Resource sharing method, terminal, and computer-readable medium

Abstract

The present disclosure provides a resource sharing method, comprising: associating a first kernel interface in a first container with a virtual interface in a second container, wherein processes in the first container communicate with each other via the first kernel interface; and controlling a process in the second container to call the virtual interface, so that an application in the second container accesses a target process in the first container. The present disclosure also provides a terminal and a computer-readable medium.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and its features include a resource sharing method, a terminal, and a computer-readable medium. Background Art

[0002] Operating systems are often designed to run in multiple containers, allowing the operating system and upper-layer applications to run independently within these containers. To conserve system memory and power consumption and improve system performance, multiple containers often need to share some basic services. Therefore, it's necessary to enable containers to penetrate other containers to access the required services. However, inter-container penetration is currently limited in practicality. Summary of the Invention

[0003] Embodiments of the present disclosure provide a resource sharing method, a terminal, and a computer-readable medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a resource sharing method, comprising: associating a first kernel interface in a first container with a virtual interface in a second container, wherein processes in the first container communicate with each other through the first kernel interface; and controlling the process in the second container to call the virtual interface so that an application in the second container accesses a target process in the first container.

[0005] In some embodiments, before the step of associating the first kernel interface in the first container with the virtual interface in the second container, the resource sharing method further includes: creating the virtual interface in the second container.

[0006] In some embodiments, associating the first kernel interface in the first container with the virtual interface in the second container includes assigning the first kernel interface to the virtual interface.

[0007] In some embodiments, before the step of associating the first kernel interface in the first container with the virtual interface in the second container, the resource sharing method further includes: obtaining the first kernel interface based on the association relationship between the first file system interface in the first container and the first kernel interface, wherein the process in the first container accesses the first kernel interface through the first file system interface.

[0008] In some embodiments, based on the association relationship between the first file system interface and the first kernel interface in the first container, the step of obtaining the first kernel interface includes: obtaining a target pointer from the first file system interface to the first kernel interface, wherein the target pointer represents the association relationship between the first file system interface and the first kernel interface; and obtaining the first kernel interface according to the target pointer.

[0009] In some embodiments, before the step of obtaining the first kernel interface based on the association relationship between the first file system interface and the first kernel interface in the first container, the resource sharing method further includes: creating the first file system interface in response to the first container being started; creating the first kernel interface; and associating the first file system interface with the first kernel interface to determine the association relationship between the first file system interface and the first kernel interface.

[0010] In some embodiments, the step of controlling the application process in the second container to call the virtual interface includes: modifying the application in the second container to access the second file system interface in the second container to access the virtual interface, wherein the process in the second container accesses the second kernel interface in the second container through the second file system interface.

[0011] In some embodiments, the first kernel interface and the second kernel interface are isolated from each other.

[0012] In a second aspect, an embodiment of the present disclosure provides a terminal, comprising: one or more processors; a memory on which one or more programs are stored, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the resource sharing method described in any one of the first aspects of the embodiment of the present disclosure; and one or more I / O interfaces connected between the processor and the memory, configured to implement information interaction between the processor and the memory.

[0013] In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the resource sharing method described in any one of the first aspects of the embodiments of the present disclosure.

[0014] The embodiments of the present disclosure provide a resource sharing method, a terminal for implementing the resource sharing method, and a computer-readable medium storing an application capable of implementing the resource sharing method. By associating a virtual interface in a second container with a first kernel interface in a first container and enabling a process in the second container to call the virtual interface, the process in the second container can access the first kernel interface in the first container, and then communicate with the process in the first container and call corresponding services. Regardless of whether the components used for communication between different processes in the kernel can be shared, inter-container penetration can be achieved. Moreover, while achieving container penetration, there is no need to maintain specific request messages of various processes, which reduces the difficulty of development and maintenance and improves practicality. In addition, the embodiments of the present disclosure can achieve inter-container penetration without changing the operating system structure of each container, which is more efficient and helps to ensure the security of the operating systems of each container. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a flow chart of a resource sharing method according to an embodiment of the present disclosure;

[0016] Figure 2 is a flowchart of some steps in another resource sharing method in an embodiment of the present disclosure;

[0017] Figure 3 is a flowchart of some steps in another resource sharing method in an embodiment of the present disclosure;

[0018] Figure 4 This is a flowchart of some steps in another resource sharing method according to an embodiment of the present disclosure;

[0019] Figure 5 This is a flowchart of some steps in another resource sharing method according to an embodiment of the present disclosure;

[0020] Figure 6 This is a flowchart of some steps in another resource sharing method according to an embodiment of the present disclosure;

[0021] Figure 7 This is a flowchart of some steps in another resource sharing method according to an embodiment of the present disclosure;

[0022] Figure 8 is a block diagram of a terminal in an embodiment of the present disclosure;

[0023] Figure 9 is a block diagram of a computer-readable medium in an embodiment of the present disclosure;

[0024] Figure 10 This is a schematic diagram of an architecture for inter-container penetration in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] To enable those skilled in the art to better understand the technical solutions of the present disclosure, the resource sharing method, terminal, and computer-readable medium provided by the present disclosure are described in detail below with reference to the accompanying drawings.

[0026] Example embodiments will be described more fully hereinafter with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the scope of this disclosure to those skilled in the art.

[0027] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0028] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0029] The terms used herein are used only to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a," "an," and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements, and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or groups thereof is not excluded.

[0030] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless expressly defined as such herein.

[0031] In multi-container Android systems, inter-container penetration is primarily achieved through the Android system's binder mechanism. Binder is an inter-process communication (IPC) framework provided by the Android system, used for message transmission, synchronization, and memory sharing between multiple processes. In a multi-container Android system, the binder service manager (ServiceManager) of different containers is shared. An application process in one container accesses a service process in the target container by obtaining the target container's ServiceManager, thus achieving binder-based inter-container penetration.

[0032] The inventors of this disclosure have discovered that in multiple container operating systems, if the components used by application processes and service processes in each container to communicate within the kernel are isolated and cannot access each other, inter-container penetration cannot be achieved. For example, in some upgraded versions of the Android kernel, the binder is designed as a file system. The binder file systems between different containers are isolated from each other, and containers cannot access each other's ServiceManager, making inter-container penetration impossible based on this binder mechanism.

[0033] In some related technologies, to achieve inter-container penetration in upgraded Android systems, the binder file system is removed, allowing multiple containers to share the ServiceManager, thereby achieving inter-container penetration through the aforementioned binder mechanism. However, removing the binder file system affects the compatibility of subsequent functions related to the binder file system. Furthermore, removing the binder file system requires maintaining the specific request messages of various service processes, which requires a deep understanding of the specific business, increasing the difficulty of development and maintenance.

[0034] In view of this, firstly, referring to Figure 1 , an embodiment of the present disclosure provides a resource sharing method, which may include but is not limited to the following operations.

[0035] S1. Associating a first kernel interface in a first container with a virtual interface in a second container, wherein processes in the first container communicate with each other through the first kernel interface;

[0036] S2. Control the process in the second container to call the virtual interface, so that the application in the second container accesses the target process in the first container.

[0037] In the embodiments of the present disclosure, there is no particular limitation on the operating systems of the first container and the second container. In some embodiments, the operating systems of the first container and the second container are Android systems.

[0038] In the disclosed embodiments, any container includes an interrelated file system interface and kernel interface. The file system interface is used by processes to access the kernel interface, and the kernel interface is used for communication between different processes within the kernel. By accessing the kernel interface, a process can communicate with a service process within the kernel, allowing the application to call the corresponding service.

[0039] It should be noted that, in the embodiment of the present disclosure, associating the first kernel interface in the first container with the virtual interface in the second container refers to performing relevant operations so that the process in the second container can access the first kernel interface in the first container by calling the virtual interface. The embodiment of the present disclosure does not specifically limit how to associate the first kernel interface with the virtual interface. For example, the implementation form of the virtual interface is an object, and the implementation form of the first kernel interface is also an object. Associating the first kernel interface with the virtual interface is to link the virtual interface object with the first kernel interface object, for example, assigning the first kernel interface object to the member variable of the virtual interface object.

[0040] In the embodiments of the present disclosure, the kernel interfaces of different containers can be isolated or shared. For example, in a multi-container Android system, the Android system can include a binder file system, and the binder file systems of different containers can be isolated from each other; or the Android system can not include a binder file system, and the ServiceManagers of different containers can be shared. This embodiment of the present disclosure does not specifically limit this.

[0041] In the embodiment of the present disclosure, a process may be an application process of any application program in the operating system, or a service process in the operating system, which is not particularly limited in the embodiment of the present disclosure.

[0042] In some embodiments, in step S2, the application process in the second container communicates with the service process serving as the target process in the first container by calling a virtual interface, thereby enabling the application corresponding to the application process in the second container to call the system service corresponding to the service process in the first container.

[0043] In the embodiment of the present disclosure, by associating the virtual interface in the second container with the first kernel interface in the first container, and enabling the process in the second container to call the virtual interface, the process in the second container can access the first kernel interface in the first container, and then communicate with the process in the first container and call the corresponding service. Regardless of whether the components used for communication between different processes in the kernel can be shared, inter-container penetration can be achieved; and while achieving container penetration, there is no need to maintain the specific request messages of various processes, which reduces the difficulty of development and maintenance and improves practicality.

[0044] In the embodiments of the present disclosure, a virtual interface is an interface used by processes in the second container to communicate with processes in the first container. The virtual interface can be an existing interface in the second container, such as the second file system interface in the second container. Alternatively, it can be a newly created interface in the second container. This embodiment of the present disclosure does not impose any specific limitations on this.

[0045] Accordingly, in some embodiments, reference Figure 2 Before step S1, the resource sharing method further includes the following step S3.

[0046] S3. Create the virtual interface in the second container.

[0047] A new virtual interface is created in the second container, so that the second file system interface in the second container can be reserved, thereby avoiding impact on functions based on the second file system interface and ensuring compatibility.

[0048] The embodiment of the present disclosure does not specifically limit how to associate the first kernel interface in the first container with the virtual interface in the second container.

[0049] In some embodiments, reference Figure 3 , step S1 includes but is not limited to step S11.

[0050] S11. Assign the first kernel interface to the virtual interface.

[0051] For example, the first kernel interface is an object, and the virtual interface is also an object. Assigning the first kernel interface to the virtual interface means assigning the first kernel interface object to a member variable of the virtual interface object.

[0052] In some embodiments, the resource sharing method further includes: acquiring the first kernel interface.

[0053] The disclosed embodiments do not specifically limit how to obtain the first kernel interface. In some embodiments, the first kernel interface is directly extracted from the first container. In some embodiments, the first kernel interface is obtained based on the association between the first file system interface and the first kernel in the first container.

[0054] Accordingly, in some embodiments, reference Figure 4 ,Before step S1, the resource sharing method also includes the following step S4.

[0055] S4. Obtain the first kernel interface based on an association between a first file system interface and the first kernel interface in the first container, wherein a process in the first container accesses the first kernel interface through the first file system interface.

[0056] The embodiment of the present disclosure does not specifically limit the form of expression of the association relationship between the first file system interface and the first kernel interface. In some embodiments, the association relationship between the first file system interface and the first kernel interface is represented by a target pointer from the first file system interface to the first kernel interface.

[0057] Accordingly, in some embodiments, reference Figure 5 , step S4 includes but is not limited to the following steps S41 to S42.

[0058] S41: Obtain a target pointer from the first file system interface to the first kernel interface, where the target pointer represents an association relationship between the first file system interface and the first kernel interface;

[0059] S42. Acquire the first kernel interface according to the target pointer.

[0060] In some embodiments, when the first container is started, in the process of establishing the first file system interface and the first kernel interface, the association relationship between the first file system interface and the first kernel interface is recorded.

[0061] Accordingly, in some embodiments, reference Figure 6 Before step S4, the resource sharing method further includes the following steps S51 to S53.

[0062] S51. In response to the first container being started, create the first file system interface;

[0063] S52: Create the first kernel interface;

[0064] S53: Associating the first file system interface with the first kernel interface to determine an association relationship between the first file system interface and the first kernel interface.

[0065] In some embodiments, reference Figure 7 , step S2 includes the following steps S21.

[0066] S21. Modify the access of the application in the second container to the second file system interface in the second container to access the virtual interface, wherein the process in the second container accesses the second kernel interface in the second container through the second file system interface.

[0067] In some embodiments, the first kernel interface and the second kernel interface are isolated from each other.

[0068] Secondly, refer to Figure 8 , an embodiment of the present disclosure provides a terminal, comprising:

[0069] One or more processors 101;

[0070] A memory 102 storing one or more programs, which, when executed by one or more processors, enable the one or more processors to implement any one of the above-mentioned resource sharing methods;

[0071] One or more I / O interfaces 103 are connected between the processor and the memory and are configured to implement information exchange between the processor and the memory.

[0072] Among them, the processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read-write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus), etc.

[0073] In some embodiments, the processor 101 , the memory 102 , and the I / O interface 103 are connected to each other via a bus 104 , and further connected to other components of the computing device.

[0074] Thirdly, refer to Figure 9 , an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements any of the above-mentioned resource sharing methods when the program is executed by a processor.

[0075] In order to enable those skilled in the art to more clearly understand the technical solutions provided by the embodiments of the present disclosure, the technical solutions provided by the embodiments of the present disclosure are described in detail below through specific examples:

[0076] Example 1

[0077] In this embodiment, the first and second containers are started sequentially. The operating systems of the first and second containers can be any operating system. It should be noted that starting the first and second containers sequentially in this embodiment is merely an example. In actual implementation, there is no specific limitation on the order in which they are started.

[0078] When the first container is started, a first file system interface is created. The first file system interface is an interface for communication access between processes within the first container.

[0079] When the first container starts, a first kernel interface is created. The first kernel interface is a driver component that implements inter-process communication in the kernel. That is, all inter-process communication functions of the operating system are implemented in this component.

[0080] Associating the first file system interface in the first container with the first kernel interface in the first container. Associating the first file system interface with the first kernel interface refers to linking the first file system interface object with the first kernel interface object, for example, assigning the first kernel interface object to a member variable in the first file system interface object structure. After the association, processes within the first container can implement inter-process communication. For example, if the camera application of the first container wants to access the camera service of the first container, this can be achieved by calling the first file system interface.

[0081] When the second container starts, a virtual interface is created. The virtual interface is an external interface for processes in the second container to communicate with processes in the first container.

[0082] Associating the virtual interface of the second container with the first kernel interface of the first container. Associating the virtual interface with the first kernel interface involves linking the virtual interface object with the first kernel interface object, for example, assigning the first kernel interface object to a member variable in the virtual interface object structure.

[0083] The application in the second container can directly access the corresponding service of the first container by calling the virtual interface. For example, the camera application in the second container can directly access the camera service of the first container by calling the virtual interface.

[0084] In Examples 2 and 3, a dual-Android terminal system is used as an example. The work container is the first container in the disclosed embodiments, the life container is the second container in the disclosed embodiments, the binder file system node is the file system interface in the disclosed embodiments, the binder physical device node is the kernel interface in the disclosed embodiments, and the virtual binder file system node is the virtual interface in the disclosed embodiments.

[0085] It should be noted that Example 2 and Example 3 are descriptions of some specific application scenarios in the embodiments of the present disclosure, which are only used to explain the embodiments of the present disclosure and are not intended to limit the embodiments of the present disclosure.

[0086] Example 2

[0087] When the working container starts, a first binder file system is created, and a pointer to a first binder physical device node pointed to by a first binder file system node under the first binder file system is recorded;

[0088] When the living container starts, a second binder file system is created, a new virtual binder file system node is created, and the node is named "binder_home_to_work". The pointer of the first binder physical device node pointed to by the first binder file system node under the first binder file system is pointed to the virtual binder file system node.

[0089] When the application in the living container needs to access the service in the working container, the second binder file system node "open / dev / binderfs / hwbinder" originally accessed by the application process in the living container is modified to access the virtual binder file system node "open / dev / binderfs / binder_home_to_work".

[0090] In this embodiment, even if there is a binder file system in the Android system that makes the binder completely isolated, binder penetration can be achieved. When achieving binder penetration, there is no need to understand the specific details of the service business process, only the calling interface needs to be modified, which improves convenience and security and ensures system compatibility.

[0091] Example 3

[0092] Figure 10 This is a schematic diagram of an architecture for inter-container penetration in this embodiment. In this embodiment, the working container 201 and the living container 202 can be started in sequence.

[0093] When the working container 201 starts, the first binder file system node is created, which is recorded as " / dev / binderfs / hwbinder". The first binder file system node is the interface for communication access between processes within the working container 201;

[0094] The working container 201 creates the first binder physical device node, denoted as "hwbinder_node". The first binder physical device node is a driver component for implementing inter-process communication in the kernel. That is, all inter-process communication functions of the operating system are implemented in this component.

[0095] Associate the first binder file system node / dev / binderfs / hwbinder in the working container 201 with the first binder physical device node hwbinder_node in the working container 201. Associating the first binder file system node with the first binder physical device node refers to linking the first binder file system node object with the first binder physical device node object. For example, assign the first binder physical device node hwbinder_node object to a member variable in the object structure of the first binder file system node / dev / binderfs / hwbinder. After the association, the processes inside the working container 201 can achieve inter-process communication. For example, if the camera application of the working container 201 wants to access the service camera provider of the working container 201, it can be achieved by calling the first binder file system node open / dev / binderfs / hwbinder.

[0096] When the living container 202 starts, a virtual binder file system node is created, named " / dev / binderfs / hwbinder_home_to_work". This virtual binder file system node is the external interface for inter-process communication between processes in the living container 202 and processes in the work container 201.

[0097] Associating the virtual binder file system node / dev / binderfs / hwbinder_home_to_work of the living container 202 with the first binder physical device node hwbinder_node of the working container 201. Associating the virtual binder file system node with the first binder physical device node involves linking the virtual binder file system node object with the first binder physical device node object. For example, assigning the first binder physical device node hwbinder_node object to a member variable in the object structure of the virtual binder file system node / dev / binderfs / hwbinder_home_to_work.

[0098] The camera application (or any other applicable application) in the life container 202 can directly access the corresponding service (such as the cameraprovider service) in the work container 201 by calling open / dev / binderfs / hwbinder_home_to_work.

[0099] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As is well known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable, and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0100] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for purposes of limitation. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly indicated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, it will be understood by those skilled in the art that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. A resource sharing method, comprising: Associating a first kernel interface in a first container with a virtual interface in a second container, wherein processes in the first container communicate in the kernel and call corresponding services through the first kernel interface, and the virtual interface is used for processes in the second container to communicate with processes in the first container; Control the process in the second container to call the virtual interface, so that the application in the second container accesses the target process in the first container through the first kernel interface.

2. The resource sharing method according to claim 1, wherein: Before the step of associating the first kernel interface in the first container with the virtual interface in the second container, the resource sharing method further includes: The virtual interface is created in the second container.

3. The resource sharing method according to claim 1 or 2, wherein: The step of associating the first kernel interface in the first container with the virtual interface in the second container includes: Assign the first kernel interface to the virtual interface.

4. The resource sharing method according to claim 1 or 2, wherein: Before the step of associating the first kernel interface in the first container with the virtual interface in the second container, the resource sharing method further includes: The first kernel interface is obtained according to an association relationship between a first file system interface and the first kernel interface in the first container, wherein the process in the first container accesses the first kernel interface through the first file system interface.

5. The resource sharing method according to claim 4, wherein: According to the association relationship between the first file system interface and the first kernel interface in the first container, the step of obtaining the first kernel interface includes: Obtaining a target pointer from the first file system interface to the first kernel interface, wherein the target pointer represents an association relationship between the first file system interface and the first kernel interface; The first kernel interface is obtained according to the target pointer.

6. The resource sharing method according to claim 4, wherein: Before the step of acquiring the first kernel interface according to the association relationship between the first file system interface and the first kernel interface in the first container, the resource sharing method further includes: In response to the first container being started, creating the first file system interface; Creating the first kernel interface; The first file system interface and the first kernel interface are associated to determine an association relationship between the first file system interface and the first kernel interface.

7. The resource sharing method according to claim 1 or 2, wherein: The step of controlling the process in the second container to call the virtual interface includes: The application in the second container accesses the second file system interface in the second container, which is modified to access the virtual interface, wherein the process in the second container accesses the second kernel interface in the second container through the second file system interface.

8. The resource sharing method according to claim 7, wherein: The first core interface and the second core interface are isolated from each other.

9. A terminal comprising: one or more processors; a memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the resource sharing method according to any one of claims 1 to 8; One or more I / O interfaces are connected between the processor and the memory and configured to implement information interaction between the processor and the memory.

10. A computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the resource sharing method according to any one of claims 1 to 8 is implemented.

Images