PaaS平台上Python沙箱研究

发布时间：2018-03-02 00:02

本文关键词： 平台即服务隔离 Python 沙箱细粒度　出处：《南京大学》2014年硕士论文　论文类型：学位论文

【摘要】：平台即服务式云计算(PaaS)是将基础设施平台作为一种服务的商业模式。PaaS向租户提供平台环境,允许多个租户同时部署自己的云服务。由于其开放和多租户的特性,PaaS平台面临着安全隔离问题：恶意租户的代码可能会对平台自身或者其他租户应用造成危害。现有的PaaS平台支持Java、Python等多种语言,本文分析现有的针对PaaS平台上Python应用的安全解决方案,认为它们存在控制粒度过粗,兼容性差等问题,导致控制策略不灵活,租户应用代码迁移成本高。本文研究应用于PaaS平台,针对Python程序的安全沙箱,以解决平台上的安全隔离问题。本文提出一种在应用框架层对Python应用进行隔离监控的安全沙箱Opsandbox,为平台提供细粒度的访问控制功能。同时利用容器虚拟化技术Linux Containers(LXC),在PaaS平台上构建进程级沙箱,为平台提供底层防护,并支持部分资源限额功能。本文的主要工作和创新包括：1.研究了目前已有的解决方法,包括容器虚拟化技术、seccomp沙箱、精简解释器、PyPy项目、RePy项目以及PyXhon项目等解决方案。并分析了各自的优缺点,认为容器虚拟化技术、seccomp沙箱以及PyXhon存在监控粒度过粗的问题,而精简解释器、PyPy项目和RePy项目存在兼容性差的问题。2.研究并理解了Python解释器的工作原理。主要分析了Python执行引擎的工作方式,包括对若干关键结构体(PyCodeObject,PyFrameObject等)的研究、对指令(opcode)执行方式的研究、以及对模块和函数实现机制的研究等。此外,对Python的内存管理机制也做了一定研究。3.提出一种在应用框架层对Python应用进行细粒度控制的沙箱Opsandbox。Opsandbox通过修改Python程序的编译结果,向其插入Python解释器指令序列,使得Python程序在运行时能够自主执行安全检查。Opsandbox不修改解释器和库函数,对用户完全透明,具有较好的兼容性；同时能够对不同的代码应用不同的控制策略,实现细粒度的访问控制功能。4.借鉴AspectBox多层防御的思想,利用容器虚拟化技术Linux Containers(LXC)构建进程级沙箱,为平台提供底层防护,并支持部分资源限额功能。本文详细描述了沙箱系统的结构和实现细节,最后通过实验证明该沙箱系统的有效性。
[Abstract]:Platform as a service cloud computing (PaaS) provides a platform environment for tenants to use the infrastructure platform as a business model for services. PaaS. It allows multiple tenants to deploy their own cloud services at the same time. Due to their open and multi-tenant characteristics PaaS platform faces security isolation problems: malicious tenant code may harm the platform itself or other tenant applications. The existing PaaS platform supports a variety of languages, such as Java Java Python, This paper analyzes the existing security solutions for Python applications on PaaS platform, and points out that they have some problems, such as too coarse control granularity and poor compatibility, which lead to inflexible control strategy. The tenant application code migration cost is high. This paper studies the application of PaaS platform, aimed at the Python program security sandbox, In order to solve the problem of security isolation on the platform, this paper presents a security sandbox that can isolate and monitor the Python application in the application framework layer, which provides fine-grained access control function for the platform. At the same time, the container virtualization technology Linux is used to provide the platform with fine-grained access control function. Container LXC, build process level sandboxes on the PaaS platform, The main work and innovation of this paper include: 1. Research on existing solutions, including container virtualization technology, seccomp sandbox, Based on the analysis of their advantages and disadvantages, it is concluded that container virtualization technology, such as seccomp sandbox and PyXhon, has the problem of too coarse monitoring granularity. However, there is a problem of poor compatibility between the simplified interpreter and the RePy project. 2. The working principle of the Python interpreter is studied and understood. The working mode of the Python execution engine is mainly analyzed, including the study of several key structures, such as PyCodeObjectPyFrameObject, etc. Research on the execution mode of instruction code, and the implementation mechanism of modules and functions, etc. In addition, The memory management mechanism of Python is also studied. 3. A sandbox Opsandbox.Opsandbox with fine granularity control over Python application at the application frame layer is proposed. By modifying the compilation result of Python program, it inserts the instruction sequence of Python interpreter into it. The Python program can independently execute the security check. Opsandbox does not modify the interpreter and library functions while running, which is transparent to the user and has good compatibility. At the same time, it can apply different control strategies to different codes. To realize fine-grained access control function .4.draw lessons from the idea of AspectBox multi-layer defense, use container virtualization technology Linux containers LXCto build process level sandbox, and provide the bottom layer protection for the platform. The structure and implementation details of the sandbox system are described in detail. Finally, the effectiveness of the sandbox system is proved by experiments.
【学位授予单位】：南京大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.09

【相似文献】