一种基于SELinux扩展的OVERLAYFS文件安全访问加固机制研究  

Research on an OVERLAYFS file security access hardening mechanism based on SELinux extension

作　　者：陈大文 Chen Dawen(Jiangsu Golden Shield Detection Technology Co.,Ltd.,Nanjing 210000,China)

机构地区：[1]江苏金盾检测技术股份有限公司,江苏南京210000

出　　处：《无线互联科技》2022年第12期133-136,168,共5页Wireless Internet Technology

摘　　要：作为新型的Linux联合文件系统,OVERLAYFS成为Docker之类Linux容器实现的主流文件系统构建技术。容器技术作为新兴的计算模式,是未来算力网络计算模式的核心,由于容器镜像的可迁移性、复制性结合算力网络调度的异地执行等特征,容器中的数据资产与软件资产等面临较大的安全风险。为此,文章提出一种容器资产访问的安全框架,制定了镜像层各方信任关系构建和执行策略,并嵌入SELinux的安全构架,通过底层的算力平台予以执行。通过框架建立基于容器中镜像层资产的信任关系,采用算力平台执行安全访问策略,实现对OVERFLAYFS的文件安全访问与控制。As a new Linux joint file system,OVERLAYFS has become the mainstream file system construction technology for Linux containers like Docker.As an emerging computing mode,the container technology is the core of the future computing power network computing mode.Due to the mobility of the container mirror image,the replication and the remote execution of the computing power network scheduling,the data assets and software assets in the containers face great security risks.To this end,this paper proposes a security framework for container asset access,in which the construction and execution strategy of the trust relationship of the mirror layer is developed,embedded in the security framework of SELinux,and executed through the underlying computing power platform.Through this framework,we can establish a trust relationship based on the mirror layer assets in the container,and then implement security access policies through the computing power platform to achieve secure file access and control of OVERFLAYFS.

关 键 词：SELINUX OVERLAYFS 容器 安全加固 算力网络 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]