Capability configuration method, electronic device, and storage apparatus

Abstract

The application discloses a capability configuration method, an electronic device and a storage device. The method comprises the following steps: receiving a processing instruction of an application program; starting a process related to the application program in response to the processing instruction; and reading capability information corresponding to the application program from pre-stored information of a Linux kernel during the process of starting the process related to the application program, and configuring the capability of the process related to the application program based on the capability information. According to the above scheme, the capability configuration of the process related to the application program can be directly realized according to the pre-stored information of the Linux kernel, and the flexibility of the capability configuration is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a capability configuration method, an electronic device and a storage device. BACKGROUND

[0002] With the development of the Internet, the Linux system is used more and more widely. Generally, different application programs can be installed on the Linux system, including third-party application programs. Considering the security of the Linux system, the permissions of the installed application programs need to be limited. For example, more operation permissions can be configured for the application programs with high security, such as setting root limited rights; and less operation permissions can be configured for the application programs with low security.

[0003] At present, the permission configuration of the application program in the Linux system is performed by prewriting in the application program file, and then the permission of the application program is determined based on the application program file. However, some application program files do not have write permission, resulting in that the permission cannot be configured or changed. SUMMARY

[0004] The technical problem solved by the present application is to provide a capability configuration method, an electronic device and a storage device, which can directly realize the capability configuration of the application program related process according to the pre-stored information of the Linux kernel, and improve the flexibility of the capability configuration.

[0005] In order to solve the above problems, the first aspect of the present application provides a capability configuration method, which comprises: receiving a processing instruction of an application program; in response to the processing instruction, starting a process related to the application program; and in the process of starting the process related to the application program, reading capability information corresponding to the application program from pre-stored information of a Linux kernel, and configuring the capability for the process related to the application program based on the capability information.

[0006] In order to solve the above problems, the second aspect of the present application provides an electronic device, which comprises a memory and a processor coupled with each other. The memory stores program data, and the processor is configured to execute the program data to implement any step of the above capability configuration method.

[0007] In order to solve the above problems, the third aspect of the present application provides a storage device, which stores program data capable of being executed by a processor. The program data is used to implement any step of the above capability configuration method.

[0008] The above scheme is different from the prior art. In the application, after receiving the processing instruction for the application program, the application program related process is started in response to the processing instruction. The capability configuration of the application program related process is directly implemented according to the pre-stored information of the Linux kernel in the process of starting the application program related process, and the capability configuration does not need to be implemented through the application program file. Therefore, the capability configuration is not limited by whether the application program file has the write permission, and the flexibility and applicability of the capability configuration can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0010] Figure 1 is a flowchart of a first embodiment of the capability configuration method of the application;

[0011] Figure 2 is a flowchart of an embodiment of step S13 in the application; Figure 1

[0012] Figure 3 is a flowchart of a second embodiment of the capability configuration method of the application;

[0013] Figure 4 is a flowchart of a third embodiment of the capability configuration method of the application;

[0014] Figure 5 is a flowchart of an embodiment of step S33 in the application; Figure 4

[0015] Figure 6 is a structural diagram of an embodiment of the capability configuration device of the application;

[0016] Figure 7 is a structural diagram of an embodiment of the electronic device of the application;

[0017] Figure 8 is a structural diagram of an embodiment of the storage device of the application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only some of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.​​

[0019] The terms "first", "second", etc. in this application are used only for descriptive purposes and are not to be construed as indicating or implying relative importance or an indicated number of technical features. Thus, features defined with "first", "second" can include at least one of the features explicitly or implicitly. In the description of this application, the meaning of "multiple" is at least two, for example, two, three, etc., unless otherwise explicitly specified. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to these processes, methods, products or devices.

[0020] In this application, referring to "embodiments" means that the specific features, structures or properties described in conjunction with the embodiments can be included in at least one embodiment of this application. The appearance of this phrase at various places in the specification does not necessarily mean the same embodiment, nor is it independent or alternative to other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0021] The present application provides the following embodiments, which will be specifically described below.

[0022] Please refer to Figure 1 , Figure 1 is a flowchart of the first embodiment of the capability configuration method of the present application. The method can include the following steps:

[0023] S11: receiving a processing instruction for an application.

[0024] In a Linux system, the process of an application (Application, referred to as App) can be set with capabilities, so that each application can have different capabilities, and different capabilities of the application can perform the ability to perform different operations. Before starting the application, a processing instruction for the application is received, wherein the processing instruction can be an instruction to start the application, and the processing instruction can also be an instruction to uninstall or install the application, etc. Specifically, the operation instruction of the user on the client side can be received, such as clicking to start the application or uninstall the application on the webpage, etc., so as to start or uninstall the application in response to the instruction. For the received processing instruction of the application, the present application does not make any limitation here.

[0025] S12: starting the process related to the application in response to the processing instruction.

[0026] The application-related process includes an application process, and if there is an executable program, the application-related process also includes a sub-process corresponding to the executable program. The application process corresponding to the processing instruction of the application can be started in response to the processing instruction of the application. In addition, after the application is started, if the application includes an executable program, a sub-process corresponding to the executable program can be started in the application process.

[0027] S13: In the process of starting the application-related process, the capability information corresponding to the application is read from the pre-stored information of the Linux kernel, and the capability of the application-related process is configured based on the capability information.

[0028] The pre-stored information stores the capability information corresponding to a plurality of applications. In the process of starting the application-related process, the capability information corresponding to the application can be read from the pre-stored information of the Linux kernel. The Linux kernel can be a security kernel of Linux. The pre-stored information can be pre-stored in the Linux kernel. After the capability information corresponding to the application is read from the pre-stored information of the Linux kernel, the capability of the application-related process can be configured based on the capability information.

[0029] In this embodiment, after receiving the processing instruction of the application in this application, the application-related process is started in response to the processing instruction. In the process of starting the application-related process, the capability information corresponding to the application is read from the pre-stored information of the Linux kernel. The capability of the application-related process is directly configured according to the pre-stored information of the Linux kernel. The capability configuration does not need to be realized through the application file. Therefore, the capability configuration does not need to be limited by whether the application file has a write permission. Thus, the flexibility of the capability configuration can be improved. In addition, the capability configuration does not depend on the application file. Therefore, the open xattr configuration of the Linux system does not need to be depended on. Resources can be saved. Further, the executable file does not need to be configured with the file capability. The executable file does not need to have a write permission. The applicability of the capability configuration is enhanced. The configuration and management of the capability information of the application are better.

[0030] In some embodiments, referring to Figure 2 , the step S13 of reading the capability information corresponding to the application from the pre-stored information of the Linux kernel can include the following steps:

[0031] S131: Obtain the identification information corresponding to the application.

[0032] In some embodiments, an index information (inode information) can be defined for each application, wherein the inode information can include meta information of files related to the application. In the present application, the inode information can include at least one of installation information, capability information, application identification, and capability identification of the application.

[0033] The installation information can be an installation path of the application, for example, an absolute installation path, so that the installation path of each application is unique. The capability information is a capability assigned to the application, so that each application corresponds to a respective set of capabilities. The application identification can be a UID (User Identification) assigned to the application, each application uniquely corresponding to a UID, the UID can be assigned from 1 and sequentially increased by natural numbers. In some application scenarios, the UID can also be referred to as a user ID (Identification), that is, an ID assigned to the application as a user. For example, user types can include superuser, normal user, virtual user, etc. The superuser can be a user with root permission, and the virtual user is used to meet the needs of file or service startup and generally does not need to log in. The capability identification can be a GID (Group Identification) of the application. The GID defines a fixed group of UIDs, and the above-mentioned UID user can be a member of a certain GID group. The GID is used for capability control of the application. For example, the GID group 20002 can include UIDs (1, 2, …, n), which can be used for capability control of application processes (APP1, APP2, …, APPn).

[0034] In some embodiments, the identification information corresponding to the application includes an application identification and / or a capability identification. The application identification is used to uniquely identify the application, and the capability identification is used to identify whether the process related to the application needs to be configured with a capability.

[0035] S132: Read the capability information corresponding to the identification information from the pre-stored information of the Linux kernel.

[0036] The pre-stored information includes index information corresponding to a plurality of applications. The pre-stored information of the application is stored in the Linux kernel, that is, the installation information, capability information, application identification, and capability identification of the application are stored in the Linux kernel. According to the obtained identification information corresponding to the application, the pre-stored information can be matched to obtain the corresponding index information, so as to read the capability information corresponding to the identification information from the pre-stored information of the Linux kernel.

[0037] In the embodiment, the identification information of the application program can uniquely identify the application program, the capability information of all executable programs in the application program can be controlled through the identification information of the application program, the capability information corresponding to the identification information is read from the pre-stored information of the Linux kernel, so that the capability information only needs to be configured for the application program, and the capability information does not need to be configured for each executable file of the application program, and all executable files contained in the application program do not need to be identified, the capability configuration effect is better, and the adaptability is stronger.

[0038] Please refer to Figure 3 , Figure 3 is a flowchart of the second embodiment of the capability configuration method of the application. The method can include the following steps:

[0039] S21: receiving a processing instruction for an application program.

[0040] The specific implementation of the step S21 can refer to the implementation process of the step S11 in the above embodiment, and will not be described here.

[0041] S22: starting an application program related process in response to the processing instruction.

[0042] The application program related process includes an application program process and / or a sub-process corresponding to an executable program. The application program process corresponding to the processing instruction can be started in response to the processing instruction for the application program.

[0043] Optionally, after starting the application program, if the application program includes an executable program, a sub-process corresponding to the executable program can be started in the application program process.

[0044] S23: reading capability information corresponding to the application program from pre-stored information of the Linux kernel during starting of the application program process, and configuring capability for the application program process based on the capability information.

[0045] The pre-stored information stores capability information corresponding to a plurality of application programs, and the capability information corresponding to the application program can be read from the pre-stored information of the Linux kernel during starting of the application program, so as to configure the capability information as the capability of the application program.

[0046] Optionally, the pre-stored information includes at least one of installation information, capability information, application program identification, capability identification and the like of the application program. The pre-stored information is stored in a preset driver module of the Linux kernel, for example, the preset driver module can be a DCAP driver module.

[0047] Optionally, the capability information corresponding to the identification information is read from the pre-stored information of the Linux kernel, and the step of reading the capability information corresponding to the application program identification from the pre-stored information of the Linux kernel can further include: determining whether the capability identification of the application program is a preset capability identification, that is, determining whether the capability identification GID of the application program is equal to the capability identification in the pre-stored information, for example, the preset capability identification is a GID group 20002. If the capability identification of the application program is the preset capability identification, the capability identification GID is equal to the group 20002, that is, the current process is controlled by the DCAP drive module, the capability information corresponding to the application program identification is read from the pre-stored information of the DCAP drive module of the Linux kernel, and the capability of the process related to the application program is configured based on the capability information. If the capability identification of the application program is not the preset capability identification, it indicates that the process does not want to be controlled by the DCAP drive module, and the step of reading the capability information corresponding to the application program identification from the pre-stored information of the DCAP drive module is not performed in the Linux kernel, that is, the capability information corresponding to the application program identification is not read from the pre-stored information of the DCAP drive module. At this time, other ways can be used to obtain the capability information corresponding to the application program.

[0048] The specific implementation of the step S23 can refer to the implementation process of the step S13 in the above embodiment, and will not be described here.

[0049] S24: If the application program includes an executable program, in the process of starting a sub-process corresponding to the executable program, the capability information corresponding to the application program is read from the pre-stored information of the Linux kernel, and the capability of the sub-process corresponding to the executable program is configured based on the capability information.

[0050] The identification information corresponding to the application program includes an application program identification and a capability identification, an executable program can be run in the application program process, and in the process of starting a sub-process corresponding to the executable program, the capability information of the application program to which the sub-process of the executable program belongs can be read from the pre-stored information of the Linux kernel, so as to configure the read capability information as the capability of the sub-process corresponding to the executable program.

[0051] In the embodiment, the pre-stored information is stored in the preset drive module of the Linux kernel, the index information corresponding to the application program in the pre-stored information includes installation information, capability information, application program identification, capability identification and the like of the application program, the index information of different application programs can be managed through the installation information of the application program, whether the capability identification of the application program is a preset capability identification is determined, and when the preset capability identification is determined, the capability information corresponding to the application program identification is read from the pre-stored information stored in the preset drive of the Linux kernel, and the capability of the process related to the application program is configured based on the capability information. A special category can be set for multiple application programs for management, and the configuration and management effect of the capability of the application program is improved.

[0052] Please refer toFigure 4 , Figure 4 is a flowchart of the third embodiment of the capability configuration method of the present application. The method can include the following steps:

[0053] S31: in response to a device startup instruction, starting a script and loading a preset driver module into a Linux kernel.

[0054] The device can be started in response to a device startup instruction. During the startup of the device, the script is automatically started, and the current process has root authority. The preset driver module is loaded into the Linux kernel by the insmod command of the Linux system in the script. For example, the preset driver module can be a DCAP driver module. The preset driver module stores pre-stored information in the Linux kernel, and the pre-stored information includes at least one of installation information, capability information, application program identification, and capability identification of an application program.

[0055] In some embodiments, during the startup of the device, a startup service for running a service process is automatically started, which can be used to start the service process, that is, can be used to start the application program. In this step, the startup service does not load the service process at this time.

[0056] S32: receiving a processing instruction for an application program.

[0057] After receiving the processing instruction for the application program, the startup service loads the service process.

[0058] The specific implementation of step S32 in this embodiment can refer to the implementation process of step S11 in the above-mentioned embodiments, which will not be described here.

[0059] S33: starting the service process after the device is started.

[0060] After the device is started, and the processing instruction for the application program is received, the service process is started by the service.

[0061] Before starting the application program process, a child process of the service process is established by a fork function in the service process, so as to start the child process of the service process. The service process can be referred to as a parent process, and the child process established in the service process is referred to as a child process.

[0062] Optionally, the capabilities of the service process and its child process are root authority. During the startup of the child process of the service process, the identification information of the child process of the service process is set as the identification information corresponding to the application program, so that the child process of the service process inherits the identification information of the service process, that is, the application program identification UID and / or the capability identification GID of the service process.

[0063] In some embodiments, please refer toFigure 5 Step S33 comprises the following steps:

[0064] S331: Find the identification information corresponding to the application based on the installation information of the application.

[0065] Before starting the sub-process of the service process, find the identification information corresponding to the application based on the installation information of the application. The installation information comprises the installation absolute path of the application. The system can dynamically assign the identification information corresponding to the application. The UID of the application identification is not a fixed value, which can be assigned from 1. The GID of the capability identification is a fixed value.

[0066] S332: Detect whether the index information of the application is included in the pre-stored information of the Linux kernel.

[0067] The index information of the application comprises the installation information of the application, the identification information corresponding to the application and the capability information. The pre-stored information is stored in the Linux kernel and in the preset drive module in the Linux kernel, i.e., the pre-stored information is stored in the DCAP drive module. The pre-stored information comprises the index information of a plurality of applications. The index information of the application can be detected based on the identification information corresponding to the application.

[0068] In this step, if the detection result is that the index information of the application is not included, step S333 is executed; if the detection result is that the index information of the application is included, step S334 or S335 is executed.

[0069] In some other embodiments, if the index information of the application is detected in the Linux kernel, but the capability information is not detected in the index information, step S333 is executed.

[0070] S333: Obtain the capability information configured by the user for the application, generate the index information of the application by using the obtained capability information, and save the index information in the pre-stored information.

[0071] In the process of obtaining the identification information corresponding to the application, the identification information corresponding to the application can be inherited from the identification information of the parent process of the currently started process. Specifically, the index information of the application is not detected in the Linux kernel, which can be the first time to start the application or install the application, or the application can not be configured with the capability information, so the capability information corresponding to the application is not stored in the kernel. The capability information configured by the user for the application is obtained, and the obtaining method can be to receive the capability information configured by the user for the application, so that the user can customize the capability information of the application. The obtained capability information, identification information, installation information and the like of the application are generated to generate the index information of the application, and the index information is saved in the pre-stored information. The pre-stored information can be a linked list including the index information of a plurality of applications, and the newly generated index information of the application can be added to the end of the linked list of the index information, so as to store the index information of the application in the DCAP drive module of the Linux kernel.

[0072] S334: If the processing instruction includes and is an uninstall instruction, delete the index information of the application from the pre-stored information.

[0073] If the received processing instruction is an uninstall instruction, the operation of uninstalling the application is performed, the service of uninstalling the application is run, and the index information of the application is deleted from the pre-stored information of the DCAP drive module of the Linux kernel.

[0074] S335: If the processing instruction includes and is not an uninstall instruction, start the child process of the service process.

[0075] When the processing instruction is not an uninstall instruction, for example, the processing instruction is an installation instruction, a start instruction and the like, the child process of the service process can be established in the service process by using the fork function to start the child process of the service process. After starting the child process of the service process, the service process will not be covered by the child process of the service process. The capability of the service process and its child process is root permission, and in the process of starting the child process of the service process, the identification information of the child process of the service process is set as the identification information corresponding to the application.

[0076] Optionally, after step S335 is executed in step S33, step S34 is executed.

[0077] S34: Start the application process by using the child process of the service process.

[0078] After the sub-process of the service process is started, the application process can be started in the sub-process of the service process by the exec function. The started application process can inherit the identification information corresponding to the service process, that is, the application identification and the capability identification corresponding to the service process and the sub-process of the service process. At this time, the started application process does not inherit the capability information of the service process and the sub-process of the service process.

[0079] In some embodiments, after the application is started, if there is an executable program, the process corresponding to the executable program can be started in the application process, that is, the sub-process corresponding to the executable program is started. If the sub-process of the executable program belongs to the same application as the application process of the parent process, the capability information read from the Linux kernel can be the same. If other application processes are started in the application process, the capability information read by the other application processes can be different when the other application processes do not belong to the same application as the application process.

[0080] Optionally, after step S34 is performed, steps S35 and / or 36 can be performed.

[0081] S35: In the process of starting the application-related process, the capability information corresponding to the application is read from the pre-stored information of the Linux kernel, and the capability of the application-related process is configured based on the capability information.

[0082] The application-related process includes the application process and the sub-process corresponding to the executable program. The application process and / or the sub-process corresponding to the executable program belong to one process of the application. The capability information corresponding to the application is read from the pre-stored information of the Linux kernel, and the capability of the application-related process is configured based on the capability information.

[0083] Optionally, reading the capability information corresponding to the identification information from the pre-stored information of the Linux kernel includes: judging whether the capability identification is a preset capability identification. If it is the preset capability identification, the capability information corresponding to the application identification is read from the pre-stored information of the Linux kernel, and the capability of the application-related process is configured based on the capability information.

[0084] S36: If the application includes an executable program, in the process of starting the sub-process corresponding to the executable program, the capability information corresponding to the application is read from the pre-stored information of the Linux kernel, and the capability of the sub-process corresponding to the executable program is configured based on the capability information.

[0085] The specific implementation of step S36 in this embodiment can refer to the implementation process of step S24 in the above-mentioned embodiments, and will not be described here.

[0086] In the application, the index information of the application, i.e. the index information including the capability information, is stored in the preset driver module of the Linux kernel, only the capability information of the leading process in the application, i.e. only the capability information of the application process started by the child process of the service process, needs to be stored, and the capability information of other executable programs started by the application does not need to be stored, so that the resources can be saved, the capability configuration of the application is facilitated, and the applicability of the capability configuration is improved.

[0087] For the above embodiment, the application provides a capability configuration device, please refer to Figure 6 , Figure 6 is a structural schematic diagram of an embodiment of the capability configuration device of the application. The capability configuration device 100 comprises a receiving module 101, a starting module 102 and a configuration module 103, and the receiving module 101, the starting module 102 and the configuration module 103 are connected with each other.

[0088] The receiving module 101 is configured to receive a processing instruction for an application.

[0089] The starting module 102 is configured to start a process related to the application in response to the processing instruction.

[0090] The starting module 102 is configured to start a process related to the application in response to the processing instruction, including: starting an application process in response to the processing instruction; after starting the application process, if the application comprises an executable program, starting a child process corresponding to the executable program.

[0091] Optionally, the starting module 102 is further configured to start a script in response to a device starting instruction, and load a preset driver module into the Linux kernel, wherein the preset information is stored in the preset driver module in the Linux kernel.

[0092] Optionally, before starting the application process, the device is started to start a service process.

[0093] Optionally, the starting of the application process comprises: starting a child process of the service process; and starting the application process by using the child process of the service process. The capability of the service process and the child process thereof is root authority. In the process of starting the child process of the service process, the identification information of the child process of the service process is set as the identification information corresponding to the application.

[0094] Optionally, before starting the sub-process of the service process, the application corresponding identification information is found based on the installation information of the application; it is detected whether the index information of the application is included in the pre-stored information of the Linux kernel, wherein the index information of the application includes the installation information of the application, the application corresponding identification information and the capability information; if not, the capability information configured by the user for the application is acquired, the index information of the application is generated by using the acquired capability information, and is saved in the pre-stored information; if yes and the processing instruction is the uninstallation instruction, the index information of the application is deleted from the pre-stored information; and / or, if yes and the processing instruction is not the uninstallation instruction, the sub-process of the service process is started.

[0095] The configuration module 103 is configured to read the capability information corresponding to the application from the pre-stored information of the Linux kernel in the process of starting the application related process, and configure the capability for the application related process based on the capability information.

[0096] In some embodiments, the capability information corresponding to the application is read from the pre-stored information of the Linux kernel, including: acquiring the identification information corresponding to the application; reading the capability information corresponding to the identification information from the pre-stored information of the Linux kernel. Wherein, the identification information corresponding to the application includes the application identification and / or the capability identification; wherein, the application identification is used to uniquely identify the application, and the capability identification is used to identify whether the capability configuration is needed for the application related process;

[0097] Wherein, the identification information corresponding to the application is acquired, including: inheriting the identification information corresponding to the application from the identification information of the parent process of the currently started process.

[0098] In other embodiments, the identification information corresponding to the application includes the application identification and the capability identification, and the capability information corresponding to the identification information is read from the pre-stored information of the Linux kernel, including: judging whether the capability identification is the preset capability identification; if yes, the capability information corresponding to the application identification is read from the pre-stored information of the Linux kernel.

[0099] Optionally, the configuration module 103 is configured to read the capability information corresponding to the application from the pre-stored information of the Linux kernel during the process of starting the application-related process, and configure the capability for the application-related process based on the capability information, including: reading the capability information corresponding to the application from the pre-stored information of the Linux kernel during the process of starting the application process, and configuring the capability for the application process based on the capability information; if the application includes an executable program, reading the capability information corresponding to the application from the pre-stored information of the Linux kernel during the process of starting the sub-process corresponding to the executable program, and configuring the capability for the sub-process corresponding to the executable program based on the capability information.

[0100] The specific implementation of the embodiment can refer to the implementation process of the above-mentioned embodiments, which will not be repeated here.

[0101] For the above-mentioned embodiments, the present application provides an electronic device, please refer to Figure 7 , Figure 7 is a structural schematic diagram of an embodiment of the electronic device of the present application. The electronic device 200 includes a memory 201 and a processor 202, wherein the memory 201 and the processor 202 are coupled to each other, the memory 201 stores program data, and the processor 202 is configured to execute the program data to realize the steps of any embodiment of the above-mentioned capability configuration method.

[0102] In the embodiment, the processor 202 can also be referred to as a CPU (Central Processing Unit, central processing unit). The processor 202 can be an integrated circuit chip with signal processing capability. The processor 202 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor 202 can also be any conventional processor.

[0103] The specific implementation of the embodiment can refer to the implementation process of the above-mentioned embodiments, which will not be repeated here.

[0104] For the above-mentioned method, it can be realized in the form of a computer program, so the present application provides a storage device, please refer to Figure 8 , Figure 8 is a structural schematic diagram of an embodiment of the storage device of the present application. The storage device 300 stores program data 301 that can be executed by a processor, and the program data can be executed by the processor to realize the steps of any embodiment of the above-mentioned capability configuration method.

[0105] The specific implementation of this embodiment can refer to the implementation process of the above-mentioned embodiments, which will not be repeated here.

[0106] The storage device 300 of this embodiment can be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc., which can store program data, or can also be a server storing the program data, which can send the stored program data to other devices for running, or can also run the stored program data by itself.

[0107] In several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic, and the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0108] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment.

[0109] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0110] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage device, which is a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, including a plurality of instructions for making an electronic device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the methods of the various embodiments of the present application.

[0111] It is apparent that those skilled in the art should understand that the modules or steps of the present application described above can be realized by general computing devices, which can be centralized on a single computing device or distributed on a network composed of multiple computing devices, and optionally, they can be realized by program codes executable by computing devices, so that they can be stored in storage devices and executed by computing devices, or they can be respectively manufactured into individual integrated circuit modules, or multiple modules or steps among them can be manufactured into a single integrated circuit module to realize. Thus, the present application is not limited to any specific combination of hardware and software.

[0112] The above description is only an embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for configuring powers, characterized in that, include: Receive processing instructions for the application; In response to the processing instruction, start the process related to the application; as well as During the startup of the application-related processes, the permission information corresponding to the application is read from the pre-stored information of the Linux kernel, and permissions are configured for the application-related processes based on the permission information, including: During the startup of the application process, the capability information corresponding to the identification information of the application is read from the pre-stored information of the Linux kernel, and the capabilities are configured for the application process based on the capability information; wherein, the pre-stored information is stored in the preset driver module in the Linux kernel; If the application includes an executable program, during the process of starting the child process corresponding to the executable program, the power information corresponding to the identification information of the application is read from the pre-stored information of the Linux kernel, and the power is configured for the child process corresponding to the executable program based on the power information. Prior to starting the processes related to the application, the following steps are included: The identification information corresponding to the application is found based on the application's installation information; The system detects whether the pre-stored information of the Linux kernel includes the index information of the application, wherein the index information of the application includes the installation information of the application, the identification information corresponding to the application, and the permission information. If not, obtain the power information configured by the user for the application, use the obtained power information to generate the index information of the application, and save it in the pre-stored information; If the processing instruction is an uninstallation instruction, then the index information of the application is deleted from the pre-stored information; and / or, if the processing instruction is not an uninstallation instruction, then a child process of the service process is started, the child process of the service process being used to start the application process.

2. The method according to claim 1, characterized in that, The step of reading the capability information corresponding to the application from the pre-stored information of the Linux kernel includes: Obtain the identification information corresponding to the application; Read the authority information corresponding to the identification information from the pre-stored information in the Linux kernel.

3. The method according to claim 2, characterized in that, The identification information corresponding to the application includes an application identifier and / or a capability identifier; wherein, the application identifier is used to uniquely identify the application, and the capability identifier is used to identify whether the process related to the application needs to be configured with capabilities; And / or, obtaining the identification information corresponding to the application includes: The application inherits its corresponding identification information from the identification information of the parent process of the currently launched process.

4. The method according to claim 1 or 2, characterized in that, The step of starting the application-related process in response to the processing instruction includes: In response to the processing instruction, the application process is started; After the application is launched, if the application includes an executable program, then the child process corresponding to the executable program is launched.

5. The method according to claim 4, characterized in that, The identification information corresponding to the application includes the application identifier and the capability identifier. Reading the capability information corresponding to the identification information from the pre-stored information of the Linux kernel includes: Determine whether the power identifier is a preset power identifier; If it is the preset capability identifier, then the capability information corresponding to the application identifier is read from the pre-stored information of the Linux kernel.

6. The method according to claim 4, characterized in that, Before launching the application process, the method further includes: After the device starts up, the service process will begin. Starting the application process includes: Start a child process of the service process; The application process is started using a child process of the service process.

7. The method according to claim 6, characterized in that, The service process and its child processes have root privileges. And / or, the method further includes: During the process of starting the child process of the service process, the identification information of the child process of the service process is set to the identification information corresponding to the application.

8. The method according to claim 1, characterized in that, The method further includes: In response to the device startup command, the startup script is started, and the preset driver module is loaded into the Linux kernel.

9. An electronic device, characterized in that, The method includes a memory and a processor coupled to each other, the memory storing program data and the processor executing the program data to implement the steps of the method according to any one of claims 1 to 8.

10. A storage device, characterized in that, The system stores program data that can be executed by a processor, the program data being used to implement the steps of the method according to any one of claims 1 to 8.

Images