基于LSM的容器多级安全隔离系统设计与优化OA

With the widespread adoption of container technology in production environments,deficiencies in security isolation mechanisms have become increasingly apparent.This paper proposes a multi-level security isolation model for containers based on the Linux Security Modules(LSM)framework.The model constructs fine-grained Mandatory Access Control(MAC)policies by defining containerized subjects and ob-jects and introducing security labels to classify container processes and file resources.A Docker LSM(DLSM)prototype system is developed to strengthen protection at two levels:restricting container access to host critical directories and other container file systems to prevent privilege es-calation and escape,and implementing grouped management with permission grading for shared data volumes to prevent data leakage or tampe-ring.Comparative experiments with SELinux and AppArmor demonstrate that DLSM achieves a 100％interception rate in across container es-cape,sensitive directory mounting,and cross-container communication attack scenarios,with performance overhead kept below 5％,providing an effective solution balancing container security and efficiency.