.png){kind=icon}
.png){kind=icon}
Return
MSpace: Multi security namespace management for containers
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jer.2025.04.007.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Existing system security frameworks like LSM are primarily designed for the operating system kernel and are not applicable to user-level container methods. This is primarily because the system security framework is designed and implemented within the operating system kernel, which is shared across the entire system and cannot fulfill the isolation requirements of containers. The security policies of multiple containers are intermixed in the underlying system kernel, which impacts each other and increases the overhead of monitoring, leading to inefficiencies in cloud servers running numerous containers. Improvements to the security of containers are ad hoc and partial, often lacking support for the universal SELinux mode. In this paper, we introduce MSpace, an enhanced kernel SELinux framework that supports containerized secure spaces with individual security policies and mechanisms. To enhance security, we first introduce an instantiation mechanism for virtual hook tables, which, in conjunction with the container's namespace, ensures each has its own instantiated hook tables instead of a system-wide one, thereby isolating secure spaces. Subsequently, a security namespace method was devised to support container-specific private security policies. Lastly, to maintain compatibility, only the instantiation and deallocation interfaces were added while preserving the original interfaces unchanged. The results demonstrate that MSpace effectively alleviates the issue of using SELinux for internal containers, with an average reduction of 2.83 % in system call latency compared to using host SELinux directly.
Keywords:
MSpace
SELinux
Container security
Virtual jump tables
System call latency
Journal
IF:
2.2
Papers:
371
Citations:
1.7K