A method for setting file permissions based on hash values

Abstract

The present invention discloses a method for setting file permissions based on hash values, the method comprising: performing a hash operation on all files to obtain a hash value for each file, and corresponding the hash value of each file, the operation mode of each file, and the operation permission of each file one by one to form an operation rule list; a user overwrites the address corresponding to the original system function with the address of the rewritten system function, thereby forming a system call table with an updated address; the user issues an operation instruction in user mode and enters kernel mode via an interrupt program, and the kernel mode finds the address of the rewritten system function executed corresponding to the operation mode in the operation instruction according to the system call table with the updated address, thereby obtaining the rewritten system function. The present invention determines file permission restrictions by increasing the hash value, which can, on the one hand, avoid erroneous operations by legitimate users, such as accidental deletion of files; and, on the other hand, effectively prevent super administrator users and illegal users from stealing information of private files.

Description

Technical Field

[0001] The present invention relates to the technical field of file management, and in particular to a method for setting file permissions based on hash values. Background Art

[0002] Since the vast majority of users use personal computers, they are generally trusted people, such as family members and friends. In this case, everyone can log in directly as an administrator; however, this is not the case on servers. Servers are accessed by more people, and the more important and valuable the data being run is, the less likely it is to be read or tampered with at will. Therefore, the permissions set on the server must be more detailed, and the user classification must be clearer. Unlike Windows systems, Linux systems add many attributes to each file, and their biggest function is to maintain data security. In Linux systems, files related to system services are usually only readable or writable by super administrators (such as root). Take the / etc / shadow file for example. This file records the password data of all users in the system and is very important. Therefore, it must not be read by anyone else. Only super administrators have read permissions, otherwise the password data will be stolen, resulting in data leaks.

[0003] In a mature software development team, we often want everyone on the team to have access to files in certain directories, while not restricting access to other members. This can be achieved by simply adding everyone on the team to a new group and granting this group read and write permissions to the directory. This also means that if directory permissions aren't properly configured, it's difficult to prevent others from accessing and modifying important files. For example, commands like powering on and off, dialing up ADSL, and adding or deleting users, which are typically only accessible to the super administrator, can be easily compromised if anyone has these permissions. Unexplained system failures and even crashes can occur. Therefore, on Linux servers, not all users should be able to log in as super administrators. User levels and permissions should be appropriately assigned based on their specific work and roles. In Linux, the three most common file permissions are read, write, and execute. Each file has specific access permissions assigned to different users. The Linux command ls displays the access permissions for each file. This role-based approach ensures stable operation and data security on Linux servers.

[0004] Currently, file permissions in Linux systems are mostly based on permissions assigned by user roles. When a user role is elevated or an illegal login occurs, the permissions that can be used to manipulate files are expanded, posing a threat to system security, privacy, and even stability. The super administrator account is particularly vulnerable because it plays an almost uncontrollable role in the system and has the highest permissions. Therefore, once this type of user role is used to perform operations, all files set by other users are readable and writable. If a user creates a system-level file and wants to restrict editing to anyone except themselves, including the super administrator user, this is impossible in Linux systems because the super administrator user has the highest permissions and is not subject to read and write permissions. Such restrictions can only prevent other users from accessing and editing. If the super administrator account is stolen, the security of the file will be compromised. Summary of the Invention

[0005] Purpose of the Invention: This invention provides a method for setting file permissions based on hash values. This method addresses the problem in Linux systems where file permissions cannot be restricted to super administrators. It also addresses the problem in Linux systems where, even when some file permissions have been restricted, a simple operation (such as copying the file to another directory and running it) can circumvent the restrictions. This invention determines file permission restrictions based on hash values, effectively improving file security.

[0006] Technical solution: The present invention provides a method for setting file permissions based on a hash value, the method comprising the following steps:

[0007] (1) Create a list of file operation rules

[0008] Perform hash operations on all files to obtain the hash value of each file, and then map the hash value of each file, the operation method of each file, and the operation permission of each file to form an operation rule list;

[0009] (2) Update the system call table

[0010] The user indexes and reads the original system function in the system call table to obtain the original system function and its corresponding address, and then overwrites the address corresponding to the original system function with the rewritten system function address, thereby forming a system call table with updated addresses;

[0011] (3) Operation

[0012] The user issues an operation instruction in user state and enters kernel state through the interrupt program. The kernel state finds the address of the rewritten system function that is executed according to the operation mode in the operation instruction based on the system call table with the updated address, thereby obtaining the rewritten system function; the rewritten system function then calculates the hash value of the corresponding file in the operation instruction, and uses the hash value to search the operation permission of the file in the operation rule list, and determines whether to continue based on the operation permission. If so, subsequent operations are allowed; if not, subsequent operations are prohibited.

[0013] Furthermore, the specific process of the rewritten system function calculating the hash value of the corresponding file in the operation instruction is as follows:

[0014] 1) First, the operation instruction includes the address of the file, and then the address of the file in the operation instruction is used for addressing, thereby obtaining the corresponding file in the operation instruction;

[0015] 2) The rewritten system function includes a hash function. The hash function in the rewritten system function is called to perform a hash operation on the corresponding file in the operation instruction, thereby obtaining a hash value of the corresponding file in the operation instruction.

[0016] Furthermore, the specific process of the rewritten system function address overwriting the address corresponding to the original system function is as follows:

[0017] First, write the rewritten system function into the driver file, then run the driver file to obtain the rewritten system function address, and then overwrite the address corresponding to the original system function with the rewritten system function address.

[0018] Furthermore, the system call table includes multiple system functions, and each system function corresponds to an operation mode of a file.

[0019] Furthermore, the operation instruction includes the operation mode of the file and the address of the file.

[0020] Beneficial effects of the present invention: The present invention proposes a method for setting file permissions based on hash values. In the Linux system, the method adds the use of hash values to determine file permission restrictions. On the one hand, it can avoid erroneous operations by legitimate users, such as accidental deletion of files; on the other hand, it can effectively prevent super administrator users and illegal users (such as those who elevate their rights through vulnerabilities) from stealing information of private files. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 Flow chart of the method of the present invention;

[0022] Figure 2 A flowchart for running operations. DETAILED DESCRIPTION

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0024] In Linux systems, file operations are mostly based on user role permissions. Roles like the super administrator have permissions to all files, but some files should not be accessible or edited even by the super administrator, which poses a file security issue. Furthermore, when some operating permissions are restricted, such as files in a specified directory cannot be run, simple operations (such as copying files to another directory to run them) can circumvent the restrictions. Ultimately, this fails to meet user demands for file permission restrictions. The present invention addresses the file operating permission issue in Linux systems by setting hash values.

[0025] like Figure 1 As shown, the present invention provides a method for setting file permissions based on a hash value, the method comprising the following steps:

[0026] (1) Create a list of file operation rules

[0027] All files are hashed to obtain their hash values. Each file's hash value, each file's operation mode, and each file's operation permissions are mapped one-to-one to form an operation rule list. The operation rule list is essentially a mapping table, indexed by the file's hash value, that records the permissions for all file operations, such as read, write, and run. Because the file's hash value is used as an index to determine file permissions, this method is suitable for scenarios where files are infrequently updated.

[0028] (2) Update the system call table

[0029] The user indexes and reads the original system function in the system call table to obtain the original system function and its corresponding address, and then overwrites the address corresponding to the original system function with the rewritten system function address, thereby forming a system call table with an updated address; the system function is a built-in function in the Linux system;

[0030] First, the system call table is a table composed of multiple system functions. The table includes multiple system functions, and each system function corresponds to the operation mode of a file. The table can index the system function and locate the function address to complete the system call;

[0031] The specific process of overwriting the address of the rewritten system function to overwrite the address corresponding to the original system function is as follows: write the rewritten system function into the driver file, such as the file reading, writing, running and other system functions, and then run the driver file to obtain the rewritten system function address, and then overwrite the address corresponding to the original system function with the rewritten system function address, so that the original reading, writing and other system functions can be replaced; finally, the system call table with the updated address is obtained;

[0032] (3) Operation

[0033] like Figure 2 As shown, the user issues an operation instruction in the user state and enters the kernel state through the interrupt program. The operation instruction includes the operation mode of the file and the address of the file. The kernel state finds the address of the rewritten system function executed corresponding to the operation mode in the operation instruction according to the system call table with the updated address, thereby obtaining the rewritten system function. The process is: first determine the operation mode in the operation instruction, and then because each system function in the system call table corresponds to the operation mode of a file, the system function can be determined according to the operation mode. It should be noted that the system function is the original system function, because we only update the address in the system call table, and then find the corresponding address according to the original system function. The address is the address of the rewritten system function, and then the rewritten system function is obtained according to the address;

[0034] Then the rewritten system function calculates the hash value of the corresponding file in the operation instruction. The specific process is as follows:

[0035] 1) First, the operation instruction includes the address of the file, and then the address of the file in the operation instruction is used for addressing, thereby obtaining the corresponding file in the operation instruction;

[0036] 2) The rewritten system function includes a hash function, and the hash function in the rewritten system function is called to perform a hash operation on the corresponding file in the operation instruction, thereby obtaining a hash value of the corresponding file in the operation instruction;

[0037] Then use the hash value to search the operation permission of the file in the operation rule list, and determine whether to continue based on the operation permission. If yes, subsequent operations are allowed; if not, subsequent operations are prohibited.

[0038] Common file operations include opening files, reading files, writing files, and running files. Here, we take reading files as an example: first, the system function corresponding to the file reading operation is already a built-in function in the existing Linux system, and then the driver file is run to obtain the rewritten system function address, and then the rewritten system function address overwrites the address corresponding to the original system function. The user wants to read file A. After the user state issues an operation instruction, the kernel state searches the system call table for the system function (old) corresponding to the file reading operation, and then finds the corresponding address based on the system function (old). This address is the address of the rewritten system function, and then the rewritten system function is obtained based on the address;

[0039] Run the rewritten system function, calculate the hash value of the corresponding file in the operation instruction, and then use the hash value to find the operation permission of the file in the operation rule list. According to the operation permission, determine whether to continue. If yes, continue to allow subsequent operations; if not, prohibit subsequent operations.

[0040] Example 1

[0041] Example: Reading file A

[0042] (1) Create a list of operation rules for file A

[0043] Perform a hash operation on file A to obtain the hash value of file A. Then, map the hash value of file A, the operation mode of file A, and the operation permissions of file A one-to-one to form an operation rule list, as shown in the following table:

[0044]

[0045] (2) Update the system call table

[0046] The user indexes and reads the original system function (the function corresponding to the read operation) in the system call table to obtain the original system function and its corresponding address, and then overwrites the address corresponding to the original system function with the rewritten system function address, thereby forming a system call table with updated addresses; the original system function is a built-in function in the Linux system; the rewritten system function is a permission judgment method constructed by adding a hash function and an operation rule list before the original system function;

[0047] The specific process of overwriting the address of the rewritten system function to cover the address corresponding to the original system function is as follows: write the rewritten system function into the driver file, then run the driver file to obtain the rewritten system function address, and then overwrite the address corresponding to the original system function with the rewritten system function address, so that the original system function corresponding to the read operation can be replaced; finally, the system call table with the updated address is obtained;

[0048] (3) Operation

[0049] The user issues a read operation instruction in user mode and enters kernel mode via the interrupt program. The read operation instruction includes the read operation mode and the address of file A. The kernel mode finds the address of the rewritten system function corresponding to the read operation mode according to the system call table with the updated address, thereby obtaining the rewritten system function. The process is as follows:

[0050] First, determine the read operation mode in the operation instruction, and then determine the system function based on the read operation mode. It should be noted that the system function is the original system function, because we only update the address in the system call table. Then, find the corresponding address based on the original system function. This address is the address of the rewritten system function, and then get the rewritten system function based on the address. In fact, the rewritten system function is found based on the address. The change of address is executed when the driver file is inserted. The system call table no longer has the address of the original system function.

[0051] Then the rewritten system function calculates the hash value of file A. The specific process is:

[0052] 1) First, the address of file A included in the read operation instruction is read, and then addressing is performed using the address of file A in the read operation instruction, thereby obtaining the corresponding file A in the read operation instruction;

[0053] 2) The rewritten system function includes a hash function, and the hash function in the rewritten system function is called to perform a hash operation on the file A corresponding to the read operation instruction, thereby obtaining a hash value of the file A corresponding to the read operation instruction;

[0054] Then use the hash value to search the operation rules list for the operation permissions of file A and find that the read operation mode of file A is prohibited, that is, subsequent operations are prohibited.

[0055] The present invention adds a method of determining file permission restrictions by using hash values in the Linux system. On the one hand, it can avoid erroneous operations by legitimate users, such as accidental deletion of files; on the other hand, it can effectively prevent super administrator users and illegal users (such as those who elevate their rights through vulnerabilities) from stealing information of private files.

Claims

1. A method for setting file permissions based on hash values, characterized in that: The method comprises the following steps: (1) Create a list of file operation rules Perform hash operations on all files to obtain the hash value of each file, and then map the hash value of each file, the operation method of each file, and the operation permission of each file to form an operation rule list; (2) Update the system call table The user indexes and reads the original system function in the system call table to obtain the original system function and its corresponding address, and then overwrites the address corresponding to the original system function with the rewritten system function address, thereby forming a system call table with updated addresses; (3) Operation The user issues an operation instruction in user state and enters kernel state through the interrupt program. The kernel state finds the address of the rewritten system function that is executed according to the operation mode in the operation instruction based on the system call table with the updated address, thereby obtaining the rewritten system function; the rewritten system function then calculates the hash value of the corresponding file in the operation instruction, and uses the hash value to search the operation permission of the file in the operation rule list, and determines whether to continue based on the operation permission. If so, subsequent operations are allowed; if not, subsequent operations are prohibited.

2. A method for setting file permissions based on hash values according to claim 1, characterized in that: The specific process of calculating the hash value of the corresponding file in the operation instruction by the rewritten system function is as follows: 1) First, the operation instruction includes the address of the file, and then the address of the file in the operation instruction is used for addressing, thereby obtaining the corresponding file in the operation instruction; 2) The rewritten system function includes a hash function. The hash function in the rewritten system function is called to perform a hash operation on the corresponding file in the operation instruction, thereby obtaining a hash value of the corresponding file in the operation instruction.

3. The method for setting file permissions based on hash values according to claim 1, wherein: The specific process of overwriting the address of the rewritten system function to cover the address corresponding to the original system function is as follows: First, write the rewritten system function into the driver file, then run the driver file to obtain the rewritten system function address, and then overwrite the address corresponding to the original system function with the rewritten system function address.

4. The method for setting file permissions based on hash values according to claim 1, wherein: The system call table includes multiple system functions, and each system function corresponds to an operation mode of a file.

5. The method for setting file permissions based on hash values according to claim 1, wherein: The operation instruction includes the operation mode of the file and the address of the file.

Images