Loading patent…
AssigneeNetApp, Inc.
InventorAzzedine Benameur
Estimating the term…
Systems and methods for enhancing container security are provided. In one example, exposure of a containerize application to potential security vulnerabilities is reduced by identifying dynamically loaded symbols by the application via performance of static and/or dynamic symbol analysis to identify dynamically loaded symbols that are potentially and/or actually used, respectively, and that correspond to functions contained within shared libraries. Based on a shared library's usage of functions within a standard library and a known mapping between functions of the standard library and system calls, those system calls potentially and actually accessed by the application may be identified and a security policy may be generated and configured for enforcement by a kernel security module to limit system call usage accordingly. Additionally, removal of files or functions of libraries that are deemed unnecessary for proper execution of the applications may be performed to reduce the footprint of the application.
A method of reducing one or more security vulnerabilities to which an application associated with a first container image is exposed, the method comprising:
A non-transitory machine readable medium storing instructions for reducing one or more security vulnerabilities to which an application associated with a first container image is exposed, which when executed by one or more processing resources of a system, cause the system to:
A system comprising:
Dependencies are inferred from the claim text.