Method, system and storage medium for configuring SELinux security policy

Abstract

The present application provides a method, system and storage medium for configuring SELinux security policy, and relates to the field of information security. The method includes: obtaining request information, the request information includes the reason type corresponding to the reason why the program is not executed as expected and the AVC alarm information of the program; analyzing the request information to obtain the analysis result; generating the permission configuration scheme of the program according to the analysis result, the permission configuration scheme is used to configure the SELinux security policy file of the program, and the permission configuration scheme includes the permission statement to be added and the adding position. The method provided in the embodiment of the present application can automatically analyze the AVC alarm information and the reason type to obtain an accurate permission configuration scheme, which is based on the permission configuration scheme to help users configure the SELinux security policy file of the program conveniently and efficiently, reduce the configuration cost, and improve the security of the developed software.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method, system and storage medium for configuring SELinux security policies. Background Art

[0002] Security-Enhanced Linux (SELinux) is a Linux kernel module and a security subsystem of Linux. SELinux provides security improvements by using mandatory access control on processes and system resources. It allows each process to have its own running area and grant minimal access rights. Therefore, it is very necessary to integrate SELinux for access control in software development, which can effectively solve existing security problems.

[0003] However, there is a certain threshold for SELinux knowledge. It is very time-consuming, costly, and error-prone for developers who are not in the field of information security to configure SELinux security policy files. Therefore, how to configure SELinux security policy files conveniently and efficiently while reducing configuration costs and improving the security of developed software is an urgent problem to be solved today. Summary of the invention

[0004] The present application provides a method, system and storage medium for configuring SELinux security policy, which can automatically analyze AVC alarm information and cause types to obtain an accurate permission configuration scheme. Based on the permission configuration scheme, it helps users to configure the SELinux security policy file of the program conveniently and efficiently, reduce configuration costs, and improve the security of developed software.

[0005] In a first aspect, the present application provides a method for configuring SELinux security policy, the method comprising: obtaining request information, the request information comprising a reason type corresponding to a reason why a program was not executed as expected and AVC alarm information of the program; analyzing the request information to obtain an analysis result; generating a permission configuration scheme for the program based on the analysis result, the permission configuration scheme being used to configure the SELinux security policy file of the program, the permission configuration scheme comprising permission statements to be added and the adding location.

[0006] The analysis result may include the subject tag and object tag corresponding to the program, and the permission statement to be added.

[0007] Reason types may include newly added process types, newly added file types, and newly added permission types for known subjects and objects.

[0008] Among them, the newly added process types include newly added system service process types and newly added inter-process communication process types.

[0009] New file types include new virtual file types, new general file types, and new attribute types.

[0010] Optionally, the request information also includes at least one of platform information, chip component information, system component information, attribute information, label information and path information.

[0011] Platform information refers to the platform used by the development program, chip component information refers to the chip component version used by the development program, system component information refers to the system component version used by the development program, attribute information may include the read attributes and / or write attributes of the file, tag information may include the tag name, path information may include the file / executable file path, etc.

[0012] The method for configuring SELinux security policy provided in the first aspect can automatically analyze AVC alarm information and cause types to obtain an accurate permission configuration plan. Based on the permission configuration plan, it helps users to configure the SELinux security policy file of the program conveniently and efficiently, reduce configuration costs, and improve the security of developed software.

[0013] In a possible implementation, the request information is analyzed to obtain analysis results, including: extracting preset keywords in the AVC alarm information; determining the subject tag and object tag corresponding to the program based on the preset keywords; and searching the database for the permission statement to be added corresponding to the reason type.

[0014] The preset keyword may include at least one of name, scontext, tcontext, class, and perms.

[0015] In this implementation, the AVC alarm information is automatically analyzed, preset keywords are extracted, and the subject label and object label corresponding to the program, as well as the permission statement to be added, are determined, providing a basis for generating a permission configuration plan.

[0016] In one possible implementation, a permission configuration scheme for the program is generated based on the analysis results, including: searching a preset data table for an addition location that matches both the subject tag and the object tag corresponding to the program; and generating a permission configuration scheme based on the permission statement to be added and the addition location.

[0017] In this implementation, the generated permission configuration plan also includes adding locations, so that users will not be blind when configuring the SELinux security policy file of the program, which is conducive to users to configure the SELinux security policy file of the program conveniently and efficiently, reducing configuration costs, saving manpower, and improving the security of developed software.

[0018] In a second aspect, the present application provides a system for configuring SELinux security policies, including: a cause confirmation module and an analysis module;

[0019] The reason confirmation module is used to display SELinux guidance information and a method for obtaining AVC alarm information, the SELinux guidance information is used to determine the reason type corresponding to the reason why the program is not executed as expected, and the method for obtaining AVC alarm information is used to obtain the AVC alarm information of the program;

[0020] The analysis module is used to determine and display the permission configuration scheme of the program according to the AVC alarm information and reason type of the program. The permission configuration scheme is used to configure the SELinux security policy file of the program. The permission configuration scheme includes the permission statement to be added and the adding position.

[0021] The system for configuring SELinux security policies provided in the second aspect guides users to determine the cause type corresponding to the reason why the program was not executed as expected through the content displayed by the cause confirmation module in the system, and can also guide users to extract AVC alarm information. The cause type determined by the cause confirmation module and the obtained AVC alarm information are input into the analysis module for processing, and a permission configuration scheme can be obtained. Based on the permission configuration scheme, it helps users to configure the SELinux security policy file of the program conveniently and efficiently, thereby reducing the configuration cost and improving the security of the developed software.

[0022] In one possible implementation, the analysis module is also used to extract preset keywords in the AVC alarm information; determine the subject tag and object tag corresponding to the program based on the preset keywords; search the database for the permission statement to be added corresponding to the cause type; search the preset data table for the addition position that matches the subject tag and object tag corresponding to the program; generate a permission configuration plan based on the permission statement to be added and the addition position.

[0023] In this implementation, the AVC alarm information and cause type are automatically analyzed to obtain an accurate permission configuration plan. Based on this permission configuration plan, it helps users to configure the SELinux security policy file of the program conveniently and efficiently, reducing configuration costs and improving the security of developed software.

[0024] In a possible implementation, the system for configuring the SELinux security policy further includes a verification module.

[0025] The verification module is used to demonstrate a variety of compilation verification methods, which are used to compile and verify the program after the SELinux security policy file is configured.

[0026] When the developed program process is compiled and verified by the compilation verification method, it can be ensured that the program can be executed as expected. When the program is compiled and verified after the SELinux security policy file is configured by the compilation verification method, it can be verified whether the configuration is effective.

[0027] In a possible implementation, the system for configuring SELinux security policy further includes a knowledge display module.

[0028] The knowledge display module is used to display SELinux related knowledge, including SELinux basic knowledge and security knowledge.

[0029] Users can learn about SELinux technology and security knowledge in the field of information security through the content displayed in this knowledge display module, and learn more about SELinux related content and the various reasons why programs do not execute as expected.

[0030] In addition, the cause confirmation module, analysis module, verification module, and knowledge display module of the system for configuring SELinux security policy provided by the embodiment of the present application are displayed on the Web interface, that is, presented in the form of a web page, and users can use it anytime and anywhere without having to install tools, plug-ins, etc. separately, which reduces the configuration cost and improves the convenience of configuring SELinux security policy. Generating a permission configuration plan is an automated process, which frees up manpower and improves configuration efficiency.

[0031] In a third aspect, the present application provides an electronic device, comprising: one or more processors; one or more memories; a module with multiple applications installed; the memory stores one or more programs, and when one or more programs are executed by the processor, the electronic device executes the method in the above-mentioned first aspect and any possible implementation thereof.

[0032] In a fourth aspect, the present application provides a chip, including a processor. The processor is used to read and execute a computer program stored in a memory to perform the method in the first aspect and any possible implementation thereof.

[0033] Optionally, the chip also includes a memory, and the memory is connected to the processor via a circuit or wire.

[0034] Optionally, the chip also includes a communication interface.

[0035] In a fifth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the processor executes the method in the first aspect and any possible implementation thereof.

[0036] In a sixth aspect, the present application provides a computer program product, the computer program product comprising: a computer program code, when the computer program code runs on an electronic device, enables the electronic device to execute the method in the first aspect and any possible implementation thereof.

[0037] In a seventh aspect, the present application provides a server for cooperating with an electronic device to jointly implement the method in the above-mentioned first aspect and any possible implementation method thereof.

[0038] The technical effects obtained by the above-mentioned second, third, fourth, fifth, sixth and seventh aspects are similar to the technical effects obtained by the corresponding technical means in the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of a method for configuring SELinux security policy in the related technology shown in this application;

[0040] Figure 2 is a schematic diagram of a system architecture shown in an exemplary embodiment of the present application;

[0041] Figure 3 is a schematic diagram of the hardware structure of an electronic device shown in an exemplary embodiment of the present application;

[0042] Figure 4 is a schematic diagram of a Web interface shown in an exemplary embodiment of the present application;

[0043] Figure 5 is another schematic diagram of a Web interface shown in an exemplary embodiment of the present application;

[0044] Figure 6 It is another schematic diagram of a Web interface shown in an exemplary embodiment of the present application;

[0045] Figure 7 is another schematic diagram of a Web interface shown in an exemplary embodiment of the present application;

[0046] Figure 8 It is a flowchart of a method for configuring SELinux security policy provided by an embodiment of the present application;

[0047] Fig. 9 It is a flowchart of a method for configuring SELinux security policy shown in an exemplary embodiment of the present application;

[0048] Fig.10 It is a flowchart of another method for configuring SELinux security policy shown in an exemplary embodiment of the present application;

[0049] Fig.11 It is a flowchart of another method for configuring SELinux security policy shown in an exemplary embodiment of the present application;

[0050] Fig.12 A schematic diagram of the structure of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0052] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0053] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this embodiment, unless otherwise specified, "plurality" means two or more.

[0054] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0055] The technical solution of the embodiment of the present application can be applied to electronic devices, such as the operating system of the electronic device, such as the Android system, and can also be applied to other operating systems, such as the Linux operating system, the Windows operating system, etc., without limitation.

[0056] In order to better understand the system for configuring SELinux security policy and the method for configuring SELinux security policy provided in the embodiments of the present application, some terms involved in the embodiments of the present application are first explained below to facilitate understanding by those skilled in the art.

[0057] 1. Security-Enhanced Linux

[0058] SELinux is a Linux kernel module. It is a mandatory access control (MAC) security system based on the domain-type model. The principle is that any process that wants to do anything in the SELinux system must first configure permissions in the SELinux security policy file. If there is no permission configured in the SELinux security policy file, the process does not have the permission for the operation. SELinux uses this mandatory access control method to ensure the security of processes and system resources. It allows each process to have its own operating area and grant the minimum access rights.

[0059] Each subject in the SELinux system has a domain, and each object has a type.

[0060] The subject mainly refers to various processes and threads in electronic devices. The object mainly refers to various system resources used for communication, information sharing and storage in electronic devices, such as files, sockets, storage space, directories, shared memory, etc. Taking the electronic device as a mobile phone as an example, the system resources in the mobile phone may include stored system files, storage space, and storage directories of different storage spaces.

[0061] 2. SEAndroid

[0062] SEAndroid is a subset of SELinux. When SELinux technology is applied to the Android system, the SELinux technology can also be called SEAndroid.

[0063] SEAndroid is exactly the same as SELinux in terms of architecture and mechanism. SEAndroid's security checks can include domain conversion, type conversion, process-related operations, kernel-related operations, file directory-related operations, file system-related operations, device-related operations, application (Application, APP)-related operations, network-related operations, and inter-process communication (Inter-Process Communication, IPC)-related operations.

[0064] 3. Access Vector Cache (AVC)

[0065] Used to record all SELinux-related access statistics.

[0066] 4. The program does not execute as expected

[0067] The failure of a program to execute as expected is an abnormal event that occurs during the execution of the program and affects the normal execution of the program. In the embodiment of the present application, the failure of a program to execute as expected may be a program running error, a program crash, a program failing to successfully execute certain operations, a program failing to implement certain functions, etc.

[0068] 5. Treble

[0069] Treble is an Android architecture from Google that is used to distinguish system components (system, system_ext) from chip components (vendor). Usually, we call this combination of Android12 S+S and Android13 T+T. Since chip components are bound to hardware, this split by Google allows the Android version to be upgraded without changing the hardware driver, that is, it can be upgraded from S+S to S+T.

[0070] The above is a brief introduction to the terms involved in the embodiments of the present application, which will not be repeated below.

[0071] With the development of electronic devices (such as mobile phones, smart wearable devices, tablet computers, personal computers (PCs), desktop computers, laptops, large-screen devices, smart TVs, etc.), the security of electronic devices is becoming more and more important. The application of SELinux technology in the existing operating system platform has greatly improved the security of the operating system.

[0072] Taking the application of SELinux technology in Android system as an example, SELinux defaults that all processes have no access rights to all system resources, so it is necessary to configure permissions in the SELinux security policy file first. For example, the security policy file configures the access rights of different processes when accessing system resources, so that different processes have different access rights, ensuring that the processes can smoothly perform their basic functions and prevent system resources from being used maliciously. Under the premise of ensuring the function of each process, minimizing its access rights can maximize system security.

[0073] In related technologies, developers usually manually configure permissions between various processes and system resources. Figure 1 , Figure 1This is a flow chart of a method for configuring SELinux security policy in the related technology shown in this application.

[0074] like Figure 1 As shown, the developer compiles the program (such as the computer management control program, system application program, and third-party application program, etc.), and the compiled program runs in the operating system of the electronic device. When running the program, the operating system will query the SELinux rule base (for example, the SELinux security policy file is a file in the Android project source code, which becomes the SELinux rule base that can be queried in the operating system after being compiled and loaded). If the policy rules corresponding to the behavior of the program are not queried in the SELinux rule base (it can be understood that the SELinux security policy file does not configure the corresponding permissions for the behavior of the program), then SELinux will intercept the program and generate an alarm message in combination with the behavior of the program.

[0075] For example, when querying the policy rules corresponding to the behavior of the program in the SELinux rule base, SELinux will use the Access Vector Cache (AVC). If the access is denied (also known as AVC denial), a denial message will be recorded in a log file. The denial message is the AVC alarm information.

[0076] When developers discover that a program does not execute as expected, they need to consult security caretakers in the information security field and ask them to add or guide them to add policy rules corresponding to the program's behavior (or, configure corresponding permissions for the program's behavior in the SELinux security policy file).

[0077] Since there is a certain threshold for SELinux knowledge, it is very time-consuming for developers in non-information security fields to configure SELinux security policy files. If the configuration is wrong, it will cause security risks to the operating system. Moreover, the development of all programs involves the configuration of SELinux permissions. It takes a lot of manpower for developers in the information security field to configure permissions or guide developers in non-information security fields to configure permissions, resulting in high configuration costs, easy configuration errors, and low configuration efficiency.

[0078] Therefore, how to configure SELinux security policy files conveniently and efficiently while reducing configuration costs and improving the security of development software is an urgent problem that needs to be solved today.

[0079] In view of this, an embodiment of the present application provides a method for configuring SELinux security policy, which can analyze the AVC alarm information and the cause process of the program to obtain the analysis result, and generate the permission configuration scheme of the program according to the analysis result. In this implementation, on the one hand, since the AVC alarm information is the most accurate among various SELinux permission detection methods, the automated analysis based on the AVC alarm information can accurately reflect the SELinux permission problem, so that the permission configuration scheme obtained after the analysis of the AVC alarm information is more accurate, and the security situation caused by the analysis error can be effectively avoided. On the other hand, compared with the related art, the present application includes the addition position in the generated permission configuration scheme, so that the user will not be blind when configuring the SELinux security policy file of the program, which is conducive to the user to configure the SELinux security policy file of the program conveniently and efficiently, reducing the configuration cost, saving manpower, and improving the security of the development software.

[0080] The embodiment of the present application also provides a system for configuring SELinux security policies. The overall architecture involved in the system for configuring SELinux security policies provided by the embodiment of the present application is described below in conjunction with the accompanying drawings.

[0081] See also Figure 2 , Figure 2 Schematic diagram of the system architecture shown in an exemplary embodiment of the present application. Figure 2 As shown, the system for configuring SELinux security policy provided by the embodiment of the present application may include an electronic device and a server. The electronic device is connected to the server through a network to achieve data communication or interaction between the two.

[0082] The electronic device in the embodiments of the present application may be a mobile phone, a tablet computer, a wearable device, an in-vehicle device, an augmented reality (AR) / virtual reality (VR) device, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiments of the present application do not impose any restrictions on the specific type and form of the electronic device.

[0083] The server in the embodiments of the present application may be an independent server, or a cloud service that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The embodiments of the present application do not impose any restrictions on the specific type and form of the server.

[0084] Exemplarily, the electronic device may display a front-end interface. The front-end interface is used to interact with the user, thereby assisting the user in configuring the SELinux security policy file. Specifically, the front-end interface may display a plurality of different modules, each module displaying different content.

[0085] For example, the front-end interface can display a cause confirmation module, an analysis module, and can also display a verification module and a knowledge display module, etc. Among them, the cause confirmation module is used to display SELinux guidance information and a method for obtaining AVC alarm information. Among them, the SELinux guidance information is used to determine the reason why the program is not executed as expected, and the reason type corresponding to the reason. Exemplarily, the SELinux guidance information may include various problems that may arise during the development of the program (such as SELinux permission problems), and the SELinux guidance information may also include various reasons that cause the program to not be executed as expected, and the reason type corresponding to each reason.

[0086] The method for obtaining the AVC warning information is used to obtain the AVC warning information of the program. In other words, the method for obtaining the AVC warning information is used to guide the user to obtain the AVC warning information of the program.

[0087] It can be understood that the SELinux guidance information displayed by the cause confirmation module can assist users in quickly determining the reason why the program was not executed as expected, and the cause type corresponding to the reason. The method for obtaining AVC alarm information displayed by the cause confirmation module can guide users to quickly extract the AVC alarm information of the program.

[0088] The analysis module is used to determine and display the permission configuration scheme of the program according to the AVC alarm information and reason type of the program. The permission configuration scheme is used to configure the SELinux security policy file of the program, and the permission configuration scheme includes the permission statement to be added and the adding position.

[0089] In a possible implementation, the user compiles the program and runs the compiled program in the operating system of the electronic device. When the user finds that the program is not executed as expected, the system for configuring SELinux security policy configures the SELinux security policy file corresponding to the program so that the program can be executed as expected.

[0090] For example, when it is found that the program is not executed as expected, the possible problems of the program are queried in the cause confirmation module of the front-end interface, that is, the type of reason that caused the program not to be executed as expected is queried in the cause confirmation module. The reason type and AVC alarm information are input into the analysis module, and the analysis module sends the input information to the server. The server analyzes the information, generates a permission configuration plan, and sends the permission configuration plan to the electronic device. The electronic device receives the permission configuration plan sent by the server and displays the permission configuration plan in the analysis module. The user can configure the corresponding permissions of the program in the SELinux security policy file according to the permission configuration plan so that the program can be executed as expected.

[0091] The verification module is used to display various compilation verification methods of the program, which can be used to compile and verify the developed program process to ensure that the program can be executed as expected. The compilation verification method can also be used to compile and verify the program after configuring the SELinux security policy file to verify whether the configuration is effective.

[0092] The knowledge display module is used to display SELinux related knowledge, including signature related knowledge (such as APK signature issues), SELinux basic knowledge, security knowledge, etc. Users can learn about SELinux technology and security knowledge in the field of information security through the content displayed in this knowledge display module, and learn more about SELinux related content and various reasons why programs do not execute as expected.

[0093] In simple terms, the front-end interface prompts the user according to the process of locating the failure of the program, analyzing the specific cause, and verifying the program (that is, prompting the user on what to do when the program does not execute as expected). During this period, the user is also guided to transmit the AVC alarm information, cause type and other information to the server, so that the server can analyze the AVC alarm information and cause type, and then generate a permission configuration plan, and send the permission configuration plan to the electronic device. The user uses the permission configuration plan to configure the corresponding permissions of the program in the SELinux security policy file so that the program can execute as expected.

[0094] In addition, the cause confirmation module, analysis module, verification module, and knowledge display module of the system for configuring SELinux security policy provided by the embodiment of the present application are displayed on the Web interface, that is, presented in the form of a web page, and users can use it anytime and anywhere without having to install tools, plug-ins, etc. separately, which reduces the configuration cost and improves the convenience of configuring SELinux security policy. Generating a permission configuration plan is an automated process, which frees up manpower and improves configuration efficiency.

[0095] The overall architecture of the system for configuring SELinux security policy provided in the embodiment of the present application is introduced above in conjunction with the accompanying drawings. The hardware structure of the electronic device involved in the embodiment of the present application will be briefly introduced below in conjunction with the accompanying drawings.

[0096] Please refer to Figure 3 , Figure 3 It is a schematic diagram of the hardware structure of an electronic device shown in an exemplary embodiment of the present application.

[0097] like Figure 3 As shown, the electronic device 100 may include a processor 110 , a memory 120 , and a computer program 130 stored in the memory 120 and executable on the processor 110 .

[0098] It is to be understood that the structure shown in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include Figure 3 More or fewer components than those shown, or the electronic device 100 may include Figure 3 Combinations of some of the components shown, or the electronic device 100 may include Figure 3 Subassemblies of some of the components shown. Figure 3 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0099] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0100] The controller may be the nerve center and command center of the electronic device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0101] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI) interface, a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0102] It is understandable that the interface connection relationship between the modules shown in this embodiment is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0103] The memory 120 may be an internal storage unit of the electronic device 100, such as a hard disk or memory of the electronic device 100. The memory 120 may also be an external storage terminal of the electronic device 100, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 100.

[0104] The memory 120 is used to store computer instructions and other programs and data required by the electronic device 100. The memory 120 can also be used to temporarily store data that has been output or is to be output.

[0105] The computer program 130 may be divided into one or more modules, which are stored in the memory 120 and executed by the processor 110 to complete the various technical solutions in the embodiments of the present application. The one or more units may be a series of computer instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program 130 in the electronic device 100.

[0106] In the embodiment of the present application, the electronic device 100 may further include a display screen, which may be used to display a front-end interface, such as displaying a cause confirmation module, an analysis module, a verification module, and a knowledge display module in the front-end interface through the display screen.

[0107] In addition, various types of operating systems are running on the above components, such as Android system, Linux operating system, Windows operating system, etc. This is only an exemplary description and is not limited to this. Applications can be installed and run on these operating systems.

[0108] The various technical solutions provided in the embodiments of the present application can be implemented in the electronic device 100 having the above-mentioned hardware structure.

[0109] The above briefly introduces the hardware structure of the electronic device involved in the embodiments of the present application. The following introduces the front-end interface displayed in the electronic device with reference to the accompanying drawings.

[0110] It is worth noting that the front-end interface can be a Web interface or an APP interface. In the embodiment of the present application, the front-end interface is taken as an example of a Web interface.

[0111] Please refer to Figure 4 , Figure 4 Schematic diagram of a Web interface shown in an exemplary embodiment of the present application. Figure 4 As shown, the Web interface includes a cause confirmation module, an analysis module, a verification module and a knowledge display module.

[0112] The following is an introduction to the reason confirmation module included in the Web interface. The reason confirmation module is used to display SELinux guidance information and obtain AVC alarm information.

[0113] The SELinux guidance information is used to determine the reason why the program is not executed as expected, and the reason type corresponding to the reason. Exemplarily, the SELinux guidance information may include various problems that may occur during the development of the program (such as SELinux permission problems), and the SELinux guidance information may also include various reasons that cause the program to not be executed as expected, and the reason type corresponding to each reason.

[0114] The method for obtaining the AVC warning information is used to obtain the AVC warning information of the program. In other words, the method for obtaining the AVC warning information is used to guide the user to obtain the AVC warning information of the program.

[0115] It can be understood that the SELinux guidance information displayed by the cause confirmation module can assist users in quickly determining the reason why the program was not executed as expected, and the cause type corresponding to the reason. The method for obtaining AVC alarm information displayed by the cause confirmation module can guide users to quickly extract the AVC alarm information of the program.

[0116] For example, through the content displayed in the cause confirmation module, the user is guided to first determine whether the reason why the program is not executed as expected is an SELinux permission problem. If the reason why the program is not executed as expected is an SELinux permission problem, the user is further guided to determine the problem type (or cause type) corresponding to the SELinux permission problem.

[0117] When the reason why a program fails to execute as expected is due to an SELinux permission issue, the program will be intercepted by SELinux when running in the operating system and an AVC alarm message will be generated. The content displayed in the cause confirmation module will further guide the user on how to obtain the AVC alarm message. For example, the method for obtaining the AVC alarm message includes the storage path of the generated AVC alarm message, and the user can extract the AVC alarm message of the program based on the storage path.

[0118] In order to facilitate users to quickly determine why the program did not execute as expected, the content displayed by the cause confirmation module can be displayed in the form of a question guide corresponding to an answer guide. In one example, in order to facilitate users to view the answer intuitively, the answer guide in the cause confirmation module can include specific answer content, that is, the answer is directly displayed below the corresponding question guide. In another example, in order to provide users with a better browsing experience when the answer content is large, the answer guide in the cause confirmation module can also include a link, and the user can click on the link to trigger the web interface to display the answer content interface corresponding to the link.

[0119] like Figure 4 As shown, the cause confirmation module can specifically display the following contents:

[0120] Question Guide 1. Please confirm whether it is a SELinux permission issue?

[0121] Answer Guide 1. SELinux shutdown method guide .

[0122] Question guide 2. Cause type

[0123] Answer guide 2. SELinux Cause Classification .

[0124] Question 3: How to obtain AVC alarm information?

[0125] Answer guide 3. How to obtain AVC alarm information .

[0126] In one example, the compiled program is run in the operating system of the electronic device. When the program is not executed as expected, the user first considers whether the failure to execute the program as expected is caused by SELinux permission issues according to problem guide 1.

[0127] Because SELinux has three optional modes in specific applications, you can give priority to whether the program fails to execute as expected due to improper SELinux mode settings.

[0128] Exemplarily, the three modes of SELinux are as follows:

[0129] The first mode is the disabled mode, also known as the shutdown mode, which means that SELinux is completely ineffective.

[0130] The second mode is the Permissive mode, which means that when a program performs an action that does not comply with the permissions, it will not be intercepted, but the interception behavior will be recorded in the log.

[0131] The third mode is the Enforcing mode, which means that when a program performs a behavior that does not comply with the permissions, it will be intercepted, the interception behavior will be recorded in the log, and an AVC alarm message will be generated.

[0132] After seeing Question Guide 1, you can check the currently running SELinux mode. If the SELinux mode is really set improperly, you can adjust the SELinux mode according to the "SELinux shutdown method guide" in Answer Guide 1.

[0133] Exemplarily, the SELinux shutdown method guide may include a method for turning on SELinux, a method for turning off SELinux, and a method for switching the mode of SELinux. The user can adjust the SELinux mode according to the "SELinux shutdown method guide" in answer guide 1.

[0134] It is understandable that the answer guide in this embodiment includes a link. Figure 4 As shown in the figure, the answer guide and the question guide are displayed in different ways (such as the answer guide contains an underline), which makes it easier for users to view the question guide and click on the answer guide. For example, the user can click on the answer guide 1, that is, click on " SELinux shutdown method guide", triggering the web interface to display the answer content interface corresponding to the link of the answer guide 1. For example, the answer content interface shows how to enable SELinux, how to disable SELinux, and how to switch the mode of SELinux.

[0135] It should be understood that the answer content interface can be the interface after the current Web interface jumps, or it can be a newly created interface, and there is no limitation on this.

[0136] If it is determined that the failure of the program to execute as expected is caused by an SELinux permission problem, and the problem is not solved according to answer guide 1, then the cause type corresponding to the reason why the program did not execute as expected is determined according to question guide 2. The cause type in this embodiment may include a newly added problem type. The newly added problem type refers to the type corresponding to the failure of the program to execute as expected due to the addition of processes, files, attributes, and newly added permissions to known subjects and objects (known subjects and / or objects) during the development of the program.

[0137] For example, a new process is added during the development of a program, and the new process may cause the program to not execute as expected. In this case, the new problem type may include a new process type. Among them, the new process may include a system service process (.rc service), an inter-process communication process (Hidl / Aidl), and other processes. Other processes refer to processes other than system service processes and inter-process communication processes.

[0138] For another example, during the development of a program, a new file is added, and the new file may cause the program to not execute as expected. In this case, the new problem type may include a new file type. Among them, the new file may include virtual files and general files. Virtual files refer to files dynamically generated when the system is running. General files refer to files that can be seen in the system directory and are not virtual files. It can be understood that general files are files that have been written by the system during compilation / development.

[0139] For another example, a new attribute is added during the development of a program, and the new attribute may cause the program to not execute as expected. In this case, the new problem type may include a new attribute type. The new attribute may include a read attribute and / or a write attribute of a file.

[0140] For another example, in the process of developing a program, new permissions are added to known subjects and / or objects, and the new permissions added to known subjects and / or objects may cause the program to not execute as expected. In this case, the new problem type may include a new permission type (or a known subject and object new permission type).

[0141] For example, the user can click on answer guide 2, that is, click on " SELinux Cause Classification " triggers the web interface to display the answer content interface corresponding to the link of the answer guide 2. For example, the answer content interface displays the newly added question type, which specifically includes the newly added process type, newly added file type, newly added attribute type and newly added permission type (or known subject and object newly added permission type) described above.

[0142] Optionally, in a possible implementation, the newly added process type further includes: newly added system service process type, newly added inter-process communication process type and newly added other process types. The newly added file type further includes: newly added virtual file type and newly added general file type.

[0143] During the process of developing a program, no matter which of the newly added processes, files, attributes, and permissions (new permissions for known subjects and objects) are added, they are all operated by the user himself. When the user sees these newly added problem types displayed on the web interface, he can be reminded to combine the newly added content during the process of developing the program (such as newly added processes, files, attributes, and new permissions for known subjects and objects) to determine the cause type corresponding to the reason why the program did not execute as expected.

[0144] When a program is not executed as expected, it will be intercepted by SELinux when running in the operating system and generate an AVC alarm message. According to Question Guide 3 and Answer Guide 3, you can obtain the AVC alarm message of the program.

[0145] For example, the user can click on answer guide 3, that is, click on " How to obtain AVC alarm information " triggers the web interface to display the answer content interface corresponding to the link of answer guide 3. For example, the answer content interface shows how to obtain the AVC alarm information. For example, the storage path of the AVC alarm information is displayed. The user can print the AVC alarm information with the word "avc denied" in the log according to the guidance of the storage path.

[0146] Exemplarily, the acquired AVC alarm information may be:

[0147] avc:denied{read}for path=" / sbin / cbd" dev="rootfs" ino=1182scontext=u:r:cbd:s0tcontext=u:object_r:rootfs:s0 tclass=file permissive=0

[0148] Wherein, avc indicates the log type. Read indicates the read permission. It should be understood that in other implementations, other characters in {} indicate other permissions. For example, in {}, write indicates the write permission; in another example, in {}, create indicates the create permission, etc.

[0149] denied indicates what SELinux did, denying or allowing. path (or name) indicates the name of the target being accessed. dev indicates the device or file system where the target is located.

[0150] ino represents the target inode number, which can be used to find the target file. scontext represents Sourcecontext, which is the context originally defined by SELinux, and can also be understood as a subject label. tcontext represents Targetcontext, which is the context of the current file, and can also be understood as an object label.

[0151] tclass indicates the type of the target, and file indicates a common file. It should be understood that in other implementations, dir after tclass indicates a directory, and fd indicates a file descriptor.

[0152] The complete meaning of this AVC alarm information is: the cbd process lacks the read permission for the rootfs type file.

[0153] In the cause confirmation module provided in the embodiment of the present application, the SELinux guidance information displayed by the cause confirmation module can assist the user to quickly determine the reason why the program was not executed as expected, and the cause type corresponding to the reason. The method for obtaining AVC alarm information displayed by the cause confirmation module can guide the user to quickly extract the AVC alarm information of the program. When the program is not executed as expected, it provides ideas and help to the user, and at the same time provides a basis for the subsequent configuration of the SELinux security policy file.

[0154] The following is an introduction to the analysis module included in the Web interface. The analysis module is used to determine and display the permission configuration scheme of the program based on the AVC alarm information and cause type of the program. The permission configuration scheme is used to configure the SELinux security policy file of the program. The permission configuration scheme includes the permission statement to be added and the location to add it.

[0155] Exemplarily, the cause type determined by the cause confirmation module and the acquired AVC alarm information are input into the analysis module, and the analysis module sends the input information to the server. The server analyzes the cause type and the AVC alarm information, obtains a permission configuration scheme, and sends the permission configuration scheme to the electronic device. The electronic device receives the permission configuration scheme sent by the server and displays the permission configuration scheme in the analysis module. The user can configure the permissions corresponding to the program in the SELinux security policy file according to the permission configuration scheme so that the program can be executed as expected. For example, the user can add the permission statement to be added to the SELinux security policy file according to the adding position in the permission configuration scheme.

[0156] like Figure 4 As shown, in order to facilitate users to quickly input the problem type and AVC alarm information, different input boxes and / or selection boxes are set in the analysis module, and users can enter the cause type and AVC alarm information in the corresponding input box and / or selection box according to the prompt. A submit button can also be displayed in the analysis module. After the user enters the cause type and AVC alarm information, the user can click the submit button to trigger the submission instruction, and the electronic device sends the cause type and AVC alarm information to the server according to the submission instruction.

[0157] It is understandable that the more comprehensive the information sent by the electronic device to the server, the more accurate the analysis results of the server will be. Therefore, in one possible implementation, the user can input one or more of the platform information, chip component information, and system component information in the analysis module on the basis of inputting the cause type and AVC alarm information. Among them, the platform information refers to the platform used by the development program, the chip component information refers to the chip component version used by the development program (which can be understood as the underlying Android version corresponding to the chip), and the system component information refers to the system component version used by the development program (which can be understood as the version of the Google Android system).

[0158] Please refer to Figure 5 , Figure 5 It is another schematic diagram of a Web interface shown in an exemplary embodiment of the present application.

[0159] like Figure 5 As shown, there is a drop-down bar behind each input prompt information (i.e., please select the reason type, please select the platform, etc.). In order to facilitate users to quickly input information, the drop-down bar in the embodiment of the present application is pre-set with multiple reason types, multiple platforms, multiple chip component versions, and multiple system component versions. Users can use the drop-down bar to input the reason type, platform information, chip component information, and system component information. For example, when a user clicks the corner mark (such as "Please select the reason type") after "Please select the reason type", the system component version is displayed. Figure 5A drop-down menu will pop up, showing multiple new question types. Users can select the corresponding new question type based on the actual situation.

[0160] In addition, there is a corresponding input box behind "Please enter the AVC alarm information", and the user can copy the AVC alarm information obtained in the cause confirmation module and paste the AVC alarm information into the input box behind "Please enter the AVC alarm information".

[0161] like Figure 5 As shown, in one example, the analysis module may display the following parts:

[0162] Please select the reason type: Add a new process type

[0163] Please select platform:qcom

[0164] Please select chip component version: T

[0165] Please select system component version: T

[0166] Please enter AVC alarm information: ...

[0167] After the user enters the above information (such as reason type, platform information, chip component information, and system component information), he can click the submit button to trigger the submission instruction, and the electronic device sends the input information to the server according to the submission instruction. The server analyzes the received information, obtains the permission configuration plan, and sends the permission configuration plan to the electronic device.

[0168] After receiving the permission configuration scheme sent by the server, the electronic device displays the permission configuration scheme on a Figure 5 in the display box below the Submit button shown.

[0169] Optionally, in a possible implementation, when the input reason types are different, on the basis of inputting the reason type, AVC alarm information, platform information, chip component information and system component information, attribute information, tag information (such as tag name) and path information (such as file / executable file path) etc. can also be input in the analysis module. In this implementation, the information sent by the electronic device to the server is more comprehensive, and the server generates the permission configuration scheme faster and with higher accuracy, so that the corresponding permissions of the program can be configured based on the permission configuration scheme sent by the server, which will be more efficient and accurate, thereby making the program safer.

[0170] Please refer to Figure 6 , Figure 6 FIG. 1 is another schematic diagram of a Web interface shown in an exemplary embodiment of the present application. Figure 6As shown, in one example, the analysis module may display the following parts:

[0171] Please select the reason type:

[0172] Please select your platform:

[0173] Please select chip component version:

[0174] Please select the system component version:

[0175] Please enter AVC alarm information:

[0176] Enter a tag name:

[0177] Please select the component to which the attribute belongs:

[0178] Please select a property writable component:

[0179] Please select a component that can read properties:

[0180] After the user enters the above information (such as reason type, platform information, chip component information, system component information, attribute information and tag information), he can click the submit button to trigger the submission instruction, and the electronic device sends the input information to the server according to the submission instruction. The server analyzes the received information, obtains the permission configuration plan, and sends the permission configuration plan to the electronic device.

[0181] After receiving the permission configuration scheme sent by the server, the electronic device displays the permission configuration scheme on a Figure 6 in the display box below the Submit button shown.

[0182] Please refer to Figure 7 , Figure 7 FIG. 1 is another schematic diagram of a Web interface shown in an exemplary embodiment of the present application. Figure 7 As shown, in one example, the analysis module may display the following parts:

[0183] Please select the reason type:

[0184] Please select your platform:

[0185] Please select chip component version:

[0186] Please select the system component version:

[0187] Please enter AVC alarm information:

[0188] Enter a tag name:

[0189] Input File / Executable Path:

[0190] After the user enters the above information (such as reason type, platform information, chip component information, system component information, tag information, and path information), he can click the submit button to trigger the submission instruction, and the electronic device sends the input information to the server according to the submission instruction. The server analyzes the received information, obtains the permission configuration plan, and sends the permission configuration plan to the electronic device.

[0191] After receiving the permission configuration scheme sent by the server, the electronic device displays the permission configuration scheme on a Figure 7 in the display box below the Submit button shown.

[0192] In the analysis module provided in the embodiment of the present application, the analysis module transmits various information of the program that is not executed as expected to the server, so that the server can analyze the information to obtain the permission configuration plan of the program, and finally display the permission configuration plan in the analysis module. There is no need to master SELinux knowledge or to receive guidance from developers in the field of information security. Through the automated analysis of the server and the display of the analysis module, users can quickly know the configuration method, thereby reducing the configuration cost and saving manpower, which is conducive to conveniently and efficiently configuring the SELinux security policy file of the program so that the program can be executed as expected, thereby improving the security of the developed software.

[0193] The following is an introduction to the verification module included in the Web interface. Exemplarily, the verification module is used to display multiple compilation verification methods of the program, which can be used to compile and verify the developed program process to ensure that the program can be executed as expected. The compilation verification method can also be used to compile and verify the program after the SELinux security policy file is configured to verify whether the configuration is effective.

[0194] Exemplarily, a variety of different compilation verification methods are set in advance according to various permission configuration schemes that may appear. In one possible implementation, the compilation verification method may include test cases, and multiple compilation verification methods are multiple test cases. Among them, a test case refers to a description of a test task for a specific program, reflecting the test plan, method, technology and strategy. The content of the test case includes test objectives, test environment, input data, test steps, expected results, test scripts, etc., and finally forms a test document. In other words, a test case is a set of test inputs, execution conditions and expected results compiled for a special goal, which is used to verify whether the program can eventually be executed as expected.

[0195] After determining the permission configuration scheme of the program according to the analysis module, find the compilation verification method that matches the permission configuration scheme among the multiple compilation verification methods displayed by the verification module, and compile and verify the program with the found compilation verification method. If the compilation verification succeeds, it proves that the SELinux security policy file configured for the program is successful and the program can be executed as expected. If the compilation verification fails, it proves that the SELinux security policy file configured for the program fails and the program needs to be adjusted.

[0196] In order to facilitate users to quickly master the compilation verification method of the program, the content displayed by the verification module is also displayed in the form of one question guide corresponding to one answer guide. In one example, in order to facilitate users to view the answers intuitively, the answer guide in the verification module can include specific answer content, that is, the answer is directly displayed below the corresponding question guide. In another example, in order to provide users with a better browsing experience when the answer content is large, the answer guide in the verification module can also include a link, and the user can click on the link to trigger the web interface to display the answer content interface corresponding to the link.

[0197] like Figure 4 As shown, the verification module can specifically display the following content:

[0198] Question Guide 1. How to perform compilation verification?

[0199] Answer Guide 1. Compile Verification Method Guide .

[0200] Question guide 2. Why does the configuration not take effect?

[0201] Answer guide 2. How tags and permissions take effect .

[0202] In one example, the compilation verification method in Answer Guide 1 is used to compile and verify the program after the permissions are configured according to the permission configuration scheme.

[0203] It is understandable that the answer guide in this embodiment includes a link. Figure 4 As shown, for example, the user can click on the answer guide 1 in the verification module Compile Verification Method Guide ", triggering the web interface to display the answer content interface corresponding to the link of the answer guide 1. The answer content interface can display how to verify the effectiveness of the configuration after configuring the SELinux security policy file. For example, it can display how to determine the compilation file and compilation image according to the added path, and how to flash the machine.

[0204] Optionally, in a possible implementation, when the user configures the permissions corresponding to the program in the SELinux security policy file according to the permission configuration scheme, the configuration may not take effect. This situation matches the question guide 2 displayed by the verification module. At this time, the user can click the answer guide 2 in the verification module. How tags and permissions take effect ", triggering the Web interface to display the answer content interface corresponding to the link of the answer guide 2. The answer content interface can display the specific content of the label and the effectiveness principle of the permission. For example, after the SELinux security policy file is configured, the details of how the permission is compiled, loaded and effective, the intermediate products of the whole process, etc., can be displayed. Users can judge at which step the permission takes effect. The problem occurs, which is convenient for users to adjust the configured program.

[0205] In the verification module provided in the embodiment of the present application, multiple compilation verification methods of the program are displayed through the verification module, and the compilation verification method can be used to compile and verify the program after configuring the SELinux security policy file, so as to verify whether the configuration is effective, thereby ensuring that the program can be executed as expected. In addition, the verification module also displays the effectiveness principle. When the configuration is not effective, the user can be guided to find out the reason why the configuration is not effective based on this, so as to adjust the program and ensure that the program can finally be executed as expected.

[0206] The following is an introduction to the knowledge display module included in the web interface. For example, the knowledge display module displays SELinux related knowledge, which includes signature related knowledge (such as APK signature issues), SELinux basic knowledge, security knowledge, etc. Users can learn about SELinux technology and security knowledge in the field of information security through the content displayed in the knowledge display module, and learn more about SELinux related content and various reasons why the program does not execute as expected.

[0207] In order to facilitate users to quickly and systematically learn more about SELinux and the various reasons why programs do not execute as expected, the content displayed by the knowledge display module is also displayed in the form of one question guide corresponding to one answer guide. In one example, in order to facilitate users to view the answers intuitively, the answer guide in the knowledge display module can include specific answer content, that is, the answer is directly displayed below its corresponding question guide. In another example, in order to provide users with a better browsing experience when the answer content is large, the answer guide in the knowledge display module can also include a link, and the user can click on the link to trigger the web interface to display the answer content interface corresponding to the link.

[0208] like Figure 4 As shown, the knowledge display module can specifically display the following contents:

[0209] Question Guide 1. apk tag problem?

[0210] Answer Guide 1. SELinux apk tag detailed explanation .

[0211] Question guide 2. SELinux basics

[0212] Answer guide 2. SELinux Basics

[0213] Question 3. OS Security Team

[0214] Answer guide 3. OS Security Team

[0215] Exemplarily, the detailed explanation of SELinux apk label includes the process of determining the application label according to the application signature and package name. It should be understood that each application must have its own label after being installed. Here, the whole process of determining the application label according to the application signature and package name after the application is installed is introduced in detail to facilitate user learning.

[0216] SELinux basics include SELinux principles, problem analysis, and addition guidance. OS security team includes team introduction, team knowledge base, etc.

[0217] For example, the user can click on the answer guide 2 "SELinux basics" in the knowledge display module to trigger the web interface to display the answer content interface corresponding to the link of the answer guide 2. The answer content interface can display the principles of SELinux, problem analysis, and addition guidance.

[0218] In the knowledge display module provided in the embodiment of the present application, SELinux related knowledge is displayed. Users can learn security knowledge in the field of SELinux technology and information security through the content displayed in the knowledge display module, and understand the various reasons why the program is not executed as expected. If the problem of the program not being executed as expected is not solved by the previous cause confirmation module, analysis module, and verification module, it can be solved after learning the content of the knowledge display module.

[0219] In addition, the cause confirmation module, analysis module, verification module, and knowledge display module of the system for configuring SELinux security policy provided by the embodiment of the present application are displayed on the Web interface, that is, presented in the form of a web page, and users can use it anytime and anywhere without having to install tools, plug-ins, etc. separately, which reduces the configuration cost and improves the convenience of configuring SELinux security policy. Generating a permission configuration plan is an automated process, which frees up manpower and improves configuration efficiency.

[0220] The above is a detailed introduction to the front-end interface displayed in the electronic device involved in the embodiments of the present application. The following embodiments of the present application will take electronic devices and servers as examples, combined with drawings and application scenarios, to specifically explain the method for configuring SELinux security policies provided in the embodiments of the present application.

[0221] See also Figure 8 , Figure 8 1 is a flow chart of a method for configuring SELinux security policy provided by an embodiment of the present application. The method includes:

[0222] S101. Obtain request information sent by an electronic device.

[0223] The request information includes the reason type corresponding to the reason why the program is not executed as expected and the AVC alarm information of the program.

[0224] Exemplarily, the server obtains the reason type sent by the electronic device and the AVC alarm information of the program. Specifically, when it is found that the program is not executed as expected, the problem that may occur in the program is queried in the reason confirmation module of the front-end interface of the electronic device, that is, the reason type causing the program not to be executed as expected is queried in the reason confirmation module.

[0225] According to the method for obtaining AVC alarm information displayed by the cause confirmation module, the AVC alarm information of the program is obtained. For example, the method for obtaining AVC alarm information includes the storage path of the generated AVC alarm information, and the user can extract the AVC alarm information of the program according to the storage path.

[0226] Exemplarily, the request information (i.e., the cause type and AVC alarm information) determined by the cause confirmation module is input into the analysis module, and the analysis module sends the input request information to the server. Specifically, in order to facilitate the user to quickly input the request information, different input boxes and / or selection boxes are provided in the analysis module, and the user can enter the request information in the corresponding input box and / or selection box according to the prompt. A submit button can also be displayed in the analysis module. After the user enters the request information, he can click the submit button to trigger the submit instruction, and the electronic device sends the request information to the server according to the submit instruction.

[0227] It is understandable that the server performs analysis based on the request information sent by the electronic device, so the information sent by the electronic device to the server is more comprehensive and the analysis result of the server will be more accurate. Therefore, in a possible implementation, the request information may include one or more of platform information, chip component information, system component information, attribute information, label information and path information in addition to the cause type and the AVC alarm information of the program.

[0228] Among them, platform information refers to the platform used by the development program, chip component information refers to the chip component version used by the development program, system component information refers to the system component version used by the development program, attribute information may include the read attributes and / or write attributes of the file, tag information may include the tag name, path information may include the file / executable file path, etc.

[0229] S102: Analyze the request information to obtain analysis results.

[0230] The analysis results may include the subject tag and object tag corresponding to the program, and the permission statement to be added.

[0231] Exemplarily, the AVC warning information is parsed to extract preset keywords in the AVC warning information. The preset keywords include at least one of name, scontext, tcontext, class, and perms.

[0232] For example, read each word symbol in the AVC warning information sequentially to query whether the current word symbol belongs to a preset keyword, operator, delimiter, identifier, etc. If the current word symbol belongs to a preset keyword, mark the current word symbol or extract the current word symbol.

[0233] By presetting the keyword name, the name of the subject being accessed can be determined; by presetting the keyword scontext, the subject label can be determined; by presetting the keyword tcontext, the object label can be determined; by presetting the keyword class, the object type can be determined; and by presetting the keyword perms, the permission type can be determined.

[0234] It should be understood that in the SELinux system, all subjects (such as processes) and objects (such as resources) have a label, wherein the subject label represents the label of the process, and the object label represents the label of the resource to be accessed.

[0235] Exemplarily, according to the reason type in the request information, the permission statement to be added corresponding to the reason type is determined. For example, a correspondence between different reason types and their corresponding permission statements to be added is pre-established and stored in a database. When the request information is received, the permission statement to be added matching the reason type in the request information is searched in the database.

[0236] For example, when the reason type is adding a general file type, the corresponding permission statement to be added can be:

[0237] your_file.te:

[0238] type your_file_label,file_type,system_file_type; / / define executable file label

[0239] file_contexts:

[0240] your_file u:object_r:your_file_label:s0 / / label

[0241] This is just an example and is not intended to be limiting.

[0242] Optionally, in a possible implementation, the legality of the AVC alarm information can be determined after step S101. For example, detect whether the AVC alarm information contains fields such as avc, denied, name, ino, scontext, tcontext, class, and perms. If it does, it proves that the AVC alarm information is legal, and further analyzes the meaning of each field. If none of them are included, it proves that the AVC alarm information is illegal. At this time, the server generates a failure prompt message and sends the failure prompt message to the electronic device. After receiving the failure prompt message, the electronic device displays the failure prompt message in the analysis module for the user to view.

[0243] By parsing the various fields in the AVC alarm information, on the one hand, it can determine whether the AVC alarm information is legal. If it is not legal, the result is directly returned without subsequent analysis, saving time. On the other hand, the subject label and object label corresponding to the program can be determined based on the extracted preset keywords, providing a guarantee for the subsequent generation of permission configuration solutions.

[0244] S103: Generate a permission configuration plan for the program according to the analysis result.

[0245] The permission configuration scheme is used to configure the SELinux security policy file of the program. The permission configuration scheme includes the permission statement to be added and the adding position.

[0246] According to the subject tag and object tag determined in S102, the path where the subject tag and object tag are defined is searched in the preset data table, that is, the position when the subject tag and object tag are defined is searched (that is, the position where the subject tag and object tag are located when the subject tag and object tag are defined), and the path (or the position) is the adding position.

[0247] The data table is pre-stored in the database. The database is a "warehouse" for storing data. In the embodiment of the present application, the database stores the code corresponding to the pre-developed program. The code stored in the database can be updated regularly, for example, a scheduled task is created to periodically download the code corresponding to each program from the company's code warehouse.

[0248] At the same time, SELinux security policy files are regularly extracted from these codes. The attribute and type fields in the SELinux security policy file are parsed to obtain the definition path (that is, the addition location in the permission configuration plan), and the attribute and type fields and the corresponding definition path are associated and stored in the data table.

[0249] In a possible implementation, when storing the attribute and type fields and the corresponding definition paths, the platform information, chip component information, system component information, etc. related to the code may also be stored in association. Alternatively, different data tables are established in advance based on different platform information, chip component information, system component information, etc., and the attribute and type fields and the corresponding definition paths are stored in the adapted data tables, so as to facilitate the subsequent quick search for the definition paths based on the platform information, chip component information, system component information, etc.

[0250] For example, when actually searching for the adding location, input attribute and type in the data table, and output: define the path. It can be generally understood that input the subject tag and object tag, and output the path where the subject tag and object tag are located.

[0251] The permission statement to be added and the adding position are determined, and the permission configuration scheme corresponding to the program is obtained. The server sends the permission configuration scheme to the electronic device. After the electronic device receives the permission configuration scheme sent by the server, the permission configuration scheme is displayed in the analysis module. The user can add the permission statement to be added to the SELinux security policy file according to the adding position in the permission configuration scheme, so that the program can be executed as expected.

[0252] In this implementation, the cause type and AVC alarm information are analyzed, and the permission configuration scheme of the program is generated based on the analysis results. On the one hand, since AVC alarm information is the most accurate among various SELinux permission detection methods, automated analysis based on the AVC alarm information can accurately reflect the SELinux permission problem. Therefore, the permission configuration scheme obtained after analyzing the AVC alarm information is more accurate, which can effectively avoid the occurrence of security conditions caused by analysis errors. On the other hand, compared with the related art, the present application includes an addition location in the generated permission configuration scheme, so that users will not be blind when configuring the SELinux security policy file of the program, which is conducive to users to configure the SELinux security policy file of the program conveniently and efficiently, reducing configuration costs, saving manpower, and improving the security of developed software.

[0253] Optionally, in some possible implementations, when the specific information contained in the request information is different, the corresponding generated permission configuration scheme is also different. For example, there is no AVC alarm information in the request information, but only tag information, then the generated permission configuration scheme is: only guide labeling. For another example, if there is only AVC alarm information in the request information, but no tag information, then the generated permission configuration scheme is: default labeling, check the legality of the alarm, default label appears, alarm and cause type mismatch problem, etc. For another example, if there is AVC alarm information and tag information in the request information, then the generated permission configuration scheme is: labeling and configuring permissions. For another example, if there is no AVC alarm information or tag information in the request information, then a failure prompt message is generated: illegal. This is only an exemplary description and is not limited to this.

[0254] Please refer to Fig. 9 , Fig. 9 FIG. 1 is a flow chart of a method for configuring SELinux security policy shown in an exemplary embodiment of the present application. Fig. 9 As shown, the method may include:

[0255] S201. Obtain request information, where the request information includes AVC alarm information and cause type.

[0256] S202: Determine whether the AVC alarm information is legal.

[0257] For the description of step S201 and step S202 in this embodiment, reference may be made to the description of step S101 above, and will not be repeated here.

[0258] If the judgment result is that the AVC warning information is illegal, then step S203 is executed. If the judgment result is that the AVC warning information is legal, then step S204 is executed.

[0259] S203: Return failure prompt information.

[0260] S204: Determine which type the cause type belongs to.

[0261] S205, belongs to the newly added process type.

[0262] S206, belongs to a newly added file type.

[0263] S207, belongs to the new permission type of known subject and object.

[0264] Exemplarily, based on the reason type in the request information, it is determined whether the reason type is a newly added process type, a newly added file type, a newly added permission type of a known subject or object, or a newly added attribute type that is not listed. In a possible implementation, the newly added attribute type may also be a subdivision of the newly added file type. For example, the newly added file type includes a newly added virtual file type, a newly added general file type, and a newly added attribute type. This is only an exemplary description and is not limited to this.

[0265] In this implementation, it is determined whether the AVC alarm information is legal. If the AVC alarm information is not legal, a failure prompt message is directly returned without subsequent analysis, saving time. If the AVC alarm information is legal, the approximate range is first determined according to the cause type, which is conducive to further subdividing the type according to the currently determined approximate range, thereby improving the speed of generating permission configuration solutions.

[0266] Please refer to Fig.10 , Fig.10 This is a flowchart of another method for configuring SELinux security policy shown in an exemplary embodiment of the present application. It should be understood that different cause types are determined, and the subsequent processing flow is also different. When the cause type is a known subject and object newly added permission type, the processing flow is as follows:

[0267] S301, determine the path where the definition is located.

[0268] Exemplarily, the path where the subject tag and object tag are defined is searched in the preset data table, that is, the location where the subject tag and object tag are defined, such as public, private, and vendor. Among them, vendor is private to the chip component, private is private to the system component, and public is public. This is reflected in the compilation process, where the chip component compiles vendor and public, and the system component compiles private and public.

[0269] S302: Determine whether cross-component access is performed.

[0270] Exemplarily, whether it is a cross-component access between vendor and private is determined according to the definition path.

[0271] S303: Determine a first adding method.

[0272] If it is not a cross-component access between vendor and private, determine the first adding method. The first adding method is: add an allow statement to the self-developed warehouse private / scontext.te where scontext is located (if it is a property, use getprop / setprop). According to the first adding method, the permission statement to be added can be obtained.

[0273] S304: Determine a second adding method.

[0274] If it is cross-component access between vendor and private, determine the second adding method. The second adding method is: add the attribute tag _attr to the public / attribute of the self-developed warehouse where the private tag is located, and add the tag _attr to the tag definition. Add the allow statement for attr to the context.te of the self-developed warehouse where the vendor-defined context is located (if it is a property, use getprop / setprop). According to the second adding method, the permission statement to be added can be obtained.

[0275] S305: Determine whether it is a Treble architecture.

[0276] Exemplarily, whether it is a Treble architecture is determined according to the platform information in the request information.

[0277] S306. Attribute needs to be added to the system component version corresponding to the chip component.

[0278] S307: Generate a permission configuration plan.

[0279] If it is determined to be a Treble architecture, the attribute needs to be added to the system component version corresponding to the chip component. If it is determined not to be a Treble architecture, the platform information in the request information is used to determine whether the joining path is a base shared warehouse, that is, whether to add it to the shared warehouse position.

[0280] In layman's terms, when the reason type is a new permission type for a known subject and object, if it is non-cross-component access, determine that the joining path is the self-developed warehouse; if it is cross-component access, define an attribute in public as a bridge, add access permissions to the vendor's self-developed warehouse, and then adapt the treble architecture. During this period, it is also necessary to consider whether the permissions are added to the shared warehouse location based on whether the platform is shared. After determining the above information, generate a permission configuration plan based on the permission statement to be added and the location to be added, and send the permission configuration plan to the electronic device for the electronic device to display in the analysis module of the Web interface.

[0281] In this implementation, when the reason type is a known subject or object newly added permission type, the corresponding permission configuration scheme can be quickly generated through the above method, so that the user can efficiently and conveniently configure the SELinux security policy file of the program.

[0282] Please refer to Fig.11 , Fig.11 This is a flowchart of another method for configuring SELinux security policy shown in an exemplary embodiment of the present application. It should be understood that different cause types are determined, and the subsequent processing flow is also different. When the cause type is a new process type, the processing flow is as follows:

[0283] S401: Obtain path information and label information in request information.

[0284] Exemplarily, the path information may include a file / executable file path, and the tag information may include a tag name.

[0285] S402: Determine whether the newly added process is a system process or a vendor process.

[0286] Determine whether it is a system process or a vendor process based on the file / executable file path, and then determine the location of your_service.te that defines the label and file_contexts that are labeled.

[0287] S403: Determine whether the process label is reused.

[0288] It is determined whether the process label is a reused label according to the label information, wherein the reused label refers to a label that is repeatedly used.

[0289] S404: Processing is performed using the processing logic corresponding to the newly added permission type of the known subject and object.

[0290] If the process tag is a reused tag, the processing logic corresponding to the newly added permission type of the known subject and object is used for processing, that is, Fig.10 The method in the corresponding embodiment is used for processing.

[0291] S405: Determine whether it is a system process service.

[0292] S406. Processing is performed using the system process tag.

[0293] S407, using vendor process label processing.

[0294] For example, if the process tag is not a reused tag, determine whether the newly added process service is a system process service. If the newly added process service is a system process service, use the system process tag to process it. If the newly added process service is not a system process service, use the vendor process tag to process it. Then, use the processing logic corresponding to the newly added permission type of the known subject and object to process it.

[0295] In an example, assuming that the input executable file path is: your_service_bin, and the process tag is: your_service, the generated permission statement to be added is:

[0296] file_contexts:

[0297] your_service_bin u:object_r:your_service_exec:s0 / / Tag

[0298] If the process label is not a reused label, perform the following first operation:

[0299] If it is a system process service, the permission statement to be added is:

[0300] your_service.te

[0301] type your_service,domain; / / define process label

[0302] type your_service_exec,exec_type,file_type,system_file_type; / / define executable file label

[0303] typeattribute your_service coredomain; / / Add label class to label

[0304] init_daemon_domain(your_service) / / Domain conversion

[0305] If it is a vendor process service, the permission statement to be added is:

[0306] your_service.te

[0307] type your_service,domain; / / define process label

[0308] type your_service_exec,exec_type,file_type,vendor_file_type; / / define executable file label

[0309] init_daemon_domain(your_service) / / Domain conversion

[0310] If the process label is a reused label, the first operation is not performed.

[0311] In this implementation, when the reason type is a newly added process type, the permission statement to be added can be quickly generated through the above method, providing a guarantee for the final generation of a permission configuration plan, so that subsequent users can efficiently and conveniently configure the SELinux security policy file of the program.

[0312] It should be understood that different reasons will lead to different subsequent processing procedures. When the reason type is a newly added file type, the added permissions and the added location are first determined based on the path information and tag information in the request information, and then the reason type is determined to be the newly added file type. For example, a newly added virtual file type, a newly added general file type, a newly added attribute type, etc.

[0313] Optionally, in a possible implementation, when the reason type is a newly added virtual file type, first determine the partition according to the file path: dev, sys, proc; if the file path is your_device, determine the permission statement to be added in the following manner:

[0314] Partition name + fs_your_device.te:

[0315] type partition name + _your_device, fs_type, sysfs_type, partition name + fs_type / / file label definition

[0316] Depending on the partition type, different methods are used to generate the permission statements to be added.

[0317] If it is a / sys partition, the permission statement to be added is:

[0318] genfs_contexts:

[0319] genfscon sysfs / your_device u:object_r:sysfs_your_device:s0 / / File labeling

[0320] If it is a / proc partition, the permission statement to be added is:

[0321] genfs_contexts:

[0322] genfscon procfs / your_device u:object_r:procfs_your_device:s0 / / file labeling

[0323] If it is a / / dev partition, the permission statement to be added is:

[0324] file_contexts:

[0325] / dev / your_device u:object_r:devfs_your_device:s0 / / File labeling

[0326] Optionally, in a possible implementation, when the reason type is adding a general file type, assuming that the file path is: your_file, and the label is: your_file_label, the generated permission statement to be added is:

[0327] your_file.te:

[0328] type your_file_label,file_type,system_file_type; (if it is vendor, then vendor_file_type)

[0329] file_contexts:

[0330] your_file u:object_r:your_file_label:s0 / / label

[0331] Optionally, in a possible implementation, when the reason type is a newly added property type, first determine which property it is based on the permission type, such as system_internal_prop that can only be read and written in system components; then, based on the tag information in the request information, the permission statement to be added is generated as follows:

[0332] property.te:

[0333] system_internal_prop(your_prop) / / Define property tag

[0334] property_contexts:

[0335] ro.your_prop.u:object_r:your_prop:s0 / / attribute labeling

[0336] In this implementation, when the reason type is a newly added file type, the permission statement to be added can be quickly generated through the above method, providing a guarantee for the final generation of the permission configuration plan, so that subsequent users can efficiently and conveniently configure the SELinux security policy file of the program.

[0337] The above describes in detail an example of a method for configuring SELinux security policy provided by an embodiment of the present application. It is understandable that, in order to implement the above functions, the electronic device includes hardware and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to exceed the scope of the present application.

[0338] The embodiment of the present application can divide the functional modules of the electronic device according to the above method example. For example, each function can be divided into various functional modules, such as a cause confirmation module, an analysis module, a verification module, and a knowledge display module, etc., or two or more functions can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0339] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0340] In the case of an integrated unit, the electronic device may further include a processing module, a storage module and a communication module. The processing module may be used to control and manage the actions of the electronic device. The storage module may be used to support the electronic device to execute stored program codes and data, etc. The communication module may be used to support the electronic device to communicate with other devices.

[0341] Among them, the processing module can be a processor or a controller. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip, a WiFi chip, etc.

[0342] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the processor executes the method for configuring the SELinux security policy of any of the above embodiments.

[0343] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the method for configuring the SELinux security policy in the above-mentioned embodiment.

[0344] The embodiment of the present application also provides a server, which is used to implement the method for configuring SELinux security policy in the above embodiment.

[0345] The present application also provides a chip. Fig.12 , Fig.12 A schematic diagram of the structure of a chip provided in an embodiment of the present application. Fig.12 The chip shown can be a general-purpose processor or a special-purpose processor. The chip includes a processor 510. The processor 510 is used to execute the method for configuring SELinux security policy of any of the above embodiments.

[0346] Optionally, the chip further includes a transceiver 520, which is used to accept control of the processor and to support the communication device in executing the technical solution shown above.

[0347] Optional, Fig.12 The chip shown may also include: a storage medium 530 .

[0348] It should be noted that Fig.12The chip shown can be implemented using the following circuits or devices: one or more field programmable gate arrays (FPGAs), programmable logic devices (PLDs), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits that can perform the various functions described throughout this application.

[0349] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0350] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0351] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0352] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0353] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0354] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0355] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for configuring SELinux security policy, characterized in that: include: Displaying multiple question guides and answer guides corresponding to each question guide on the display interface, wherein the question guides are used to guide the determination of whether the reason why the program is not executed as expected is an SELinux permission problem, and when the reason is an SELinux permission problem, guide the determination of the reason type corresponding to the SELinux permission problem; The answer guide is used to solve the SELinux permission problem; Determine request information based on the multiple question instructions and the answer instructions corresponding to each question instruction, wherein the request information includes a reason type corresponding to the reason why the program is not executed as expected, AVC alarm information of the program, platform information, chip component information, and system component information; the reason type includes a newly added process type and a newly added file type; Analyze the request information to obtain analysis results; A permission configuration scheme for the program is generated according to the analysis result, the permission configuration scheme is used to configure the SELinux security policy file of the program, and the permission configuration scheme includes permission statements to be added and an adding position.

2. The method according to claim 1, characterized in that The analysis result includes the subject tag and the object tag corresponding to the program, and the permission statement to be added, and the analysis of the request information to obtain the analysis result includes: Extracting preset keywords in the AVC alarm information; Determine the subject tag and object tag corresponding to the program according to the preset keyword; The permission statement to be added corresponding to the reason type is searched in a database.

3. The method according to claim 1, characterized in that Generating a permission configuration scheme for the program according to the analysis result includes: Searching for an addition location in a preset data table that matches both the subject tag and the object tag corresponding to the program; The permission configuration scheme is generated according to the permission statement to be added and the adding position.

4. The method according to claim 2, characterized in that The preset keyword includes at least one of name, scontext, tcontext, class and perms.

5. The method according to any one of claims 1 to 4, characterized in that: The request information also includes at least one of attribute information, label information and path information.

6. A system for configuring SELinux security policy, characterized in that: include: Cause confirmation module and analysis module; The reason confirmation module is used to display multiple question instructions and answer instructions corresponding to each question instruction, wherein the question instructions are used to guide the determination of whether the reason why the program is not executed as expected is an SELinux permission problem, and when the reason is an SELinux permission problem, guide the determination of the reason type corresponding to the SELinux permission problem; the answer instructions are used to solve the SELinux permission problem; the reason type includes a newly added process type and a newly added file type; The cause confirmation module is further used to display a method for obtaining AVC alarm information, platform information, chip component information, and system component information, wherein the method for obtaining AVC alarm information is used to obtain the AVC alarm information of the program; The analysis module is used to determine and display the permission configuration scheme of the program according to the AVC alarm information of the program and the cause type, and the permission configuration scheme is used to configure the SELinux security policy file of the program, and the permission configuration scheme includes the permission statement to be added and the adding position.

7. The system according to claim 6, characterized in that The analysis module is also used to: Extracting preset keywords in the AVC alarm information; Determine the subject tag and object tag corresponding to the program according to the preset keyword; Searching a database for the permission statement to be added corresponding to the reason type; Searching for an addition location in a preset data table that matches both the subject tag and the object tag corresponding to the program; The permission configuration scheme is generated according to the permission statement to be added and the adding position.

8. The system according to claim 6 or 7, characterized in that The system also includes a verification module; The verification module is used to display a variety of compilation verification methods, and the compilation verification methods are used to compile and verify the program after the SELinux security policy file is configured.

9. The system according to claim 6, characterized in that The system also includes a knowledge display module; The knowledge display module is used to display SELinux related knowledge, and the related knowledge includes SELinux basic knowledge and security knowledge.

10. An electronic device, characterized in that: include: one or more processors; one or more memories; The memory stores one or more programs, and when the one or more programs are executed by the processor, the electronic device executes the method according to any one of claims 1 to 5.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

Images