
- cgroups(7) - Linux manual page. https://man7.org/linux/man-pages/man7/ cgroups.7.html.Google Scholar
- chroot(2) - Linux manual page. https://man7.org/linux/man-pages/man2/chroot. 2.html.Google Scholar
- containerd: An industry-standard container runtime with an emphasis on simplicity, robustness and portability. https://containerd.io/.Google Scholar
- Containers vs. virtual machines. https://learn.microsoft.com/enus/virtualization/windowscontainers/about/containers-vs-vm.Google Scholar
- CVE-2017--1002101. https://kubernetes.io/blog/2018/04/04/fixing-subpathvolume-vulnerability/.Google Scholar
- CVE-2019--14271 loading of nsswitch based config inside chroot under Glib. https://github.com/containers/buildah/issues/2740.Google Scholar
- CVE-2019--5736: Runc uses more memory during start up after the fix. https: //github.com/opencontainers/runc/issues/1980.Google Scholar
- daemon: pause containers before doing filesystem operations. https://github. com/moby/moby/pull/39252.Google Scholar
- Definitions of the actions. https://sites.google.com/view/container-isolation/ paper-appendix/b.Google Scholar
- Docker: Accelerated, Containerized Application Development. https://www. docker.com/.Google Scholar
- Docker Hub. https://hub.docker.com/.Google Scholar
- Docker storage drivers. https://docs.docker.com/storage/storagedriver/selectstorage-driver/.Google Scholar
- FileBench. http://www.nfsv4bat.org/Documents/nasconf/2004/filebench.pdf.Google Scholar
- filepath-securejoin. https://github.com/cyphar/filepath-securejoin.Google Scholar
- go-callvis. https://github.com/ofabry/go-callvis.Google Scholar
- Go Packages. https://pkg.go.dev/.Google Scholar
- gVisor: The Container Security Platform. https://gvisor.dev/.Google Scholar
- Kata Containers. https://katacontainers.io/.Google Scholar
- Kubernetes. https://kubernetes.io/.Google Scholar
- Kubernetes Volumes. https://kubernetes.io/docs/concepts/storage/volumes/.Google Scholar
- Managing dependencies - The Go Programming Language. https://go.dev/doc/ modules/managing-dependencies.Google Scholar
- mount(8) - Linux manual page. https://man7.org/linux/man-pages/man8/mount. 8.html.Google Scholar
- mount_namespaces(7) - Linux manual page. https://man7.org/linux/man-pages/ man7/mount_namespaces.7.html.Google Scholar
- opencontainers/runc. https://github.com/opencontainers/runc.Google Scholar
- Patrol. https://github.com/CGCL-codes/Patrol.Google Scholar
- pivot_root(2) - Linux manual page. https://man7.org/linux/man-pages/man2/ pivot_root.2.html.Google Scholar
- Podman. https://podman.io/.Google Scholar
- Podman issues about the CVE-2018--15664. https://github.com/containers/ podman/pull/3214.Google Scholar
- Proposal: path/filepath: addition of SecureJoin helper. https://github.com/golang/ go/issues/20126.Google Scholar
- Race Condition in crun. https://security.snyk.io/vuln/SNYK-ORACLE8-CRUN2585150.Google Scholar
- Rootless Containers. https://rootlesscontaine.rs/.Google Scholar
- SPEC. http://www.spec.org/index.html.Google Scholar
- Spin - Formal Verification. https://spinroot.com/spin/whatispin.html.Google Scholar
- Third-party dependencies of the container tools. https://sites.google.com/view/ container-isolation/paper-appendix/a.Google Scholar
- Windows Server Containers Are Open, and Here's How You Can Break Out. https: //unit42.paloaltonetworks.com/windows-server-containers-vulnerabilities/.Google Scholar
- Daniel P. Bovet and Marco Cesati. Understanding the Linux Kernel: from I/O ports to process management. O'Reilly Media, Inc., 2005.Google Scholar
- Thanh Bui. Analysis of docker security. arXiv preprint arXiv:1501.02967, 2015.Google Scholar
- R. Joseph Connor, Tyler McDaniel, Jared M. Smith, and Max Schuchard. PKU Pitfalls: Attacks on PKU-based Memory Isolation Systems. In Proceedings of 29th USENIX Security Symposium, pages 1409--1426, 2020.Google Scholar
- Guillaume Everarts de Velp, Etienne Rivière, and Ramin Sadre. Understanding the performance of container execution environments. In Proceedings of the 6th International Workshop on Container Technologies and Container Clouds, pages 37--42, 2020.Google ScholarDigital Library
- Andy Galloway, Gerald Lüttgen, Jan Tobias Mühlberg, and Radu I Siminiceanu. Model-checking the linux virtual file system. In Proceedings of the 10th International Conference on Verification, Model Checking, and Abstract Interpretation, pages 74--88, 2009.Google Scholar
- Xing Gao, Zhongshu Gu, Mehmet Kayaalp, Dimitrios Pendarakis, and Haining Wang. Containerleaks: Emerging security threats of information leakages in container clouds. In Proceedings of the 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, pages 237--248, 2017.Google ScholarCross Ref
- Xing Gao, Zhongshu Gu, Zhengfa Li, Hani Jamjoom, and Cong Wang. Houdini's escape: Breaking the resource rein of linux control groups. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 1073--1086, 2019.Google ScholarDigital Library
- John L. Henning. Spec cpu2006 benchmark descriptions. ACM SIGARCH Computer Architecture News, 34(4):1--17, 2006.Google Scholar
- Zhiqiang Jian and Long Chen. A defense method against docker escape attack. In Proceedings of the 2017 International Conference on Cryptography, Security and Privacy, pages 142--146, 2017.Google ScholarDigital Library
- Paul Luo Li, Amy J. Ko, and Jiamin Zhu. What makes a great software engineer? In Proceedings of the 37th IEEE International Conference on Software Engineering, pages 700--710, 2015.Google ScholarCross Ref
- Xin Lin, Lingguang Lei, Yuewu Wang, Jiwu Jing, Kun Sun, and Quan Zhou. A measurement study on linux container security: Attacks and countermeasures. In Proceedings of the 34th Annual Computer Security Applications Conference, pages 418--429, 2018.Google ScholarDigital Library
- Antony Martin, Simone Raponi, Théo Combe, and Roberto Di Pietro. Docker ecosystem--vulnerability analysis. Computer Communications, 122:30--43, 2018.Google ScholarCross Ref
- René Neumann. Using promela in a fully verified executable ltl model checker. In Proceedings of the 6th International Conference on Verified Software: Theories, Tools and Experiments, pages 105--114, 2014.Google ScholarCross Ref
- Elena Reshetova, Janne Karhunen, Thomas Nyman, and N. Asokan. Security of os-level virtualization technologies. In Proceedings of the 2014 Nordic Conference on Secure IT Systems, pages 77--93, 2014.Google ScholarDigital Library
- David Schrammel, Samuel Weiser, Richard Sadek, and Stefan Mangard. Jenny: Securing Syscalls for PKU-based Memory Isolation Systems. In Proceedings of the 31st USENIX Security Symposium, pages 936--952, 2022.Google Scholar
- Yuqiong Sun, David Safford, Mimi Zohar, Dimitrios Pendarakis, Zhongshu Gu, and Trent Jaeger. Security namespace: making linux security frameworks available to containers. In Proceedings of the 27th USENIX Security Symposium, pages 1423--1439, 2018.Google Scholar
- Gang Tan. Principles and implementation techniques of software-based fault isolation. Foundations and Trends in Privacy and Security, 1(3):137--198, 2017.Google ScholarDigital Library
- Chia-Che Tsai, Yang Zhan, Jayashree Reddy, Yizheng Jiao, Tao Zhang, and Donald E. Porter. How to get more value from your file system directory cache. In Proceedings of the 25th Symposium on Operating Systems Principles, pages 441--456, 2015.Google ScholarDigital Library
- Alexios Voulimeneas, Jonas Vinck, Ruben Mechelinck, and Stijn Volckaert. You shall not (by) pass! practical, secure, and fast PKU-based sandboxing. In Proceedings of the Seventeenth European Conference on Computer Systems, pages 266--282, 2022.Google ScholarDigital Library
- Bowen Xu, Le An, Ferdian Thung, Foutse Khomh, and David Lo. Why reinventing the wheels? an empirical study on library reuse and re-implementation. Empirical Software Engineering, 25:755--789, 2020.Google ScholarDigital Library
Index Terms
- Lost along the Way: Understanding and Mitigating Path-Misresolution Threats to Container Isolation
Recommendations
Union Buster: A Cross-Container Covert-Channel Exploiting Union Mounting
Cyber Security, Cryptology, and Machine LearningAbstractSoftware containers provide a light-weight counterpart to virtual machines, utilizing the native host operating system to efficiently manage virtualization. Though efficient, this sharing of resources opens a potentially exploitable communication ...
Understanding Container Isolation: An Investigation of Performance Implications of Container Runtimes
WoC '23: Proceedings of the 9th International Workshop on Container Technologies and Container CloudsContainers have become a popular method of deploying and managing applications due to their lightweight nature, scalability, and portability. However, as container technologies evolve, it is important to understand new implications for performance and ...
Reducing Attack Surface with Container Transplantation for Lightweight Sandboxing
APSys '23: Proceedings of the 14th ACM SIGOPS Asia-Pacific Workshop on SystemsContainers, which have evolved in Linux primarily, have become a significant trend in the cloud due to their lightweight virtualization and growing convenient ecosystem. However, the laxer isolation of containerization also introduces attack surfaces on ...
Comments