Linux software anti-uninstallation methods, devices, electronic equipment, and storage media

Abstract

This application provides a method, apparatus, electronic device, and storage medium for preventing Linux software uninstallation. The method includes the following steps: upon detecting successful installation of target software, setting the file attributes of the target software's installation folder to an unmodifiable state; starting the user process of the target software and setting it to start automatically at boot; setting the uninstallation flag of the target software to a first value, where the first value indicates that the target software cannot be uninstalled; and loading the kernel module of the target software based on its user process. This application can prevent software from being uninstalled. Simultaneously, it reduces the probability of the anti-uninstallation function being cracked. Furthermore, this application also has the advantage of minimal impact on the system.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a method, apparatus, electronic device, and storage medium for preventing Linux software from being uninstalled. Background Technology

[0002] Currently, to protect the security of domestically developed Linux desktop operating systems, desktop security software needs to be installed for real-time system monitoring. However, if this security software is uninstalled arbitrarily, the system loses its protection; therefore, it is necessary to prevent the uninstallation of security software.

[0003] In existing technologies, methods to prevent security software from being uninstalled mainly include the following steps: when an external signal indicating that the software to be uninstalled is being received is obtained, it is detected whether the process of the software to be uninstalled is alive; if the uninstallation process is alive, the uninstallation process of the software to be uninstalled is terminated; if the uninstallation process is not alive, it is detected whether the installation directory of the software to be uninstalled exists; if the installation directory of the software to be uninstalled exists, the uninstallation process of the software to be uninstalled is terminated.

[0004] However, users can bypass the anti-uninstallation function by deleting the installation directory of the software to be uninstalled and closing its process.

[0005] Therefore, existing technologies still have the problem of software being illegally and forcibly uninstalled. Summary of the Invention

[0006] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for preventing Linux software from being uninstalled. Furthermore, this application can reduce the probability of the anti-uninstallation function being cracked.

[0007] In a first aspect, the present invention provides a method for preventing Linux software from being uninstalled, the method comprising:

[0008] Once the target software is detected to be successfully installed, the file attributes of the installation folder of the target software are set to an unmodifiable state.

[0009] Start the user process of the target software and set the user process of the target software to start automatically at boot.

[0010] Set the uninstallation flag of the target software to a first value, wherein the first value indicates that the target software cannot be uninstalled;

[0011] The kernel module of the target software is loaded based on the user process of the target software;

[0012] Based on the kernel module of the target software, determine whether the processing object of the process shutdown system call is the user process of the target software. If so, refuse to execute the process shutdown system call.

[0013] Based on the kernel module of the target software, determine whether the processing object of the file attribute modification system call is the installation folder of the target software. If so, refuse to execute the file attribute modification system call.

[0014] Based on the kernel module of the target software, it is determined whether the processing object of the boot startup settings system call is a user process of the target software. If so, the execution of the boot startup settings system call is refused.

[0015] In the first aspect of this application, by setting the file attributes of the target software's installation folder to an unmodifiable state, the user can be prevented from deleting the target software's installation folder in user mode. By starting the target software's user process and setting the target software's user process to start on boot, the target software's user process can be kept running at all times, thereby preventing the user from bypassing the anti-uninstallation function by deleting the target software's user process.

[0016] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0017] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0018] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0019] In an optional implementation, setting the file attributes of the installation folder of the target software to an unmodifiable state includes:

[0020] The chattr command on Linux systems sets the file attributes of the installation folder of the target software to an unmodifiable state.

[0021] In the above optional implementation, the chattr command based on the Linux system can set the file attributes of the installation folder of the target software to an unmodifiable state.

[0022] In an optional implementation, the method further includes:

[0023] Register a hook function, wherein the hook function is used to intercept the process shutdown system call, the file attribute modification system call, and the boot startup settings system call.

[0024] In the above optional implementation, by registering hook functions, the system calls for closing the process, modifying file attributes, and setting startup settings can be intercepted.

[0025] In an optional implementation, the method further includes:

[0026] Randomly generate uninstallation codes;

[0027] The uninstallation code is input into the uninstallation tool so that the uninstallation tool calculates the first verification code based on a preset algorithm and the uninstallation code;

[0028] The first verification code is displayed so that the user can input the first verification code into a pre-generated image interface;

[0029] Obtain the first verification code from the image interface, and compare the first verification code with the second verification code. If the first verification code and the second verification code are the same, set the file attributes of the installation folder of the target software to a modifiable state.

[0030] Remove the kernel module of the target software and respond to the uninstallation command for the target software.

[0031] In the above optional implementation, by randomly generating an uninstallation code, a first verification code can be calculated. Then, by comparing the first verification code with a second verification code, if the first verification code is the same as the second verification code, the kernel module of the target software can be removed, and an uninstallation command for the target software can be responded to, thus completing the normal uninstallation of the target software.

[0032] Secondly, the present invention provides a Linux software anti-uninstallation device, the device comprising:

[0033] The file operation unit is used to set the file attributes of the installation folder of the target software to an unmodifiable state after the target software is detected to be successfully installed.

[0034] A process setting unit is used to start the user process of the target software and set the user process of the target software to start automatically at boot.

[0035] The uninstallation attribute setting unit is used to set the uninstallation flag of the target software to a first value, wherein the first value indicates that the target software cannot be uninstalled.

[0036] A loading unit is used to load the kernel module of the target software based on the user process of the target software;

[0037] The first judgment unit is used to determine, based on the kernel module of the target software, whether the processing object of the process shutdown system call is the user process of the target software; if so, the execution of the process shutdown system call is refused.

[0038] The second judgment unit is used to determine, based on the kernel module of the target software, whether the processing object of the file attribute modification system call is the installation folder of the target software; if so, the file attribute modification system call is refused to be executed.

[0039] The third judgment unit is used to determine, based on the kernel module of the target software, whether the processing object of the boot startup settings system call is the user process of the target software. If so, the execution of the boot startup settings system call is refused.

[0040] The apparatus of the second aspect of this application, by implementing a Linux software anti-uninstallation method, can prevent users from deleting the installation folder of the target software in user mode by setting the file attributes of the target software's installation folder to an unmodifiable state. By starting the user process of the target software and setting the user process of the target software to start at boot, the user process of the target software can be kept running at all times, thereby preventing users from bypassing the anti-uninstallation function by deleting the user process of the target software.

[0041] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0042] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0043] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0044] In an optional implementation, the file operation unit is specifically used for:

[0045] The chattr command on Linux systems sets the file attributes of the installation folder of the target software to an unmodifiable state.

[0046] In the above optional implementation, the chattr command based on the Linux system can set the file attributes of the installation folder of the target software to an unmodifiable state.

[0047] In an optional embodiment, the apparatus further includes:

[0048] A registration unit is used to register hook functions, wherein the hook functions are used to intercept the process shutdown system call, the file attribute modification system call, and the boot startup settings system call.

[0049] In the above optional implementation, the registration unit can register hook functions, thereby enabling the interception of the process shutdown system call, the file attribute modification system call, and the boot startup settings system call.

[0050] In an optional embodiment, the apparatus further includes:

[0051] A generation unit is used to randomly generate unloading codes;

[0052] An input unit is used to input the uninstallation code into the uninstallation tool, so that the uninstallation tool calculates a first verification code based on a preset algorithm and the uninstallation code;

[0053] A display unit is used to display the first verification code so that the user can input the first verification code into a pre-generated image interface;

[0054] The verification unit is used to obtain the first verification code in the image interface and compare the first verification code with the second verification code. If the first verification code and the second verification code are the same, the file attributes of the installation folder of the target software are set to a modifiable state.

[0055] The uninstallation unit is used to remove the kernel module of the target software and respond to uninstallation commands for the target software.

[0056] In the above optional implementation, by randomly generating an uninstallation code, a first verification code can be calculated. Then, by comparing the first verification code with a second verification code, if the first verification code is the same as the second verification code, the kernel module of the target software can be removed, and an uninstallation command for the target software can be responded to, thus completing the normal uninstallation of the target software.

[0057] Thirdly, the present invention provides an electronic device, comprising:

[0058] Processor; and

[0059] The memory is configured to store machine-readable instructions that, when executed by the processor, perform the Linux software anti-uninstallation method as described in any of the foregoing embodiments.

[0060] The electronic device of the third aspect of this application, by implementing the Linux software anti-uninstallation method, can prevent users from deleting the target software's installation folder in user mode by setting the file attributes of the target software's installation folder to an unmodifiable state. By starting the target software's user process and setting the target software's user process to start on boot, the target software's user process can be kept running at all times, thereby preventing users from bypassing the anti-uninstallation function by deleting the target software's user process.

[0061] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0062] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0063] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0064] Fourthly, the present invention provides a storage medium storing a computer program, the computer program being executed by a processor as described in any of the foregoing embodiments of the Linux software anti-uninstallation method.

[0065] The storage medium of the fourth aspect of this application, by implementing the Linux software anti-uninstallation method, can prevent users from deleting the target software's installation folder in user mode by setting the file attributes of the target software's installation folder to an unmodifiable state. By starting the target software's user process and setting the target software's user process to start at boot, the target software's user process can be kept running at all times, thereby preventing users from bypassing the anti-uninstallation function by deleting the target software's user process.

[0066] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0067] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0068] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced. Attached Figure Description

[0069] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0070] Figure 1This is a flowchart illustrating a Linux software anti-uninstallation method disclosed in an embodiment of this application;

[0071] Figure 2 This is a schematic diagram of the structure of a Linux software anti-uninstallation device disclosed in an embodiment of this application;

[0072] Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. Detailed Implementation

[0073] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0074] Example 1

[0075] Please see Figure 1 , Figure 1 This is a flowchart illustrating a Linux software anti-uninstallation method disclosed in an embodiment of this application, as shown below. Figure 1 As shown, the method in this application embodiment includes the following steps:

[0076] 101. Once the target software is detected to be successfully installed, set the file attributes of the target software's installation folder to an unmodifiable state;

[0077] 102. Start the user process of the target software and set the user process of the target software to start automatically at boot.

[0078] 103. Set the uninstallation flag of the target software to the first value, where the first value indicates that the target software cannot be uninstalled;

[0079] 104. Load the kernel module of the target software based on the user process of the target software;

[0080] 105. Based on the kernel module of the target software, determine whether the processing object of the process shutdown system call is a user process of the target software. If so, refuse to execute the process shutdown system call.

[0081] 106. Based on the kernel module of the target software, determine whether the processing object of the file attribute modification system call is the installation folder of the target software. If so, refuse to execute the file attribute modification system call.

[0082] 107. Based on the kernel module of the target software, determine whether the processing object of the boot startup settings system call is a user process of the target software. If so, refuse to execute the boot startup settings system call.

[0083] In this embodiment, by setting the file attributes of the target software's installation folder to an unmodifiable state, the user can be prevented from deleting the target software's installation folder in user mode. By starting the target software's user process and setting the target software's user process to start on boot, the target software's user process can be kept running at all times, thereby preventing the user from bypassing the anti-uninstallation function by deleting the target software's user process.

[0084] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0085] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0086] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0087] In this embodiment, for step 101, exemplarily, when an employee accesses the company intranet, they are forcibly redirected to the download page of the target software, causing the employee to download and install the target software based on the download page. Further, the target software can refer to security software used to protect the Linux system. Of course, the target software can also be other software that employees are prohibited from uninstalling without authorization; for example, the target software can be network access client software.

[0088] In this embodiment, regarding step 101, the target software generates an installation folder during installation. By setting the file attributes of the installation folder to an unmodifiable state, the user cannot modify the installation folder in user mode; for example, the user cannot delete the installation folder in user mode. It should be noted that user mode refers to a non-privileged state.

[0089] In this embodiment, regarding step 102, the user process of the target software can be started via process operation instructions, wherein the user process of the target software is associated with a unique process ID. On the other hand, regarding setting the user process of the target software to start automatically at boot, please refer to the specific process of setting boot items in the prior art.

[0090] In this embodiment of the application, for step 103, setting the uninstallation flag of the target software to a first value is to mark the current target software as unremovable. The uninstallation flag of the target software is modified to a second value when the first check code and the second check code are the same. The second value indicates that the target software can be uninstalled. Then, by reading the uninstallation flag of the target software, it is determined whether the target software can be uninstalled.

[0091] In this embodiment, regarding step 104, since the kernel module of the target software is loaded by the user process of the target software, rather than by the startup item-related operations, the stealth of the kernel module of the target software can be improved. Therefore, in some scenarios, users can analyze the startup items and then remove the kernel module based on the analysis results. In this way, the kernel module cannot be loaded, thus failing to increase the difficulty of cracking.

[0092] In this embodiment of the application, for step 104, the kernel module of the target software refers to the code in kernel mode, wherein the code can implement steps 105, 106, and 107.

[0093] In this embodiment of the application, for step 105, the process shutdown system call takes a process as the processing object and carries the ID of the process. Then, by comparing the process ID carried by the process shutdown system call with the user process ID of the target software, it can be determined whether the processing object of the process shutdown system call is the user process of the target software. For example, when the process ID carried by the process shutdown system call is the same as the user process ID of the target software, then the processing object of the process shutdown system call is the user process of the target software.

[0094] In this embodiment of the application, regarding step 106, the file attribute modification system call is one of the many file operation-related system calls provided by the Linux system. When a user needs to modify file attributes in kernel mode, they need to call the chattr command provided by the system. Therefore, by determining whether the folder name or ID corresponding to the chattr command points to the installation folder of the target software, it can be determined whether the processing object of the file attribute modification system call is the installation folder of the target software. For example, when the folder name corresponding to the chattr command is the same as the installation folder name of the target software, it is determined that the processing object of the file attribute modification system call is the installation folder of the target software.

[0095] In an optional implementation, step 101: setting the file attributes of the target software's installation folder to an unmodifiable state includes the following steps:

[0096] The chattr command on Linux systems sets the file attributes of the target software's installation folder to an unmodifiable state.

[0097] In the above optional implementation, the chattr command based on the Linux system can set the file attributes of the target software's installation folder to an unmodifiable state.

[0098] In an optional implementation, the method of this application embodiment further includes the following steps:

[0099] Register hook functions, which are used to intercept system calls for process shutdown, file attribute modification, and startup settings.

[0100] In the above optional implementation, by registering hook functions, system calls for process shutdown, file attribute modification, and startup settings can be intercepted.

[0101] In the above optional implementations, hook functions are part of the Linux message handling mechanism. By setting "hooks," applications can filter all messages and events at the system level and access messages that are normally inaccessible. Essentially, a hook is a program used to process system messages; it is attached to the system through system calls.

[0102] In an optional implementation, the method in this application embodiment further includes the following steps:

[0103] Randomly generate uninstallation codes;

[0104] Input the uninstallation code into the uninstallation tool so that the uninstallation tool can calculate the first verification code based on the preset algorithm and the uninstallation code;

[0105] Display the first verification code so that the user can input the first verification code into the pre-generated image interface;

[0106] Obtain the first verification code from the graphical interface and compare it with the second verification code. If the first verification code and the second verification code are the same, set the file attributes of the target software's installation folder to be editable.

[0107] Remove the kernel module of the target software and respond to uninstallation commands for the target software.

[0108] In the above optional implementation, by randomly generating an uninstallation code, a first checksum can be calculated. Then, by comparing the first checksum with a second checksum, if the first checksum and the second checksum are the same, the kernel module of the target software can be removed, and an uninstallation command for the target software can be responded to, thus completing the normal uninstallation of the target software.

[0109] In the above optional implementation, one specific way to randomly generate the uninstallation code is to generate the uninstallation code randomly based on the current system time.

[0110] In the above optional implementation, the uninstallation tool can generate a first verification code based on the user account password and uninstallation code.

[0111] It should be noted that verification methods can also be used to verify the user's uninstallation permission, such as facial recognition. This application does not limit the implementation of this method, and the above-mentioned optional implementation methods are only preferred implementation methods.

[0112] Example 2

[0113] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a Linux software anti-uninstallation device disclosed in an embodiment of this application, as shown below. Figure 2 As shown, the apparatus in this embodiment includes the following functional modules:

[0114] The file operation unit 201 is used to set the file attributes of the installation folder of the target software to an unmodifiable state after the target software is detected to be successfully installed.

[0115] The process setting unit 202 is used to start the user process of the target software and set the user process of the target software to start on boot.

[0116] The uninstallation attribute setting unit 203 is used to set the uninstallation flag of the target software to a first value, wherein the first value indicates that the target software cannot be uninstalled.

[0117] Loading unit 204 is used to load the kernel module of the target software based on the user process of the target software;

[0118] The first judgment unit 205 is used to determine, based on the kernel module of the target software, whether the processing object of the process shutdown system call is a user process of the target software. If so, the process shutdown system call is refused to be executed.

[0119] The second judgment unit 206 is used to determine, based on the kernel module of the target software, whether the processing object of the file attribute modification system call is the installation folder of the target software. If so, the file attribute modification system call is refused to be executed.

[0120] The third judgment unit 207 is used to determine, based on the kernel module of the target software, whether the processing object of the boot startup settings system call is a user process of the target software. If so, the boot startup settings system call is refused to be executed.

[0121] The apparatus in this application embodiment, by executing the Linux software anti-uninstallation method, can prevent users from deleting the target software's installation folder in user mode by setting the file attributes of the target software's installation folder to an unmodifiable state. By starting the target software's user process and setting it to start automatically at boot, the target software's user process can be kept running at all times, thereby preventing users from bypassing the anti-uninstallation function by deleting the target software's user process.

[0122] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0123] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0124] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0125] In an optional implementation, the file operation unit 201 is specifically used for:

[0126] The chattr command on Linux systems sets the file attributes of the target software's installation folder to an unmodifiable state.

[0127] In the above optional implementation, the chattr command based on the Linux system can set the file attributes of the target software's installation folder to an unmodifiable state.

[0128] In optional embodiments, the apparatus of this application further includes the following functional modules:

[0129] The registration unit is used to register hook functions, which are used to intercept system calls for process shutdown, file attribute modification, and startup settings.

[0130] In the above optional implementation, the registration unit can register hook functions, thereby enabling the interception of system calls for process shutdown, file attribute modification, and startup settings.

[0131] In optional embodiments, the apparatus of this application further includes the following functional modules:

[0132] A generation unit is used to randomly generate unloading codes;

[0133] The input unit is used to input the uninstallation code into the uninstallation tool, so that the uninstallation tool can calculate the first verification code based on the preset algorithm and the uninstallation code;

[0134] The display unit is used to display the first verification code so that the user can input the first verification code into the pre-generated image interface;

[0135] The verification unit is used to obtain the first verification code in the image interface and compare the first verification code with the second verification code. If the first verification code and the second verification code are the same, the file attributes of the installation folder of the target software are set to the modifiable state.

[0136] The unloading unit is used to remove the kernel module of the target software and respond to uninstallation commands for the target software.

[0137] In the above optional implementation, by randomly generating an uninstallation code, a first checksum can be calculated. Then, by comparing the first checksum with a second checksum, if the first checksum and the second checksum are the same, the kernel module of the target software can be removed, and an uninstallation command for the target software can be responded to, thus completing the normal uninstallation of the target software.

[0138] It should be noted that for other detailed descriptions of the apparatus in the embodiments of this application, please refer to the relevant description in Embodiment 1 of this application, which will not be repeated in the embodiments of this application.

[0139] Example 3

[0140] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application, such as... Figure 3 As shown, the electronic device in this application embodiment includes:

[0141] Processor 301; and

[0142] The memory 302 is configured to store machine-readable instructions that, when executed by the processor 301, perform the Linux software anti-uninstallation method as described in any of the foregoing embodiments.

[0143] The electronic device in this application, by executing the Linux software anti-uninstallation method, can prevent users from deleting the target software's installation folder in user mode by setting the file attributes of the target software's installation folder to an unmodifiable state. By starting the target software's user process and setting it to start automatically at boot, the target software's user process is ensured to always exist, thereby preventing users from bypassing the anti-uninstallation function by deleting the target software's user process.

[0144] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0145] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0146] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0147] Example 4

[0148] This application discloses a storage medium storing a computer program, which is executed by a processor as a Linux software anti-uninstallation method according to any of the foregoing embodiments.

[0149] The storage medium in this embodiment of the application, by executing the Linux software anti-uninstallation method, can prevent users from deleting the target software's installation folder in user mode by setting the file attributes of the target software's installation folder to an unmodifiable state. By starting the target software's user process and setting it to start automatically at boot, the target software's user process can be kept running at all times, thereby preventing users from bypassing the anti-uninstallation function by deleting the target software's user process.

[0150] Furthermore, by using the kernel module of the target software, it is possible to prevent users from modifying the target software's startup, closing user processes, and setting the installation folder to a modifiable state based on system calls, i.e., based on kernel mode. This increases the difficulty of cracking the anti-uninstallation function and reduces the probability of the anti-uninstallation function being cracked.

[0151] Furthermore, since the kernel module of the target software is loaded by the user process of the target software, rather than set in the system startup items, the stealth of the kernel module of the target software can be improved, preventing users from disabling the kernel module of the target software by modifying the startup items, thereby further increasing the difficulty of cracking the anti-uninstallation function and reducing the probability of cracking the anti-uninstallation function.

[0152] Furthermore, since the target software's kernel module only handles system calls for modifying file attributes, rather than hooking all file operating system calls, the impact on the overall system operation can be reduced.

[0153] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interface; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0154] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0155] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0156] It should be noted that if a function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0157] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0158] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for preventing Linux software from being uninstalled, characterized in that, The method includes: Once the target software is detected to be successfully installed, the file attributes of the installation folder of the target software are set to an unmodifiable state. Start the user process of the target software and set the user process of the target software to start on boot so that the user process of the target software always exists; Set the uninstallation flag of the target software to a first value, wherein the first value indicates that the target software cannot be uninstalled; The kernel module of the target software is loaded based on the user process of the target software. The kernel module of the target software hooks the system calls for process shutdown, file attribute modification and boot setting, rather than hooking all file operating system calls. Based on the kernel module of the target software, determine whether the processing object of the process shutdown system call is a user process of the target software. If so, refuse to execute the process shutdown system call. Based on the kernel module of the target software, determine whether the processing object of the file attribute modification system call is the installation folder of the target software. If so, refuse to execute the file attribute modification system call. Based on the kernel module of the target software, it is determined whether the processing object of the boot startup settings system call is a user process of the target software. If so, the execution of the boot startup settings system call is refused.

2. The method as described in claim 1, characterized in that, Setting the file attributes of the installation folder of the target software to an unmodifiable state includes: The chattr command on Linux systems sets the file attributes of the installation folder of the target software to an unmodifiable state.

3. The method as described in claim 1, characterized in that, The method further includes: Register a hook function, wherein the hook function is used to intercept the process shutdown system call, the file attribute modification system call, and the boot startup settings system call.

4. The method as described in claim 1, characterized in that, The method further includes: Randomly generate uninstallation codes; The uninstallation code is input into the uninstallation tool so that the uninstallation tool calculates the first verification code based on a preset algorithm and the uninstallation code; The first verification code is displayed so that the user can input the first verification code into the pre-generated image interface; Obtain the first verification code from the image interface, and compare the first verification code with the second verification code. If the first verification code and the second verification code are the same, set the file attributes of the installation folder of the target software to a modifiable state. Remove the kernel module of the target software and respond to the uninstallation command for the target software.

5. A Linux software anti-uninstallation device, characterized in that, The device includes: The file operation unit is used to set the file attributes of the installation folder of the target software to an unmodifiable state after the target software is detected to be successfully installed. A process setting unit is used to start the user process of the target software and set the user process of the target software to start on boot so that the user process of the target software always exists. The uninstallation attribute setting unit is used to set the uninstallation flag of the target software to a first value, wherein the first value indicates that the target software cannot be uninstalled. The loading unit is used to load the kernel module of the target software based on the user process of the target software. The kernel module of the target software hooks the process shutdown system call, file attribute modification system call and boot startup setting system call, rather than hooking all file operating system calls. The first judgment unit is used to determine, based on the kernel module of the target software, whether the processing object of the process shutdown system call is a user process of the target software; if so, the execution of the process shutdown system call is refused. The second judgment unit is used to determine, based on the kernel module of the target software, whether the processing object of the file attribute modification system call is the installation folder of the target software; if so, the execution of the file attribute modification system call is refused. The third judgment unit is used to determine, based on the kernel module of the target software, whether the processing object of the boot startup settings system call is the user process of the target software. If so, the execution of the boot startup settings system call is refused.

6. The apparatus as claimed in claim 5, characterized in that, The file operation unit is specifically used for: The chattr command on Linux systems sets the file attributes of the installation folder of the target software to an unmodifiable state.

7. The apparatus as claimed in claim 5, characterized in that, The device further includes: A registration unit is used to register hook functions, wherein the hook functions are used to intercept the process shutdown system call, the file attribute modification system call, and the boot startup settings system call.

8. The apparatus as claimed in claim 5, characterized in that, The device further includes: A generation unit is used to randomly generate unloading codes; An input unit is used to input the uninstallation code into the uninstallation tool, so that the uninstallation tool calculates a first verification code based on a preset algorithm and the uninstallation code; A display unit is used to display the first verification code so that the user can input the first verification code into a pre-generated image interface; The verification unit is used to obtain the first verification code in the image interface and compare the first verification code with the second verification code. If the first verification code and the second verification code are the same, the file attributes of the installation folder of the target software are set to a modifiable state. The uninstallation unit is used to remove the kernel module of the target software and respond to uninstallation commands for the target software.

9. An electronic device, characterized in that, include: processor; as well as A memory configured to store machine-readable instructions that, when executed by the processor, perform the Linux software anti-uninstallation method as described in any one of claims 1-4.

10. A storage medium, characterized in that, The storage medium stores a computer program, which is executed by a processor as described in any one of claims 1-4, to prevent Linux software uninstallation.

Images