MiniCon: Automatic Enforcement of a Minimal Capability Set for Security-Enhanced Containers

Abstract

Nowadays, containers have been widely adopted not only for clouds but also for individual users. On the one hand, containers provide much more light-weight virtualized infrastructure, but on the other hand, it is unavoidable to handle security issues since the isolation of containers is relatively weak, compared to the legacy VMs. Under the container architecture, adversaries are able to exploit kernel vulnerabilities to escalate privilege to gain root privilege, and leak system, privacy critical information. Although previous solutions provide strong security protection, unfortunately, none of them do provide a way to apply policies. Therefore, in this paper, we present an eBPF-based capability enforcement system, MiniCon, that automatically generates and enforces a minimal capability set by using Seccomp Filter. It monitors capability requests from containers, merges those requests to create a minimal capability set, and enforces capability policies through Seccomp Filter.