Page 482 - 《软件学报》2026年第3期

李志 等: 容器文件系统隔离增强机制 1445

FCFS 的有效性和高效性, 结果表明 FCFS 可以完全阻止这两类漏洞, 同时引入的开销几乎可以忽略不计. 由于
FCFS 未改变 Linux 内核原有的系统调用语义与文件系统行为, 开源社区和企业用户可以直接将其应用于主流
Linux 发行版 (如 CentOS、Ubuntu、Debian 等), 无需对上层应用或容器引擎做出适配性修改, 具有较高的可移植
性和兼容性. FCFS 不仅根本性解决了路径解析错误漏洞和文件描述符泄露漏洞, 确保了准确和全面的主机和容器
交互控制, 同时保持了良好的兼容性, 这项工作为容器技术的安全应用提供了重要参考. 由于不同操作系统在内核
架构、文件系统管理和进程调度等方面存在差异, 因此未来的工作可能是针对鸿蒙操作系统 (HarmonyOS) 等新
型操作系统的特性对 FCFS 进行适配性设计和优化, 并且探索更复杂的权限场景下 FCFS 的优化方案, 尝试进一
步结合基于角色的访问控制 (role-based access control) [56] 等机制, 以支持多租户使用场景.

References
[1] Linux. namespaces(7)—Linux manual page. 2025. https://www.man7.org/linux/man-pages/man7/namespaces.7.html
[2] Linux. cgroup(7)—Linux manual page. 2025. https://man7.org/linux/man-pages/man7/cgroups.7.html
[3] Linux. mountpoint(1)—Linux manual page. 2025. https://man7.org/linux/man-pages/man1/mountpoint.1.html
[4] Docker. Docker: Accelerated containerized application development. 2025. https://www.docker.com/
[5] Podman. The best free & open source container tools. 2025. https://podman.io/
[6] Containerd. containerd: An industry-standard container runtime with an emphasis on simplicity, robustness and portability. 2025. https://
containerd.io/
[7] Kubernetes. Production-grade container orchestration. 2025. https://kubernetes.io/
[8] Li Z, Liu WJ, Wang XF, Yuan B, Tian HL, Jin H, Yan SM. Lost along the way: Understanding and mitigating path-Misresolution threats
to container isolation. In: Proc. of the 2023 ACM SIGSAC Conf. on Computer and Communications Security. Copenhagen: ACM, 2023.
3063–3077. [doi: 10.1145/3576915.3623154]
[9] CVE. CVE-2017-1002101. 2017. https://www.cve.org/CVERecord?id=CVE-2017-1002101
[10] CVE. CVE-2021-25741. 2021. https://www.cve.org/CVERecord?id=CVE-2021-25741
[11] Linux. mount_namespaces(7)—Linux manual page. 2025. https://man7.org/linux/man-pages/man7/mount_namespaces.7.html
[12] Gitee. FCFS. 2025. https://gitee.com/ClownandBox/FCFS
[13] Zhong BS, Zhang YC, Zhou MJ. Analysis about virtual file system of Linux. Computer and Modernization, 2010(9): 76–78 (in Chinese
with English abstract). [doi: 10.3969/j.issn.1006-2475.2010.09.021]
[14] Song NY, Kim H, Han H, Yeom HY. Efficient dentry lookup with backward finding mechanism. In: Proc. of the 2018 Int’l Conf. on
High Performance Computing in Asia-Pacific Region. Chiyoda: ACM, 2018. 299–308. [doi: 10.1145/3149457.3149468]
[15] Linux. seccomp(2)—Linux manual page. 2025. https://man7.org/linux/man-pages/man2/seccomp.2.html
[16] AppArmor. Linux kernel security module. 2025. https://apparmor.net/
[17] Linux. capabilities(7)—Linux manual page. 2025. https://man7.org/linux/man-pages/man7/capabilities.7.html
[18] Dua R, Kohli V, Patil S, Patil S. Performance analysis of Union and CoW file systems with Docker. In: Proc. of the 2016 Int’l Conf. on
Computing, Analytics and Security Trends. Pune: IEEE, 2016. 550–555. [doi: 10.1109/CAST.2016.7915029]
[19] GitHub, Inc. opencontainers/runc. 2025. https://github.com/opencontainers/runc
[20] Azure. Add continuous integration to your container builds. 2025. https://learn.microsoft.com/en-us/azure-sphere/app-development/
continuous-integration
[21] CVE. CVE-2019-10152. 2019. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10152
[22] CVE. CVE-2019-18466. 2019. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18466
[23] CVE. CVE-2021-30465. 2021. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30465
[24] CVE. CVE-2019-19921. 2019. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19921
[25] CVE. CVE-2022-23648. 2022. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23648
[26] CVE. CVE-2022-0492. 2022. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0492
[27] Bratus S, D’Cunha N, Sparks E, Smith SW. TOCTOU, traps, and trusted computing. In: Lipp P, Sadeghi AR, Koch KM, eds. Trusted
Computing—Challenges and Applications. Berlin: Springer, 2008. 14–32 [doi: 10.1007/978-3-540-68979-9_2]
[28] CVE. CVE-2018-15664. 2018. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15664
[29] CVE. CVE-2023-0778. 2023. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0778
[30] GitHub, Inc. daemon: Archive: Pause containers before doing filesystem operations. 2025. https://github.com/moby/moby/pull/39252
[31] Linux. mount(8)—Linux manual page. 2025. https://man7.org/linux/man-pages/man8/mount.8.html
[32] Dockerdocs. Docker container cp. 2025. https://docs.docker.com/reference/cli/docker/container/cp/
[33] CVE. CVE-2019-14271. 2019. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14271