Program access permission control method and device, computing device, and storage medium

Abstract

The application discloses a program access permission control method and device, a computing device and a storage medium. The program access permission control method is executed in the computing device, and the method comprises the following steps: receiving a first access request sent by a program, wherein the first access request at least comprises an identification parameter of the program; forwarding the first access request from a first file system to a second module by a first module; sending the first access request to a permission control module residing in a user space by the second module; generating a result indicating an access permission of the program according to the identification parameter by the permission control module, and forwarding the result to the first file system through the first module by the second module; and forwarding the result to the program by the first file system, so that the program executes corresponding processes based on the result.

Description

[0001] The present application is a divisional application of the invention patent application filed on July 13, 2021, the original application number: 2021107873969, the invention name: program access permission control method and device, computing equipment and storage medium. TECHNICAL FIELD

[0002] The present application relates to the field of Internet, in particular to a program access permission control method and device, computing equipment and storage medium. BACKGROUND

[0003] For permission isolation and security management requirements, usually programs access system files are isolated for operation, that is, only authorized target files can be accessed, for example, Windows UWP, Android data-strongeapi, iOS application isolation and Linux system permission and access control list-based access control.

[0004] Linux system provides permission and access control list-based access control, which can only prevent programs from illegally accessing data, but cannot strictly prevent programs from collecting relevant information. In particular, the user's home directory basically has no restrictions on the user's process, and any program can access and obtain the content of the user directory. In order to realize this access control function, development needs to be carried out in the kernel space of the Linux system. The biggest problem of kernel development is that it involves a lot of content, and debugging is not very convenient. Therefore, many functional applications are not willing to involve kernel space development. SUMMARY

[0005] In view of the above problems, the present application is proposed in order to provide a program access permission control method, device, computing equipment and storage medium which can overcome the above problems or at least partially solve the above problems.

[0006] According to an aspect of the present application, a program access permission control method is provided, which is executed in a computing device including a first file system and a second file system, the second file system including at least a first module and a second module, and the first file system residing in a kernel space of an operating system, the first module residing in the kernel space of the operating system and the second module residing in a user space of the first operating system, the method including: receiving a first access request sent by a program, the first access request including at least an identification parameter of the program; forwarding, by the first module, the first access request from the first file system to the second module; sending, by the second module, the first access request to a permission control module residing in the user space; generating, by the permission control module, a result indicating an access permission of the program according to the identification parameter and forwarding, by the second module, the result to the first file system through the first module; and forwarding, by the first file system, the result to the program, so that the program executes a corresponding process based on the result.

[0007] Optionally, in the program access permission control method according to the present application, the step of forwarding, by the first module, the first access request from the first file system to the second module includes: connecting a calling interface of the first file system with the first module; and connecting the first module with a calling interface of the second module.

[0008] Optionally, in the program access permission control method according to the present application, the step of generating, by the permission control module, a result indicating an access permission of the program according to the identification parameter and forwarding, by the second module, the result to the first file system through the first module includes: judging whether the program corresponding to the identification parameter has a permission to access a target file; if yes, generating a first result; and if no, generating a second result.

[0009] Optionally, in the program access permission control method according to the present application, after the step of generating a second result if the program does not have the permission, the method further includes a step of prompting a user whether to authorize the program.

[0010] Optionally, in the program access permission control method according to the present application, before the step of receiving, by the first file system, a first access request sent by a program, the first access request including at least an identification parameter of the program, the method further includes a step of dynamically generating the permission control module based on the second file system.

[0011] Optionally, in the program access permission control method according to the present application, the step of dynamically generating the permission control module based on the second file system includes: encapsulating a function function residing in the second module; re-writing a function function of the second module based on the encapsulated function function; and generating the permission control module according to the re-written function function and a preset function requirement.

[0012] Optionally, in the program access permission control method according to the present application, the first file system is VFS, the second file system is FUSE, the first module is a FUSE kernel module, and the second module is libFUSE.

[0013] According to another aspect of the present application, a program access permission control apparatus is provided, comprising: a first file system adapted to receive a first access request sent by a program and forward a result of access permission to the program, the first access request comprising at least an identification parameter of the program; a second file system comprising a first module and a second module, the first module adapted to forward the first access request from the first file system to the second module and forward the result of access permission to the first file system, and the second module adapted to send the first access request to a permission control module residing in a user space and forward the result of access permission to the first module; and the permission control module adapted to generate the result of access permission indicating the program according to the identification parameter; wherein the first file system and the first module are arranged in a kernel space of an operating system, and the second module and the permission control module are arranged in a user space of the operating system.

[0014] According to another aspect of the present application, a computing device is provided, comprising: at least one processor; and a memory storing program instructions configured to be executed by the at least one processor, the program instructions comprising instructions for performing the above method.

[0015] According to another aspect of the present application, a readable storage medium storing program instructions is provided, which, when read and executed by a computing device, causes the computing device to perform the above method.

[0016] According to the present application, by means of the second file system residing in the user space, the problem that the file system must be arranged in the kernel space is solved, and the implementation of the file system is moved from the kernel mode to the user mode, so that all accesses in the kernel space are forwarded to the user space, and the problem that the permission control module must be developed in the kernel space is solved.

[0017] According to the present application, the program development is completed in the user space, and the user space is more convenient than the kernel space for program development, and the modular or plug-in development mode can be conveniently used. By providing the function of loading plug-ins, the plug-ins are called in the form of middleware, so that different functions can be conveniently extended by means of the plug-ins.

[0018] The above description is only a summary of the technical solutions of the present application, in order to more clearly understand the technical means of the present application, the specific embodiments of the present application can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0019] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments with reference to the drawings. The drawings are for purposes of illustration only and are not intended to limit the present application thereto. Like reference numerals are used to refer to like elements throughout. In the drawings:

[0020] Figure 1 A schematic diagram of a computing device 100 according to one embodiment of the present application is shown;

[0021] Figure 2 A flowchart of a program access permission control method 200 according to one embodiment of the present application is shown;

[0022] Figure 3 A block diagram of a program access permission control apparatus 300 according to one embodiment of the present application is shown. DETAILED DESCRIPTION

[0023] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is to be understood that the present disclosure can be embodied in various forms without being limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0024] Currently, in the face of the vigorous demonstration and promotion of autonomous controllable applications, the security of file applications based on Linux operating system environment is increasingly valued and widely concerned, and its security, availability and ease of use are particularly important.

[0025] Under the Linux operating system environment, the security application management of files includes encryption protection and identification of file security levels. The common method in the market is to configure access control based on permissions and access control lists in the Linux system, but this operation can only prevent programs from illegally accessing data and cannot strictly prevent programs from collecting relevant information. In particular, the user's home directory basically has no restrictions on the user's processes, and any program can access and obtain the contents of the user's directory.

[0026] However, the Linux file system (virtual File System VFS) is developed in the kernel space, and the biggest problem of kernel space development is that it involves a lot of content and is not very convenient to debug. Therefore, many application functions are not willing to involve the development of kernel space, so that there is no better program access permission control method.

[0027] In essence, the role of VFS is to provide a unified operating interface and application programming interface for various file systems by using standard Unix system calls to read and write different file systems located on different physical media. VFS acts as a glue layer that allows system calls such as open(), read(), and write() to work without needing to know the underlying storage media and file system type.

[0028] To address the problems existing in the prior art, the present invention provides a solution. One embodiment of the present invention provides a program access permission control method, which can be executed in a computing device. Figure 1 A structural diagram of a computing device 100 according to an embodiment of the present invention is shown. Figure 1 As shown, in the basic configuration 102, the computing device 100 typically includes system memory 106 and one or more processors 104. Memory bus 108 can be used for communication between processor 104 and system memory 106.

[0029] Depending on the desired configuration, processor 104 can be any type of processor, including but not limited to: microprocessor (μP), microcontroller (μC), digital information processor (DSP), or any combination thereof. Processor 104 may include one or more levels of cache such as L1 cache 110 and L2 cache 112, processor core 114, and registers 116. Example processor core 114 may include an arithmetic logic unit (ALU), floating-point unit (FPU), digital signal processing core (DSP core), or any combination thereof. Example memory controller 118 may be used with processor 104, or in some implementations, memory controller 118 may be an internal part of processor 104.

[0030] Depending on the desired configuration, the system memory 106 can be of any type including but not limited to volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.) or any combination thereof. Physical memory in a computing device typically refers to volatile memory, such as RAM, and data in the physical memory needs to be loaded into physical memory before it can be accessed by the processor 104. The system memory 106 can include an operating system 120, one or more applications 122, and program data 124. Applications 122 are essentially programs that, when executed by the processor 104, provide the functionality described herein. In some embodiments, the applications 122 can be arranged to execute instructions in the program data 124 using the operating system 120 on the one or more processors 104. The operating system 120, for example, can be a version of Linux, Windows, iOS, Android, etc., that includes procedures for handling various basic system services and for performing hardware dependent tasks. The applications 122 can include a browser, an instant messaging program, a software development tool (e.g., an integrated development environment (IDE), a compiler, etc.), etc., but are not limited to such. A driver module can be added to the operating system 120 when the application 122 is installed into the computing device 100.

[0031] When the computing device 100 is in operation, the processor 104 is configured to read instructions from the memory 106 and execute these instructions to perform the operations for which the computing device 100 was designed. The applications 122 are executed by the processor 104 by way of readings the instructions from the memory 106 using the operating system 120, and interfaces provided by the underlying hardware. When the user invokes an application 122, the application 122 is loaded into the memory 106 and the processor 104 reads and executes the instructions from the memory 106.

[0032] The computing device 100 also includes a storage device 132 that can include one or more removable storage devices 136 and one or more non-removable storage devices 138, which are connected through a storage interface bus 134.

[0033] The computing device 100 also includes an interface bus 140 for facilitating communication from various interface devices (e.g., output devices 142, peripheral interfaces 144, and communication devices 146) to the basic configuration 102 via the bus / interface controller 130. Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150, which can be configured to facilitate communication to various external devices such as a display or speakers via one or more A / V ports 152. Example peripheral interfaces 144 include a serial interface controller 154 or a parallel interface controller 156, which can be configured to facilitate communication to various external devices such as input devices (e.g., keyboard, mouse, pen, voice input device, touch input device) or other peripheral devices (e.g., printer, scanner, etc.) via one or more I / O ports 158. An example

[0034] Network communication links can be one example of a communication media. Communication media can typically be embodied by computer readable instructions, data structures, program modules, etc., in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. A "modulated data signal" can be a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media can include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), microwave, infrared (IR) and other wireless media. The term computer readable media as used herein can include both storage media and communication media.

[0035] The computing device 100 also includes a storage interface bus 134 that connects the bus / interface controller 130 to storage devices 132. The storage devices 132 are adapted to store data used in accordance with this disclosure. Example storage devices 132 can include a removable storage 136 (e.g., floppy disks, CD-ROMs, DVDs, tape, etc.) and a non-removable storage 138 (e.g., a hard disk drive, etc.).

[0036] In the computing device 100 according to the present disclosure, the application 122 includes a plurality of program instructions that execute the method 200.

[0037] Figure 2 A flowchart of a program access right control method 200 according to an embodiment of the present disclosure is shown. The method 200 is adapted to be executed in a computing device (e.g., the aforementioned computing device 100).

[0038] AsFigure 2 As shown, the method 200 aims to realize a program access permission control method, which starts from step S202, in which a first access request sent by a program is received, and the first access request at least includes an identification parameter of the program.

[0039] It should be noted that in the computing device in which the program access permission control method of the embodiment can be implemented, a first operating system is configured, the first operating system includes a first file system and a second file system, the second file system at least includes a first module and a second module, and the first file system resides in a kernel space of the operating system, the first module resides in the kernel space of the operating system, and the second module resides in a user space of the first operating system. The first operating system is a Linux operating system, the first file system is a VFS, and the second file system is a FUSE. The FUSE (filesystem in userspace) is a user space file system. The FUSE is composed of a FUSE kernel module (fuse.ko) and a user space dynamic link library libfuse (libfuse.*), and through the support of the FUSE kernel module, a developer only needs to implement specific file operations according to the interface provided by the FUSE to implement a file system. Since the main implementation code is located in the user space and does not need to be recompiled into the kernel, this brings a lot of convenience to the developer.

[0040] In step S204, the first access request is forwarded from the first file system to the second module by the first module. The FUSE kernel module can forward the calling interface of the VFS to the calling interface of the libfuse, so as to realize the forwarding of the first access request from the first file system to the second file system. The libFUSE provides a large number of interfaces, and can transfer the access in the kernel space to the user space for control. Although the switching between the kernel space and the user space will bring certain performance consumption, the convenience brought by this is incomparable to kernel programming.

[0041] Specifically, the calling interface of the first file system is connected with the first module, and the calling interface of the first module is connected with the second module. The FUSE kernel module is arranged in the kernel space of the computing device, and in addition to the interface forwarding function, the FUSE kernel module can also provide functions such as directory and file interception for the user space.

[0042] It should be noted that since the FUSE kernel module cannot directly forward the calling interface of the VFS located in the kernel space to the calling interface of the FUSE located in the user space, a space interface conversion module residing in the FUSE is needed to realize the conversion of the interface from the user space to the kernel space or from the kernel space to the user space.

[0043] In step S206, the first access request is sent by the second module to a permission control module residing in the user space. The permission control module is actually a plug-in with a permission control function, which is dynamically generated based on the second file system. That is, the permission control module is a user state plug-in (also referred to as a program) developed using FUSE.

[0044] Since libFUSE is a C interface, it is not particularly convenient to develop on the C++ language, so a series of processing is needed for the functions of libFUSE.

[0045] Specifically, first, the function functions residing in the second module are encapsulated.

[0046] In one specific example, a template class is provided as follows to encapsulate libFUSE:

[0047] template<class T>

[0048] FUSE::t_getattr FUSE::Fuse <t>::proxy_getattr = nullptr;

[0049] template <class T> struct is_pointer { enum { value = 0};

[0050] FUSE::t_readlink FUSE::Fuse <t>::proxy_readlink = nullptr;

[0051] template <class T> struct is_pointer { enum { value = 0};

[0052] FUSE::t_mknod FUSE::Fuse <t>::proxy_mknod = nullptr;

[0053] template <class T> struct is_pointer { static const bool value = false;};

[0054] FUSE::t_mkdir FUSE::Fuse <t>::proxy_mkdir = nullptr;

[0055] template <class T> void

[0056] FUSE::t_unlink FUSE::Fuse <t>::proxy_unlink = nullptr;

[0057] template <class T> struct is_pointer { static const bool value = false;};

[0058] FUSE::t_rmdir FUSE::Fuse <t>::proxy_rmdir = nullptr;

[0059] template <class T> struct is_pointer { static const bool value = false;};

[0060] FUSE::t_symlink FUSE::Fuse <t>::proxy_symlink = nullptr;

[0061] template <class T>

[0062] FUSE::t_rename FUSE::Fuse <t>::proxy_rename = nullptr.

[0063] After that, the function functions of the second module are reprogrammed based on the encapsulated function functions. After the basic encapsulation of the libFUSE functions is completed, the C++ inheritance can be used to complete the rewriting of the libFUSE functions.

[0064] Continuing the foregoing embodiment, the rewriting of the libFUSE functions can be implemented by the following functions:

[0065]

[0066]

[0067] It should be noted that each function in FUSE has a different role, and some functions need to be combined with multiple functions to complete the final work. For example, to open a file, the getattr function needs to be called first to obtain the permission, and then the open function needs to be called to open the file.

[0068] In order to provide security for local storage, we need to put a dot on several key functions, such as the open function, the readdir function, etc. When the program accesses the storage, the fuse kernel module will forward the call of the related function to the user process, and finally call the related function of the program for processing. If the program refuses the open function, the file cannot be opened, and if the program prohibits the read function, even if the file is opened (the open function is released), the content cannot be obtained.

[0069] In this embodiment, by providing FUSE, the development of plug-ins can be easily realized by using modular or plug-in development methods. By providing the function of loading plug-ins, the call in the form of middleware is realized, which can easily extend different functions through plug-ins, such as providing permission control plug-ins and black and white list plug-ins. As long as one plug-in does not allow access, the final result is that access is not allowed.

[0070] In addition, in some embodiments, the permission control module actively registers the target function residing in the second module based on the communication interface with the second module, that is, by defining the communication interface of libFUSE, the permission control module actively registers its own processing function.

[0071] In a specific example, the permission control module actively registers the target function residing in the second module can be implemented by the following interface definition:

[0072]

[0073] By defining the communication interface of libFUSE, the plug-in can actively register its processing function, for example, the permission control plug-in, which can perform permission control and permission registration on the open / read function.

[0074] In step S208, the permission control module generates a result indicating the access permission of the program according to the identification parameter, and the second module forwards the result to the first file system through the first module.

[0075] Based on the permission control module developed in step S206, the program corresponding to the identification parameter can be judged whether it has the permission to access the target file, if yes, the first result is generated; if not, the second result is generated.

[0076] Specifically, the judgment can be performed by querying the historical access record, for example, before receiving the access request, the program has been granted by the user to access the target file, then the result of allowing access (the first result) is generated, otherwise, the result of not allowing access (the second result) is generated.

[0077] It should be noted that the historical record can be stored in the permission control module, or in the libFUSE library, and the permission control module obtains the historical record through interface calling. This embodiment is not limited.

[0078] Preferably, after the second result is generated, the user can be prompted whether to authorize the program. If the user authorizes it, the second result is modified to the first result, otherwise, the second result is kept.

[0079] For the forwarding process of the result, first, the second module in the second file system receives the result, and then forwards the result to the first file system through the first module, and the forwarding principle is the same as the forwarding principle of the first access request, which will not be repeated here.

[0080] In step S210, the first file system forwards the result to the program, so that the program executes the corresponding process based on the result.

[0081] Figure 3 The structure diagram of the program access permission control device 300 according to an embodiment of the present application is shown. As shown in the figure, Figure 3 As shown, the device 300 comprises a first file system 302 (VFS) and a second file system 304 (FUSE), the second file system 304 comprises at least a first module 324 (FUSE kernel module) and a second module 344 (libFUSE), the first file system 302 resides in the kernel space of an operating system, the first module 324 resides in the kernel space of the operating system and the second module 344 resides in the user space of the operating system, and further comprises a permission control module 306.

[0082] The first file system 302 is adapted to receive a first access request sent by a program and forward the result of access permission to the program, the first access request comprises at least an identification parameter of the program;

[0083] The first module 324 is adapted to forward the first access request from the first file system 302 to the second module 344 and forward the result of access permission to the first file system 302;

[0084] The second module 344 is adapted to send the first access request to the permission control module 306 residing in the user space and forward the result of access permission to the first module 324;

[0085] The permission control module 306 is adapted to generate the result of access permission of the program according to the identification parameter.

[0086] It should be noted that the principle and working process of the program access permission control device 300 provided in the embodiment are similar to those of the program access permission control method 200, and the related parts can be referred to the description of the program access permission control method 300.

[0087] The various techniques described herein can be implemented in connection with hardware or software or, where appropriate, with a combination of hardware / software. Thus, the methods and apparatus of the present application, or certain aspects or portions thereof, can take the form of program code (i.e., instructions) embodied in tangible media, such as removable hard disks, U disks, magnetic diskettes, CD-ROMs, or any other machine-readable storage medium wherein, when the program code is loaded into an internal memory of the machine such as a computer, the machine becomes an apparatus for practicing the present application.

[0088] Where the program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The storage medium is configured to store program code which implements the methods of the present application. The processor is configured to execute instructions contained in the program code as loaded into the memory to implement the methods of the present application.

[0089] By way of example, and not limitation, a readable medium includes a readable storage medium and a communication medium. A readable storage medium stores information such as computer readable instructions, data structures, program modules or other data. A communication medium conveys information such as computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. Combinations of the above are also included within the scope of readable media.

[0090] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order to not obscure the understanding of this description.

[0091] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been described in detail in order to not obscure the understanding of this description.

[0092] Similarly, it is to be understood that the above description is one example of inventive aspects of the application and that many modifications, changes, and substitutions can be made by one skilled in the art without departing from the inventive spirit. It is intended that all such modifications, changes, and substitutions be included within the scope of the following claims, to the extent that such modifications, changes, and substitutions are within the intent of the present application.

[0093] Those skilled in the art will understand that the modules, or units, or components of the devices in the examples disclosed herein can be arranged in a device as described in the examples, or alternatively can be located in one or more devices different from the devices in the examples. The modules in the foregoing examples can be combined into one module or further divided into multiple sub-modules.

[0094] Those skilled in the art will appreciate that the modules in the apparatuses in the embodiments can be adapted and placed in one or more apparatuses other than the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and further can be split into multiple sub-modules or sub-units or sub-components. Any combination of all the features disclosed in the specification (including the accompanying claims, abstract and drawings), and any method or process or device of any combination of the features disclosed in the specification (including the accompanying claims, abstract and drawings) can be taken, except that at least some of such features and / or processes or units are mutually exclusive, unless specifically stated otherwise. Each feature disclosed in the specification (including the accompanying claims, abstract and drawings) can be replaced by alternative features serving the same, equivalent or similar purpose, unless specifically stated otherwise.

[0095] Furthermore, those skilled in the art will appreciate that the features of the various embodiments described herein are not mutually exclusive and can be combined in different embodiments. For example, in the following claims, any of the embodiments claimed can be used in any combination.

[0096] Furthermore, some of the embodiments described herein are described as a method or combination of elements of a method implementable by a processor of a computer system or by other means of carrying out the function. Accordingly, a processor with the necessary instructions for carrying out such a method or element of a method forms a means for carrying out the method or element of a method. Furthermore, an element of a method described herein that is implemented as a means for carrying out a particular function performs that function whether or not recited as a means for carrying out that function.

[0097] As used herein, unless otherwise indicated, the use of the ordinal adjectives "first", "second", "third", etc., merely to distinguish different instances of an object to a common object and are not intended to imply that a sequence or order to those instances necessarily exist. The use of the articles "a", "an", etc., as in "a wave" and / or "an element", is expressly understood as including the meaning "one" or "only one", even though the phrase "one" or the phrase "only one" can never be used in the specification.

[0098] While the application has been described in accordance with the various embodiments shown and described, it is to be understood that the application is not limited to those precise embodiments, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the present application. It is intended that the scope of the application should only be limited as recited in the appended claims.< / t> < / t> < / t> < / t> < / t> < / t> < / t> < / t>

Claims

1. A program access permission control method, executed in a computing device, the computing device comprising a first file system, a second file system and a permission control module, the second file system comprising at least a first module and a second module, and the first file system residing in a kernel space of an operating system, the first module residing in the kernel space of the operating system and the second module residing in a user space of the operating system, the permission control module residing in the user space of the operating system, the first file system being a VFS, the second file system being a FUSE, the first module being a FUSE kernel module, and the second module being a libFUSE, the method comprising: dynamically generating the permission control module based on the second file system, including encapsulating a function function residing in the second module, re-writing the function function of the second module based on the encapsulated function function, and generating the permission control module according to the re-written function function and a preset function requirement, wherein the permission control module is a plug-in with a permission control function, and the permission control module actively registers a target function residing in the second module based on a communication interface with the second module; the first file system receiving a first access request sent by a program, the first access request comprising at least an identification parameter of the program; the first module forwarding the first access request from the first file system to the second module; the second module sending the first access request to the permission control module; the permission control module generating a result indicating an access permission of the program according to the identification parameter, and the second module forwarding the result to the first file system through the first module; and the first file system forwarding the result to the program, so that the program executes a corresponding process based on the result. The step of forwarding the first access request from the first file system to the second module by the first module comprises: connecting a calling interface of the first file system with the first module; and connecting the first module with a calling interface of the second module. The step of generating a result indicating an access permission of the program according to the identification parameter by the permission control module, and forwarding the result to the first file system through the first module by the second module comprises: judging whether the program corresponding to the identification parameter has a permission to access a target file; if yes, generating a first result; and if no, generating a second result. After the step of generating a second result if the program does not have the permission, the method further comprises the step of: prompting a user whether to authorize the program. 5.A program access permission control device, comprising: ​ ​ 2. The method of claim 1, wherein, ​ ​ ​ 3. The method of claim 1, wherein, ​ ​ ​ ​ 4. The method of claim 3, wherein, ​ ​ ​ The first file system, the second file system and the permission control module, the second file system comprising at least a first module and a second module, and the first file system residing in a kernel space of an operating system, the first module residing in the kernel space of the operating system and the second module residing in a user space of the operating system, the permission control module residing in the user space of the operating system, the first file system being a VFS, the second file system being a FUSE, the first module being a FUSE kernel module, and the second module being a libFUSE; the first file system adapted to receive a first access request sent by a program, the first access request comprising at least an identification parameter of the program; the first module adapted to forward the first access request from the first file system to the second module; the second module adapted to send the first access request to the permission control module; the permission control module adapted to generate a result indicating an access permission of the program according to the identification parameter, wherein the permission control module is dynamically generated based on the second file system, including encapsulating a function function residing in the second module, re-writing a function function of the second module based on the encapsulated function function, and generating the permission control module according to the re-written function function and a preset function requirement, wherein the permission control module is a plug-in with a permission control function, and the permission control module actively registers a target function residing in the second module based on a communication interface with the second module; the second module further adapted to forward the result to the first file system through the first module; the first file system further adapted to forward the result to the program, so that the program executes a corresponding process based on the result.

6. A computing device comprising: at least one processor; and a memory having stored program instructions configured to be executed by the at least one processor, the program instructions comprising instructions for performing the method of any one of claims 1-4.

7. A readable storage medium having stored program instructions, which when read and executed by a computing device, cause the computing device to perform the method of any one of claims 1-4.

Images