基於容器配置的自動化SELinux安全策略生成與部署工具

Automatic SELinux Security Policy Generation and Deployment Tool Based on Container Configuration

隨著容器化技術的廣泛應用，如何提升容器環境的安全性成為重要課題。SELinux作為Linux平台上的強制訪問控制機制，能有效限制容器對資源的存取，但現有的SELinux管理工具存在操作繁瑣、靈活性不足等問題，難以適應容器環境的動態變化。本研究設計基於容器配置的安全策略自動化生成與部署機制，開發自動安全策略生成與部署工具-AutoSEL。透過監控容器事件，AutoSEL可動態分析容器配置，自動更新SELinux策略，提高管理效率與安全性。
實驗結果顯示，AutoSEL在啟動時間、記憶體佔用及工作負載性能上均接近原生Docker容器，並優於gVisor。AutoSEL具自動化精準控制特權容器權限能力，增強安全防護效果。AutoSEL的模組化設計提供了靈活性和擴展性，能有效提升容器執行環境的安全性與管理效率，為容器化應用提供高效解決方案，適用於對安全性要求高的軟體環境。

With the widespread application of containerization technology, improving the container environment’s security has become an important issue. As a mandatory access control mechanism on the Linux platform, SELinux can effectively limit container access to resources. However, existing SELinux management tools have problems such as cumbersome operations and insufficient flexibility, making it difficult to adapt to dynamic changes in the container environment. This study proposes the AutoSEL tool to realize automated generation and deployment of SELinux policies based on container configuration. AutoSEL can dynamically analyze container configurations by monitoring container events and automatically update SELinux policies to improve management efficiency and security.
Experimental results show that AutoSEL is close to native Docker regardingstartup time, memory usage, and workload performance and is better than gVisor. In addition, AutoSEL has automation capabilities that can accurately control privileged container permissions and enhance security protection. AutoSEL's modular design provides flexibility and scalability, which can effectively improve the security and management efficiency of the container execution environment, provide an efficient solution for containerized applications, and is suitable for production environments with high-security requirements.