System image software package detection method and system

Abstract

The present invention discloses a system image software package detection method and system, the method comprising: executing a software package information query command through a software package manager in the system image to obtain a first software package list including software package information; reading a current image system configuration file through a preset path, and parsing out a second software package list including software package information; respectively comparing each software package information in the first software package list and the second software package list to generate a comprehensive software package list including all software package information in the first software package list and the second software package list; through the above detection method, the software packages in the system image can be fully and accurately detected, thereby avoiding missed detection and false detection.

Description

Technical Field

[0001] The present invention relates to the technical field of software package security detection, and in particular to a system image software package detection method and system. Background Art

[0002] With the development of the software industry, the requirements for computer hardware are getting higher and higher, and the development cost is increasing rapidly. In order to efficiently use computer resources, the use of Docker technology (container virtualization technology) is becoming more and more widespread. Alpine images are loved by many developers because of their small size and simplicity, but with the widespread use of Alpine images, its security is also receiving more and more attention. The security of Alpine images is mainly affected by software packages, so it is necessary to conduct a comprehensive inspection of the software packages in the Alpine system image. However, the current detection methods for software included in system images generally have problems of missed detection and false detection. Summary of the invention

[0003] The purpose of the present invention is to solve the above technical problems and to provide a system image software package detection method and system that can comprehensively and accurately detect all software packages in the system image.

[0004] In order to achieve the above object, the present invention discloses a system image software package detection method, which comprises:

[0005] Execute a software package information query command through a software package manager in the system image to obtain a first software package list including software package information;

[0006] Read the current mirror system configuration file through a preset path, and parse out a second software package list including software package information;

[0007] Each piece of software package information in the first software package list and the second software package list is compared respectively to generate a comprehensive software package list including all software package information in the first software package list and the second software package list.

[0008] Compared with the prior art, the system image software package detection method of the present invention obtains a first software package list by automatically executing an information query command in a software package manager, reads a mirror system configuration file through a preset path and parses a second software package list, and then comprehensively compares the first software package list and the second software package list, thereby obtaining a comprehensive software package list including all software package information in the system image; it can be seen that through the above detection method, the software packages in the system image can be comprehensively and accurately detected, thereby avoiding missed detection and false detection.

[0009] Preferably, the read current mirror system configuration file is parsed by a regular expression to obtain the second software package list.

[0010] Preferably, the method for generating the comprehensive software package list includes:

[0011] Read each piece of software package information in the first software package list, and write it into the comprehensive software package list;

[0012] Read each piece of software package information in the second software list one by one, and query whether the currently read software package information already exists in the comprehensive software package list. If yes, skip it; if not, write the piece of software package information into the comprehensive software package list.

[0013] Preferably, the system image is an Alpine image.

[0014] The present invention also discloses a system image software package detection system, which includes a first list acquisition module, a second list acquisition module and a comprehensive list generation module;

[0015] The first list acquisition module is used to execute a software package information query command through a software package manager in the system image to acquire a first software package list including software package information;

[0016] The second list acquisition module is used to read the current mirror system configuration file through a preset path and parse out a second software package list including software package information;

[0017] The comprehensive list generating module is used to generate a comprehensive software package list including all software package information in the first software package list and the second software package list based on a comparison and analysis of each software package information in the first software package list and the second software package list.

[0018] Preferably, the second list acquisition module parses the read current mirror system configuration file by regular expressions to obtain the second software package list.

[0019] Preferably, the comprehensive list generating module comprises a first reading and writing module and a second reading and writing module; the first reading and writing module is used to read each piece of software package information in the first software package list and write it into the comprehensive software package list; the second reading and writing module is used to read each piece of software package information in the second software package list one by one, and write the software package information different from that in the first software package list into the comprehensive software package list.

[0020] Preferably, the system image is an Alpine image.

[0021] The present invention also discloses a system image software package detection system, which comprises:

[0022] one or more processors;

[0023] Memory;

[0024] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs include instructions for executing the system image software package detection method as described above.

[0025] The present invention also discloses a computer-readable storage medium, which includes a computer program. The computer program can be executed by a processor to complete the system image software package detection method as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The following is a flow chart of a method for detecting a system image software package in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0028] This embodiment discloses a system image software package detection method to detect the software package in the system image, so as to provide basic data for the security analysis of the system image. The system image in this embodiment is preferably an Alpine image, but is not limited thereto. Specifically, Figure 1 As shown, the detection method comprises the following steps:

[0029] S1: executing a software package information query command (apk list|grepinstalled) through the software package manager in the system image to obtain a first software package list including software package information;

[0030] S2: Read the current image system configuration file through the preset path ( / lib / apk / db / installed), and parse out the second software package list including software package information;

[0031] S3: Compare each piece of software package information in the first software package list and the second software package list respectively to generate a comprehensive software package list including all software package information in the first software package list and the second software package list.

[0032] Furthermore, in the above step S2, the read current mirror system configuration file is parsed by a regular expression to obtain a second software package list. Specifically, when parsing the read configuration file, the software package information is parsed by matching the P and V fields in the configuration file by a regular expression.

[0033] Furthermore, the specific method of generating the comprehensive software package list includes:

[0034] First, read each piece of software package information in the first software package list and write it into the comprehensive software package list;

[0035] Then, each piece of software package information in the second software list is read one by one, and it is checked whether the currently read software package information already exists in the comprehensive software package list. If yes, it is skipped (to avoid duplicate storage); if not, the piece of software package information is written into the comprehensive software package list, so that all software package information in the first software package list and the second software package list are stored in the comprehensive software package list.

[0036] The software packages in the Alpine system image are detected by the detection method disclosed in the above embodiment, and the first software package list is obtained by automatically executing the information query command in the software package manager, and the image system configuration file is read through a preset path and the second software package list is parsed, and then the first software package list and the second software package list are comprehensively compared to obtain a comprehensive software package list including all software package information in the system image; it can be seen that the above detection method can comprehensively and accurately detect the software packages in the system image by combining command execution and file reading, thereby avoiding missed detection and false detection.

[0037] The invention also discloses a system image software package detection system, which comprises a first list acquisition module, a second list acquisition module and a comprehensive list generation module.

[0038] The first list acquisition module is used to execute a software package information query command through a software package manager in the system image to acquire a first software package list including software package information.

[0039] The second list acquisition module is used to read the current mirror system configuration file through a preset path, and parse out a second software package list including software package information.

[0040] The comprehensive list generating module is used to generate a comprehensive software package list including all software package information in the first software package list and the second software package list based on the comparison and analysis of each software package information in the first software package list and the second software package list.

[0041] Furthermore, the second list acquisition module parses the read current mirror system configuration file through a regular expression to obtain a second software package list.

[0042] Furthermore, the comprehensive list generation module includes a first read-write module and a second read-write module; the first read-write module is used to read each software package information in the first software package list and write it into the comprehensive software package list; the second read-write module is used to read each software package information in the second software package list one by one, and write the software package information different from that in the first software package list into the comprehensive software package list.

[0043] Specifically, the system image is an Alpine image.

[0044] It should also be noted that the working principle of the system image software package detection system in this embodiment is detailed in the above-mentioned system image software package detection method, which will not be repeated here.

[0045] The present invention also discloses another system image software package detection system, which includes one or more processors, a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the program includes instructions for executing the system image software package detection method as described above. The processor can adopt a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits, for executing related programs, to realize the functions required to be executed by the module in the system image software package detection system of the embodiment of the present application, or to execute the system image software package detection method of the method embodiment of the present application.

[0046] The present invention also discloses a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the system image software package detection method as described above. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state disk (SSD), etc.

[0047] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A system image software package detection method, characterized in that: include: Execute a software package information query command through a software package manager in the system image to obtain a first software package list including software package information; Read the current mirror system configuration file through a preset path, and parse out a second software package list including software package information; Compare each piece of software package information in the first software package list and the second software package list respectively to generate a comprehensive software package list including all software package information in the first software package list and the second software package list; Parsing the read current mirror system configuration file by using a regular expression to obtain the second software package list; The method for generating the comprehensive software package list includes: Read each piece of software package information in the first software package list, and write it into the comprehensive software package list; Read each piece of software package information in the second software package list one by one, and query whether the currently read software package information already exists in the comprehensive software package list. If yes, skip it; if not, write the piece of software package information into the comprehensive software package list.

2. The system image software package detection method according to claim 1, characterized in that: The system image is an Alpine image.

3. A system image software package detection system, characterized in that: It includes a first list acquisition module, a second list acquisition module and a comprehensive list generation module; The first list acquisition module is used to execute a software package information query command through a software package manager in the system image to acquire a first software package list including software package information; The second list acquisition module is used to read the current mirror system configuration file through a preset path and parse out a second software package list including software package information; The comprehensive list generating module is used to generate a comprehensive software package list including all software package information in the first software package list and the second software package list based on the comparison and analysis of each software package information in the first software package list and the second software package list; The second list acquisition module parses the read current mirror system configuration file through a regular expression to obtain the second software package list; The comprehensive list generation module includes a first read-write module and a second read-write module; the first read-write module is used to read each piece of software package information in the first software package list and write it into the comprehensive software package list; the second read-write module is used to read each piece of software package information in the second software package list one by one, and write software package information different from that in the first software package list into the comprehensive software package list.

4. The system image software package detection system according to claim 3, characterized in that: The system image is an Alpine image.

5. A system image software package detection system, characterized in that: include: one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs comprising instructions for executing the system image software package detection method according to any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that: The method comprises a computer program, wherein the computer program can be executed by a processor to complete the system image software package detection method according to any one of claims 1 to 2.

Images