A file processing method, device and storage medium

Abstract

The present application provides a file processing method, device and storage medium, which relate to the field of information security and are used to solve the problem of being unable to process files in a host machine and all containers. The method comprises: obtaining file information of a target file by calling a pre-installed target program. Then, when the file system of the target file is the file system of a first container, based on the file information, the file descriptor of the target file is obtained from the file system of the first container, and file scanning processing is performed on the target file according to the file descriptor. When the file system of the target file is the file system of the host machine, the mapping file path of the file storage path in the target container is obtained, and file scanning processing is performed on the target file according to the mapping file path. The present application can realize the processing of files of the host machine and all containers.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a file processing method, device and storage medium. Background Art

[0002] The traditional file processing method is usually to deploy antivirus software on the host machine to detect and kill malicious files in the host machine.

[0003] When a container is running in a host, the antivirus software deployed on the host can only detect and kill malicious files on the host because the file systems of the host and the container are isolated from each other. If antivirus software is deployed on the host and all containers at the same time, it will occupy a large amount of host resources (for example: memory, central processing unit (CPU) resources, input / output (IO) resources, etc.). Therefore, in the container application scenario, traditional file processing methods cannot scan the files of the host and all containers, which makes it impossible to process all malicious files. Summary of the invention

[0004] The present application provides a file processing method, device and storage medium, which are used to solve the problem in existing file processing methods that the file systems of the host machine and the container are isolated from each other, and the files of the host machine and all containers cannot be scanned, thereby resulting in the inability to process all malicious files.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a file processing method is provided, which is applied to a target container, and at least one container other than the target container is also running on the host machine running the target container. The file processing method includes: receiving a file processing instruction. When the file processing instruction indicates processing a container file in the file system of at least one container, the file directory of at least one container in the first container monitoring list can be traversed, and then, according to the file system identifier of the file system of at least one container in the first container monitoring list, the file descriptor of the container file can be obtained from the file system of at least one container, and then, according to the file descriptor, file scanning processing can be implemented for the container file. When the file processing instruction indicates processing a host file in the file system of the host machine, the mount directory of the root directory of the pre-mounted host file in the target container can be traversed to implement file scanning processing for the host file.

[0007] Optionally, the method also includes: obtaining a second container monitoring list; calling a pre-installed target program to obtain process information of a target process; the target program is used to obtain process information of processes in different file systems; the file system is a file system of a host machine or a file system of a first container; the first container is any one of at least one container; the process information includes: a file system identifier for indicating a file system on which the target process is running; when the file system identifier is used to indicate that the file system on which the target process is running is a file system of the first container, based on the process information, updating the second container monitoring list to obtain the first container monitoring list.

[0008] Optionally, the process information also includes: a process event type and a process identifier; when the process identifier indicates that the target process is an initial process, the process information also includes a file directory of the first container; when the file system identifier is used to indicate that the file system running the target process is the file system of the first container, based on the process information, updating the second container monitoring list to obtain the first container monitoring list. The method specifically includes: when the process identifier indicates that the target process is an initial process and the process event type is a process creation event, adding the file system identifier of the file system of the first container and the file directory of the first container to the second container monitoring list; when the process identifier indicates that the target process is an initial process and the process event type is a process exit event, deleting the file system identifier of the file system of the first container and the file directory of the first container in the second container monitoring list.

[0009] Optionally, the method also includes: mounting the root directory of the host machine's file system; when the root directory does not include the installation information of the target program, sending an instruction message to the host machine to instruct the host machine to install the target program, so that the host machine installs the target program in response to the instruction message and updates the root directory; when the root directory includes the installation information of the target program, loading the target program.

[0010] Optionally, the target program is an extended Berkeley packet filter (eBPF) program.

[0011] Optionally, when the file processing instruction indicates processing a container file in the file system of at least one container, the method of traversing the file directory of at least one container in the pre-stored first container monitoring list and obtaining the file descriptor of the container file from the file system of at least one container specifically includes: updating the process parameters of a pre-created process according to the file system identifier to obtain an updated process; the process is used to obtain the file descriptor of the file from the file system corresponding to the process parameters of the process; calling the updated process and obtaining the file descriptor of the container file according to the file directory of at least one container.

[0012] Optionally, when the file processing instruction indicates processing a container file in the file system of at least one container, traversing the file directory of at least one container in the pre-stored first container monitoring list, obtaining the file descriptor of the container file from the file system of at least one container, and performing file scanning processing on the container file according to the file descriptor, the method also includes: when the container file includes a malicious file, executing a preset processing strategy; the preset processing strategy includes: restarting the container corresponding to the malicious file, deleting the malicious file, or isolating at least one of the malicious file.

[0013] In a second aspect, a file processing device is provided, including: a receiving unit, a first processing unit, and a second processing unit; the receiving unit is used to receive a file processing instruction; the first processing unit is used to traverse the file directory of at least one container in the first container monitoring list when the file processing instruction received by the receiving unit indicates processing a container file in the file system of at least one container, obtain a file descriptor of the container file from the file system of at least one container, and perform file scanning processing on the container file according to the file descriptor; the first container monitoring list includes a file system identifier of the file system of at least one container; the second processing unit is used to traverse the mount directory of the root directory of the pre-mounted host file in the target container when the file processing instruction received by the receiving unit indicates processing a host file in the file system of the host, and perform file scanning processing on the host file.

[0014] Optionally, the file processing device also includes: a third processing unit; the third processing unit is used to obtain a second container monitoring list; calling a pre-installed target program to obtain process information of a target process; the target program is used to obtain process information of processes in different file systems; the file system is a file system of a host machine or a file system of a first container; the first container is any one of at least one container; the process information includes: a file system identifier for indicating a file system on which the target process is running; when the file system identifier is used to indicate that the file system on which the target process is running is a file system of the first container, based on the process information, updating the second container monitoring list to obtain the first container monitoring list.

[0015] Optionally, the process information also includes: a process event type and a process identifier; when the process identifier indicates that the target process is an initial process, the process information also includes a file directory of the first container; a third processing unit is specifically used to: when the process identifier indicates that the target process is an initial process and the process event type is a process creation event, add the file system identifier of the file system of the first container and the file directory of the first container in the second container monitoring list; when the process identifier indicates that the target process is an initial process and the process event type is a process exit event, delete the file system identifier of the file system of the first container and the file directory of the first container from the second container monitoring list.

[0016] Optionally, the file processing device also includes: a fourth processing unit; the fourth processing unit is used to mount the root directory of the host machine's file system; when the root directory does not include the installation information of the target program, sending an instruction message to the host machine to instruct the host machine to install the target program, so that the host machine installs the target program in response to the instruction message and updates the root directory; when the root directory includes the installation information of the target program, loading the target program.

[0017] Optionally, the target program is an eBPF program.

[0018] Optionally, the first processing unit is specifically used to: update the process parameters of a pre-created process according to a file system identifier to obtain an updated process; the process is used to obtain a file descriptor of a file from a file system corresponding to the process parameters of the process; call the updated process and obtain a file descriptor of a container file according to a file directory of at least one container.

[0019] Optionally, the file processing device also includes: a fifth processing unit; the fifth processing unit is used to execute a preset processing strategy when the container file includes a malicious file; the preset processing strategy includes: restarting the container corresponding to the malicious file, deleting the malicious file, or isolating at least one of the malicious files.

[0020] In a third aspect, a file processing device is provided, comprising a memory and a processor; the memory is used to store computer execution instructions, and the processor is connected to the memory through a bus; when the file processing device is running, the processor executes the computer execution instructions stored in the memory, so that the file processing device executes the file processing method described in the first aspect.

[0021] The file processing device may be a network device, or a part of a network device, such as a chip system in a network device. The chip system is used to support the network device to implement the functions involved in the first aspect and any possible implementation thereof, for example, to obtain, determine, and send the data and / or information involved in the above-mentioned file processing method. The chip system includes a chip, and may also include other discrete devices or circuit structures.

[0022] In a fourth aspect, a computer-readable storage medium is provided, the computer-readable storage medium comprising computer execution instructions, and when the computer execution instructions are executed on a computer, the computer executes the file processing method described in the first aspect.

[0023] In a fifth aspect, a computer program product is also provided. The computer program product includes computer instructions. When the computer instructions are executed on a file processing device, the file processing device executes the file processing method as described in the first aspect above.

[0024] It should be noted that the above computer instructions may be stored in whole or in part on a first computer-readable storage medium, wherein the first computer-readable storage medium may be packaged together with the processor of the file processing device, or may be packaged separately from the processor of the file processing device, which is not limited in the embodiments of the present application.

[0025] The description of the second, third, fourth and fifth aspects of the present application can refer to the detailed description of the first aspect; and the beneficial effects of the second, third, fourth and fifth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0026] In the embodiments of the present application, the name of the file processing device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of the present application, they fall within the scope of the claims of the present application and their equivalent technologies.

[0027] These and other aspects of the present application will become more apparent from the following description.

[0028] The technical solution provided by this application brings at least the following beneficial effects:

[0029] Based on any of the above aspects, an embodiment of the present application provides a file processing method, and after receiving the file processing instruction, the target container can determine the type of file to be processed according to the file processing instruction. When the file type to be processed is a container file, the file descriptor of the container file can be obtained from the file system of at least one container by traversing the file directory of at least one container in the first container monitoring list, thereby realizing the scanning of the container file. When the file type to be processed is a host file, the host file can be scanned by traversing the mount directory of the host file in the target container. In this way, the target container can realize the scanning and processing of the host file, and can also realize the scanning and processing of other container files, which solves the problem that the prior art cannot process files in multiple file systems of the host and all containers. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the structure of a file processing system provided in an embodiment of the present application;

[0031] Figure 2 A schematic diagram of the structure of a target container provided in an embodiment of the present application;

[0032] Figure 3 A schematic diagram of the hardware structure of a file processing device provided in an embodiment of the present application;

[0033] Figure 4 A schematic diagram of the hardware structure of another file processing device provided in an embodiment of the present application;

[0034] Figure 5 A flowchart of a file processing method provided in an embodiment of the present application;

[0035] Figure 6 A flowchart of another file processing method provided in an embodiment of the present application;

[0036] Figure 7 A flowchart of another file processing method provided in an embodiment of the present application;

[0037] Figure 8 A flowchart of another file processing method provided in an embodiment of the present application;

[0038] Fig. 9 A flowchart of another file processing method provided in an embodiment of the present application;

[0039] Fig.10 A flowchart of another file processing method provided in an embodiment of the present application;

[0040] Fig.11 A flowchart of another file processing method provided in an embodiment of the present application;

[0041] Fig.12 A flowchart of another file processing method provided in an embodiment of the present application;

[0042] Fig.13 A schematic diagram of the structure of a file processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0044] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0045] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and order of execution.

[0046] In order to facilitate the understanding of the present application, the relevant elements involved in the present application are now described.

[0047] Container Technology

[0048] Container technology is a process-level isolation technology that can share the host's operating system kernel and implement isolation based on operating system capabilities. The host is the physical server that runs the container. Containers are isolated from each other and from the host. Container technology can load operating system images and applications into the host at the same time, effectively reducing the occupation of host resources (for example: memory, central processing unit (CPU) resources, input / output (IO) resources, etc.).

[0049] Linux Kernel

[0050] Linux is an open source computer operating system kernel. The main modules (or components) of the Linux kernel are divided into the following parts: storage management, multiple central processing units (CPUs) and process management, file systems, device management and drivers, network communications, as well as system initialization (booting), system calls, etc.

[0051] Namespace

[0052] The namespace mechanism is a means used in the Linux kernel to achieve Linux resource isolation. The Linux namespace provides a kernel-level method to isolate system resources. It achieves resource isolation by placing the system's global resources in different namespaces. There can be multiple namespaces on the Linux kernel. For each namespace, there is a dedicated process to achieve Linux isolation. Currently, there are six main types of Linux namespaces, including: mount (MNT) namespace (used to isolate file systems and disk mount points), inter-process communication (IPC) namespace (used to isolate inter-process communication), network (Net) namespace (used to isolate networks), UNIX time-sharing system (UTS) namespace (used to isolate host names and domain names), process id (PID) namespace (used to isolate processes), and user (User) namespace (used to isolate users).

[0053] Extended Berkeley Packet Filter (eBPF)

[0054] eBPF is the latest module added to the Linux kernel. The eBPF program supports its own bytecode language, which is compiled into kernel native code based on the bytecode language and runs in the kernel.

[0055] Hook function

[0056] Hook function refers to a type of function that is part of the Windows message processing mechanism. By setting a "hook", the application can filter all messages and events at the system level and access messages that are inaccessible under normal circumstances. The essence of a hook is a program used to process system messages, which is hooked into the system through system calls.

[0057] Container cluster management system (kubernetes, K8S)

[0058] K8S is an open source orchestration management tool for managing containerized container applications on multiple hosts in a cloud platform. K8S provides application deployment, planning, updating, maintenance and other mechanisms to make the deployment of containerized applications simple and efficient.

[0059] Ring buffer

[0060] A ring buffer is a first-in, first-out circular buffer that provides mutually exclusive access to the buffer to communicating programs.

[0061] As described in the background art, in the existing file processing method, since the file systems of the host and the container are isolated from each other, it is impossible to scan the files of the host and all containers, which leads to the inability to process all malicious files.

[0062] In response to the above problems, an embodiment of the present application provides a file processing method. After receiving the file processing instruction, the target container can determine the type of file to be processed according to the file processing instruction. When the file type to be processed is a container file, the file descriptor of the container file can be obtained from the file system of at least one container by traversing the file directory of at least one container in the first container monitoring list, thereby realizing the scanning of the container file. When the file type to be processed is a host file, the host file can be scanned by traversing the mount directory of the host file in the target container. In this way, the target container can realize the scanning and processing of the host file, and can also realize the scanning and processing of other container files, which solves the problem that the prior art cannot process files in multiple file systems of the host and all containers.

[0063] The file processing method is suitable for a file processing system. Figure 1 A structure of the file processing system is shown. Figure 1 As shown, the file processing system includes: a host machine 103 running multiple containers (including a target container 101 and a first container 102).

[0064] The file systems of the target container 101 , the first container 102 , and the host machine 103 are isolated from each other.

[0065] Figure 1 The multiple containers in the system run on the host machine through the container technology, and are used to deploy applications on the host machine 103. The multiple containers can be managed by a container orchestrator such as K8S.

[0066] The target container 101 is used to process files in the first container 102 and the host machine 103 .

[0067] Figure 1 The first container 102 in the example may be any container among the multiple containers except the target container 101.

[0068] Figure 1 The host machine 103 in the example is an independent hardware dedicated host or independent server that actually exists. The host machine 103 may be a server in a server cluster (composed of multiple servers).

[0069] Combination Figure 1 ,like Figure 2As shown, the operating system of the target container 101 is divided into kernel state 210 (the CPU can access all data in the memory, including peripheral devices such as hard disk and network card, and the CPU can also switch itself from one program to another) and user state 220 (only limited access to memory, and no access to peripheral devices is allowed, the ability to occupy the CPU is deprived, and CPU resources can be obtained by other programs) according to execution permissions.

[0070] The functional modules of the target container 101 running in the kernel state 210 include: a target program running module 211 (including a container process monitoring submodule 212, which is used to monitor the creation and exit events of the container process, capture the process information in the event, and send the process information to the container lifecycle monitoring module 222 in the user state 220).

[0071] The functional modules of the target container 101 running in the user state 220 include: a target program loading module 221 (started before other modules run, used to load the target program installed on the host machine 103 into the kernel state 210 for operation), a container lifecycle monitoring module 222 (used to update the container monitoring list according to the process information sent by the container process monitoring submodule 212), a host file scanning module 223 (used to traverse the mount directory of the root directory of the host file in the target container according to the file processing instruction, scan the host file, and forward the file information of the malicious file to the file processing module 225), a container file scanning module 224 (used to traverse the file directory of the container in the container monitoring list updated by the container lifecycle monitoring module 222 according to the file processing instruction, scan the file of the container, and forward the file information of the malicious file to the file processing module 225), and a file processing module 225 (used to process the malicious file according to the file information of the malicious file sent by the host file scanning module 223 or the container file scanning module 224).

[0072] Optionally, the host file scanning module 223 and the container file scanning module 224 may be two independently deployed functional modules or two submodules in a file scanning module, which is not limited in any way by the present embodiment of the application.

[0073] For ease of understanding, this application mainly uses the example of the independent deployment of the host file scanning module 223 and the container file scanning module 224 as an example for explanation.

[0074] The host machine 103 in the file processing system includes Figure 3 or Figure 4 The components included in the communication device shown are described below. Figure 3 and Figure 4 Taking the communication device shown as an example, the hardware structure of the host machine 103 is introduced.

[0075] like Figure 3 , which is a schematic diagram of a hardware structure of a communication device provided in an embodiment of the present application. The communication device includes a processor 21, a memory 22, a communication interface 23, and a bus 24. The processor 21, the memory 22, and the communication interface 23 can be connected via a bus 24.

[0076] The processor 21 is the control center of the communication device, which can be a processor or a general term for multiple processing elements. For example, the processor 21 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0077] As an embodiment, the processor 21 may include one or more CPUs, such as Figure 2 CPU 0 and CPU 1 are shown in .

[0078] The memory 22 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0079] In a possible implementation, the memory 22 may exist independently of the processor 21, and the memory 22 may be connected to the processor 21 via a bus 24 to store instructions or program codes. When the processor 21 calls and executes the instructions or program codes stored in the memory 22, the file processing method provided in the following embodiment of the present invention can be implemented.

[0080] In another possible implementation, the memory 22 may also be integrated with the processor 21 .

[0081] The communication interface 23 is used for the communication device to connect with other devices through a communication network, and the communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 23 may include a receiving unit for receiving data and a sending unit for sending data.

[0082] The bus 24 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0083] Figure 4 FIG. 2 shows another hardware structure of the communication device in the embodiment of the present invention. Figure 4 As shown, the communication device may include a processor 31 and a communication interface 32. The processor 31 is coupled to the communication interface 32.

[0084] The functions of the processor 31 may refer to the description of the processor 21. In addition, the processor 31 also has a storage function and can function as the memory 22 described above.

[0085] The communication interface 32 is used to provide data to the processor 31. The communication interface 32 may be an internal interface of the communication device, or an external interface of the communication device (equivalent to the communication interface 23).

[0086] It should be pointed out that Figure 3 (or Figure 4 ) does not constitute a limitation on the communication device, except Figure 3 (or Figure 4 ) In addition to the components shown in the figure, the communication device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0087] The file processing method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0088] like Figure 5 As shown, the file processing method provided in the embodiment of the present application is applied to the target container, and the host machine running the target container also runs at least one container other than the target container. The file processing method includes: S501-S503.

[0089] S501: The target container receives a file processing instruction.

[0090] The file processing instruction is used to instruct the target container to process at least one of a container file in a file system of at least one container or a host file in a file system of a host machine.

[0091] Optionally, the file processing instruction may include configuration parameters for the instruction.

[0092] Combination Figure 2 When the file processing instruction includes configuration parameters of the instruction, after receiving the file processing instruction, the host file scanning module 223 and the container file scanning module 224 of the target container can parse the configuration parameters of the instruction to determine the file system type of the file to be processed.

[0093] S502: When the file processing instruction indicates processing a container file in a file system of at least one container, the target container traverses a file directory of at least one container in the first container monitoring list, obtains a file descriptor of the container file from the file system of the at least one container, and performs file scanning processing on the container file according to the file descriptor.

[0094] The first container monitoring list includes a file system identifier of a file system of at least one container.

[0095] The file scanning process is used to determine whether a container file contains malicious files.

[0096] Optional, combined Figure 2 The first container monitoring list may be a container monitoring list generated by the container lifecycle monitoring module 222 by acquiring the container process in real time.

[0097] Combination Figure 2 When the file processing instruction indicates processing a container file in the file system of at least one container, the container file scanning module 224 of the target container may traverse the file directory of at least one container in the first container monitoring list in the container lifecycle monitoring module 222. Then, the container file scanning module 224 may obtain a file descriptor of the container file from the file system of at least one container, and perform file scanning processing on the container file according to the file descriptor.

[0098] Optional, combined Figure 2 The first container monitoring list may also be a request message for requesting the running status of at least one container sent periodically by the container lifecycle monitoring module 222 to at least one application programming interface (API) corresponding to at least one container. Then, in response to the request message, at least one API sends the running status of at least one container to the container lifecycle monitoring module 222. Then, the container lifecycle monitoring module 222 may generate a container monitoring list according to the running status of at least one container.

[0099] S503: When the file processing instruction indicates processing a host file in the file system of the host, the target container traverses the mount directory of the root directory of the pre-mounted host file in the target container, and performs file scanning processing on the host file.

[0100] The file scanning process is used to determine whether the host machine files include malicious files.

[0101] Combination Figure 2 When the file processing instruction indicates processing a host file in the file system of the host, the host file scanning module 223 of the target container may traverse the mount directory of the root directory of the pre-mounted host file in the target container. Then, the host file scanning module 223 may perform file scanning processing on the host file in the mount directory.

[0102] In one embodiment, in combination Figure 5 ,like Figure 6 As shown, after S501, the file processing method further includes: S601-S602.

[0103] S601: The target container parses the file processing instruction to determine whether to process the container file.

[0104] When the file processing instruction indicates processing a container file, S502 is executed.

[0105] When the file processing instruction indicates not to process the container file, the other operations in the file processing instruction are performed.

[0106] S602: The target container parses the file processing instruction to determine whether to process the host file.

[0107] When the file processing instruction indicates processing a host file, S503 is executed.

[0108] When the file processing instruction indicates not to process the host file, other operations in the file processing instruction are executed.

[0109] The embodiment of the present application does not limit the order of S601 and S602. The target container may execute S601 first and then S602; it may execute S602 first and then S601; it may also execute S601 and S602 simultaneously.

[0110] In one embodiment, if Figure 7 As shown, the file processing method also includes: S701-S703.

[0111] S701: The target container obtains a monitoring list of the second container.

[0112] Combination Figure 2After the target container is started, the container lifecycle monitoring module 222 sends a request message for requesting the running status of at least one container to at least one API corresponding to at least one container. Then, in response to the request message, at least one API sends the running status of at least one container to the container lifecycle monitoring module 222. Then, the container lifecycle monitoring module 222 can generate a second container monitoring list according to the running status of at least one container.

[0113] S702: The target container calls a pre-installed target program to obtain process information of a target process.

[0114] The target program is used to obtain process information of processes in different file systems.

[0115] The file system is a file system of a host machine or a file system of a first container, and the first container is any container of the at least one container.

[0116] The process information includes: a file system identifier for indicating a file system running the target process.

[0117] Optionally, the file system identifier may be an MNT namespace ID, or may be other identifiers used to represent a file system, which is not limited in this application.

[0118] Optionally, the process information may also include: process event type, process identifier, process ID, IPC namespace ID, Net namespace ID, UTS namespace ID, User namespace ID, etc.

[0119] Optionally, the process identifier may be a PID namespace ID, or other identifier used to represent a process, which is not limited in this application.

[0120] Optionally, the process event type may be a process creation event, a process exit event, etc.

[0121] Optionally, the target program can be an eBPF program.

[0122] Combination Figure 2 , when the file system identifier is an MNT namespace ID and the target program is an eBPF program, the container process monitoring submodule 212 running the eBPF program in the target container can filter all events at the system level by setting a process operation event hook function to obtain a process operation event. Then, the container process monitoring submodule 212 obtains process information such as the MNT namespace ID of the target process from the process operation event.

[0123] S703: When the file system identifier is used to indicate that the file system running the target process is the file system of the first container, the target container updates the second container monitoring list based on the process information to obtain the first container monitoring list.

[0124] Combination Figure 2 When the file system identifier is an MNT namespace ID, the target container may determine the container corresponding to the MNT namespace ID in the process information as the first container. Then, the target container may update the second container monitoring list based on the process information to obtain the first container monitoring list.

[0125] In one embodiment, in combination Figure 7 ,like Figure 8 As shown, when the process identifier indicates that the target process is the initial process, the process information also includes the file directory of the first container. In S703, when the file system identifier is used to indicate that the file system running the target process is the file system of the first container, the target container updates the second container monitoring list based on the process information to obtain the first container monitoring list. The method specifically includes: S801-S802.

[0126] S801: When the process identifier indicates that the target process is an initial process and the process event type is a process creation event, the target container adds the file system identifier of the file system of the first container and the file directory of the first container to the second container monitoring list.

[0127] Combination Figure 2 When the file system identifier is an MNT namespace ID and the process identifier is a PID namespace ID, after the container process monitoring submodule 212 obtains the process information, it can forward the process information to the container lifecycle monitoring module 222 through the ring buffer. Then, the container lifecycle monitoring module 222 can determine whether the target process is an initial process according to the PID namespace ID.

[0128] When the PID namespace ID is equal to 1, it indicates that the target process is the initial process. In this case, when the container lifecycle monitoring module 222 determines that the process event type of the target process is a process creation event, the MNT namespace ID and file directory of the container corresponding to the target process can be added to the second container monitoring list.

[0129] S802: When the process identifier indicates that the target process is an initial process and the process event type is a process exit event, the target container deletes the file system identifier of the file system of the first container and the file directory of the first container in the second container monitoring list.

[0130] Combination Figure 2When the file system identifier is an MNT namespace ID and the process identifier is a PID namespace ID, after the container process monitoring submodule 212 obtains the process information, it can forward the process information to the container lifecycle monitoring module 222 through the ring buffer. Then, the container lifecycle monitoring module 222 can determine whether the target process is an initial process according to the PID namespace ID.

[0131] When the PID namespace ID is equal to 1, it indicates that the target process is the initial process. In this case, when the container lifecycle monitoring module 222 determines that the process event type of the target process is a process exit event, the MNT namespace ID and file directory of the container corresponding to the target process can be deleted from the second container monitoring list.

[0132] In one embodiment, in combination Figure 5 ,like Fig. 9 As shown, before S501, the file processing method also includes: S901-S903.

[0133] S901. The target container mounts the root directory of the host file system.

[0134] After the target container is started, the root directory of the host's file system is mounted into the container so that the target container can scan the host's files in the target container.

[0135] S902: When the root directory does not include installation information of the target program, the target container sends an instruction message to the host machine for instructing the host machine to install the target program, so that the host machine installs the target program in response to the instruction message and updates the root directory.

[0136] Optionally, the installation information of the target program may be information such as the installation location and installation directory of the target program.

[0137] Combination Figure 2 When the target program is an eBPF program, if the root directory does not include the installation information of the eBPF program, the target program loading module 221 may send an instruction message to the host machine to instruct the host machine to install the eBPF program. In response to the instruction message, the host machine installs the eBPF program and updates the root directory.

[0138] S903: When the root directory includes installation information of the target program, the target container loads the target program.

[0139] Combination Figure 2 When the target program is an eBPF program, if the root directory includes the installation information of the eBPF program, the target program loading module 221 loads the eBPF program into the kernel state 210 for execution.

[0140] In one embodiment, in combination Figure 5 ,like Fig.10 As shown, in S502, when the file processing instruction indicates processing a container file in the file system of at least one container, the target container traverses the file directory of at least one container in the first container monitoring list, obtains the file descriptor of the container file from the file system of at least one container, and performs file scanning processing on the container file according to the file descriptor. The method specifically includes: S1001-S1002.

[0141] S1001. The target container updates the process parameters of a pre-created process according to a file system identifier to obtain an updated process.

[0142] The process is used to obtain a file descriptor of a file from a file system corresponding to a process parameter of the process.

[0143] Combination Figure 2 When the file system identifier is an MNT namespace ID, the container file scanning module 224 pre-creates a process after startup. After receiving the file information forwarded by the container lifecycle monitoring module 222, the container file scanning module 224 can block the currently running scanning process. Then, the container file scanning module 224 can call the setns function to associate the pre-created process with the MNT namespace of the container file according to the MNT namespace ID of the container file, so as to obtain an updated process in the same MNT namespace as the container file.

[0144] S1002: The target container calls the updated process and obtains a file descriptor of a container file according to a file directory of at least one container.

[0145] Combination Figure 2 , when the file system identifier is an MNT namespace ID, the container file scanning module 224 can call the updated process in the same MNT namespace as the target file, and obtain the storage location of the container file according to the file directory of at least one container. Then, the container file scanning module 224 can open the container file in the MNT namespace of the container file and obtain the file descriptor from the container file. Then, the updated process sends the file descriptor to the scanning process through the communication between the child process and the parent process, so that the container file scanning module 224 can obtain and scan the container file in the MNT namespace of at least one container.

[0146] In one embodiment, in combination Figure 5 ,like Fig.11 As shown, after S502, the file processing method further includes: S1101.

[0147] S1101: When a container file includes a malicious file, the target container executes a preset processing strategy.

[0148] The preset processing strategy includes: restarting the container corresponding to the malicious file, deleting the malicious file, or isolating the malicious file.

[0149] Combination Figure 2 When the preset processing strategy is to restart the first container, the file processing module 225 can call the corresponding application program interface API to restart the container corresponding to the malicious file.

[0150] Optionally, the target container may execute a preset processing strategy according to pre-configured rules such as the risk level of the malicious file, the virus type of the malicious file, etc.

[0151] The method for the target container to execute the preset processing strategy according to the risk level of the malicious file can be: when the risk level of the malicious file is less than or equal to the preset low risk level, the malicious file is not processed. When the risk level of the malicious file is greater than the preset low risk level and less than or equal to the preset medium risk level, the malicious file is isolated. When the risk level of the malicious file is greater than the preset medium risk level and less than or equal to the preset high risk level, the malicious file is deleted. When the risk level of the malicious file is greater than the preset high risk level, the container storing the malicious file is restarted.

[0152] In one embodiment, if Fig.12 As shown, the file processing method also includes: S1201-S1204.

[0153] S1201. When the result of the file scanning process indicates that a malicious file exists, the target container determines whether the malicious file is a host file.

[0154] Optionally, the method for the target container to determine whether the malicious file is a host file may be: the target container determines whether the file system storing the malicious file is the file system of the host according to the file system identifier of the malicious file.

[0155] Combination Figure 2 When the file system identifier is an MNT namespace ID, the method by which the file processing module 225 determines that the file system storing the malicious file is the file system of the host machine according to the file information may be: the module that sends the result of the file scanning process containing the malicious file is the host machine file scanning module 223, or the MNT namespace ID of the malicious file is found to be the MNT namespace ID of the host machine.

[0156] When the file system storing the malicious file is the file system of the host machine, S1202 is executed.

[0157] When the file system storing the malicious file is not the file system of the host machine, S1204 is executed.

[0158] S1202: The target container determines whether it is necessary to restart the container corresponding to the malicious file according to a preset processing strategy.

[0159] When it is necessary to restart the container corresponding to the malicious file, execute S1203.

[0160] When there is no need to restart the container corresponding to the malicious file, execute S1204.

[0161] S1203: The target container restarts the container corresponding to the malicious file.

[0162] Combination Figure 2 The file processing module 225 can call the API corresponding to the first container to restart the first container according to the preset configuration rules.

[0163] S1204: The target container processes the malicious file according to a preset processing strategy.

[0164] In summary, the embodiment of the present application provides a file processing method. After receiving the file processing instruction, the target container can determine the type of file to be processed according to the file processing instruction. When the file type to be processed is a container file, the file descriptor of the container file can be obtained from the file system of at least one container by traversing the file directory of at least one container in the first container monitoring list, thereby realizing the scanning of the container file. When the file type to be processed is a host file, the host file can be scanned by traversing the mount directory of the host file in the target container. In this way, the target container can realize the scanning and processing of the host file, and can also realize the scanning and processing of other container files, which solves the problem that the prior art cannot process files in multiple file systems of the host and all containers.

[0165] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0166] The embodiment of the present application can divide the file processing device into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0167] like Fig.13 The figure is a schematic diagram of the structure of a file processing device provided in an embodiment of the present application. The file processing device can be used to execute Figure 5 , Figure 6 , Figure 7 , Figure 8 , Fig. 9 , Fig.10 , Fig.11 or Fig.12 The method of file processing shown. Fig.13 The file processing device shown includes: a receiving unit 1301 , a first processing unit 1302 and a second processing unit 1303 .

[0168] Receiving unit 1301 is used to receive a file processing instruction. Figure 5 , the receiving unit 1301 is used to execute S501.

[0169] The first processing unit 1302 is configured to, when the file processing instruction received by the receiving unit 1301 indicates processing a container file in the file system of at least one container, traverse the file directory of at least one container in the first container monitoring list, obtain the file descriptor of the container file from the file system of at least one container, and perform file scanning processing on the container file according to the file descriptor. Figure 5 , the first processing unit 1302 is used to execute S502.

[0170] The second processing unit 1303 is used to traverse the mount directory of the root directory of the pre-mounted host file in the target container and perform file scanning processing on the host file when the file processing instruction received by the receiving unit 1301 indicates processing a host file in the file system of the host. Figure 5 , the second processing unit 1303 is used to execute S503.

[0171] Optionally, the file processing device further includes: a third processing unit 1304 .

[0172] The third processing unit 1304 is used to obtain the second container monitoring list; call the pre-installed target program to obtain the process information of the target process; when the file system identifier is used to indicate that the file system running the target process is the file system of the first container, update the second container monitoring list based on the process information to obtain the first container monitoring list. Figure 7 , the third processing unit 1304 is used to execute S701-S703.

[0173] Optionally, the third processing unit 1304 is specifically configured to add the file system identifier of the file system of the first container and the file directory of the first container to the second container monitoring list when the process identifier indicates that the target process is the initial process and the process event type is a process creation event; and to delete the file system identifier of the file system of the first container and the file directory of the first container from the second container monitoring list when the process identifier indicates that the target process is the initial process and the process event type is a process exit event. Figure 8 , the third processing unit 1304 is used to execute S801-S802.

[0174] Optionally, the file processing device further includes: a fourth processing unit 1305 .

[0175] The fourth processing unit 1305 is used to mount the root directory of the file system of the host machine; when the root directory does not include the installation information of the target program, send an instruction message to the host machine to instruct the host machine to install the target program, so that the host machine installs the target program in response to the instruction message and updates the root directory; when the root directory includes the installation information of the target program, load the target program. Fig. 9 , the fourth processing unit 1305 is used to execute S901-S903.

[0176] Optionally, the first processing unit 1302 is specifically configured to update the process parameters of the pre-created process according to the file system identifier to obtain an updated process; call the updated process, and obtain the file descriptor of the container file according to the file directory of at least one container. Fig.10 , the first processing unit 1302 is used to execute S1001-S1002.

[0177] Optionally, the file processing device further includes: a fifth processing unit 1306 .

[0178] The fifth processing unit 1306 is used to execute a preset processing strategy when the container file includes a malicious file; the preset processing strategy includes: restarting the container corresponding to the malicious file, deleting the malicious file, or isolating the malicious file. Fig.11 , the fifth processing unit 1306 is used to execute S1101.

[0179] An embodiment of the present application also provides a computer-readable storage medium, which includes computer execution instructions. When the computer execution instructions are executed on a computer, the computer executes the file processing method provided in the above embodiment.

[0180] The embodiment of the present application also provides a computer program, which can be directly loaded into a memory and contains software code. After being loaded and executed by a computer, the computer program can implement the file processing method provided in the above embodiment.

[0181] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented using software, the functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer-readable storage media and communication media, wherein communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium may be any available medium that a general or special-purpose computer can access.

[0182] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0183] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0184] In addition, each functional unit in each embodiment of the present invention can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a ROM, a RAM, a disk, or an optical disk.

[0185] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A file processing method, characterized in that: The target container is applied; the host machine running the target container also runs at least one container other than the target container; the file processing method includes: receiving file processing instructions; When the file processing instruction indicates processing a container file in the file system of the at least one container, traverse the file directory of the at least one container in the first container monitoring list, obtain the file descriptor of the container file from the file system of the at least one container, and perform file scanning processing on the container file according to the file descriptor; the first container monitoring list includes the file system identifier of the file system of the at least one container; When the file processing instruction indicates processing a host file in the file system of the host machine, traverse the mount directory of the pre-mounted root directory of the host file in the target container, and perform file scanning processing on the host file; Get the second container monitoring list; Calling a pre-installed target program to obtain process information of a target process; the target program is used to obtain process information of processes in different file systems; the file system is a file system of the host machine or a file system of a first container; the first container is any container of the at least one container; the process information includes: a file system identifier for indicating the file system running the target process; When the file system identifier is used to indicate that the file system running the target process is the file system of the first container, the second container monitoring list is updated based on the process information to obtain the first container monitoring list.

2. The file processing method according to claim 1, characterized in that: The process information further includes: a process event type and a process identifier; when the process identifier indicates that the target process is an initial process, the process information further includes a file directory of the first container; When the file system identifier is used to indicate that the file system running the target process is the file system of the first container, updating the second container monitoring list based on the process information to obtain the first container monitoring list includes: When the process identifier indicates that the target process is an initial process and the process event type is a process creation event, adding a file system identifier of the file system of the first container and a file directory of the first container to the second container monitoring list; When the process identifier indicates that the target process is an initial process and the process event type is a process exit event, the file system identifier of the file system of the first container and the file directory of the first container are deleted from the second container monitoring list.

3. The file processing method according to claim 1, characterized in that: Also includes: Mount the root directory of the host machine's file system; When the root directory does not include installation information of the target program, sending an instruction message for instructing the host machine to install the target program to the host machine, so that the host machine installs the target program in response to the instruction message and updates the root directory; When the root directory includes the installation information of the target program, the target program is loaded.

4. The file processing method according to claim 1 or 3, characterized in that: The target program is an extended Berkeley Packet Filter (eBPF) program.

5. The file processing method according to claim 1, characterized in that: When the file processing instruction indicates processing a container file in the file system of the at least one container, traversing the file directory of the at least one container in the pre-stored first container monitoring list, and obtaining a file descriptor of the container file from the file system of the at least one container, comprises: updating the process parameters of the pre-created process according to the file system identifier to obtain an updated process; the process is used to obtain a file descriptor of a file from the file system corresponding to the process parameters of the process; The updated process is called, and a file descriptor of the container file is obtained according to the file directory of the at least one container.

6. The file processing method according to claim 1, characterized in that: When the file processing instruction indicates processing a container file in the file system of the at least one container, after traversing the file directory of the at least one container in the pre-stored first container monitoring list, obtaining the file descriptor of the container file from the file system of the at least one container, and performing file scanning processing on the container file according to the file descriptor, the method further includes: When the container file includes a malicious file, a preset processing strategy is executed; the preset processing strategy includes: restarting the container corresponding to the malicious file, deleting the malicious file, or isolating the malicious file.

7. A file processing device, characterized in that: include: A receiving unit, a first processing unit, a second processing unit, and a third processing unit; The receiving unit is used to receive a file processing instruction; The first processing unit is configured to, when the file processing instruction received by the receiving unit indicates processing of a container file in a file system of at least one container, traverse the file directory of the at least one container in the first container monitoring list, obtain a file descriptor of the container file from the file system of the at least one container, and perform file scanning processing on the container file according to the file descriptor; the first container monitoring list includes a file system identifier of the file system of the at least one container; The second processing unit is configured to, when the file processing instruction received by the receiving unit indicates processing a host file in a file system of the host machine, traverse a mount directory of a pre-mounted root directory of the host file in the target container, and perform file scanning processing on the host file; The third processing unit is used for: Get the second container monitoring list; Calling a pre-installed target program to obtain process information of a target process; the target program is used to obtain process information of processes in different file systems; the file system is a file system of the host machine or a file system of a first container; the first container is any container of the at least one container; The process information includes: a file system identifier for indicating a file system running the target process; When the file system identifier is used to indicate that the file system running the target process is the file system of the first container, the second container monitoring list is updated based on the process information to obtain the first container monitoring list.

8. The file processing device according to claim 7, characterized in that: The process information further includes: a process event type and a process identifier; when the process identifier indicates that the target process is an initial process, the process information further includes a file directory of the first container; the third processing unit is specifically configured to: When the process identifier indicates that the target process is an initial process and the process event type is a process creation event, adding a file system identifier of the file system of the first container and a file directory of the first container to the second container monitoring list; When the process identifier indicates that the target process is an initial process and the process event type is a process exit event, the file system identifier of the file system of the first container and the file directory of the first container are deleted from the second container monitoring list.

9. The file processing device according to claim 7, characterized in that: Also includes: A fourth processing unit; the fourth processing unit is used to: Mount the root directory of the host machine's file system; When the root directory does not include installation information of the target program, sending an instruction message for instructing the host machine to install the target program to the host machine, so that the host machine installs the target program in response to the instruction message and updates the root directory; When the root directory includes the installation information of the target program, the target program is loaded.

10. The file processing device according to claim 7 or 8, characterized in that: The target program is an extended Berkeley Packet Filter (eBPF) program.

11. The file processing device according to claim 7, characterized in that: The first processing unit is specifically configured to: updating the process parameters of the pre-created process according to the file system identifier to obtain an updated process; the process is used to obtain a file descriptor of a file from the file system corresponding to the process parameters of the process; The updated process is called, and a file descriptor of the container file is obtained according to the file directory of the at least one container.

12. The file processing device according to claim 7, characterized in that: Also includes: a fifth processing unit; The fifth processing unit is configured to execute a preset processing strategy when the container file includes a malicious file; The preset processing strategy includes: restarting the container corresponding to the malicious file, deleting the malicious file, or isolating the malicious file.

13. A file processing device, characterized in that: It comprises a memory and a processor; the memory is used to store computer-executable instructions, and the processor is connected to the memory through a bus; when the file processing device is running, the processor executes the computer-executable instructions stored in the memory, so that the file processing device executes the file processing method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer is enabled to execute the file processing method according to any one of claims 1 to 6.

Images