Linux operating system permission control method, device, equipment and medium

Abstract

The present application discloses a Linux operating system permission control method, apparatus, device and medium, which relates to the field of computer technology and is applied to a permission management host, including: obtaining the current permission status set of all users in the Linux operating system of each development and test server; when receiving a permission refresh event and a current target role-based access control model, parsing the current target role-based access control model to obtain a target permission status set; determining permission difference information between the current permission status set and the target permission status set to generate a permission update command; the type of the permission update command is a permission addition type and / or a permission deletion type; sending the permission update command to the development and test server, and the server controls the current permission status set in the local Linux operating system to update based on the permission update command, and feeds back the next permission status set to the permission management host. Through the above scheme, the efficiency and reliability of the Linux operating system permission control are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a Linux operating system permission control method, device, equipment and medium. Background Art

[0002] During the development and testing of internet applications, the same application often undergoes multiple processes and testing in different environments. In these situations, the same application is often deployed on multiple Linux systems, each operated by multiple users. Failure to manage the user permissions of each employee's Linux system can lead to numerous security issues. Conventional methods, which manage permissions for each Linux system individually, are inefficient, cumbersome, and prone to errors.

[0003] In summary, it can be seen that how to improve the efficiency and reliability of Linux operating system permission control is a problem to be solved in this field. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a Linux operating system permission control method, device, equipment and medium to improve the efficiency and reliability of Linux operating system permission control. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a Linux operating system permission control method, which is applied to a permission management host, comprising:

[0006] Get the current permission status of all users in the Linux operating system of each development and test server;

[0007] When receiving a permission refresh event and a current target role-based access control model, parsing the current target role-based access control model to obtain a target permission state set;

[0008] Determining permission difference information between the current permission state set and the target permission state set, and generating a permission update command based on the permission difference information; wherein the permission update command is a permission addition type and / or a permission deletion type;

[0009] The permission update command is sent to the corresponding development and testing server, so that the development and testing server controls the current permission status set in the local Linux operating system to update based on the permission update command, and feeds back the generated next permission status set to the permission management host.

[0010] Optionally, determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes:

[0011] A server difference set between a first server key-value pair of the current permission state set and a second server key-value pair of the target permission state set is determined, and a user update command is generated based on the server difference set.

[0012] Optionally, before determining the server difference set between the first server key-value pair of the current permission state set and the second server key-value pair of the target permission state set, the method further includes:

[0013] Based on the server attributes in the current permission state set and the server attributes of the target permission state set, the current permission state set and the target permission state set are deduplicated to obtain a first server key-value pair of the current permission state set and a second server key-value pair of the target permission state set.

[0014] Optionally, determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes:

[0015] Acquire the first user information in the current permission state set and the second user information in the target permission state set;

[0016] determining a symmetric difference between the first user information and the second user information as an Internet protocol difference set;

[0017] An Internet protocol update command is generated based on the Internet protocol difference set and the second server key-value pair of the target authority state set.

[0018] Optionally, determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes:

[0019] Based on the file permissions in the current permission state set and the file permissions in the target permission state set, obtaining a first file permission key-value pair of the current permission state set and a second file permission key-value pair of the target permission state set; wherein the file permissions include file path information and file server information;

[0020] Determine a file permission difference set between the first file permission key-value pair and the second file permission key-value pair, and generate a corresponding file permission update command based on the file permission difference set.

[0021] Optionally, determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes:

[0022] Based on the command permissions in the current permission state set and the command permissions in the target permission state set, a first command permission key-value pair of the current permission state set and a second command permission key-value pair of the target permission state set are obtained; wherein the command permissions include the location information of the execution command script, the name information of the user who can execute the command beyond the permission, and the server information to which the command belongs;

[0023] A command permission difference set between the first command permission key-value pair and the second command permission key-value pair is determined, and a corresponding command permission update command is generated based on the command permission difference set.

[0024] Optionally, sending the permission update command to the corresponding development and testing server includes:

[0025] Saving the permission update command to a corresponding development and test server script, and sending the development and test server script to the corresponding development and test server;

[0026] Accordingly, the development and testing server controls the local Linux operating system to update the current permission status set based on the permission update command, including:

[0027] The development and testing server executes the development and testing server script to control the current permission status set in the local Linux operating system to update.

[0028] In a second aspect, the present application discloses a Linux operating system permission control device, which is applied to a permission management host, comprising:

[0029] The current status set acquisition module is used to obtain the current permission status set of all users in the Linux operating system of each development and test server;

[0030] a target state set acquisition module, configured to parse the current target role-based access control model upon receiving a permission refresh event and the current target role-based access control model to obtain a target permission state set;

[0031] a permission update command generation module, configured to determine permission difference information between the current permission state set and the target permission state set, and generate a permission update command based on the permission difference information; wherein the permission update command is of a permission addition type and / or a permission deletion type;

[0032] The permission status set update module is used to send the permission update command to the corresponding development and testing server, so that the development and testing server controls the update of the current permission status set in the local Linux operating system based on the permission update command, and feeds back the generated next permission status set to the permission management host.

[0033] In a third aspect, the present application discloses an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] The processor is used to execute the computer program to implement the steps of the aforementioned Linux operating system permission control method.

[0036] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed Linux operating system permission control method are implemented.

[0037] The beneficial effects of the present application are as follows: the present application is applied to a permission management host to obtain the current permission status set of all users in the Linux operating system of each development and testing server; when receiving a permission refresh event and a current target role-based access control model, the current target role-based access control model is parsed to obtain a target permission status set; permission difference information between the current permission status set and the target permission status set is determined, and a permission update command is generated based on the permission difference information; wherein the type of the permission update command is a permission addition type and / or a permission deletion type; the permission update command is sent to the corresponding development and testing server, so that the development and testing server controls the current permission status set in the local Linux operating system to be updated based on the permission update command, and feeds back the generated next permission status set to the permission management host. It can be seen that when this application receives a permission refresh event, it triggers the permission update thread, that is, it obtains the permission difference information between the target permission status set and the current permission status set to obtain the corresponding permission update command, and then sends the permission update command to the corresponding development and test server, so that the corresponding development and test server controls the permissions of the local Linux operating system based on the corresponding permission update command to update. In this way, multiple development and test servers can be automatically controlled, and this application parses the current target role-based access control model to obtain the target permission status set, so that the permissions of multiple users can be automatically managed, breaking the limitation of only being able to manage the permissions of one user of a development and test server, and greatly improving the efficiency and reliability of the Linux operating system permission control. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0039] Figure 1 This is a flow chart of a Linux operating system permission control method disclosed in this application;

[0040] Figure 2 This is a flowchart of a specific Linux operating system permission control method disclosed in this application;

[0041] Figure 3 This is a schematic diagram of the structure of a Linux operating system permission control device disclosed in this application;

[0042] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0044] During the development and testing of internet applications, the same application often undergoes multiple processes and testing in different environments. In these situations, the same application is often deployed on multiple Linux systems, each operated by multiple users. Failure to manage the user permissions of each employee's Linux system can lead to numerous security issues. Conventional methods, which manage permissions for each Linux system individually, are inefficient, cumbersome, and prone to errors.

[0045] To this end, this application provides a Linux operating system permission control solution to improve the efficiency and reliability of Linux operating system permission control.

[0046] See also Figure 1 As shown, the embodiment of the present application discloses a Linux operating system permission control method, which is applied to a permission management host, including:

[0047] Step S11: obtaining the current permission status set of all users in the Linux operating system of each development and test server.

[0048] It can be understood that the permission control in this embodiment is to control the permissions in the Linux operating system of the corresponding development and testing server to be updated when permissions need to be updated, that is, to update the current permission status set in the Linux operating system of the development and testing server to the next permission status set, wherein the next permission status set should be consistent with the target permission status set.

[0049] Step S12: When receiving the permission refresh event and the current target role-based access control model, the current target role-based access control model is parsed to obtain a target permission state set.

[0050] The permission management host is used by administrators, and the development and testing server is used by employees. Currently, permission management can only correspond to one employee for one development and testing server. However, in actual applications, the same development and testing server corresponds to several employees, and employees can also correspond to several development and testing servers. Therefore, the current permission management is inefficient and prone to management errors.

[0051] This embodiment pre-establishes a target role-based access control model, that is, optimizes the traditional role-based access control model (RBAC) to obtain the target role-based access control model. The optimization contents include:

[0052] 1) In addition to traditional user attributes, IP (Internet Protocol) attributes are added to each user to control the IP terminal used by employees to log in. At the same time, the user's Linux system login information is also saved in the user;

[0053] 2) In addition to the transferred employee-role-permissions, employees can be directly bound to permissions, making the configuration of independent permissions more flexible;

[0054] 3) To make the target role-based access control model more applicable to control scenarios such as file reading and writing, program startup and shutdown, and script execution in development and testing environments, permissions are abstracted into command permissions and file permissions. Properties for generating Linux commands, such as read, write, and execute permissions, directory status, and unauthorized execution user, are also added.

[0055] 4) In order to flexibly manage multiple Linux systems, a development and test server object is added and stored in the file permissions and command permissions. After the permission update command is generated later, the development and test server corresponding to the permission update command is determined so that the development and test server can execute the corresponding script. At the same time, the amount of permission data can be reduced, making it easier for administrators to manage and control permissions.

[0056] When the administrator needs to update the permissions of the Linux operating system in the development and testing server, the permission management host receives a model adjustment instruction to adjust the previous target role-based access control model to obtain the current target role-based access control model. The model adjustment instruction can be a corresponding model adjustment instruction issued by the administrator based on the specific situation. Therefore, when the current target role-based access control model is subsequently parsed, the target permission state set, that is, the expected next permission state set, can be obtained.

[0057] Step S13: Determine permission difference information between the current permission status set and the target permission status set, and generate a permission update command based on the permission difference information; wherein the permission update command is a permission addition type and / or a permission deletion type.

[0058] In a first specific embodiment, the determination of permission difference information between the current permission status set and the target permission status set, and the generation of a permission update command based on the permission difference information, includes: determining a server difference set between the first server key-value pair of the current permission status set and the second server key-value pair of the target permission status set, and generating a user update command based on the server difference set. It can be understood that the server difference set contains employee-server key-value pairs of accounts that need to be deleted and / or employee-server key-value pairs of accounts that need to be created, that is, accounts that should be owned in the Linux operating system of the development and testing server and accounts that should be deleted. An example of the command generation format is shown below:

[0059] "if[-z\"`sed-n' / "+userName+"* / p' / etc / passwd`\"];

[0060] then useradd-d / home / staff / "+userName+"-m"+userName+

[0061] "&&echo"+userName+"|passwd--stdin"+userName+"fi".

[0062] Wherein, before determining the server difference set between the first server key-value pair of the current permission state set and the second server key-value pair of the target permission state set, the method further includes: based on the server attributes in the current permission state set and the server attributes of the target permission state set, deduplicating the current permission state set and the target permission state set to obtain the first server key-value pair of the current permission state set and the second server key-value pair of the target permission state set. Deduplicating is performed by traversing the server attributes of all permissions under each employee in the current permission state set A and the target permission state set B to obtain the first server key-value pair of the current permission state set A and the second server key-value pair of the target permission state set B. The key-value pairs are mainly used to save the Linux operating system of the development and testing server with the employee account.

[0063] In a second specific embodiment, the determination of the permission difference information between the current permission state set and the target permission state set, and the generation of a permission update command based on the permission difference information, includes: obtaining the first user information in the current permission state set and the second user information in the target permission state set; determining the symmetric difference between the first user information and the second user information as an Internet protocol difference set; and generating an Internet protocol update command based on the Internet protocol difference set and the second server key-value pair of the target permission state set. Traversing the employee information of the current permission state set A and the employee information of the target permission state set B, obtaining employee IP information A and employee IP information B, i.e., first user information A and second user information B, taking the symmetric difference between employee IP information A and employee IP information B, obtaining the set of employees whose IPs have changed, i.e., obtaining the Internet protocol difference set, and generating an Internet protocol update command based on the Internet protocol difference set and the second server key-value pair of the target permission state set, wherein the command generation format is as follows:

[0064] "sed-i' / AllowUsers"+userName+"[@*]' / d / etc / ssh / sshd_config;

[0065] echo'AllowUsers"+userName+("*")+("@")+ip+">> / etc / ssh / sshd_config".

[0066] In a third specific embodiment, determining the permission difference information between the current permission state set and the target permission state set, and generating a permission update command based on the permission difference information, includes: obtaining the first file permission key-value pair of the current permission state set and the second file permission key-value pair of the target permission state set based on the file permissions in the current permission state set and the file permissions in the target permission state set; wherein the file permissions include file path information and file server information; determining the file permission difference set between the first file permission key-value pair and the second file permission key-value pair, and generating a corresponding file permission update command based on the file permission difference set. By traversing all file permissions under each employee in the current permission state set A and the target permission state set B, the employee-file permission key-value pair A and the employee-file permission key-value pair B, i.e., the first file permission key-value pair of the current permission state set and the second file permission key-value pair of the target permission state set, are obtained. The key-value pairs are mainly used to indicate the files and specific permissions used by the employee on all servers. The file permission difference set includes a set of file permissions that need to be newly granted and / or a set of file permissions that need to be revoked. The generation format of the file permission update command is as follows:

[0067] 1) To increase file permissions, create a script as follows:

[0068] "setfacl"+("-R")+("-m")+("d:")+"u:"+userName+":"+("rwx");

[0069] 2) For reduced permissions create a script as follows:

[0070] "setfacl"+("-R")+("-x")+("d:")+"u:"+username+":"+("rwx").

[0071] In a fourth specific embodiment, the determination of the permission difference information between the current permission state set and the target permission state set, and the generation of a permission update command based on the permission difference information, includes: obtaining the first command permission key-value pair of the current permission state set and the second command permission key-value pair of the target permission state set based on the command permissions in the current permission state set and the command permissions in the target permission state set; wherein, the command permissions include the location information of the command script to be executed, the user name information that can be executed beyond the authority, and the server information to which the command belongs; determining the command permission difference set between the first command permission key-value pair and the second command permission key-value pair, and generating a corresponding command permission update command based on the command permission difference set. The command permission key-value pair is mainly used to indicate that an employee has the permission to execute certain scripts as other users on all servers; the command permission difference set contains a set of command permissions that need to be revoked and / or a set of command permissions that need to be newly granted, wherein the generation format of the command permission update command is as follows:

[0072] "sed -i' / "+userName+"

[0073] ALL=("+("root")+")"+" / d' / etc / sudoers".

[0074] Step S14: Send the permission update command to the corresponding development and testing server, so that the development and testing server controls the current permission status set in the local Linux operating system to update based on the permission update command, and feeds back the generated next permission status set to the permission management host.

[0075] It is understandable that the script containing the permission update command is sent to the corresponding development and test server, so that the development and test server can execute the script, thereby realizing the update of permissions. It should be noted that this embodiment can also compare the generated next permission state set with the target permission state set. If the next permission state set is consistent with the target permission state set, it means that the permission update is successful, and a corresponding update success prompt message is generated, so that the administrator can determine that the corresponding development and test server has successfully completed this update; if the next permission state set is inconsistent with the target permission state set, it means that the permission update failed, and a corresponding update failure prompt message is generated, so that the administrator can determine that the corresponding development and test server did not successfully complete this update. The administrator can make corresponding processing based on the next permission state set, for example, using the next permission state set as the current permission state set and continuing to update.

[0076] The beneficial effects of the present application are as follows: the present application is applied to a permission management host to obtain the current permission status set of all users in the Linux operating system of each development and testing server; when receiving a permission refresh event and a current target role-based access control model, the current target role-based access control model is parsed to obtain a target permission status set; permission difference information between the current permission status set and the target permission status set is determined, and a permission update command is generated based on the permission difference information; wherein the type of the permission update command is a permission addition type and / or a permission deletion type; the permission update command is sent to the corresponding development and testing server, so that the development and testing server controls the current permission status set in the local Linux operating system to be updated based on the permission update command, and feeds back the generated next permission status set to the permission management host. It can be seen that when this application receives a permission refresh event, it triggers the permission update thread, that is, it obtains the permission difference information between the target permission status set and the current permission status set to obtain the corresponding permission update command, and then sends the permission update command to the corresponding development and test server, so that the corresponding development and test server controls the permissions of the local Linux operating system based on the corresponding permission update command to update. In this way, multiple development and test servers can be automatically controlled, and this application parses the current target role-based access control model to obtain the target permission status set, so that the permissions of multiple users can be automatically managed, breaking the limitation of only being able to manage the permissions of one user of a development and test server, and greatly improving the efficiency and reliability of the Linux operating system permission control.

[0077] See also Figure 2 As shown, the embodiment of the present application discloses a specific Linux operating system permission control method, which is applied to a permission management host, including:

[0078] Step S21: Obtain the current permission status set of all users in the Linux operating system of each development and test server.

[0079] Step S22: When receiving the permission refresh event and the current target role-based access control model, the current target role-based access control model is parsed to obtain a target permission state set.

[0080] Step S23: Determine the permission difference information between the current permission status set and the target permission status set, and generate a permission update command based on the permission difference information; wherein the permission update command is a permission addition type and / or a permission deletion type.

[0081] The types of permission update commands in this embodiment are permission addition type and / or permission deletion type. That is to say, when performing permission management on multiple employees and multiple servers, both permission granting and permission revocation can be taken into account, solving the problem of incomplete management permissions.

[0082] Step S24: Save the permission update command to the corresponding development and testing server script.

[0083] It can be understood that in this embodiment, the permission update command is saved in the corresponding development and test server script. For example, the permission update command A is used to update the permission of the development and test server A, the permission update command B is used to update the permission of the development and test server A, and the permission update command C is used to update the permission of the development and test server C. Then it is necessary to save the permission update command A and the permission update command B to the development and test server script A corresponding to the development and test server A, and save the permission update command C to the development and test server script C corresponding to the development and test server C.

[0084] Step S25: Send the development and test server script to the corresponding development and test server so that the development and test server executes the development and test server script, controls the current permission status set in the local Linux operating system to update, and feeds back the generated next permission status set to the permission management host.

[0085] For example, development test server script A is sent to development test server A, and development test server script C is sent to development test server C. In this way, development test server A executes development test server script A to complete the update of the current permission status set in the local Linux operating system, and development test server C executes development test server script C to complete the update of the current permission status set in the local Linux operating system. In this way, the automatic update of different permissions in multiple development test servers can be controlled, and the administrator does not need to update the permissions of only one user on one development test server.

[0086] This demonstrates that this application eliminates the limitation of managing permissions for only one user on a development and test server. It can automate updates for different development and test servers, different employees, and different permissions, significantly improving the efficiency and reliability of Linux operating system permission control. This improves upon the existing role model of the Linux operating system, allowing administrators to simply understand the company's team structure without having to manage concepts like user groups or pay attention to the details of each machine. Instead, unified management is achieved at the company team or architecture level, with permission update commands automatically generated, eliminating the need for administrators to worry about command details.

[0087] See also Figure 3 As shown, the embodiment of the present application discloses a Linux operating system permission control device, which is applied to a permission management host, including:

[0088] The current status set acquisition module 11 is used to obtain the current permission status set of all users in the Linux operating system of each development and test server;

[0089] The target state set acquisition module 12 is configured to parse the current target role-based access control model upon receiving a permission refresh event and the current target role-based access control model to obtain a target permission state set;

[0090] a permission update command generating module 13, configured to determine permission difference information between the current permission state set and the target permission state set, and generate a permission update command based on the permission difference information; wherein the permission update command is of a permission addition type and / or a permission deletion type;

[0091] The permission status set update module 14 is used to send the permission update command to the corresponding development and testing server, so that the server controls the current permission status set in the local Linux operating system to update based on the permission update command, and feeds back the generated next permission status set to the permission management host.

[0092] The beneficial effects of the present application are as follows: the present application is applied to a permission management host to obtain the current permission status set of all users in the Linux operating system of each development and testing server; when receiving a permission refresh event and a current target role-based access control model, the current target role-based access control model is parsed to obtain a target permission status set; permission difference information between the current permission status set and the target permission status set is determined, and a permission update command is generated based on the permission difference information; wherein the type of the permission update command is a permission addition type and / or a permission deletion type; the permission update command is sent to the corresponding development and testing server, so that the development and testing server controls the current permission status set in the local Linux operating system to be updated based on the permission update command, and feeds back the generated next permission status set to the permission management host. It can be seen that when this application receives a permission refresh event, it triggers the permission update thread, that is, it obtains the permission difference information between the target permission status set and the current permission status set to obtain the corresponding permission update command, and then sends the permission update command to the corresponding development and test server, so that the corresponding development and test server controls the permissions of the local Linux operating system based on the corresponding permission update command to update. In this way, multiple development and test servers can be automatically controlled, and this application parses the current target role-based access control model to obtain the target permission status set, so that the permissions of multiple users can be automatically managed, breaking the limitation of only being able to manage the permissions of one user of a development and test server, and greatly improving the efficiency and reliability of the Linux operating system permission control.

[0093] Furthermore, an embodiment of the present application also provides an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0094] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Specifically, the device may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the Linux operating system permission control method performed by the electronic device as disclosed in any of the aforementioned embodiments.

[0095] In this embodiment, the power supply 23 is used to provide operating voltage for various hardware devices on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0096] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0097] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0098] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device to enable the processor 21 to calculate and process the massive data 223 in the memory 22. It can be Windows, Unix, Linux, etc. In addition to including computer programs that can be used to implement the Linux operating system permission control method executed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to perform other specific tasks. In addition to data received by the electronic device and transmitted from external devices, the data 223 can also include data collected by its own input and output interface 25.

[0099] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned Linux operating system permission control method. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0101] Professionals may further appreciate that the units and algorithmic steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable EPROM (Erasable Programmable Read Only Memory), electrically erasable programmable EEPROM (Electrically Erasable Programmable read only memory), registers, hard disk, removable disk, CD-ROM (CoMP23026529act Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0102] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0103] The above is a detailed introduction to the Linux operating system permission control method, device, equipment and medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A Linux operating system permission control method, characterized in that: Applicable to the rights management host, including: Get the current permission status of all users in the Linux operating system of each development and test server; When receiving a permission refresh event and a current target role-based access control model, parsing the current target role-based access control model to obtain a target permission state set; Determining permission difference information between the current permission state set and the target permission state set, and generating a permission update command based on the permission difference information; wherein the permission update command is a permission addition type and / or a permission deletion type; Sending the permission update command to the corresponding development and testing server, so that the development and testing server controls the current permission status set in the local Linux operating system to update based on the permission update command, and feeds back the generated next permission status set to the permission management host; The Linux operating system permission control method further includes: Comparing the next permission state set with the target permission state set, and generating a corresponding update success prompt message if the next permission state set is consistent with the target permission state set; and generating a corresponding update failure prompt message if the next permission state set is inconsistent with the target permission state set; The determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes: Determining a server difference between a first server key-value pair of the current permission state set and a second server key-value pair of the target permission state set, and generating a user update command based on the server difference; Before determining the server difference set between the first server key-value pair of the current permission state set and the second server key-value pair of the target permission state set, the method further includes: Based on the server attributes in the current permission state set and the server attributes of the target permission state set, the current permission state set and the target permission state set are deduplicated to obtain a first server key-value pair of the current permission state set and a second server key-value pair of the target permission state set.

2. The Linux operating system permission control method according to claim 1, wherein: The determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes: Acquire the first user information in the current permission state set and the second user information in the target permission state set; determining a symmetric difference between the first user information and the second user information as an Internet protocol difference set; An Internet protocol update command is generated based on the Internet protocol difference set and the second server key-value pair of the target authority state set.

3. The Linux operating system permission control method according to claim 1, wherein: The determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes: Based on the file permissions in the current permission state set and the file permissions in the target permission state set, obtaining a first file permission key-value pair of the current permission state set and a second file permission key-value pair of the target permission state set; wherein the file permissions include file path information and file server information; Determine a file permission difference set between the first file permission key-value pair and the second file permission key-value pair, and generate a corresponding file permission update command based on the file permission difference set.

4. The Linux operating system permission control method according to claim 1, wherein: The determining permission difference information between the current permission status set and the target permission status set, and generating a permission update command based on the permission difference information, includes: Based on the command permissions in the current permission state set and the command permissions in the target permission state set, a first command permission key-value pair of the current permission state set and a second command permission key-value pair of the target permission state set are obtained; wherein the command permissions include the location information of the execution command script, the name information of the user who can execute the command beyond the permission, and the server information to which the command belongs; A command permission difference set between the first command permission key-value pair and the second command permission key-value pair is determined, and a corresponding command permission update command is generated based on the command permission difference set.

5. The Linux operating system permission control method according to any one of claims 1 to 4, characterized in that: The sending of the permission update command to the corresponding development and testing server includes: Saving the permission update command to a corresponding development and test server script, and sending the development and test server script to the corresponding development and test server; Accordingly, the development and testing server controls the local Linux operating system to update the current permission status set based on the permission update command, including: The development and testing server executes the development and testing server script to control the current permission status set in the local Linux operating system to update.

6. A Linux operating system authority control device, characterized in that: Applicable to the rights management host, including: The current status set acquisition module is used to obtain the current permission status set of all users in the Linux operating system of each development and test server; a target state set acquisition module, configured to parse the current target role-based access control model upon receiving a permission refresh event and the current target role-based access control model to obtain a target permission state set; a permission update command generation module, configured to determine permission difference information between the current permission state set and the target permission state set, and generate a permission update command based on the permission difference information; wherein the permission update command is of a permission addition type and / or a permission deletion type; A permission status set update module is used to send the permission update command to the corresponding development and test server, so that the development and test server controls the current permission status set in the local Linux operating system to update based on the permission update command, and feeds back the generated next permission status set to the permission management host; The Linux operating system authority control device is specifically used to: Comparing the next permission state set with the target permission state set, and generating a corresponding update success prompt message if the next permission state set is consistent with the target permission state set; and generating a corresponding update failure prompt message if the next permission state set is inconsistent with the target permission state set; The permission update command generation module is specifically used to: Determining a server difference between a first server key-value pair of the current permission state set and a second server key-value pair of the target permission state set, and generating a user update command based on the server difference; The Linux operating system authority control device is specifically used to: Based on the server attributes in the current permission state set and the server attributes of the target permission state set, the current permission state set and the target permission state set are deduplicated to obtain a first server key-value pair of the current permission state set and a second server key-value pair of the target permission state set.

7. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the Linux operating system permission control method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the Linux operating system permission control method according to any one of claims 1 to 5 are implemented.

Images