A software package management method and system based on authority control

Abstract

The present invention discloses a software package management method and system based on permission control, the method of the present invention comprises: extracting permission control information from a target software package; comparing the permission control information extracted from the target software package with the permission control information of the current host, and only when the two permission control information match, allowing and executing the management operation of the target software package in the current host, the management operation refers to software installation, software update or software uninstallation. The present invention can realize software package management based on permission control, can reduce the construction and maintenance costs of software warehouses, improve the processing efficiency of software packages, can realize the source tracking of software packages, improve the management efficiency of software packages in the whole life cycle process, provide support for the unified installation management of software packages, and has the advantages of simple management, convenient application and easy implementation.

Description

Technical Field

[0001] The present invention relates to software package distribution management technology in a computer operating system, and in particular to a software package management method and system based on authority control. Background Art

[0002] In the Linux operating system, various types of application software are currently provided to users in the form of software packages, which organize applications, configuration files, and management data in a unified manner, and have strong ease of use and scalability. Commonly used software packages are mainly rpm and deb. The rpm software package is a package encapsulation format provided by Redhat Linux, and the deb software package is a package installation format provided by operating systems such as Debian and Ubuntu. In Debian and Ubuntu operating systems, the management of deb format software packages is achieved through the apt / software package management tool dpkg, including software package management operations, updates, and deletions. When installing a software package, the dpkg software package management tool reads the software package content to install it and records the information in the control file. The apt software package management tool can actively obtain a list of software package information from the software repository and build a software package description and dependency database locally, and download the corresponding software package from the software repository according to the software package information for installation.

[0003] The software package processing scenarios in the existing Linux operating system are as follows: Figure 1 As shown, different software warehouses (software warehouse A to software warehouse N) are usually built for different types of users / units. System users of each type of user / unit (user group 1 to user group M) can download the software packages in the corresponding software warehouse through the apt / dpkg software package tool to implement software package management operations, updates, and uninstalls. Taking the Ubuntu operating system as an example, the software distribution control is implemented through the software source warehouse signature in the software package management mechanism. The operating system manufacturer signs the software source warehouse and integrates the public key corresponding to the software source warehouse into its distribution version. When the user downloads the software from the software warehouse source, the signature information of the software source is first verified with the public key certificate in the system. After confirming that it is a reliable software source, the software can be downloaded and installed. Otherwise, it cannot be downloaded and installed.

[0004] With the continuous advancement of domestic information system construction, the scale of domestic operating system usage has gradually expanded, and users have higher requirements for software package management, hoping to have more reliable, stricter and more practical management and control technologies. For example, software packages can be classified according to unit organizations or personnel types, different permissions are granted to users of different organizations, and software packages are identified, so as to realize a software package management method based on permission control, such as software packages can be installed, updated and uninstalled according to different permissions. The typical application scenario is as follows: For different software packages P, Q and R, different users may have different access rights. For user U1, he has the permission to use software packages P and Q, for user U2, he has the permission to use software packages Q and R, and for user U3, he has no permission to use software packages P, Q and R. Therefore, the existing software package management mechanism has the following problems: the software package cannot be managed based on permission control according to the user type. When facing different organizations and users, different software warehouse sources need to be built to meet the usage requirements of different users. This has increased the workload of operating system manufacturers for software source warehouse maintenance and management to a certain extent. Especially when there are many types of users, this problem will be magnified, and the impact on the maintenance and management of software packages is very large.

[0005] In the existing Linux operating system software package installation management process, software package installation is mainly achieved through two tools: apt and dpkg. Based on the software package management tool dpkg, the software package management tool apt can automatically detect and solve dependency problems in the software package installation process. The process of processing software packages is still implemented through the software package management tool dpkg. The software package management tool dpkg will perform targeted processing according to the structure of the software package during the software installation process. Traditional mainstream software packages provide general information for software management such as installation files, installation configuration information, and software package dependency information by default, and rely on supporting management tools for management and maintenance. Taking the deb software package in the Ubuntu system as an example, its format is as follows: Figure 2As shown. A deb package usually consists of three parts: a data package (data.tar.xz), which contains the actual installed program data; an installation information and control script package (control.tar.xz), which contains the installation instructions, labels and scripts of the deb software package; and a binary data package (debian-binary), which includes header files and other information. During the installation process, the data in the data.tar.xz package will be directly decompressed into the specified file / directory tree. The control.tar.xz contains the control information required for the installation of a deb software package, which usually includes control, preinst, postinst, prerm and postrm files. Control is used to record software identification, such as version number, platform, dependency information and other data. Preinst is a script that runs before decompressing the data package data.tar.xz. Postinst is a script that runs after decompressing the data package data.tar.xz. Prerm is a script that runs before deleting files during the uninstallation of the software package. Postrm is a script that runs after deleting files during the uninstallation of the software package.

[0006] like Figure 3 As shown, the specific processing steps of installing a software package using the existing software package management tool dpkg are as follows:

[0007] (1) Use the software package management tool dpkg to decompress the control.tar.xz file in the deb software package;

[0008] (2) The software package management tool dpkg parses the control file control by calling the parsedb function.

[0009] The specific parsing process of the control file control is as follows: S1) The control file control is read through the parsedb function in the dpkg code, and then the control file control is parsed through the parse_stanza function; S2) The parse_stanza function parses each field of the control file control, and records the starting position and length of the attribute field field and the corresponding attribute value value of each field, and calls the parsedb_parse function to process each field. Taking apt's control as an example, field refers to Package, Priority and Section, etc.; S3) The parsedb_parse_field function compares the name or alias of each field, calls the corresponding read function (such as the f_depenency function) to parse the corresponding value, and records the parsing result as M1{(field1,value1), (field2,value2),…}.

[0010] (3) The software package management tool dpkg executes the preinst script;

[0011] (4) dpkg decompresses the data.tar.xz file in the deb software package to the corresponding directory;

[0012] (5) Execute the postinst script to complete the software configuration;

[0013] (6) The software package installation process is completed.

[0014] As described above, it can be seen that during the installation of the software package by the software package management tool dpkg, the control file control does not contain information related to permission control, which makes the existing software package management tool dpkg unsuitable for specific user scenarios. For example, the developer of the software package customized a version v1 for a specific user User1, and version v1 is only applicable to the user User1, so it is hoped that version v1 can only be installed by user User1, and other users cannot install this version. Obviously, the existing software package management process cannot be applied to this scenario. Summary of the invention

[0015] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a method and system for software package management based on permission control are provided. The present invention controls the management operation, update and uninstallation of the software package in the current host by comparing the permission control information embedded in the software package with the permission control information of the host. The software package management based on permission control can be realized, and the construction and maintenance costs of the software warehouse can be reduced, and the processing efficiency of the software package can be improved. The source of the software package can be tracked, and the management efficiency of the software package during the entire life cycle can be improved, and support is provided for the unified installation management of the software package. The system has the advantages of simple management, convenient application and easy implementation.

[0016] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0017] A software package management method based on permission control, comprising:

[0018] 1) Extract the permission control information from the target software package;

[0019] 2) extracting permission control information from the target software package and the permission control information of the current host, and only allowing and executing management operations of the target software package in the current host when the two permission control information match, wherein the management operations refer to software installation, software update or software uninstallation.

[0020] Optionally, the permission control information includes at least one permission control record, and the permission control record is a permission key-value pair consisting of an attribute field and a corresponding attribute value.

[0021] Optionally, the attribute fields of the authority control information include part or all of user name, department information, security level, version number, classification information, purpose information, project information, and management operation type.

[0022] Optionally, in step 1), the target software package refers to the target deb software package, and the permission control information is embedded in the control information of the target deb software package and the attribute extension enhancement information CustomExtensions of the control file control in the script package control.tar.xz; step 1) includes:

[0023] 1.1) Unzip the control information and script package control.tar.xz of the target deb software package to obtain the control file control;

[0024] 1.2) Read the control file control, parse the attribute fields in the control file control, extract the starting position and length of each attribute field and the corresponding attribute value, obtain the name or alias of the attribute field according to the extracted starting position and length of each attribute field, call the specified read function according to the name or alias of the attribute field to parse the attribute value corresponding to each attribute field, and finally obtain the software package information of the target deb software package and the permission control information in the attribute extension enhancement information CustomExtensions.

[0025] Optionally, step 2) includes:

[0026] 2.1) Obtain the permission control information of the current host, and store the permission key-value pairs consisting of the attribute fields and corresponding attribute values ​​recorded therein into the specified variable Auth_map;

[0027] 2.2) Determine whether each attribute field and its corresponding attribute value in the attribute extension enhancement information CustomExtensions contained in the interpretation result set M1 matches all the attribute fields and their corresponding attribute values ​​in the variable Auth_map. If all match, the management operation of the target deb software package in the current host is allowed and executed. Otherwise, it is determined that the target deb software package has no management operation authority in the current host, and the management operation of the deb software package is ended and exited.

[0028] Optionally, when decompressing the management operation information and the control script package control.tar.xz of the deb software package in step 1.1), it also includes obtaining a pre-run script file preinst and a post-run script file postint, and step 2.2) includes:

[0029] 2.2.1) Traverse and select an attribute field from the attribute extension enhancement information CustomExtensions contained in the interpretation result set M1 as the current attribute field. If the traversal and selection are completed, jump to step 2.2.3); otherwise, jump to the next step;

[0030] 2.2.2) Determine whether the current attribute field has a corresponding attribute field in the variable Auth_map. If the attribute field does not exist, it is determined that the two permission control information do not match, and the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is terminated and exited; if the attribute field exists, determine whether the current attribute field and the corresponding attribute field in the variable Auth_map match. If they match, jump to step 2.2.1). If they do not match, it is determined that the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is terminated and exited;

[0031] 2.2.3) Allow and execute the management operation of the target deb software package in the current host: If the management operation is an installation operation or an update operation, first run the control information of the target deb software package and the pre-run script file preinst in the script package control.tar.xz, then copy the program data file data.tar.xz of the target deb software package to the specified directory, and finally run the control information of the target deb software package and the post-run script file postint in the script package control.tar.xz to complete the installation operation or update operation; if the management operation is an uninstallation operation, directly uninstall the target deb software package.

[0032] Optionally, when determining in step 2.2.2 whether the attribute field and the corresponding attribute field in the variable Auth_map match, if the attribute field and the corresponding attribute field in the variable Auth_map are equal or satisfy a preset constraint relationship or mapping relationship, then it is determined that the attribute field and the corresponding attribute field in the variable Auth_map match; otherwise, it is determined that the attribute field and the corresponding attribute field in the variable Auth_map do not match.

[0033] Optionally, before step 1), the step also includes receiving a software package management operation request sent by a user through a preset software package management tool apt. After receiving the software package management operation request sent by the user, if the management operation is installation or update, the software package management tool apt first obtains the required software package and its dependent software packages from the designated software warehouse source server, and then calls the software package management tool dpkg to execute steps 1) and 2) to perform installation or update operations controlled by permission control information on the required software package and its dependent software packages; if the management operation is uninstallation, the software package management tool dpkg is directly called to execute steps 1) and 2) to perform uninstall operations controlled by permission control information on the software package.

[0034] In addition, the present invention also provides a software package management system based on authority control, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the steps of the software package management method based on authority control.

[0035] In addition, the present invention also provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be executed by a microprocessor to implement the steps of the software package management method based on permission control.

[0036] Compared with the prior art, the method of the present invention comprises extracting permission control information from the target software package; comparing the permission control information extracted from the target software package and the permission control information of the current host, and allowing and executing the management operation of the target software package in the current host only when the two permission control information match, and the management operation refers to software installation, software update or software uninstallation. The present invention mainly has the following advantages:

[0037] 1. The present invention can meet the personalized usage needs of different users through one software warehouse, instead of building a separate software warehouse for each type of user, thereby reducing the construction and maintenance costs of the software warehouse.

[0038] 2. The present invention adds permission control information to the software package, distinguishes the use requirements of different users for the software package, and realizes unified processing of various software packages based on a unified software package management platform, thereby improving the processing efficiency of the software package.

[0039] 3. The present invention can track the source of the software package by adding permission control information to the software package, thereby improving the management efficiency of the software package throughout its life cycle.

[0040] In summary, the present invention controls the management operations, updates and uninstallations of the software package in the current host by comparing the permission control information embedded in the software package with the permission control information of the host, which can realize the software package management based on permission control and provide support for the unified installation management of the software package, and has the advantages of simple management, convenient application and easy implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a schematic diagram of the existing software installation principle based on the software warehouse.

[0042] Figure 2 This is a schematic diagram of the existing deb software package format;

[0043] Figure 3 A schematic diagram of the software installation process for the existing software package management tool dpkg;

[0044] Figure 4 Schematic diagram of the basic principle of the method of the embodiment of the present invention.

[0045] Figure 5 The figure is a schematic diagram of improvements to the software package format and software package management tool in an embodiment of the present invention.

[0046] Figure 6 The figure is a schematic diagram of the interaction flow of the software package management tool in the embodiment of the present invention.

[0047] Figure 7 The flowchart of performing management operation (installation) in the embodiment of the present invention. DETAILED DESCRIPTION

[0048] like Figure 4 As shown, the software package management method based on permission control in this embodiment includes:

[0049] 1) Extract the permission control information from the target software package;

[0050] 2) extracting permission control information from the target software package and the permission control information of the current host, and only allowing and executing management operations of the target software package in the current host when the two permission control information match, wherein the management operations refer to software installation, software update or software uninstallation.

[0051] In this embodiment, the authority control information may include multiple authority control records, which are authority key-value pairs consisting of attribute fields and corresponding attribute values ​​to meet the personalized usage needs of different users. In addition, for certain specific needs, one authority control record may also be used as needed.

[0052] The attribute fields required for the permission control information can be selected as needed. For example, the attribute fields of the permission control information include some or all of the user name, department information, security level, version number, classification information, purpose information, project information, and management operation type (software installation, software update, or software uninstallation). If the attribute field includes the user name, the user name can be used as the control object of the management operation to control the software installation, software update, or software uninstallation. If the user names in the two permission control information match, the software installation, software update, or software uninstallation can be performed, otherwise the software installation, software update, or software uninstallation cannot be performed. If the attribute field includes the department information, the department information can be used as the control object of the management operation to control the software installation, software update, or software uninstallation. For example, if the specified department information matches, the software installation, software update, or software uninstallation can be performed, otherwise the software installation, software update, or software uninstallation cannot be performed. In addition, the security level, version number, classification information, purpose information, and project information are deduced in turn, and are not listed one by one here. If the attribute field includes the management operation type, the permissions for software installation, software update, or software uninstallation can be classified and controlled.

[0053] It should be noted that the meaning behind extracting the permission control information from the target software package is that the permission control information is embedded in the target software package, and the method of embedding the permission control information in the target software package can be selected according to needs. As a specific implementation method, the target software package in step 1) of this embodiment refers to the target deb software package, and the permission control information is embedded in the control information of the target deb software package and the attribute extension enhancement information CustomExtensions of the control file control in the script package control.tar.xz. On the basis of the original deb software package format, the extensibility of the attributes is realized by enhancing the attribute management mechanism, thereby supporting the permission control of software installation. Figure 5 The figure shows a schematic diagram of the implementation principle of the enhanced attribute management mechanism. For the structure of the target deb software package, permission control information is added to the enhanced information CustomExtensions through the attribute extension of the control file control on the basis of the original information. The permission control information is a key embedded object of the deb software package. In addition, the software package management tool and its interface library are also enhanced (i.e., forming: software package enhancement management tool and software package enhancement interface library) to achieve compatibility with the reading and processing of the target deb software package. In addition to providing information about the basic software package, the extended and enhanced deb software package also needs to provide information related to software package security control and management, such as permission control, unified classification, purpose and project information. By adding an extended attribute system, unified management of software packages can be more convenient to meet the software package management needs in key areas. Specifically, the format of the permission control information embedded in the target deb software package in this embodiment is as follows:

[0054] CustomExtensions:security / text;

[0055] username=user1

[0056] department=kylin

[0057] level=1

[0058] The first line CustomExtensions:security / text is the default start, CustomExtensins is the field name, security / text is a MIMIE-like representation, security indicates security-related permission information, and text indicates that the information type is text. The second line contains the specific permission information, with two spaces at the beginning of the permission information. The definition format is attribute field Auth_name = attribute value Auth_value. Each line is a specific attribute field, and the attribute value Auth_value can be one or more.

[0059] In this embodiment, step 1) includes:

[0060] 1.1) Unzip the control information and script package control.tar.xz of the target deb software package to obtain the control file control;

[0061] 1.2) Read the control file control, parse each attribute field in the control file control, extract the starting position and length of each attribute field and the corresponding attribute value, obtain the name or alias of the attribute field according to the extracted starting position and length of each attribute field, call the specified read function according to the name or alias of the attribute field to parse the attribute value corresponding to each attribute field, and finally obtain the software package information of the target deb software package and the permission control information in the attribute extension enhancement information CustomExtensions. As an optional implementation, after obtaining the interpretation result set M1 in this embodiment, the interpretation result set M1 uses the pkgbin class to implement object-oriented storage, and can also be stored in other ways as needed.

[0062] In this embodiment, step 1.2) includes: reading the control file control through the parsedb function (a function in the software package management tool dpkg), and then parsing the control file control through the parse_stanza function (a function in the software package management tool dpkg), the parse_stanza function parses each attribute field therein, and records the starting position and length of each attribute field (field) and its corresponding attribute value (value), and calls the parsedb_parse function to process each attribute field (field); finally, comparing the name or alias of each attribute field (field) through the parsedb_parse_field function (a function in the software package management tool dpkg), calling the corresponding read function (such as the f_depenency function) to parse the corresponding attribute value (value), and recording the parsing result as M1{(field1, value1), (field2, value2), ...}; wherein (field1, value1) and (field2, value2) represent the attribute fields and the corresponding attribute values ​​in the software package information or the permission control information.

[0063] Take the management operation of installing software as an example, see Figure 7 In this embodiment, step 2) includes:

[0064] 2.1) Obtain the permission control information of the current host, and store the permission key-value pairs consisting of the attribute fields and the corresponding attribute values ​​recorded therein into the specified variable Auth_map; in this embodiment, the permission control information permission file Auth_file of the host is used to declare the permission information possessed by the current user environment, and its format is as follows:

[0065] Auth:

[0066] Username:user1

[0067] Department:kylin

[0068] Level:1 ......

[0070] Among them, Auth is the default beginning of the identification permission information. From the second line onwards, the specific permission information is defined. The attribute field Auth_name: attribute value Auth_value is defined in the form of permission key-value pairs. Each line is a specific attribute field, and the attribute value Auth_value is 1. It should be noted that the storage form of the host's permission control information can not only be stored as a file, but also stored as data, and can also be stored in memory as a temporary variable. The source of the host's permission control information can be either local, or a designated server or cloud.

[0071] 2.2) Determine whether each attribute field (field) and its corresponding attribute value (value) in the attribute extension enhancement information CustomExtensions contained in the interpretation result set M1 matches all the attribute fields (Auth_name) and their corresponding attribute values ​​(Auth_value) in the variable Auth_map. If all match, the management operation of the target deb software package in the current host is allowed and executed. Otherwise, it is determined that the target deb software package has no management operation authority in the current host, and the management operation of the deb software package is terminated and exited.

[0072] Since the explanation result set M1 uses the pkgbin class to implement object-oriented storage, the attribute fields in the attribute extension enhancement information CustomExtensions can be conveniently traversed as object nodes. For example, CustomExtensions->Auth is to obtain the first attribute field, and Auth->next is to obtain the next attribute field. Figure 7 As shown, in step 1.1) of this embodiment, when decompressing the control information and script package control.tar.xz of the target deb software package, it also includes obtaining the pre-run script file preinst and the post-run script file postint, and step 2.2) includes:

[0073] 2.2.1) From the attribute extension enhancement information CustomExtensions contained in the interpretation result set M1, select an attribute field as the current attribute field, denoted as Auth. The first traversal can be expressed as:

[0074] Auth = CustomExtensions->Auth

[0075] Each subsequent traversal can be expressed as:

[0076] Auth=Auth->next

[0077] If the traversal selection is completed (i.e. Auth = null), jump to step 2.2.3); otherwise (i.e. Auth! = null), jump to the next step;

[0078] 2.2.2) Determine whether the current attribute field has a corresponding attribute field in the variable Auth_map. If the attribute field does not exist, it is determined that the two permission control information do not match, and the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is terminated and exited; if the attribute field exists, determine whether the current attribute field and the corresponding attribute field in the variable Auth_map match. If they match, jump to step 2.2.1). If they do not match, it is determined that the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is terminated and exited;

[0079] 2.2.3) Allow and execute the management operation of the target deb software package in the current host: if the management operation is an installation operation or an update operation, first run the control information of the target deb software package and the pre-run script file preinst in the script package control.tar.xz, then copy the program data file data.tar.xz of the target deb software package to the specified directory, and finally run the control information of the target deb software package and the post-run script file postint in the script package control.tar.xz to complete the installation operation or update operation; if the management operation is an uninstallation operation, directly uninstall the target deb software package. In this embodiment, the attribute values ​​"user1", "kylin" and "1" of the attribute field in the attribute extension enhancement information CustomExtensions are exactly the same as the attribute values ​​"user1", "kylin" and "1" of the attribute field in the permission control information (variable Auth_map) of the current host, so the management operation of the target deb software package in the current host is allowed and executed. Taking the installation as an example, first run the control information of the target deb software package and the pre-run script file preinst in the script package control.tar.xz, then copy the program data file data.tar.xz of the target deb software package to the specified directory, and finally run the control information of the target deb software package and the post-run script file postint in the script package control.tar.xz to complete the installation operation.

[0080] In general, it is characterized in that, when determining whether the attribute field and the corresponding attribute field in the variable Auth_map match in step 2.2.2), if the attribute field and the corresponding attribute field in the variable Auth_map are equal, then it is determined that the attribute field and the corresponding attribute field in the variable Auth_map match, otherwise it is determined that the attribute field and the corresponding attribute field in the variable Auth_map do not match. Therefore, Figure 7 The matching judgment in is expressed as:

[0081] Auth.name==Map_field.name&&Auth.value==Map_field.value

[0082] Among them, Auth.name and Auth.value are the name and attribute value of the current attribute field respectively, and Map_field.name and Map_field.value are the name and attribute value of the corresponding attribute field in the variable Auth_map respectively.

[0083] In addition, considering the flexibility of attribute field matching, when judging whether the current attribute field and the corresponding attribute field in the variable Auth_map match, it includes not only equality but also wildcard matching. For example, if the attribute field "host" in the target deb software package is limited to "PC*", any current host starting with PC can have management operation permissions for the target deb software package. At this time, the matching judgment can be expressed as:

[0084] Auth.name==Map_field.name&&Match0(Map_field.value,Auth.value)

[0085] Among them, Auth.name and Auth.value are the name and attribute value of the current attribute field, Map_field.name and Map_field.value are the name and attribute value of the corresponding attribute field in the variable Auth_map, Match0 represents a matching function that supports wildcards. If the wildcard contained in Auth.value in the attribute field of the target deb software package matches Map_field.value, Match0 returns true, otherwise Match0 returns false. Since wildcard-based character comparison is an existing conventional method, its specific implementation will not be described in detail here.

[0086] In addition, considering the flexibility of attribute field matching, it is also possible to determine that the attribute field and the corresponding attribute field in the variable Auth_map match when the attribute field and the corresponding attribute field in the variable Auth_map satisfy a preset constraint relationship, for example, limiting the current host to only install software packages with a security level greater than a set security level, limiting the current host to only install software packages with a version number greater than a set version number, etc. In this case, the matching judgment can be expressed as:

[0087] Auth.name==Map_field.name&&Match1(Map_field.value,Auth.value)

[0088] Among them, Auth.name and Auth.value are the name and attribute value of the current attribute field respectively, Map_field.name and Map_field.value are the name and attribute value of the corresponding attribute field in the variable Auth_map respectively, Match1 represents the constraint judgment function, and if the wildcard contained in Auth.value in the attribute field of the target deb software package and Map_field.value meet the constraint, Match1 returns true, otherwise Match1 returns false.

[0089] In addition, considering the security of attribute field matching, it is also possible to determine that the attribute field and the corresponding attribute field in the variable Auth_map match when the attribute field and the corresponding attribute field in the variable Auth_map satisfy the preset mapping relationship. For example, the attribute value of a certain attribute field in the target deb software package is x, and the attribute value x can obtain the value y through a certain specified mapping function (such as a hash function or other encryption function). If the attribute value of the attribute field in the current host is y, then the two are determined to match. In this case, since the confidential information of the mapping function can be mastered by the administrator, the security of the software package management based on permission control can be effectively improved. At this time, the matching judgment can be expressed as:

[0090] Auth.name==Map_field.name&&Map_field.value==f(Auth.value)

[0091] Wherein, Auth.name and Auth.value are the name and attribute value of the current attribute field, Map_field.name and Map_field.value are the name and attribute value of the corresponding attribute field in the variable Auth_map, f represents a mapping function (for example, a hash function can be used), and if the result f(Auth.value) calculated by the mapping function f in the attribute field of the target deb software package is equal to Map_field.value, the expression on the right side returns true, otherwise the expression on the right side returns false. Based on the above enlightenment, an attribute field for checking the field can be further added to all attribute fields as needed, and the attribute value x of the checking field is calculated by the other attribute fields in the permission control information (for example, a hash function or other encryption function), and the attribute value x of the checking field can be obtained by a specified mapping function (for example, a hash function or other encryption function) to obtain a value y. If the attribute value of the attribute field in the current host is y, it is determined that the two match. In this case, since the confidential information of the mapping function can be manually controlled by the administrator, the security of the software package management based on permission control can be effectively improved.

[0092] Furthermore, in this embodiment, the software package management tool dpkg and its interface library for accessing the target deb software package are extended and enhanced to provide support for the unified installation management of the software package. Figure 6 As shown, before step 1) of this embodiment, the method further includes receiving a software package management operation request sent by a user through a preset software package management tool apt. After receiving the software package management operation request sent by the user, if the management operation is installation or update, the software package management tool apt first obtains the required software package and its dependent software packages from the designated software warehouse source server, and then calls the software package management tool dpkg to execute steps 1) and 2) to perform installation or update operations controlled by permission control information on the required software package and its dependent software packages; if the management operation is uninstallation, the software package management tool dpkg is directly called to execute steps 1) and 2) to perform uninstallation operations controlled by permission control information on the software package, so that the combination of the software package management tool apt and the software package management tool dpkg can be used to solve the dependency problem in the software package management operation and achieve good compatibility.

[0093] In addition, this embodiment also provides a software package management system based on authority control, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the steps of the aforementioned software package management method based on authority control.

[0094] In addition, this embodiment further provides a computer-readable storage medium, in which a computer program is stored. The computer program is used to be executed by a microprocessor to implement the steps of the aforementioned software package management method based on permission control.

[0095] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0096] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A software package management method based on authority control, characterized in that: include: 1) Extract permission control information from the target software package; 2) comparing the permission control information extracted from the target software package and the permission control information of the current host, and allowing and executing management operations of the target software package in the current host only when the two permission control information match, wherein the management operations refer to software installation, software update or software uninstallation; In step 1), the target software package refers to the target deb software package, and the permission control information is embedded in the control information of the target deb software package and the attribute extension enhancement information CustomExtensions of the control file control in the script package control.tar.xz; step 1) includes: 1.1) Unzip the control information and script package control.tar.xz of the target deb software package to obtain the control file control; 1.2) Read the control file control, parse the attribute fields in the control file control, extract the starting position and length of each attribute field and the corresponding attribute value, obtain the name or alias of the attribute field according to the extracted starting position and length of each attribute field, call the specified read function according to the name or alias of the attribute field to parse the attribute value corresponding to each attribute field, and finally obtain the software package information of the target deb software package and the permission control information in the attribute extension enhancement information CustomExtensions. Step 2) includes: 2.1) Obtain the permission control information of the current host, and store the permission key-value pairs consisting of the attribute fields and corresponding attribute values ​​recorded therein into the specified variable Auth_map; 2.2) Determine whether each attribute field and its corresponding attribute value in the attribute extension enhancement information CustomExtensions contained in the interpretation result set M1 matches all the attribute fields and their corresponding attribute values ​​in the variable Auth_map. If all of them match, the management operation of the target deb software package in the current host is allowed and executed. Otherwise, it is determined that the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is ended and exited.

2. The method for managing software packages based on authority control according to claim 1, characterized in that: The authority control information includes at least one authority control record, and the authority control record is an authority key-value pair consisting of an attribute field and a corresponding attribute value.

3. The method for managing software packages based on authority control according to claim 2, characterized in that: The attribute fields of the authority control information include part or all of the user name, department information, security level, version number, classification information, purpose information, project information, and management operation type.

4. The method for managing software packages based on authority control according to claim 1, characterized in that: When decompressing the control information and script package control.tar.xz of the target deb software package in step 1.1), it also includes obtaining the pre-run script file preinst and the post-run script file postint. Step 2.2) includes: 2.2.1) Traverse and select an attribute field from the attribute extension enhancement information CustomExtensions contained in the interpretation result set M1 as the current attribute field. If the traversal and selection are completed, jump to step 2.2.3); otherwise jump to the next step; 2.2.2) Determine whether the current attribute field has a corresponding attribute field in the variable Auth_map. If the attribute field does not exist, it is determined that the two permission control information do not match, and the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is terminated and exited; if the attribute field exists, determine whether the current attribute field and the corresponding attribute field in the variable Auth_map match. If they match, jump to step 2.2.1). If they do not match, it is determined that the target deb software package has no management operation permission in the current host, and the management operation of the deb software package is terminated and exited; 2.2.3) Allow and execute the management operation of the target deb software package in the current host: If the management operation is an installation operation or an update operation, first run the control information of the target deb software package and the pre-run script file preinst in the script package control.tar.xz, then copy the program data file data.tar.xz of the target deb software package to the specified directory, and finally run the control information of the target deb software package and the post-run script file postint in the script package control.tar.xz to complete the installation operation or update operation; if the management operation is an uninstallation operation, directly uninstall the target deb software package.

5. The method for managing software packages based on authority control according to claim 4, characterized in that: In step 2.2.2), when determining whether the attribute field and the corresponding attribute field in the variable Auth_map match, if the attribute field and the corresponding attribute field in the variable Auth_map are equal or satisfy a preset constraint relationship or mapping relationship, then it is determined that the attribute field and the corresponding attribute field in the variable Auth_map match; otherwise, it is determined that the attribute field and the corresponding attribute field in the variable Auth_map do not match.

6. The method for managing software packages based on authority control according to claim 1, characterized in that: Before step 1), the method also includes receiving a software package management operation request sent by a user through a preset software package management tool apt. After receiving the software package management operation request sent by the user, if the management operation is installation or update, the software package management tool apt first obtains the required software package and its dependent software packages from the designated software warehouse source server, and then calls the software package management tool dpkg to execute steps 1) and 2) to perform installation or update operations controlled by permission control information on the required software package and its dependent software packages; if the management operation is uninstallation, the software package management tool dpkg is directly called to execute steps 1) and 2) to perform uninstallation operations controlled by permission control information on the software package.

7. A software package management system based on authority control, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the steps of the software package management method based on authority control as recited in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored therein, characterized in that: The computer program is used to be executed by a microprocessor to implement the steps of the software package management method based on authority control as described in any one of claims 1 to 6.

Images