System initialization method, mac-based access control method, and related device

Abstract

Embodiments of the present application disclose a system initialization method, a MAC-based access control method and related devices, which are used for enabling a kernel to accurately run a MAC permission review function. The method of the embodiments of the present application comprises: creating a container init process of a container system; starting the container init process, so that the container init process mounts a container resource file of the container system, and writes container policy data of the container system into a container policy database, the container policy data being determined based on a container policy file in the container resource file, and the container policy database being used for performing a MAC mandatory access control mechanism check on the container system.

Description

Technical Field

[0001] This application relates to the field of cloud gaming, and more particularly to system initialization methods, MAC-based access control methods, and related devices. Background Technology

[0002] For smart terminal devices, they typically come pre-installed with a single hardware unit and operating system, which is sufficient for the normal operation of various applications. However, in cloud gaming scenarios, the hardware is generally an array server assembled from multiple system-on-chips (SoCs). To maximize the utilization of SoC resources, system virtualization is usually performed on each SoC according to the complexity of the game. This allows the game to run on each system of a single SoC, enabling multiple users to play simultaneously.

[0003] Virtualization based on container technology achieves its functionality by sharing a kernel and mounting different user file systems. Mandatory access control (MAC) permission verification is performed by the kernel. However, in virtualized hardware devices, due to the shared kernel environment, the kernel's MAC permission verification function becomes confused and fails. In other words, the kernel cannot distinguish between the virtual system (or container system) and the host system, nor can it differentiate the rules corresponding to the virtual system and the host system in the policy database, thus failing to perform MAC permission verification for either the virtual system or the host system.

[0004] Therefore, there is an urgent need for a method that allows the kernel to accurately run MAC permission auditing functions in virtualized hardware devices. Summary of the Invention

[0005] This application provides a system initialization method, a MAC-based access control method, and related devices to enable the kernel to accurately run the MAC permission review function.

[0006] A first aspect of this application provides a system initialization method applied to a computer device, wherein the computer device deploys a host system and a container system, and the host system has a corresponding host policy database; the method includes:

[0007] Create the container init process for the container system;

[0008] The container init process is started so that it mounts the container resource files of the container system and writes the container policy data of the container system into the container policy database. The container policy data is determined based on the container policy file in the container resource file. The container policy database is used to perform MAC mandatory access control mechanism verification on the container system.

[0009] In one specific implementation, the container init process that creates the container system includes:

[0010] The host system creates the container init process of the container system.

[0011] In one specific implementation, the host system creates the container init process of the container system, including:

[0012] The host system creates the container management program;

[0013] Start the container manager so that it creates the container init process for the container system.

[0014] In one specific implementation, before starting the container init process, the method further includes:

[0015] Modify the access permissions of the container init process to kernel-mode permissions so that the container init process can access the kernel space of the host system, where the container policy database and the host policy database are stored.

[0016] In one specific implementation, the kernel space of the host system includes the host policy database and at least one pre-built blank policy database. The container init process writes the container policy data of the container system into the container policy database, including:

[0017] The container policy database is determined from at least one pre-built blank policy database;

[0018] Write the container policy data of the container system into the container policy database.

[0019] In one specific implementation, before determining the container policy database, the method further includes:

[0020] Multiple blank policy databases are created in the kernel space of the host system;

[0021] In response to the kernel initialization of the host system, a host init process of the host system is created;

[0022] The host init process is started so that it mounts the host system's host resource files and writes the host system's host policy data into any blank policy database, which is the host policy database.

[0023] In one specific implementation, determining the container policy database from at least one pre-built blank policy database includes:

[0024] Determine the container process namespace to which the container init process belongs;

[0025] Based on the container process namespace, the container policy database is determined from at least one pre-built blank policy database.

[0026] In one specific implementation, the container init process writes the container policy data of the container system into the container policy database, including:

[0027] The container init process copies the container policy data into memory, so that the memory can parse the container policy data and write the parsed container policy data into the container policy database.

[0028] A second aspect of this application provides a MAC-based access control method, comprising:

[0029] In response to a resource access request sent by a user space process of any system, a target policy database corresponding to the system is determined. The target policy database is a policy database in which policy data is written to the system. The target policy database is constructed by the system initialization method described in the first aspect.

[0030] The resource access request is reviewed based on the target policy database.

[0031] In one specific implementation, the target policy database includes at least one type of policy table, and the step of reviewing the resource access request based on the target policy database includes:

[0032] From the target policy database, search for the similar policy table corresponding to the resource access request, and examine the policy type of the policy data required by the resource access request to ensure that it is consistent with the policy type corresponding to the similar policy table.

[0033] From the table of similar policies, determine the target policy data required to review the resource access request;

[0034] The resource access request is reviewed based on the target policy data.

[0035] A third aspect of this application provides a computer device, wherein the computer device deploys a host system and a container system, the host system having a corresponding host policy database, and the computer device includes:

[0036] A creation unit is used to create the container init process of the container system.

[0037] The writing unit is used to start the container init process, so that the container init process mounts the container resource files of the container system and writes the container policy data of the container system into the container policy database. The container policy data is determined based on the container policy file in the container resource file. The container policy database is used to perform MAC mandatory access control mechanism verification on the container system.

[0038] In one specific implementation, the creation unit is specifically used to enable the host system to create the container init process of the container system.

[0039] In one specific implementation, the creation unit is specifically used to enable the host system to create the container management program;

[0040] Start the container manager so that it creates the container init process for the container system.

[0041] In one specific implementation, the computer device further includes: a modification unit;

[0042] The modification unit is used to modify the access permissions of the container init process to kernel-mode permissions, so that the container init process can access the kernel space of the host system, and the container policy database and the host policy database are stored in the kernel space.

[0043] In one specific implementation, the kernel space of the host system includes the host policy database and at least one pre-built blank policy database. The writing unit is specifically used to determine the container policy database from the at least one pre-built blank policy database.

[0044] Write the container policy data of the container system into the container policy database.

[0045] In one specific implementation, the creation unit is further configured to create multiple blank policy databases in the kernel space of the host system;

[0046] The creation unit is also configured to create a host init process of the host system in response to the kernel initialization of the host system;

[0047] The writing unit is further configured to start the host init process, so that the host init process mounts the host resource files of the host system and writes the host policy data of the host system into any blank policy database, wherein the blank policy database is the host policy database.

[0048] In one specific implementation, the writing unit is specifically used to determine the container process namespace to which the container init process belongs;

[0049] Based on the container process namespace, the container policy database is determined from at least one pre-built blank policy database.

[0050] In one specific implementation, the writing unit is specifically used by the container init process to copy the container policy data into memory, so that the memory parses the container policy data and writes the parsed container policy data into the container policy database.

[0051] A fourth aspect of this application provides a computer device, including:

[0052] The determining unit is configured to, in response to a resource access request sent by a user space process of any system, determine the target policy database corresponding to the any system, wherein the target policy database is a policy database in which policy data is written to the any system, and the target policy database is constructed by the system initialization method described in the first aspect.

[0053] The review unit reviews the resource access request based on the target policy database.

[0054] In one specific implementation, the review unit is specifically used to search for a similar policy table corresponding to the resource access request from the target policy database, and review the policy type of the policy data required by the resource access request to ensure that it is consistent with the policy type corresponding to the similar policy table.

[0055] From the table of similar policies, determine the target policy data required to review the resource access request;

[0056] The resource access request is reviewed based on the target policy data.

[0057] A fifth aspect of this application provides a computer device, including:

[0058] Central processing unit, memory, and input / output interfaces;

[0059] The memory is either a short-term storage memory or a persistent storage memory;

[0060] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method described in the first or second aspect.

[0061] A sixth aspect of this application provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first or second aspect.

[0062] A seventh aspect of this application provides a computer storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in the first or second aspect.

[0063] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: For computer devices that simultaneously deploy a host system and a container system, the host system is configured with a corresponding host policy database. Simultaneously, during the initialization process of the container system, the container init process writes the container policy data of the container system into the container policy database. This policy database deployment method allows the kernel to call the container policy database corresponding to the container system when it receives a MAC mechanism review initiated by the container system, and to use the container policy data recorded in the container policy database for review, thereby enabling the kernel to accurately run the MAC permission review function. Attached Figure Description

[0064] Figure 1 This is a schematic flowchart of a system initialization method disclosed in an embodiment of this application;

[0065] Figure 2 This is a schematic diagram of the Linux system call process disclosed in an embodiment of this application;

[0066] Figure 3 This is a flowchart illustrating the system initialization method and MAC-based access control method disclosed in the embodiments of this application;

[0067] Figure 4 This is a schematic diagram of the structure of a computer device disclosed in an embodiment of this application;

[0068] Figure 5 This is another structural schematic diagram of the computer device disclosed in the embodiments of this application;

[0069] Figure 6 This is another schematic diagram of the computer device disclosed in the embodiments of this application. Detailed Implementation

[0070] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0071] This application provides a system initialization method, a MAC-based access control method, and related devices to enable the kernel to accurately run the MAC permission review function.

[0072] Please see Figure 1 This application provides a system initialization method that can be executed by a computer device, which includes the following steps:

[0073] 101. Create the container init process of the container system.

[0074] In Linux, all processes are created and run by the init process. Therefore, to complete the initialization of a container system, the container init process, which controls the container system, must first be created.

[0075] Additionally, it should be noted that the computer device in this application embodiment is deployed with a host system and at least one container system. The host system has a corresponding host policy database, and the computer device can be a server, server cluster, or terminal, etc., which can realize the deployment of the host system and at least one container system. No specific limitation is made here.

[0076] In some specific implementations, the container init process can be created by the host system or the kernel. Furthermore, if the container init process is created by the host system, it can be created by a user-space container manager running on the host system. Specifically, first, the host system creates the container manager; then, the container manager starts and creates the container init process within the container environment.

[0077] The container management program is created by the host system and is responsible for managing the startup and shutdown of containers, as well as starting the container init process.

[0078] 102. Start the container init process so that the container init process mounts the container system's container resource files and writes the container system's container policy data into the container policy database. The container policy data is determined based on the container policy file in the container resource file. The container policy database is used to perform MAC mechanism verification on the container system.

[0079] After the container init process starts, it can mount the container system's container resource files and write the container system's container policy data to the container policy database. Once the container policy data is written to the container policy database, when the kernel receives a MAC mechanism review (or resource access request) initiated by the container system, it can call the corresponding container policy data in the container policy database for review.

[0080] In practical applications, container resource files for a container system can be obtained from a server. When creating a new container system, the container resource files can be retrieved from a specified server address using the corresponding container system's system identifier. In cloud gaming scenarios, the container resource files may differ depending on the operating system type or the type of cloud game. Therefore, the container system's system identifier can be determined based on the operating system type or cloud game type required for the current SOC deployment; no specific limitation is made here. In addition to container policy files, container resource files may also include configuration files and runtime resource files required for the container system's normal operation.

[0081] In this embodiment, for computer devices that simultaneously deploy a host system and a container system, the host system is configured with a corresponding host policy database. Simultaneously, during the container system initialization process, the container init process writes the container system's container policy data into the container policy database. This policy database deployment method allows the kernel to call the container system's corresponding container policy database when it receives a MAC (Machine Access Control) mechanism review initiated by the container system, and use the container policy data recorded in the container policy database for review, thereby enabling the kernel to accurately execute the MAC permission review function.

[0082] The foregoing embodiments provide a specific implementation method for the host system to create a user-space container manager, and for the container manager to create a container init process. Since the container policy database is deployed in the kernel, the init process that writes container policy data to the container policy database in step 102 requires kernel privileges.

[0083] However, the container init process is created within the container environment; therefore, the context in which the container init process resides is user space. Thus, before starting the container init process in step 102, its access permissions need to be changed to kernel-mode permissions to ensure that the container init process can access the host system's kernel space. It should be noted that the host policy database also resides in the host system's kernel space. Furthermore, since the container init process is created by the container manager, its permissions can also be specified by the container manager.

[0084] In some specific implementations, to improve the efficiency of building the container policy database, the kernel space of the host system may include at least one pre-built blank policy database in addition to the host policy database. If the kernel space of the host system includes at least one pre-built blank policy database, then the step in step 102 above, where the container init process writes the container policy data of the container system into the container policy database, can be implemented as follows: determine the container policy database from the at least one pre-built blank policy database; write the container policy data of the container system into the container policy database.

[0085] Specifically, the architecture of the required blank policy database may vary depending on the container policy data. Furthermore, considering that container policy data is closely related to the operating system type or the type of cloud game, blank policy databases corresponding to different types of operating systems or cloud games can be configured to accurately determine the container policy database based on the operating system type of the container system or the type of cloud game deployed.

[0086] Furthermore, before the container system performs system initialization, the host system also undergoes a similar system initialization process. Prior to determining the container policy database, the host system's initialization process may include the following steps: creating multiple blank policy databases in the host system's kernel space; creating a host init process in response to the host system's kernel initialization; starting the host init process so that it mounts the host system's host resource files and writes the host system's host policy data into any of the blank policy databases, whereby any blank policy database becomes the host policy database.

[0087] Specifically, during kernel initialization, the host system's host init process is first created. Then, the host init process starts, mounting the host system's host resource files and writing the host system's host policy data into any blank policy database (once written into the host policy database, it becomes the host policy database). In the host machine (i.e., the computer device where the host system is deployed), the host system is the first operating system deployed. Therefore, before the host system performs system initialization, there is no operating system on the host machine, and consequently, there is no policy database already written into it; that is, only a blank policy database exists in the kernel space. The method for determining any blank policy database can be similar to the method for determining the container policy database, and is not limited here.

[0088] A process namespace is the activity space where a process resides, primarily used for grouping and isolating processes. It is assigned a unique identifier upon creation. In practice, to achieve process isolation, all processes of the host system typically run within the host process namespace, and all processes of the container system typically run within the container process namespace. Considering these characteristics, a mapping between each process namespace and a blank policy database can be established first. Then, based on the container process namespace to which the container's init process belongs, the container policy database is determined. Specifically, this could involve establishing a mapping between the container process namespace A (running in container system A on the host machine) and the blank policy database A, and establishing a mapping between the container process namespace B (running in container system B on the host machine) and the blank policy database B. This application does not specifically limit the method for determining the container policy database.

[0089] In some specific implementations, to improve kernel read efficiency during policy data writing, memory mapping can be used to write policy data to the policy database. Specifically, the container init process copies the container policy data into memory, enabling memory to parse the container policy data and write the parsed data into the container policy database. Copying the container policy data into memory means creating a file-like structure for easier memory access.

[0090] Based on the system initialization method described in the foregoing embodiments, this application provides a MAC-based access control method, including the following steps: in response to a resource access request sent by a user space process of any system, determining a target policy database corresponding to any system, wherein the target policy database is a policy database that writes policy data to any system, and the target policy database is constructed by any system initialization method provided in the foregoing embodiments; and reviewing the resource access request based on the target policy database.

[0091] Specifically, after constructing the container policy database and / or the host policy database using the system initialization method described in the foregoing embodiments, upon receiving a resource access request from any system, firstly, the user process namespace to which that system belongs is determined (since all process namespaces are deployed in user space, the host process namespace and container process namespace can be collectively referred to as the user process namespace), that is, the user process namespace where each process corresponding to that system runs. Then, the target policy database corresponding to that user process namespace is determined, that is, the policy database into which policy data for that system is written. Finally, the aforementioned resource access request can be reviewed based on the policy data in the target policy database (i.e., the policy data corresponding to any system).

[0092] In practical applications, to better manage the policy data in the policy database, policy data tables corresponding to different policy types are typically built within the policy database. In other words, the target policy database includes at least one type of policy table. By constructing these policy data tables, when reviewing resource access requests, the system can quickly locate the corresponding policy data table in the target policy database based on the policy type of the policy data required (or requested) by the resource access request. Then, based on this corresponding policy data table, the system can accurately determine the resource for which the request is being reviewed and the required target policy data. Finally, the resource access request is reviewed based on the target policy data.

[0093] The preceding text describes the system initialization method and various implementations of the MAC-based access control method provided in this application. Please refer to [link / reference]. Figure 2 and Figure 3 The technical solutions of the embodiments of this application are described below in the scenario of deploying Security-enhanced Linux (SELinux).

[0094] First, during system (container system and / or host system) initialization, SELinux initialization is performed, including the following steps: the kernel starts and initializes the environment; the kernel creates a user init process (since all init processes are deployed in user space, the host init process and the container init process can be collectively referred to as the user init process); the init process (abbreviated as init) initializes the user space environment and creates device nodes; init mounts the file system and loads files that can be accessed by the program; init mounts the SELinux file system; init loads the policy file into the kernel through the SELinux file system; init enables SELinux functionality through the SELinux file system.

[0095] Secondly, after completing SELinux initialization and system initialization, the system can implement MAC-based access control through the following process: A user-space process of the host system requests resource access; the process triggers a system call and enters kernel space via an interrupt; the kernel first checks the parameters of the system call; the kernel then performs a DAC check on the current user of the system call; the kernel then performs a MAC check on the system call by looking up the Access Vector Table (AVC); the kernel finally executes the corresponding resource access operation; and the kernel returns the system call execution result to user space.

[0096] Specifically, firstly, the host init process is created during the kernel initialization process, in kernel mode. At this point, the system is not fully ready, some kernel threads have not yet been created, and init has kernel superuser privileges. Secondly, the container init process is created in the container environment, in user mode, by a user-mode container manager. The permissions of the container init process are specified by the container manager. Kernel privileges are required when initializing the policy database, but the container system init process typically has restricted user-mode permissions, which are achieved by modifying the container init process permissions. The processes for the host system and container system are similar, with differences including, but not limited to, the need for the host system to create a container manager.

[0097] Next, the host init process and the container init process mount the kernel SELinuxFS to user space. Simultaneously, the kernel selects a policy database based on the process namespace to which the init process belongs. If the policy database does not exist in the current process namespace, it will be created and its internal tables (i.e., the policy data tables) will be initialized. Specifically, the kernel SELinuxFS superblock is mounted via the `mount` system call (different superblocks are mounted depending on the process namespace), the SELinuxFS file list is mapped to user space, and the kernel populates the policy database with policy data.

[0098] Then, the host init process and the container init process open the file named load in selinuxfs, write rules using memory mapping, the kernel parses and classifies the rules, and then inserts them sequentially into the corresponding tables.

[0099] Finally, because the processes of the host system and the processes of the container system belong to different process namespaces, when a kernel system call is triggered, the kernel obtains the process namespace ID of the current process, first selects the corresponding policy database, and then queries the permission policy item in the policy table of the corresponding policy database for review.

[0100] In this embodiment, by modifying some code logic within the context of the paths created by the init process, and by using the different process namespaces of the host system and container system during mounting and loading to distinguish between different mounting processes, and by using MAC-based access control to perform permission checks by determining the process namespace of the process and indexing rules in different policy databases, MAC-based access control is achieved in a virtual multi-system environment without affecting the original single-host system.

[0101] Figure 2 and Figure 3In this context, the Hook function chain refers to the abstraction layer of the Linux security module (LSM) in the kernel. It is responsible for associating entry and exit functions. Specifically, it jumps to the corresponding function through a pre-configured security module. For example, if the security module is SELinux, then a jump to the corresponding SELinux function can be made through a pre-configured SELinux security module. The security module can also be a ruleset-based access control (RSBAC), but this is not a limitation here.

[0102] Please see Figure 4 This application also provides a computer device that deploys a host system and a container system. The host system has a corresponding host policy database. The computer device includes:

[0103] Create unit 401, used to create the container init process of the container system;

[0104] The writing unit 402 is used to start the container init process, so that the container init process mounts the container resource files of the container system and writes the container policy data of the container system into the container policy database. The container policy data is determined based on the container policy file in the container resource file. The container policy database is used to perform MAC mandatory access control mechanism verification on the container system.

[0105] In one specific implementation, creation unit 401 is specifically used to enable the host system to create the container init process of the container system.

[0106] In one specific implementation, creation unit 401 is specifically used to enable the host system to create a container manager;

[0107] Start the container manager so that it can create the container init process for the container system.

[0108] In one specific implementation, the computer device further includes: a modification unit;

[0109] The modification unit is used to change the access permissions of the container init process to kernel-mode permissions, so that the container init process can access the host system's kernel space, and the container policy database and the host policy database are stored in the kernel space.

[0110] In one specific implementation, the kernel space of the host system includes a host policy database and at least one pre-built blank policy database. The writing unit 402 is specifically used to determine the container policy database from the at least one pre-built blank policy database.

[0111] Write the container policy data of the container system into the container policy database.

[0112] In one specific implementation, the creation unit 401 is also used to create multiple blank policy databases in the kernel space of the host system;

[0113] Creation unit 401 is also used to create the host init process of the host system in response to the kernel initialization of the host system;

[0114] The writing unit 402 is also used to start the host init process, so that the host init process mounts the host system's host resource files and writes the host system's host policy data into any blank policy database, where any blank policy database is the host policy database.

[0115] In one specific implementation, the writing unit 402 is specifically used to determine the container process namespace to which the container init process belongs;

[0116] Based on the container process namespace, the container policy database is determined from at least one pre-built blank policy database.

[0117] In one specific implementation, the writing unit 402 is specifically used by the container init process to copy container policy data into memory, so that the memory can parse the container policy data and write the parsed container policy data into the container policy database.

[0118] Please see Figure 5 This application also provides a computer device, including:

[0119] The determining unit 501 is used to determine the target policy database corresponding to any system in response to a resource access request sent by a user space process of any system. The target policy database is a policy database that writes policy data to any system. The target policy database is constructed by the system initialization method of the first aspect.

[0120] Review unit 502 reviews resource access requests based on the target policy database.

[0121] In one specific implementation, the review unit 502 is specifically used to search for the same type of policy table corresponding to the resource access request from the target policy database, and to review the policy type of the policy data required by the resource access request, which is consistent with the policy type corresponding to the same type of policy table.

[0122] From the similar policy table, determine the target policy data required to review resource access requests;

[0123] Review resource access requests based on target policy data.

[0124] Figure 6 This is a schematic diagram of a computer device structure provided in an embodiment of this application. The computer device 600 may include one or more central processing units (CPUs) 601 and a memory 605, in which one or more application programs or data are stored.

[0125] The memory 605 can be volatile or persistent storage. The program stored in the memory 605 can include one or more modules, each module including a series of instruction operations on the computer device. Furthermore, the central processing unit 601 can be configured to communicate with the memory 605 and execute the series of instruction operations stored in the memory 605 on the computer device 600.

[0126] The computer device 600 may also include one or more power supplies 602, one or more wired or wireless network interfaces 603, one or more input / output interfaces 604, and / or one or more operating systems, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0127] The central processing unit 601 can perform the aforementioned... Figures 1 to 5 The specific operations performed by the computer device in the illustrated embodiment will not be described in detail here.

[0128] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0130] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0131] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0132] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0133] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the system initialization method and the MAC-based access control method described above.

Claims

1. A system initialization method, characterized in that, Applied to computer devices, the computer devices deploying a host system and a container system, the host system having a corresponding host policy database, the host policy database being used to perform mandatory access control mechanism verification on the host system, the method comprising: Create the container init process for the container system; The container init process is started so that it mounts the container resource files of the container system and writes the container policy data of the container system into the container policy database. The container policy data is determined based on the container policy file in the container resource file. The container policy database is used to perform mandatory access control mechanism verification on the container system. The host system's kernel space includes the host policy database and at least one pre-built blank policy database. The container init process writes the container system's container policy data into the container policy database, including: The container policy database is determined from at least one pre-built blank policy database; Write the container policy data of the container system into the container policy database; Determining the container policy database from at least one pre-built blank policy database includes: Determine the container process namespace to which the container init process belongs; Based on the container process namespace, the container policy database is determined from at least one pre-built blank policy database.

2. The method according to claim 1, characterized in that, The container init process that creates the container system includes: The host system creates the container init process of the container system.

3. The method according to claim 2, characterized in that, The host system creates the container init process of the container system, including: The host system creates a container management program; Start the container manager so that it creates the container init process for the container system.

4. The method according to claim 1, characterized in that, Before starting the container init process, the method further includes: Modify the access permissions of the container init process to kernel-mode permissions so that the container init process can access the kernel space of the host system, where the container policy database and the host policy database are stored.

5. The method according to claim 1, characterized in that, The method further includes: Multiple blank policy databases are created in the kernel space of the host system; In response to the kernel initialization of the host system, a host init process of the host system is created; The host init process is started so that it mounts the host system's host resource files and writes the host system's host policy data into any blank policy database, which is the host policy database.

6. The method according to any one of claims 1 to 5, characterized in that, The container init process writes the container policy data of the container system into the container policy database, including: The container init process copies the container policy data into memory, so that the memory can parse the container policy data and write the parsed container policy data into the container policy database.

7. A MAC-based access control method, characterized in that, include: In response to a resource access request sent by a user space process of any system, a target policy database corresponding to the system is determined, wherein the target policy database is a policy database in which policy data of the system is written, and the target policy database is constructed by the system initialization method of any one of claims 1 to 6; The resource access request is reviewed based on the target policy database.

8. The method according to claim 7, characterized in that, The target policy database includes at least one type of policy table, and the review of the resource access request based on the target policy database includes: From the target policy database, search for the similar policy table corresponding to the resource access request, and examine the policy type of the policy data required by the resource access request to ensure that it is consistent with the policy type corresponding to the similar policy table. From the table of similar policies, determine the target policy data required to review the resource access request; The resource access request is reviewed based on the target policy data.

9. A computer storage medium, characterized in that, The computer storage medium stores instructions that, when executed on the computer, cause the computer to perform the method as described in any one of claims 1-6 or 7-8.

Images