POLARIS: an automated framework for enhancing file access policies in containerized environments

With the widespread adoption of container-based architectures, container runtime security tools have become essential for protecting cloud workloads. However, existing path-based policies rely on static paths and may be bypassed through alternative paths, become ineffective across different Linux distributions, or overblock symbolic link entry points that resolve to the same executable. To address these limitations, we present POLARIS, a runtime policy enhancement framework that combines policy hardening, LLM-assisted program inference with container-level validation, and LSM-BPF-based fine-grained symbolic link enforcement. Our evaluation shows that POLARIS increases PBP applicability from 33.3% to 100% across the evaluated program and distribution combinations. On a ground-truth dataset of 415 program–distribution pairs across five Linux container images, GPT-5.1 achieves 98.80% program inference accuracy. POLARIS also blocks 100% of the evaluated policy-targeted symbolic link executions without observed unintended blocking. In the evaluated Nginx and Redis workloads, it increases the tested bypass block rate from 0% to 100% while maintaining a 0% false positive rate.