A desktop system file manager remote operation behavior control method and system
By analyzing the interaction process between the file manager and open source components and using key functions and bus monitors to monitor file descriptors, the problem of being unable to control remote file operations in existing technologies is solved, and accurate identification and blocking of remote file operations are achieved, thereby improving the security and controllability of the file manager.
Patent Information
- Application Number
- CN202111161962.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-09-30
- Publication Date
- 2025-09-16
- Estimated Expiration
- 2041-09-30
Smart Images
Figure CN114020684B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of remote file management, and in particular relates to a method and system for controlling remote operation behavior of a desktop system file manager. Background Art
[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.
[0003] In addition to managing local disk files, many systems' desktop file managers (such as the Linux desktop file manager Nautilus of Red Hat system, Caja of domestic Kylin system, and DDE-File-Manager of domestic UOS system) can also manage remote service files in the interface by entering the address of the remote service in the menu or address bar and passing the authentication, just like operating local files.
[0004] Traditional file control technologies mainly use kernel-layer hooks (such as system call hooks, inline hooks, etc.) or application-layer hooks (such as LD_PRELOAD technology) to hook key system functions to control file operations. At the same time, file managers operate remote files by utilizing open source components. The file manager interacts with the corresponding service programs of the open source components through protocols to complete the operation of remote files.
[0005] Existing control methods analyze file operations based on processes and can only identify file manager operations on local files. They cannot handle the complex interactions between file managers and open source components, and cannot control remote file operations. Summary of the Invention
[0006] In order to solve the above problems, the present invention proposes a method and system for controlling the remote operation behavior of a desktop system file manager. The present invention analyzes the detailed interaction process between the file manager and the services related to open source components, and controls the key nodes in the interaction process, so as to accurately distinguish between local operations and remote operations of files and complete the function of controlling the operations of remote files.
[0007] According to some embodiments, the present invention adopts the following technical solutions:
[0008] A method for controlling remote operation behavior of a desktop system file manager comprises the following steps:
[0009] Call related key functions;
[0010] Utilize the open and read key functions to obtain the corresponding actions in the file manager process, obtain the file information of the operation, and put it into the processing queue for processing;
[0011] Use bus monitor to monitor the file manager and the corresponding interface of open source components to create private connections;
[0012] Parse the output of the bus monitor to obtain the return value of the private connection;
[0013] Monitor the bus interactions of new private connections, obtain the open write interactions of the corresponding interfaces of the file manager and open source components, and obtain new file descriptors:
[0014] Enable the called write key function, monitor the file manager's write operation on the new file descriptor, compare the data packet transmitted by the write key function with the hash value of the data information obtained by the read key function, and when the hash values match, pass the data information obtained by the read key function for business processing;
[0015] The close key function is called to recycle the data packet and the data information.
[0016] As an optional implementation, the relevant key functions include at least open, read, write and close key functions.
[0017] As an optional implementation, the file information of the operation includes a file path, and the information is hashed.
[0018] As an optional implementation, the specific process of obtaining a new file descriptor includes: returning an ID value based on the output result of the open write interaction between the file manager and the corresponding interface of the open source component, where this value is the new file descriptor obtained by the file manager through inter-process file descriptor transfer for communicating with the open source component.
[0019] As an optional implementation method, the specific process of transmitting the data information obtained by the read key function for business processing includes sending the data information obtained by the read key function to the upper-level business logic module to perform business processing including file permission judgment and sensitive information inspection.
[0020] As an optional implementation, if the hash values match, it proves that the file manager is performing a file data transmission operation with the open source component process; if the hash values do not match, it proves that the file manager is performing a local file operation.
[0021] As a further limited implementation method, according to the return result of the upper-level business logic module, the return value of the write-key function is modified to perform blocking processing.
[0022] A desktop system file manager remote operation behavior control system, comprising:
[0023] The calling module is configured to call relevant key functions, use the open and read key functions therein to obtain the corresponding actions in the file manager process, obtain the file information of the operation, and put it into the processing queue for processing;
[0024] The monitoring module uses the bus monitor to monitor the file manager and the corresponding interface of the open source component to create a private connection; monitor the bus interaction of the new private connection, obtain the open write interaction of the corresponding interface of the file manager and the open source component, and obtain the new file descriptor:
[0025] a matching module configured to enable the called write key function, monitor the write operation of the file manager for the new file descriptor, compare the data packet transmitted by the write key function with the hash value of the data information obtained by the read key function, and when the hash values match, pass the data information obtained by the read key function for business processing;
[0026] The recycling module is configured to call the closing key function to recycle the data packet and the data information.
[0027] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor of a terminal device and executing the steps of the above method.
[0028] A terminal device includes a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the steps of the above method.
[0029] Compared with the prior art, the present invention has the following beneficial effects:
[0030] The present invention can accurately judge the processing process of the file manager for remote service (ftp, smb, ssh) files, can realize the audit and blocking functions of remote file operations, and accurately identify and distinguish local file operations and remote file operation behaviors.
[0031] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.
[0033] Figure 1 This is a flow chart of the present embodiment taking the FTP service as an example;
[0034] Figure 2 This is a schematic diagram of the org.gtk.vfs.Daemon interface definition in this embodiment;
[0035] Figure 3 This is a schematic diagram of the definition of "OpenForWrite" of the org.gtk.vfs.Mount interface in this embodiment. DETAILED DESCRIPTION
[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0037] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.
[0038] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.
[0039] This embodiment is described by taking Linux desktop system file management as an example, but it does not mean that the present invention can only be used in this system.
[0040] The process analysis of the file manager connecting to the remote service and copying local files to the remote service in this embodiment is explained using the FTP service as an example. However, for other services such as SMB and SSH connections, the same solution as FTP can be used to implement management and control:
[0041] like Figure 1 As shown, the following steps are included:
[0042] Step (1) Use kernel layer hooks to hook system calls such as open, read, write, and close.
[0043] Step (2) uses the open and read functions of the hook to obtain the open and read actions of the file manager process (such as caja), obtains the file information of the operation (file path, read data information for hash processing) and puts it into the processing queue for processing.
[0044] Step (3) Use the system tool command dbus-monitor to monitor the file management and the interaction with the "GetConnection" method of the "org.gtk.vfs.Daemon" interface of gvfsd-ftp, that is, the process of creating a private connection, and obtain the new dbus address generated by gvfsd-ftp.
[0045] The "org.gtk.vfs.Daemon" interface is defined as follows Figure 2 shown.
[0046] Step (4) parses the output of dbus-monitor and obtains the return value of the "GetConnect" method, address1.
[0047] Step (5) monitors the dbus interaction of the new private connection and obtains the interaction between the file manager and the "OpenForWrite" method of the "org.gtk.vfs.Mount" interface of gvfsd-ftp.
[0048] The "OpenForWrite" definition of the "org.gtk.vfs.Mount" interface is as follows Figure 3 Get the "fd_id" return value of the output result. This value is the new file descriptor fd of the socketpair "pipe" used to communicate with gvfsd-ftp obtained by the file manager through inter-process file descriptor transfer.
[0049] After obtaining the fd in step (6), the write function of the hook is enabled to monitor the write operation of the file manager process for the fd, and the data packet transmitted by the write function is compared with the data information hash obtained by the read in step (2). If the values match, it proves that the file manager is performing a file data transmission operation with the gvfs-ftp process. At this time, the file related information obtained in step (2) can be sent to the upper-level business logic module for business processing, such as file permission judgment, sensitive information check, etc. According to the return result of the upper-level business logic, the return value of the hook write function can be modified to perform blocking processing.
[0050] Step (7) uses the close function of the hook to recycle the data information generated in steps (2) and (6), which can handle normal local file access and prevent the leakage of resources such as memory.
[0051] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0052] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0053] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0054] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0055] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.
Claims
1. A method for controlling remote operation behavior of a desktop system file manager, characterized by: The following steps are involved: Call related key functions; Utilize the open and read key functions to obtain the corresponding actions in the file manager process, obtain the file information of the operation, and put it into the processing queue for processing; Use bus monitor to monitor the file manager and the corresponding interface of open source components to create private connections; Parse the output of the bus monitor to obtain the return value of the private connection; Monitor the bus interactions of new private connections, obtain the open write interactions of the corresponding interfaces of the file manager and open source components, and obtain new file descriptors: The specific process of obtaining a new file descriptor includes: according to the ID return value of the output result of the open write interaction between the file manager and the corresponding interface of the open source component, this value is the new file descriptor obtained by the file manager through inter-process file descriptor transmission for communication with the open source component; Enable the called write key function, monitor the file manager's write operation on the new file descriptor, compare the data packet transmitted by the write key function with the hash value of the data information obtained by the read key function, and when the hash values match, pass the data information obtained by the read key function for business processing; If the hash values match, it proves that the file manager is performing file data transmission operations with the open source component process. If the hash values do not match, it proves that the file manager is performing local file operations. According to the return result of the upper-level business logic module, modify the return value of the key function to perform blocking processing; The close key function is called to recycle the data packet and the data information.
2. A desktop system file manager remote operation behavior control method according to claim 1, characterized in that: The relevant key functions include at least open, read, write and close key functions.
3. The method for controlling remote operation behavior of a desktop system file manager according to claim 1, wherein: The file information of the operation includes a file path, and the information is hashed.
4. The method for controlling remote operation behavior of a desktop system file manager according to claim 1, wherein: The specific process of transmitting the data information obtained by the read key function for business processing includes sending the data information obtained by the read key function to the upper-level business logic module to perform business processing including file permission judgment and sensitive information inspection.
5. A desktop system file manager remote operation behavior control system using the method of claim 1, characterized in that: include: The calling module is configured to call relevant key functions, use the open and read key functions therein to obtain the corresponding actions in the file manager process, obtain the file information of the operation, and put it into the processing queue for processing; The monitoring module uses the bus monitor to monitor the file manager and the corresponding interface of the open source component to create a private connection; monitor the bus interaction of the new private connection, obtain the open write interaction of the corresponding interface of the file manager and the open source component, and obtain the new file descriptor: a matching module configured to enable the called write key function, monitor the write operation of the file manager for the new file descriptor, compare the data packet transmitted by the write key function with the hash value of the data information obtained by the read key function, and when the hash values match, pass the data information obtained by the read key function for business processing; The recycling module is configured to call the closing key function to recycle the data packet and the data information.
6. A computer-readable storage medium, characterized in that: There are a plurality of instructions, which are suitable for being loaded by a processor of a terminal device and executing the steps of the method according to any one of claims 1 to 4.
7. A terminal device, characterized in that: The method comprises a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; and the computer-readable storage medium is used to store a plurality of instructions, wherein the instructions are suitable for being loaded by the processor and executing the steps of the method according to any one of claims 1 to 4.