Advances, Systems and Applications
From: Optimus: association-based dynamic system call filtering for container attack surface reduction
Container Image | Operation that rarely occurs | Required system calls | Reason to invoke system calls |
---|---|---|---|
PostgreSQL | Memory Buffer Bloating | mremap | To resize memory space for transaction logs and caching |
Nginx | Configuration Reload | lstat | To confirm and parsing the new configuration file |
 |  | umask | To open log files and new sockets |
 |  | getpgrp | To obtain the PGID of the old worker processes |
 |  | kill | To send the SIGTERM signal to the old worker processes |
Nginx | Cache Purging | unlink | To delete the old cached files |
Apache Httpd | Server Reconfiguration | dup2 | To duplicate the file descriptor of the dummy socket |
 |  | sysinfo | To get available memory/swap space size |
 |  | getpgrp | To obtain the PGID of the old worker processes |
 |  | kill, tgkill | To send the SIGTERM signal to the old worker processes |