Process control method and device, electronic equipment and storage medium

Abstract

The invention provides a process control method and device, electronic equipment and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: switching a current preset mode of the terminal into at least one customized mode in response to a selection operation on at least one customized mode in the terminal; based on the mode identifier of the at least one customization mode, under the condition that a mandatory access control rule corresponding to the preset mode is started, starting the mandatory access control rule corresponding to the at least one customization mode; and for any process in the terminal, in response to a process access request of the process, executing mandatory access control on the process through the mandatory access control rule corresponding to the at least one customized mode and the mandatory access control rule corresponding to the preset mode. According to the scheme, switching of security control strategies in various specific scenes can be realized through superposition of multiple layers of mandatory access control rules, and the security of resources in the terminal is better protected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a process control method, device, electronic device and storage medium. Background Art

[0002] Security-Enhanced Linux (SELinux) is a security module of the Linux kernel. With SELinux, terminals can better protect and restrict system services, control access to application data and system logs, and reduce the impact of malware. Therefore, how to use SELinux to protect the security of user terminals is an important research direction in the current field.

[0003] In the related technology, the terminal can use SELinux to enforce mandatory access control (MAC) on all processes. Under the restrictions of this access control system, only operations that comply with the mandatory access control rules are allowed to be executed, that is, the process can only access the files required in its task, and the system will prohibit the process from accessing files outside the allowed scope.

[0004] However, in the above solution, since the usage scenarios of the terminal are becoming more and more diverse, the security requirements of different usage scenarios are also different. Therefore, when the mandatory access control rules are relatively simple, the security of the terminal will be poor. Summary of the invention

[0005] The embodiments of the present application provide a process control method, device, electronic device and storage medium, which can realize the switching of security control strategies in various specific scenarios by superimposing multiple layers of mandatory access control rules, and better protect the security of resources in the terminal. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a process control method is provided, the method comprising:

[0007] In response to a selection operation of at least one customized mode in the terminal, switching the current preset mode of the terminal to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode;

[0008] Based on the mode identifier of the at least one customized mode, in the case where the mandatory access control rule corresponding to the preset mode has been enabled, enabling the mandatory access control rule corresponding to the at least one customized mode;

[0009] For any process in the terminal, in response to a process access request of the process, mandatory access control is performed on the process through mandatory access control rules corresponding to the at least one customized mode and mandatory access control rules corresponding to the preset mode, and the process access request is used to request access to resources in the terminal.

[0010] According to another aspect of an embodiment of the present application, a process control device is provided, the device comprising:

[0011] a mode switching module, configured to, in response to a selection operation of at least one customized mode in the terminal, switch the preset mode currently in which the terminal is located to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode;

[0012] A rule enabling module, configured to enable the mandatory access control rule corresponding to the at least one customized mode based on the mode identifier of the at least one customized mode, if the mandatory access control rule corresponding to the preset mode has been enabled;

[0013] A process control module is used to perform mandatory access control on any process in the terminal in response to a process access request of the process, through mandatory access control rules corresponding to at least one customized mode and mandatory access control rules corresponding to the preset mode, wherein the process access request is used to request access to resources in the terminal.

[0014] In some embodiments, the at least one customized mode is a plurality of customized modes;

[0015] The rule enabling module includes:

[0016] A first determining unit is configured to determine, for any customized mode among the multiple customized modes, based on a mode identifier of the customized mode, whether the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode can be enabled at the same time if the mandatory access control rule corresponding to the preset mode is enabled;

[0017] an enabling unit, configured to enable the mandatory access control rule corresponding to the customized mode when the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode can be enabled at the same time;

[0018] A disabling unit is used to disable the mandatory access control rule corresponding to the customized mode when the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode cannot be enabled at the same time.

[0019] In some embodiments, the at least one customized mode is a plurality of customized modes;

[0020] The rule enabling module is used to obtain the enabling priorities of the multiple customized modes based on the mode identifiers of the multiple customized modes, when the mandatory access control rules corresponding to the preset mode have been enabled; based on the enabling priorities of the multiple customized modes, enable the mandatory access rules corresponding to the first customized mode, the first customized mode being the customized mode with the highest enabling priority among the multiple customized modes.

[0021] In some embodiments, the at least one customized mode is a plurality of customized modes;

[0022] The process control module comprises:

[0023] an acquiring unit, configured to acquire, for any process in the terminal, security levels of the plurality of customized modes in response to a process access request of the process;

[0024] A second determining unit, configured to determine a second customized mode based on the security levels of the multiple customized modes, wherein the second customized mode is a customized mode with the highest security level among the multiple customized modes;

[0025] A process control unit is used to perform mandatory access control on the process through the mandatory access control rules corresponding to the second customized mode and the mandatory access control rules corresponding to the preset mode.

[0026] In some embodiments, the process control module is used to, for any process in the terminal, in response to a process access request of the process, determine whether the process access request complies with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the at least one customized mode based on the process identifier of the process and the resource identifier of the target resource that the process requests to access; and if the process access request complies with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the at least one customized mode, allow the process to access the target resource.

[0027] In some embodiments, the process control module is also used to obtain the working mode of the security-enhanced Linux in the terminal when the process access request does not comply with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the at least one custom mode; when the working mode is the mandatory mode, deny the process access to the target resource; when the working mode is the permissive mode, allow the process to access the target resource and display a warning message, wherein the warning message is used to prompt a suggestion to deny the process access to the target resource.

[0028] In some embodiments, the process control module is also used to display a first prompt message when the working mode is the forced mode and the number of illegal accesses to the process is less than a first quantity threshold, and the first prompt message is used to prompt the working mode to be switched to the tolerant mode; and to display a second prompt message when the working mode is the tolerant mode and the number of illegal accesses to the process is greater than a second quantity threshold, and the second prompt message is used to prompt the working mode to be switched to the forced mode.

[0029] In some embodiments, the mode switching module is further configured to switch at least one customized mode currently in which the terminal is located to the preset mode in response to a selection operation on the preset mode;

[0030] The rule enabling module is further configured to disable the mandatory access control rule corresponding to the at least one customized mode and enable the mandatory access control rule corresponding to the preset mode based on the mode identifier of the preset mode;

[0031] The process control module is further configured to, for any process in the terminal, respond to a process access request of the process and perform mandatory access control on the process through a mandatory access control rule corresponding to the preset mode.

[0032] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the process control method as described in the above aspect.

[0033] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method as described in the above aspects.

[0034] According to another aspect of an embodiment of the present application, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip runs on a computer device, it is used to implement the process control method described in the above aspects.

[0035] According to another aspect of an embodiment of the present application, a computer program product is provided, wherein the computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method described in the above aspect.

[0036] The embodiment of the present application provides a process control method, in which the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can continue to enable the mandatory access control rules corresponding to at least one customized mode while enabling the original mandatory access control rules of the terminal in the preset mode. Through the superposition of multiple layers of mandatory access control rules, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode, thereby realizing the switching of security control strategies in a variety of specific scenarios and better protecting the security of resources in the terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 It is a schematic diagram of an implementation environment of a process control method provided in an embodiment of the present application;

[0039] Figure 2 is a flow chart of a process control method provided by an embodiment of the present application;

[0040] Figure 3 is a flow chart of another process control method provided by an embodiment of the present application;

[0041] Figure 4 It is a schematic diagram of a process control flow provided by an embodiment of the present application;

[0042] Figure 5 It is a structural schematic diagram of a process control device provided in an embodiment of the present application;

[0043] Figure 6 is a structural schematic diagram of another process control device provided in an embodiment of the present application;

[0044] Figure 7 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0046] In this article, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0047] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the mode identification, activation priority and security level of the customized mode involved in this application are all obtained with full authorization.

[0048] The process control method provided in the embodiment of the present application can be executed by an electronic device. Taking the electronic device as a terminal as an example, Figure 1 Schematic diagram of an implementation environment of a process control method provided in an embodiment of the present application. Figure 1 , the implementation environment includes a terminal 101 and a server 102. The terminal 101 and the server 102 are connected via a wireless network.

[0049] In some embodiments, the terminal 101 can be a mobile phone, a desktop computer, a laptop computer, a tablet computer, an intelligent voice interaction device, a vehicle-mounted terminal, and other types of terminals. The terminal 101 is provided with multiple modes. By default, the terminal usually runs in a preset mode. For some specific scenarios with high security requirements, the user can enable a security mode customized for a specific scenario, that is, a customized mode of the terminal, such as a child mode, a youth mode, an anti-eavesdropping mode, and the like. The security module SELinux of the terminal in different modes can enable different mandatory access control rules to protect and restrict system services and control the access of processes to application data and system logs.

[0050] In some embodiments, the server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server 102 is used to provide background services for various processes in the terminal 101.

[0051] In some embodiments, the server 102 undertakes the main computing work and the terminal 101 undertakes the secondary computing work; or, the server 102 undertakes the secondary computing work and the terminal 101 undertakes the main computing work; or, the server 102 and the terminal 101 adopt a distributed computing architecture to perform collaborative computing.

[0052] Figure 2 is a flow chart of a process control method provided in an embodiment of the present application. The method is executed by an electronic device, and in the present embodiment of the present application, the method is described by taking execution by a terminal as an example. Figure 2 , the method comprising:

[0053] 201. In response to a selection operation of at least one customized mode in a terminal, the terminal switches a current preset mode to at least one customized mode, wherein a security level of the at least one customized mode is higher than a security level of the preset mode.

[0054] In an embodiment of the present application, a plurality of modes are provided in the terminal, including a preset mode and a customized mode. The preset mode is the mode used by the terminal by default under normal circumstances, and the customized mode is a mode suitable for specific scenarios, such as a child mode, a youth mode, a student mode, an elderly mode, an anti-eavesdropping mode, a do not disturb mode, etc. Among them, the security level of the customized mode is higher than the security level of the preset mode. When the user is in a specific scenario with higher security requirements, the user can turn on the customized mode corresponding to the specific scenario, that is, in response to the user's selection operation of at least one customized mode in the terminal, the terminal can switch the preset mode used by default to a customized mode with a higher security level. For example, when the user is in a meeting, the user can turn on the anti-eavesdropping mode and the do not disturb mode suitable for the meeting scenario.

[0055] 202. Based on the mode identifier of the at least one customized mode, the terminal enables the mandatory access control rule corresponding to the at least one customized mode when the mandatory access control rule corresponding to the preset mode has been enabled.

[0056] In an embodiment of the present application, when the terminal is in a preset mode, the terminal can enable the mandatory access control rules that come with the security module SELinux, that is, the mandatory access control rules corresponding to the preset mode. Therefore, when the terminal switches the preset mode to at least one customized mode, the terminal can keep enabling the mandatory access control rules corresponding to the preset mode according to the mode identifier of at least one customized mode, and continue to enable the mandatory access control rules corresponding to at least one customized mode. Among them, the mandatory access control corresponding to the customized mode has stricter requirements on access control than the mandatory access control rules corresponding to the preset mode. For example, when the terminal is in anti-eavesdropping mode, the terminal prohibits any process from accessing the microphone, thereby preventing some applications from eavesdropping.

[0057] 203. For any process in the terminal, in response to a process access request of the process, the terminal performs mandatory access control on the process through at least one mandatory access control rule corresponding to a customized mode and a mandatory access control rule corresponding to a preset mode, and the process access request is used to request access to resources in the terminal.

[0058] In the embodiment of the present application, for any process in the terminal, when the process accesses the resources in the terminal, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to the previously enabled preset mode and the mandatory access control rules corresponding to at least one currently enabled customized mode. That is, the terminal can control the process of the process accessing resources according to the mandatory access control rules obtained by the combination by arranging and combining the mandatory access control rules corresponding to the preset mode and at least one customized mode.

[0059] The embodiment of the present application provides a process control method, in which the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can continue to enable the mandatory access control rules corresponding to at least one customized mode while enabling the original mandatory access control rules of the terminal in the preset mode. Through the superposition of multiple layers of mandatory access control rules, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode, thereby realizing the switching of security control strategies in a variety of specific scenarios and better protecting the security of resources in the terminal.

[0060] Figure 3 is a flow chart of another process control method provided in an embodiment of the present application. The method is executed by an electronic device, and in the embodiment of the present application, the method is described by taking the execution by a terminal as an example, see Figure 3 , the method comprising:

[0061] 301. In response to a selection operation of at least one customized mode in a terminal, the terminal switches a current preset mode to at least one customized mode, wherein a security level of the at least one customized mode is higher than a security level of the preset mode.

[0062] In the embodiment of the present application, a plurality of modes are set in the terminal, including a preset mode and a custom mode. The preset mode is the mode used by the terminal by default, and the custom mode is a mode suitable for a specific scene or a specific user group. The custom modes include: child mode, youth mode, elderly mode, anti-eavesdropping mode, do not disturb mode, etc., which are not limited in the embodiment of the present application. Among them, the child mode, the youth mode, and the elderly mode are customized modes set for specific user groups such as children, teenagers, and the elderly, while the anti-eavesdropping mode and the do not disturb mode are customized modes set for users in specific scenes with high security requirements such as meetings and exams. Therefore, when a specific user group uses the terminal or the user is in a specific scene with high security requirements, the user can turn on the customized mode corresponding to the specific user group or the customized mode corresponding to the specific scene, that is, in response to the user's selection operation of at least one customized mode in the terminal, the terminal can switch the default preset mode to a customized mode with a higher security level.

[0063] For example, when a user is in a meeting, the user can enable the anti-eavesdropping mode and do not disturb mode applicable to the meeting scenario. When the user currently using the terminal is a minor, the user can enable the youth mode, which regulates the minor's online behavior in terms of terminal usage time, duration, functions and browsing content.

[0064] It should be noted that at least one customized mode in the above step 301 can be one customized mode or multiple customized modes. In the case where at least one customized mode is one customized mode, the terminal can, based on the mode identifier of the customized mode, continue to enable the mandatory access control rules corresponding to the customized mode when the mandatory access control rules corresponding to the preset mode have been enabled. Then, the terminal performs mandatory access control on the process requesting access to resources in the terminal through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode. In the case where at least one customized mode is multiple customized modes, the terminal can execute the following steps 302-307.

[0065] 302. In the case where at least one customized mode is multiple customized modes, the terminal determines, based on the mode identifiers of the multiple customized modes, whether mandatory access control rules corresponding to the multiple customized modes can be enabled at the same time.

[0066] In an embodiment of the present application, the mandatory access control rules corresponding to different customized modes are different, and the restrictions on the access of processes to resources in the terminal by different mandatory access control rules are also different. For example, for the target resource that a process requests to access, the mandatory access control rules corresponding to some customized modes do not allow the process to access the target resource, but the mandatory access control rules corresponding to some customized modes allow the process to access the target resource. Therefore, in the case where the user chooses to turn on multiple customized modes at the same time, since the mandatory access control rules corresponding to some of the multiple customized modes may conflict with each other, the terminal can determine whether the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time based on the mode identifiers of the multiple customized modes before enabling the mandatory access control rules corresponding to the multiple customized modes, so as to avoid the situation where the process cannot normally access the resources in the terminal due to the conflict of mandatory access rules.

[0067] For example, in the case where multiple customized modes are youth mode and do not disturb mode, the terminal determines, based on the mode identifier of the youth mode and the mode identifier of the do not disturb mode, that the mandatory access control rules corresponding to the youth mode can be enabled simultaneously with the mandatory access control rules corresponding to the do not disturb mode; in the case where multiple customized modes are youth mode and child mode, the terminal determines, based on the mode identifier of the youth mode and the mode identifier of the child mode, that the mandatory access control rules corresponding to the youth mode cannot be enabled simultaneously with the mandatory access control rules corresponding to the child mode.

[0068] Optionally, when the user chooses to enable multiple customized modes at the same time, the terminal can obtain a customized mode configuration file, which includes mode tags of multiple customized modes in the terminal. For any customized mode, the mode tag of the customized mode can indicate the customized mode corresponding to the mandatory access control rules that can be enabled simultaneously with the mandatory access control rules corresponding to the customized mode, or indicate the customized mode corresponding to the mandatory access control rules that cannot be enabled simultaneously with the mandatory access control rules corresponding to the customized mode. Based on the mode identifiers of the multiple customized modes, the terminal can determine the mode tags of the multiple customized modes from the customized mode configuration file, and then determine whether the mandatory access control rules corresponding to the multiple customized modes can be enabled simultaneously according to the mode tags of the multiple customized modes.

[0069] In some embodiments, when at least one customized mode is a plurality of customized modes, before the terminal enables the mandatory access control rule corresponding to any customized mode, the terminal can determine whether the mandatory access control rule corresponding to the customized mode can be enabled at the same time as the mandatory access control rule corresponding to the preset mode. Accordingly, for any customized mode among the plurality of customized modes, the terminal determines whether the mandatory access control rule corresponding to the customized mode can be enabled at the same time as the mandatory access control rule corresponding to the preset mode based on the mode identifier of the customized mode, when the mandatory access control rule corresponding to the preset mode has been enabled; then, when the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode can be enabled at the same time, the terminal enables the mandatory access control rule corresponding to the customized mode; conversely, when the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode cannot be enabled at the same time, the terminal disables the mandatory access control rule corresponding to the customized mode. Among them, the mandatory access control rule corresponding to the preset mode is different from the mandatory access control rule corresponding to the customized mode, and some mandatory access control rules corresponding to the customized mode may conflict with the mandatory access control rule corresponding to the preset mode. For example, in the preset mode, the terminal allows the process to access the network, and in the flight mode, the terminal does not allow the process to access the network. Therefore, when the mandatory access control rules corresponding to the preset mode are enabled, the terminal needs to determine whether the mandatory access control rules corresponding to the customized mode to be enabled will conflict with the mandatory access control rules corresponding to the preset mode. Optionally, for any customized mode, the terminal can determine the mode tag of the customized mode from the customized mode configuration file based on the mode identifier of the customized mode, and the mode tag can be used to indicate whether the mandatory access control rules corresponding to the customized mode can be enabled at the same time as the mandatory access control rules corresponding to the preset mode.

[0070] It should be noted that, when the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time, the terminal executes the following steps 303-304; when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, the terminal executes the following steps 305-307.

[0071] 303. When the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time, the terminal enables the mandatory access control rule corresponding to the preset mode and the mandatory access control rules corresponding to the multiple customized modes.

[0072] In the embodiment of the present application, since the mandatory access control rules corresponding to any one of the multiple customized modes can be enabled at the same time as the mandatory access control rules corresponding to the preset mode, and the mandatory access control rules corresponding to each of the multiple customized modes can also be enabled at the same time, the terminal can simultaneously enable the mandatory access rules corresponding to the preset mode and the mandatory access rules corresponding to the multiple customized modes. Among them, the mandatory access control corresponding to the customized mode has stricter requirements on access control than the mandatory access control rules corresponding to the preset mode. For example, when the terminal is in anti-eavesdropping mode, the terminal prohibits any process from accessing the microphone, thereby preventing some applications from eavesdropping.

[0073] 304. For any process in the terminal, in response to a process access request of the process, the terminal performs mandatory access control on the process through mandatory access control rules corresponding to multiple customized modes and mandatory access control rules corresponding to preset modes, and the process access request is used to request access to resources in the terminal.

[0074] In an embodiment of the present application, for any process in the terminal, when the process accesses a resource in the terminal, the terminal can respond to the process access request of the process and perform mandatory access control on the process through the mandatory access control rules corresponding to the previously enabled preset mode and the mandatory access control rules corresponding to the currently enabled multiple customized modes. Among them, mandatory access control refers to a security mechanism that limits the operations that a process can perform in order to protect resources. When the mandatory access control rules are enabled, whenever a process attempts to access a resource, the mandatory access control rules will be enforced by the operating system kernel of the terminal to check the security attributes of the process and the resource and determine whether the process can access the resource.

[0075] In some embodiments, when at least one customized mode is a plurality of customized modes, the terminal can perform mandatory access control on the process only through the mandatory access control rules corresponding to the customized mode with the highest security level. Accordingly, the process in which the terminal responds to the process access request of the process and performs mandatory access control on the process through the mandatory access control rules corresponding to the plurality of customized modes includes: for any process in the terminal, in response to the process access request of the process, the terminal obtains the security levels of the plurality of customized modes; then, the terminal determines the second customized mode based on the security levels of the plurality of customized modes, and the second customized mode is the customized mode with the highest security level among the plurality of customized modes; then, the terminal performs mandatory access control on the process through the mandatory access control rules corresponding to the second customized mode and the mandatory access control rules corresponding to the preset mode. Among them, the security level of the customized mode is used to indicate the security of the mandatory access control rules corresponding to the customized mode. The higher the security level of the customized mode, the higher the security of the mandatory access control rules corresponding to the customized mode, that is, the mandatory access control rules have stricter requirements on access control. The embodiment of the present application, based on the mandatory access control rules corresponding to the preset mode, also performs mandatory access control on the process through the mandatory access control rules corresponding to the customized mode with the highest security level. This can reduce the operational flow of performing mandatory access control on the process through the mandatory access control rules while ensuring the security of the process requesting access to resources, thereby improving the efficiency of the process's access to resources.

[0076] 305. When the mandatory access control rules corresponding to the multiple customized modes cannot be enabled at the same time, the terminal obtains the enabling priorities of the multiple customized modes.

[0077] In an embodiment of the present application, when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, it indicates that the restrictions on process access to resources by the mandatory access control rules corresponding to the multiple customized modes conflict with each other. Therefore, the terminal can determine the mandatory access control rules corresponding to the customized mode to be enabled from the multiple customized modes according to the enabling priorities of the multiple customized modes. Among them, the enabling priority of the customized mode is used to indicate the priority of the terminal to enable the mandatory access control corresponding to the customized mode. The higher the enabling priority of the customized mode, the higher the priority of the terminal to enable the mandatory access control corresponding to the customized mode.

[0078] 306. When the mandatory access control rule corresponding to the preset mode is enabled, the terminal enables the mandatory access rule corresponding to the first customized mode based on the enabling priorities of the multiple customized modes, where the first customized mode is the customized mode with the highest enabling priority among the multiple customized modes.

[0079] In an embodiment of the present application, when the terminal has enabled the mandatory access control rules corresponding to the preset mode, the terminal can determine the enabling priorities of the mandatory access control rules corresponding to multiple customized modes based on the enabling priorities of multiple customized modes, thereby being able to determine the customized mode corresponding to the mandatory access control rule with the highest enabling priority as the first customized mode, and enabling the mandatory access rules corresponding to the first customized mode.

[0080] For example, in the case where multiple customized modes are A mode and B mode, since the mandatory access control rules corresponding to A mode cannot be enabled at the same time as the mandatory access control rules corresponding to B mode, the terminal can determine the mandatory access control rules corresponding to the customized mode to be enabled according to the enabling priorities of A mode and B mode. Since the enabling priority of A mode is higher than the enabling priority of B mode, the terminal determines A mode as the first customized mode, and continues to enable the mandatory access control rules corresponding to A mode when the mandatory access control rules corresponding to the preset mode are enabled.

[0081] Optionally, when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, in addition to enabling the mandatory access control rules corresponding to the preset mode and enabling the mandatory access control rules corresponding to the first customized mode with the highest priority, the terminal can also enable the mandatory access control rules corresponding to the customized mode from the mandatory access control rules corresponding to multiple customized modes that can be enabled simultaneously with the mandatory access control rules corresponding to the first customized mode.

[0082] For example, in the case where multiple customized modes are A mode, B mode and C mode, the mandatory access control rules corresponding to A mode, B mode and C mode cannot be enabled at the same time, and the enabling priority of these multiple customized modes is: A mode>B mode>C mode. Since the mandatory access control rules corresponding to B mode cannot be enabled at the same time as the mandatory access control rules corresponding to A mode, but the mandatory access control rules corresponding to C mode can be enabled at the same time as the mandatory access control rules corresponding to A mode. Therefore, the terminal can enable the mandatory access control rules corresponding to the preset mode and the mandatory access control corresponding to the A mode with the highest priority, while also enabling the mandatory access control rules corresponding to C mode.

[0083] Optionally, when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, the terminal can determine multiple third customized modes from the multiple customized modes. For any third customized mode, the mandatory access control rules corresponding to the third customized mode can be enabled at the same time as the mandatory access control corresponding to the first customized mode with the highest priority, but the mandatory access control rules corresponding to multiple third customized modes cannot be enabled at the same time. At this time, the terminal can enable the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the first customized mode, while also enabling the mandatory access control rules corresponding to the third customized mode with the highest priority among the multiple third customized modes.

[0084] For example, when multiple customized modes are A mode, B mode and D mode, the mandatory access control rules corresponding to A mode, B mode and D mode cannot be enabled at the same time, and the enabling priority of these multiple customized modes is: D mode>A mode>B mode. Since the mandatory access control rules corresponding to D mode can be enabled simultaneously with the mandatory access control rules corresponding to A mode and with the mandatory access control rules corresponding to B mode, but the mandatory access control rules corresponding to A mode cannot be enabled simultaneously with the mandatory access control rules corresponding to B mode. Therefore, the terminal can enable the mandatory access control rules corresponding to the preset mode and the mandatory access control corresponding to the D mode with the highest priority, and also enable the mandatory access control rules corresponding to the A mode with a higher enabling priority than the B mode.

[0085] Optionally, in the case where the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, there are multiple first customized modes with the highest priority enabled among the multiple customized modes. If the mandatory access control rules corresponding to the multiple first customized modes with the highest priority can be enabled at the same time, the terminal can enable the mandatory access control rules corresponding to the multiple first customized modes at the same time when the mandatory access control rules corresponding to the preset mode are enabled. If the mandatory access control rules corresponding to the multiple first customized modes with the highest priority cannot be enabled at the same time, then for any first customized mode, the terminal can determine the number of customized modes corresponding to the mandatory access control rules that can be enabled at the same time with the mandatory access control rules corresponding to the first customized mode. And determine the first customized mode with the largest number of simultaneous enabled ones from the multiple first customized modes as the customized mode corresponding to the mandatory access control rules to be enabled, so that while enabling the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the first customized mode, the mandatory access control rules corresponding to the multiple customized modes that can be enabled at the same time with the mandatory access control rules corresponding to the first customized mode can also be enabled.

[0086] For example, in the case where multiple customized modes are A mode, B mode, C mode, D mode and E mode, the mandatory access control rules corresponding to A mode, B mode, C mode, D mode and E mode cannot be enabled at the same time, and the enabling priority of these multiple customized modes is: A mode = B mode > C mode > D mode > E mode. Since the mandatory access control corresponding to A mode and the mandatory access control rules corresponding to B mode cannot be enabled at the same time, the mandatory access control corresponding to A mode can be enabled at the same time with the mandatory access control rules corresponding to C mode and E mode, and the mandatory access control corresponding to B mode can be enabled at the same time with the mandatory access control rules corresponding to D mode. That is, the mandatory access control rules corresponding to A mode, C mode and E mode can be enabled at the same time, and the mandatory access control rules corresponding to B mode and D mode can be enabled at the same time. Therefore, when the terminal enables the mandatory access control rules corresponding to the preset mode, it can also enable a larger number of mandatory access control rules corresponding to A mode, C mode and E mode at the same time.

[0087] 307. For any process in the terminal, in response to a process access request of the process, the terminal performs mandatory access control on the process through mandatory access control rules corresponding to the first customized mode and mandatory access control rules corresponding to the preset mode, and the process access request is used to request access to resources in the terminal.

[0088] In the embodiment of the present application, the specific implementation process of step 307 is similar to the above step 304, which will not be repeated here. In order to facilitate understanding of the specific process of the above process control method, the embodiment of the present application also provides a schematic diagram of the process control flow. Figure 4As shown, in the case where at least one customized mode is a customized mode, two modes are set in the terminal, including: preset mode and customized mode. The mode switch has two states, which are used to control the switching between the preset mode and the customized mode. When the mode switch is in the on state, the terminal switches to the customized mode; when the mode switch is in the off state, the terminal switches to the preset mode. Among them, 0 represents the off state, and 1 represents the on state. In order to ensure that the mode switch is not controlled by malicious ROOT, the terminal places the mode switch in a trusted execution environment with a higher authority than EL0 (unprivileged execution exception level). Among them, EL0 is usually used for the execution of user programs, which is executed in the user space and can be called user mode. When the terminal switches to the preset mode, the terminal can enable the system's own mandatory access control rules, that is, the mandatory access control rules corresponding to the preset mode. When the terminal switches to the customized mode, the terminal can simultaneously enable the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode. At this time, when a process in the terminal requests to access the target resource in the terminal, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode.

[0089] In some embodiments, the terminal can allow the process to access the target resource if the process access request complies with the combined mandatory access control rules corresponding to the preset mode and at least one customized mode. Accordingly, the process of the terminal performing mandatory access control on the process through the mandatory access control rules corresponding to at least one customized mode includes: for any process in the terminal, in response to the process access request of the process, the terminal determines whether the process access request complies with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode based on the process identifier of the process and the resource identifier of the target resource requested to be accessed by the process; then, the terminal allows the process to access the target resource if the process access request complies with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode. The process access request carries the process identifier of the process and the resource identifier of the target resource requested to be accessed by the process. Based on the process identifier and the resource identifier, the terminal can query whether the process has access rights to the target resource from the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode. When the process has access rights to the target resource, it indicates that the process access request complies with the mandatory access control rules corresponding to the preset mode and at least one customized mode; conversely, when the process does not have access rights to the target resource, it indicates that the process access request does not comply with the mandatory access control rules. The embodiment of the present application can determine whether the process has access rights to the target resource through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode, and if the process has access rights, allow the process to access the target resource, thereby improving the security of the process accessing resources.

[0090] In some embodiments, the terminal can determine whether to deny the process access to the target resource according to the current working mode of the security-enhanced Linux when the process access request does not comply with the mandatory access control rules corresponding to the preset mode and at least one customized mode. Accordingly, when the process access request does not comply with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the at least one customized mode, the terminal obtains the working mode of the security-enhanced Linux in the terminal; then, when the working mode is the mandatory mode, the terminal denies the process access to the target resource; when the working mode is the permissive mode, the terminal allows the process to access the target resource and displays a warning message, which is used to prompt the suggestion to deny the process access to the target resource. Among them, the working mode of the security-enhanced Linux (SELinux) includes a shutdown mode, a mandatory mode, and a permissive mode. In the shutdown mode, SELinux is turned off, and the terminal enables the discretionary access control (DAC) rules to control the process access. In the mandatory mode, SELinux is enabled, and the terminal will enforce the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the at least one customized mode for all processes, that is, when the process access request does not comply with the mandatory access control rules, the terminal can deny the process access to the target resource. In permissive mode, SELinux is enabled, but the mandatory access control rules corresponding to the preset mode and at least one mandatory access control rule corresponding to the custom mode are not enforced, that is, when the process access request does not comply with the mandatory access control rule, the terminal can still allow the process to access the target resource. In the embodiment of the present application, when the process does not have access rights to the target resource, through the working mode of SELinux, when the working mode is the mandatory mode, the process access is denied, and when the working mode is the permissive mode, the process access is allowed but a warning message is displayed to prompt the user to deny the process access to the target resource, thereby ensuring the security of the process accessing resources.

[0091] In some embodiments, the terminal can prompt the user to switch the SELinux working mode according to the number of violations of the process. Accordingly, when the working mode is the mandatory mode and the number of illegal accesses of the process is less than the first quantity threshold, the terminal displays a first prompt message, and the first prompt message is used to prompt the working mode to be switched to the permissive mode; when the working mode is the permissive mode and the number of illegal accesses of the process is greater than the second quantity threshold, the terminal displays a second prompt message, and the second prompt message is used to prompt the working mode to be switched to the mandatory mode. Among them, when the working mode is the mandatory mode and the number of illegal accesses of the process is less than the first quantity threshold, it means that the user has fewer illegal access operations in the current working mode, so the terminal can prompt the user to switch the working mode to the permissive mode. When the working mode is the permissive mode and the number of illegal accesses of the process is greater than the second quantity threshold, it means that the user has more illegal access operations in the current working mode, so the terminal can prompt the user to switch the working mode to the mandatory mode. The embodiment of the present application detects the number of illegal accesses of the process and prompts the user to switch the current working mode in combination with the current working mode, so as to ensure that when the number of illegal accesses is large, the user is prompted to switch to the forced mode to ensure the terminal security, and when the number of illegal accesses is small, the user is prompted to switch to the tolerant mode to ensure the operating performance of the terminal.

[0092] In some embodiments, the terminal can perform mandatory access control on the process according to the mandatory access control rules corresponding to the preset mode. Accordingly, when the terminal is in the preset mode, the process of mandatory access control on the process includes: in response to the selection operation of the preset mode, the terminal switches at least one customized mode currently in which the terminal is located to the preset mode; then, based on the mode identifier of the preset mode, the terminal disables the mandatory access control rules corresponding to at least one customized mode and enables the mandatory access control rules corresponding to the preset mode; then, for any process in the terminal, in response to the process access request of the process, the terminal performs mandatory access control on the process through the mandatory access control rules corresponding to the preset mode. The embodiment of the present application can determine whether the process can access the resource through the mandatory access control rules corresponding to the preset mode when the mode in which the terminal is located is switched to the preset mode, according to the mode identifier of the preset mode, and enables the mandatory access control rules corresponding to the preset mode, so as to realize the flexible switching of the mandatory access control rules enabled in the preset mode and the customized mode.

[0093] The embodiment of the present application provides a process control method, in which the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can continue to enable the mandatory access control rules corresponding to at least one customized mode while enabling the original mandatory access control rules of the terminal in the preset mode. Through the superposition of multiple layers of mandatory access control rules, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode, thereby realizing the switching of security control strategies in a variety of specific scenarios and better protecting the security of resources in the terminal.

[0094] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0095] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0096] Figure 5 is a schematic diagram of the structure of a process control device provided in an embodiment of the present application. Figure 5 , the device comprises:

[0097] A mode switching module 501, configured to, in response to a selection operation of at least one customized mode in the terminal, switch the preset mode currently in which the terminal is located to at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode;

[0098] A rule enabling module 502, configured to enable, based on a mode identifier of at least one customized mode, a mandatory access control rule corresponding to at least one customized mode when a mandatory access control rule corresponding to a preset mode has been enabled;

[0099] The process control module 503 is used to perform mandatory access control on any process in the terminal in response to a process access request of the process through at least one mandatory access control rule corresponding to a customized mode and a mandatory access control rule corresponding to a preset mode. The process access request is used to request access to resources in the terminal.

[0100] In some embodiments, at least one customized mode is a plurality of customized modes;

[0101] Figure 6 is a schematic diagram of the structure of another process control device provided in an embodiment of the present application. Figure 6 , the rule activation module 502 includes:

[0102] A first determining unit 601 is configured to determine, for any customized mode among the multiple customized modes, based on a mode identifier of the customized mode, whether a mandatory access control rule corresponding to the customized mode and a mandatory access control rule corresponding to the preset mode can be enabled at the same time if a mandatory access control rule corresponding to the preset mode is enabled;

[0103] An enabling unit 602, configured to enable the mandatory access control rule corresponding to the customized mode when the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode can be enabled at the same time;

[0104] The disabling unit 603 is used to disable the mandatory access control rule corresponding to the customized mode when the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode cannot be enabled at the same time.

[0105] In some embodiments, at least one customized mode is a plurality of customized modes;

[0106] The rule enabling module 502 is used to obtain the enabling priorities of multiple customized modes based on the mode identifiers of multiple customized modes, when the mandatory access control rules corresponding to the preset mode have been enabled; based on the enabling priorities of multiple customized modes, enable the mandatory access rules corresponding to the first customized mode, and the first customized mode is the customized mode with the highest enabling priority among the multiple customized modes.

[0107] In some embodiments, at least one customized mode is a plurality of customized modes;

[0108] Continue to see Figure 6 , the process control module 503 includes:

[0109] An acquisition unit 604 is used to acquire, for any process in the terminal, security levels of multiple customized modes in response to a process access request of the process;

[0110] A second determining unit 605, configured to determine a second customized mode based on the security levels of the multiple customized modes, wherein the second customized mode is a customized mode with the highest security level among the multiple customized modes;

[0111] The process control unit 606 is used to perform mandatory access control on the process through the mandatory access control rules corresponding to the second customized mode and the mandatory access control rules corresponding to the preset mode.

[0112] In some embodiments, the process control module 503 is used to determine, for any process in the terminal, in response to a process access request of the process, whether the process access request complies with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode based on the process identifier of the process and the resource identifier of the target resource that the process requests to access; if the process access request complies with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode, the process is allowed to access the target resource.

[0113] In some embodiments, the process control module 503 is also used to obtain the working mode of the security-enhanced Linux in the terminal when the process access request does not comply with the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to at least one customized mode; when the working mode is the mandatory mode, deny the process access to the target resources; when the working mode is the permissive mode, allow the process to access the target resources and display a warning message, which is used to prompt the suggestion to deny the process access to the target resources.

[0114] In some embodiments, the process control module 503 is also used to display a first prompt message when the working mode is a forced mode and the number of illegal accesses to the process is less than a first quantity threshold, and the first prompt message is used to prompt the working mode to be switched to a tolerant mode; when the working mode is a tolerant mode and the number of illegal accesses to the process is greater than a second quantity threshold, a second prompt message is displayed, and the second prompt message is used to prompt the working mode to be switched to a forced mode.

[0115] In some embodiments, the mode switching module 501 is further configured to switch at least one customized mode currently in the terminal to a preset mode in response to a selection operation on a preset mode;

[0116] The rule enabling module 502 is further used to disable the mandatory access control rule corresponding to at least one customized mode and enable the mandatory access control rule corresponding to the preset mode based on the mode identifier of the preset mode;

[0117] The process control module 503 is further configured to, for any process in the terminal, respond to a process access request of the process and perform mandatory access control on the process through mandatory access control rules corresponding to a preset mode.

[0118] The embodiment of the present application provides a process control device, and the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can continue to enable the mandatory access control rules corresponding to at least one customized mode while enabling the original mandatory access control rules of the terminal in the preset mode. Through the superposition of multiple layers of mandatory access control rules, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to the preset mode and the mandatory access control rules corresponding to the customized mode, thereby realizing the switching of security control strategies in a variety of specific scenarios and better protecting the security of resources in the terminal.

[0119] It should be noted that the device provided in the above embodiment, when implementing its functions, only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the server is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0120] An embodiment of the present application provides an electronic device, which includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the process control method provided by the above-mentioned various method embodiments.

[0121] Figure 7 7 is a block diagram of a structure of an electronic device 700 provided according to an embodiment of the present application. In some embodiments, the electronic device 700 is a smart phone, a tablet computer, a computer with wireless communication function, or a wearable device. The electronic device 700 in the present application includes at least one or more of the following components: a processor 710, a memory 720, and at least two wireless links 730.

[0122] In some embodiments, the processor 710 includes one or more processing cores. The processor 710 uses various interfaces and lines to connect various parts of the entire electronic device 700, and executes various functions and processes data of the electronic device 700 by running or executing program codes stored in the memory 720, and calling data stored in the memory 720. In some embodiments, the processor 710 is implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 710 can integrate one or more combinations of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content that needs to be displayed on the display screen; the NPU is used to implement artificial intelligence (AI) functions; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 710, but may be implemented by a separate chip.

[0123] In some embodiments, the processor 710 is used to control the working conditions of at least two wireless links 730. Accordingly, the processor 710 is a processor integrated with a wireless fidelity (Wireless Fidelity, Wi-Fi) chip. The Wi-Fi chip is a chip with dual Wi-Fi processing capabilities. For example, the Wi-Fi chip is a dual-band dual concurrent (Dual Band Dual Concurrent, DBDC) chip, or a dual-band synchronous (Dual Band Simultaneous, DBS) chip, etc.

[0124] In some embodiments, the memory 720 includes a random access memory (RAM), and in some embodiments, the memory 720 includes a read-only memory (ROM). In some embodiments, the memory 720 includes a non-transitory computer-readable storage medium. The memory 720 can be used to store program codes. The memory 720 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.; the data storage area may store data (such as audio data, a phone book) created according to the use of the electronic device 700, etc.

[0125] In some embodiments, the memory 720 stores reception schemes for receiving beacon frames of different wireless links 730, as well as identifiers of access nodes connected to different wireless links 730, identifiers of wireless links 730, and the like.

[0126] The at least two wireless links 730 are used to connect different access points (APs) to receive downlink data sent by the APs, wherein the different access points are access points in the same router or access points in different routers.

[0127] In some embodiments, the electronic device 700 also includes a display screen. The display screen is a display component that displays a user interface. In some embodiments, the display screen is a display screen with a touch function, through which the user can use any suitable object such as a finger or a stylus to perform touch operations on the display screen. In some embodiments, the display screen is generally arranged on the front panel of the electronic device 700. In some embodiments, the display screen is designed to be a full screen, a curved screen, a special-shaped screen, a double-sided screen, or a folding screen. In some embodiments, the display screen is also designed to be a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, etc., which is not limited in this embodiment.

[0128] In addition, those skilled in the art will appreciate that the structure of the electronic device 700 shown in the above figures does not limit the electronic device 700, and the electronic device 700 includes more or fewer components than shown, or combines certain components, or arranges components differently. For example, the electronic device 700 also includes components such as a microphone, a speaker, an input unit, a sensor, an audio circuit, a module, a power supply, and a Bluetooth module, which will not be described in detail here.

[0129] The present application also provides a computer-readable storage medium, which stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the process control method shown in the above embodiments.

[0130] The present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal, it is used to implement the process control method shown in the above embodiments.

[0131] The present application also provides a computer program product, which stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method shown in the above embodiments.

[0132] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0133] Those skilled in the art can understand that all or part of the steps in the process control method of the above embodiment can be completed by hardware, or by a program to instruct the relevant hardware to complete the process control method. The program can be stored in a computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a disk or an optical disk, etc. The above is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A process control method, characterized in that: The method comprises: In response to a selection operation of at least one customized mode in the terminal, switching the current preset mode of the terminal to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode; Based on the mode identifier of the at least one customized mode, in the case where the mandatory access control rule corresponding to the preset mode has been enabled, enabling the mandatory access control rule corresponding to the at least one customized mode; For any process in the terminal, in response to a process access request of the process, mandatory access control is performed on the process through mandatory access control rules corresponding to the at least one customized mode and mandatory access control rules corresponding to the preset mode, and the process access request is used to request access to resources in the terminal.

2. The method according to claim 1, characterized in that: The at least one customized mode is a plurality of customized modes; The mode identification based on the at least one customized mode, in the case where the mandatory access control rule corresponding to the preset mode is enabled, enabling the mandatory access control rule corresponding to the at least one customized mode, comprises: For any customized mode among the multiple customized modes, based on the mode identifier of the customized mode, if the mandatory access control rule corresponding to the preset mode has been enabled, determining whether the mandatory access control rule corresponding to the customized mode can be enabled at the same time as the mandatory access control rule corresponding to the preset mode; In the case where the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode can be enabled at the same time, enabling the mandatory access control rule corresponding to the customized mode; In a case where the mandatory access control rule corresponding to the customized mode and the mandatory access control rule corresponding to the preset mode cannot be enabled at the same time, the mandatory access control rule corresponding to the customized mode is disabled.

3. The method according to claim 1, characterized in that The at least one customized mode is a plurality of customized modes; The mode identification based on the at least one customized mode, in the case where the mandatory access control rule corresponding to the preset mode is enabled, enabling the mandatory access control rule corresponding to the at least one customized mode, comprises: Based on the mode identifiers of the multiple customized modes, when the mandatory access control rule corresponding to the preset mode has been enabled, obtaining the enabling priorities of the multiple customized modes; Based on the activation priorities of the multiple customized modes, the mandatory access rule corresponding to the first customized mode is activated, and the first customized mode is the customized mode with the highest activation priority among the multiple customized modes.

4. The method according to claim 1, characterized in that: The at least one customized mode is a plurality of customized modes; The step of performing mandatory access control on any process in the terminal in response to a process access request of the process by using the mandatory access control rule corresponding to the at least one customized mode and the mandatory access control rule corresponding to the preset mode includes: For any process in the terminal, in response to a process access request of the process, obtaining security levels of the plurality of customized modes; Determining a second customized mode based on the security levels of the multiple customized modes, where the second customized mode is a customized mode with the highest security level among the multiple customized modes; Mandatory access control is performed on the process through the mandatory access control rule corresponding to the second customized mode and the mandatory access control rule corresponding to the preset mode.

5. The method according to claim 1, characterized in that The step of performing mandatory access control on any process in the terminal in response to a process access request of the process by using the mandatory access control rule corresponding to the at least one customized mode and the mandatory access control rule corresponding to the preset mode includes: For any process in the terminal, in response to a process access request of the process, determining whether the process access request complies with the mandatory access control rule corresponding to the preset mode and the mandatory access control rule corresponding to the at least one customized mode based on the process identifier of the process and the resource identifier of the target resource that the process requests to access; In a case where the process access request complies with the mandatory access control rule corresponding to the preset mode and the mandatory access control rule corresponding to the at least one customized mode, the process is allowed to access the target resource.

6. The method according to claim 5, characterized in that The method further comprises: When the process access request does not comply with the mandatory access control rule corresponding to the preset mode and the mandatory access control rule corresponding to the at least one customized mode, obtaining the working mode of the security-enhanced Linux in the terminal; When the working mode is the mandatory mode, denying the process access to the target resource; In the case where the working mode is the permissive mode, the process is allowed to access the target resource and a warning message is displayed, wherein the warning message is used to prompt a suggestion to deny the process from accessing the target resource.

7. The method according to claim 6, characterized in that The method further comprises: When the working mode is the mandatory mode and the number of illegal accesses of the process is less than a first quantity threshold, displaying first prompt information, wherein the first prompt information is used to prompt the working mode to be switched to the permissive mode; When the working mode is the permissive mode and the number of illegal accesses of the process is greater than a second quantity threshold, a second prompt message is displayed, where the second prompt message is used to prompt the working mode to be switched to the mandatory mode.

8. The method according to claim 1, characterized in that The method further comprises: In response to a selection operation of the preset mode, switching at least one customized mode currently in which the terminal is located to the preset mode; Based on the mode identifier of the preset mode, disabling the mandatory access control rule corresponding to the at least one customized mode, and enabling the mandatory access control rule corresponding to the preset mode; For any process in the terminal, in response to a process access request of the process, mandatory access control is performed on the process through the mandatory access control rule corresponding to the preset mode.

9. A process control device, characterized in that: The device comprises: a mode switching module, configured to, in response to a selection operation of at least one customized mode in the terminal, switch the preset mode currently in which the terminal is located to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode; A rule enabling module, configured to enable the mandatory access control rule corresponding to the at least one customized mode based on the mode identifier of the at least one customized mode, if the mandatory access control rule corresponding to the preset mode has been enabled; A process control module is used to perform mandatory access control on any process in the terminal in response to a process access request of the process, through mandatory access control rules corresponding to at least one customized mode and mandatory access control rules corresponding to the preset mode, wherein the process access request is used to request access to resources in the terminal.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the process control method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method according to any one of claims 1 to 8.

12. A chip, characterized in that: The chip includes a programmable logic circuit and / or program instructions, and when the chip runs on the terminal, it is used to implement the process control method as described in any one of claims 1 to 8.

13. A computer program product, comprising a computer program, characterized in that The computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method according to any one of claims 1 to 8.

Images