Linux file access method, device and system and electronic equipment

Abstract

The invention relates to the technical field of data access, and particularly provides a Linux file access method, device and system and electronic device.The method comprises the steps that operation executed by a service application side on a virtual directory file is read, and an operation event is generated, the operation event comprises at least one of operation process information, operator information, operation file information and operation time; performing authority judgment on the operation event through an authority control rule, and determining a judgment result which is operation permission or operation rejection; and sending the judgment result to the service application end. According to the embodiment of the invention, the dynamic access of the Linux file can be realized, and the flexibility is relatively high.

Description

Technical Field

[0001] The present application relates to the technical field of data access, and in particular to a method, device, system and electronic device for Linux file access. Background Art

[0002] The Linux file permission control model provides a flexible and powerful way to manage access rights to files and directories, allowing system administrators to precisely control user access to the file system.

[0003] At present, the file permission control model of Linux basically relies on the precise control of the Linux system administrator. It is actually a relatively static permission model. Once the system administrator completes the configuration, the file permission control model is fixed. If the permission needs to be changed later, it is generally done by the system administrator through manual operation, which has poor adaptability.

[0004] Therefore, how to provide a technical solution for a method for accessing Linux files with high adaptability becomes a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a Linux file access method, device, system and electronic device. Through the technical solutions of the embodiments of the present application, dynamic changes in file access permissions can be achieved with higher flexibility and better adaptability.

[0006] In a first aspect, some embodiments of the present application provide a Linux file access method, comprising: reading the operation performed by a business application end on a virtual directory file, generating an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time; performing permission determination on the operation event through permission control rules, and determining a determination result, wherein the determination result is: allowing the operation or denying the operation; and sending the determination result to the business application end.

[0007] Some embodiments of the present application monitor the operations of the business application end, generate operation events after reading the corresponding operations, and then compare them with the permission control rules to obtain the judgment result of whether the operation is allowed. The embodiments of the present application can realize the judgment and dynamic change of file access rights, realize dynamic access management of files, and have higher flexibility and better adaptability.

[0008] In some embodiments, before reading the operation performed by the business application end on the virtual directory file, the method also includes: receiving an actual operation directory, a virtual mapping directory and the permission control rules sent by the permission management end, wherein the actual operation directory stores the data files generated by the operation, and the virtual mapping directory is used by the business application end to perform read and write operations on the virtual directory file.

[0009] Some embodiments of the present application can achieve effective management of dynamic access to files by receiving actual operation directories, virtual mapping directories, and permission control rules sent by the management end.

[0010] In some embodiments, the permission control rules include: process rules, user rules, directory rules and effectiveness rules.

[0011] Some embodiments of the present application can achieve dynamic management of permissions by setting various types of rules.

[0012] In some embodiments, the permission determination is performed on the operation event through the permission control rule to determine the determination result, including: if it is determined that each operation information in the operation event complies with the permission control rule, the determination result is the allowed operation; if it is determined that there is information in the operation event that does not comply with the permission control rule, the determination result is the rejected operation.

[0013] Some embodiments of the present application compare actual operations with permission control rules to obtain judgment results, thereby achieving dynamic management of file permissions and improving adaptability.

[0014] In a second aspect, some embodiments of the present application provide a Linux file access device, comprising: a reading module, configured to read the operation performed by a business application end on a virtual directory file, and generate an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time; a determination module, configured to perform permission determination on the operation event through permission control rules, and determine a determination result, wherein the determination result is: allowing the operation or denying the operation; a sending module, configured to send the determination result to the business application end.

[0015] In some embodiments, before the reading module, the device also includes: a configuration receiving module; the configuration receiving module is configured to: receive the actual operation directory, the virtual mapping directory and the permission control rules sent by the permission management end, wherein the actual operation directory stores the data files generated by the operation, and the virtual mapping directory is used by the business application end to perform read and write operations on the virtual directory file.

[0016] In a third aspect, some embodiments of the present application provide a Linux file access system, comprising: a business application end and a permission control end; wherein the business application end is used to operate files in a virtual mapping directory; the permission control end is used to read the operation and generate an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time; the operation event is subjected to permission determination through permission control rules to determine a determination result, wherein the determination result is: allowing the operation or denying the operation; and the determination result is sent to the business application end.

[0017] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0018] In a fifth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0019] In a sixth aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A system diagram of Linux file access provided for some embodiments of the present application;

[0022] Figure 2 One of the flow charts of the Linux file access method provided for some embodiments of the present application;

[0023] Figure 3 A second flowchart of a method for accessing a Linux file provided in some embodiments of the present application;

[0024] Figure 4 A block diagram of a Linux file access device provided in some embodiments of the present application;

[0025] Figure 5 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0027] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0028] In the related art, the Linux operating system currently provides a powerful file permission control model, which is based on the concept of User-Group-Other (UGO). In Linux, each file and directory has a set of permissions, which specify the permissions for operations such as read permission (r), write permission (w) and execute permission (x) on the file or directory.

[0029] The existing Linux file permission model, although simple, flexible and powerful, is basically dependent on the precise control of the Linux system administrator. It is actually a relatively static permission model. Once the system administrator completes the configuration, this permission model is finalized and rarely changes. Even if changes are required, they are generally completed by the system administrator through manual operations. However, in actual application scenarios, the business is dynamic and changeable, and the use of this static model cannot adapt well to the dynamic and changeable characteristics of the business. For example, in a transparent file security encryption system built on fuse, it is necessary to adapt to the dynamic user and dynamic file permission model from the application layer, and this file permission model at the Linux operating system level cannot be well adapted.

[0030] It can be seen from the above-mentioned related technologies that the existing Linux file permission model for Linux file access is relatively static, difficult to change, and lacks flexibility; the application layer's requirements for file permissions are dynamic, and the current Linux file permissions are difficult to adapt; and the application layer's definition of users is also dynamic, and the current Linux user model is difficult to adapt.

[0031] In view of this, some embodiments of the present application provide a method for Linux file access, which configures permission control rules to determine the permission of the operation event corresponding to the operation generated by the business application end, and confirms whether the operation is allowed to be performed, so as to achieve dynamic adjustment of permissions. The method can be applied to various file permissions and user requirements in the application layer, improves the flexibility of Linux file access, and has high adaptability.

[0032] The Filesystem in Userspace (FUSE) mentioned in this application is a technology that allows user space programs to create and manage file systems. Usually the file system is managed by the operating system kernel, but with FUSE, developers can write file systems in user space without modifying the operating system kernel. This flexibility and scalability make FUSE have a variety of application scenarios.

[0033] FUSE can be used to create virtual file systems, which do not store actual data but generate file content according to program requirements. For example, FUSE can be used to create a virtual file system for accessing data on network resources, databases, or other non-traditional storage media. This application uses the virtual file system characteristics of FUSE to build a flexible and dynamic user and user authority system adapted to the upper-level business system.

[0034] The following is combined with Figure 1 The overall composition structure of the Linux file access system provided by some embodiments of the present application is exemplified.

[0035] like Figure 1 As shown, some embodiments of the present application provide a Linux file access system, which may include: a business application terminal 100, a permission control terminal 200, and a permission management terminal 300. Among them, the permission control terminal 200 is built based on FUSE, which can also be called a dynamic permission control module, referred to as a control module.

[0036] Specifically, the control module is integrated into the FUSE application program. The control module captures and analyzes the file operation events of the service application terminal 100, and makes a determination according to the authority control rules to determine whether to allow or deny the current file operation.

[0037] The permission management terminal 300 (referred to as the management terminal) generally provides a user management interface, and the application administrator can flexibly configure it as needed according to specific application needs, or flexibly change it after configuration. After the application administrator completes the configuration on the permission management terminal 300, it generates the corresponding dynamic permission control rules and pushes them to the control module in real time to complete its mission.

[0038] The control module receives the "dynamic permission control rules" pushed by the permission management terminal 300, parses and saves them, and then responds to the file operation event in real time, makes a judgment according to the "dynamic permission control rules", and allows or denies the current file operation.

[0039] In some embodiments of the present application, if the control module already contains or can configure the corresponding authority control rules, the authority management terminal 300 may not be provided. The embodiments of the present application are not specifically limited here.

[0040] In some embodiments of the present application, the permission management terminal 300 is generally for the convenience of the control module administrator to perform visual rule configuration, and after completing the configuration, the corresponding dynamic permission control rules are generated and pushed to the dynamic permission control module. This step is optional, that is, the corresponding permission control model rule file (that is, permission control rules) can be directly generated offline, and pushed to the control module through the interface retained by the control module. Specifically, it can be selected according to the actual application scenario, and the embodiments of the present application are not specifically limited here.

[0041] The following is combined with Figure 2 The implementation process of Linux file access performed by the permission control terminal 200 provided in some embodiments of the present application is exemplified.

[0042] Please see attached Figure 2 , Figure 2 A flowchart of a method for accessing a Linux file is provided for some embodiments of the present application. The method for accessing a Linux file may include:

[0043] S210, reading the operation performed by the business application end on the virtual directory file, and generating an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time.

[0044] For example, in some embodiments of the present application, the permission control terminal 200 can monitor the operation of the business application terminal 100 to timely capture or read the file operations that occur therein. When the application (as a specific example of the business application terminal 100) starts to operate (for example, open, close, read, write, delete files / folders, change file / folder attributes, etc.) a file in the virtual mapping directory (as a specific example of operating file information), the permission control terminal 200 can read the corresponding operation and generate an operation event.

[0045] For example, after the file operation of the virtual binding directory (that is, the virtual mapping directory) is intercepted by the dynamic permission control module, a corresponding operation event is generated, which can parse the operator process PID, PPID, the complete path of the operated virtual mapping directory, the operation mode (for example, file / folder reading, writing, deleting, attribute changes, etc.), the operation file offset and buffer size and other operation process information of the virtual directory operation event from the FUSE context.

[0046] It should be noted that the information contained in the operation event can be flexibly adjusted, and the embodiments of the present application are not limited to this.

[0047] In some embodiments of the present application, before executing S210, the Linux file access method may include: receiving an actual operation directory, a virtual mapping directory and the permission control rules sent by the permission management end, wherein the actual operation directory stores data files generated by the operation, and the virtual mapping directory is used by the business application end to perform read and write operations on the virtual directory file.

[0048] For example, in some embodiments of the present application, an application administrator can log in to the management terminal to complete the configuration or change of dynamic permission control rules. Among them, the management terminal can respond to the operation instructions of the application administrator to complete the creation of the following two directories: the actual operation directory (for example, / real, the actual data file is generated under this directory); the virtual mapping directory (for example, / plain, the read and write directory configured by the application, and read and write operations are performed on this directory after FUSE binding). At the same time, the configuration of permission control rules can also be completed through the management terminal. The management terminal can send the actual operation directory, virtual mapping directory and permission control rules to the control module so that the control module can perform permission monitoring on related operations.

[0049] In some embodiments of the present application, the permission control rules include: process rules, user rules, directory rules and effectiveness rules.

[0050] For example, in some embodiments of the present application, each rule in the dynamic permission control rule may include all or part of the following:

[0051] 1) Process rules, that is, which processes are allowed to operate the file, such as the allowed process PID or PPID, or the full path of the allowed process executable file, or the parameters that the allowed process must contain, etc.

[0052] 2) User rules, that is, which Linux users are allowed to operate the file, such as: allowed user ID; or allowed user name; or allowed user group, etc.

[0053] 3) Directory rules, i.e. some other restrictions on the directory, such as: the maximum directory size allowed; the maximum file size allowed (for example, the maximum file size is 1GB); the maximum number of files allowed (for example, the maximum number of files is 100), etc.

[0054] 4) Effective rules, that is, the settings of the permission control rules themselves, such as whether the rule is activated, the effective time of the rule, the expiration time of the rule, etc.

[0055] It should be understood that the content in the dynamic permission control rules can be flexibly adjusted, and the embodiments of the present application are not limited to this.

[0056] S220, performing permission determination on the operation event according to permission control rules to determine a determination result, wherein the determination result is: allowing the operation or denying the operation.

[0057] For example, in some embodiments of the present application, whether the operation is allowed is confirmed by comparing the information in the operation event with the permission control rules.

[0058] In some embodiments of the present application, S220 may include: if it is determined that each operation information in the operation event complies with the permission control rule, the judgment result is the allowed operation; if it is determined that there is information in the operation event that does not comply with the permission control rule, the judgment result is the rejected operation.

[0059] For example, in some embodiments of the present application, each piece of operation information is compared with each rule in the permission control rules to determine whether it complies with the rules. If all are in compliance, the business application end 100 can be allowed to continue to operate on the file. If at least one piece of operation information does not comply, the operation is rejected. Among them, allowing the operation indicates that the business application end has the permission for the operation, otherwise it does not have the corresponding permission. For example, if the operation event includes the operation time, it is necessary to confirm whether the operation time is within the range of the file operation time in the permission control rules. If so, the current operation is released, otherwise the current operation is rejected.

[0060] S230: Send the determination result to the service application end.

[0061] For example, in some embodiments of the present application, the control module may send the determination result to the business application terminal 100. When the operation is allowed, an operation release notification may be sent to the business application terminal 100 so that the business application terminal 100 can complete the operation on the file of the virtual directory. When the operation is rejected, an operation rejection notification may be sent to the business application terminal 100, and the business application terminal 100 will obtain the file operation error information of the virtual directory.

[0062] The following is combined with Figure 3The specific process of Linux file access provided by some embodiments of the present application is exemplified.

[0063] Please see attached Figure 3 , Figure 3 A flow chart of a Linux file access method provided for some embodiments of the present application.

[0064] The above process is explained below as an example.

[0065] S310, the authority control end receives the actual operation directory, the virtual mapping directory and the authority control rule sent by the authority management end.

[0066] S320: The business application terminal operates the files in the virtual mapping directory.

[0067] S330, the authority control end reads the operation of the business application end and generates an operation event.

[0068] S340, determine whether the operation event complies with the authority control rules, if so, execute S350, otherwise execute S360.

[0069] S350, the authority control end sends the result of allowing the operation to the business application end.

[0070] S360: The permission control end sends a result of the rejection operation to the business application end.

[0071] It can be understood that the specific implementation process of S310 to S360 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0072] From some of the above embodiments of the present application, it can be seen that the dynamic permission control module constructed based on FUSE in the present application enhances the permission control function of file operations, converts the static control that originally needs to be configured by the Linux system administrator into a dynamic control that can be configured through the management end of the business system, greatly improves the flexibility of file system permission control, adapts to the flexible and changeable business characteristics of upper-level business applications, and strongly supports the personalized needs of business applications. Moreover, the dynamic permission control module constructed based on FUSE can easily integrate the dynamic permission control of file operations without changing the business application while maintaining the original mode of business application operation files, greatly expanding the flexibility of the application architecture.

[0073] Please refer to Figure 4 , Figure 4The block diagram of the composition of the device for Linux file access provided by some embodiments of the present application is shown. It should be understood that the device for Linux file access corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for Linux file access can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0074] Figure 4 The Linux file access device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the Linux file access device, and the Linux file access device includes: a reading module 410, configured to read the operation performed by the business application end on the virtual directory file, and generate an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time; a determination module 420, configured to perform permission determination on the operation event through permission control rules, and determine a determination result, wherein the determination result is: allowing the operation or denying the operation; a sending module 430, configured to send the determination result to the business application end.

[0075] In some embodiments of the present application, before the reading module 410, the Linux file access device also includes: a configuration receiving module (not shown in the figure); the configuration receiving module is configured to: receive the actual operation directory, the virtual mapping directory and the permission control rules sent by the permission management end, wherein the actual operation directory stores the data files generated by the operation, and the virtual mapping directory is used by the business application end to perform read and write operations on the virtual directory file.

[0076] In some embodiments of the present application, the permission control rules include: process rules, user rules, directory rules and effectiveness rules.

[0077] In some embodiments of the present application, the determination module 420 is configured such that if it is determined that each operation information in the operation event complies with the permission control rule, the determination result is the allowed operation; if it is determined that there is information in the operation event that does not comply with the permission control rule, the determination result is the rejected operation.

[0078] Other embodiments of the present application also provide a Linux file access system, including: a business application end and a permission control end; wherein the business application end 100 is used to operate files in a virtual mapping directory; the permission control end 200 is used to read the operation and generate an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time; the operation event is subjected to permission determination through permission control rules to determine a determination result, wherein the determination result is: allowing the operation or denying the operation; and the determination result is sent to the business application end.

[0079] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and system can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0080] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0081] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0082] like Figure 5 As shown, some embodiments of the present application provide an electronic device 500, which includes: a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520, wherein the processor 520 can implement a method as described in any of the above embodiments when reading the program from the memory 510 through a bus 530 and executing the program.

[0083] Processor 520 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 520 can be a microprocessor.

[0084] The memory 510 may be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 520 of the disclosed embodiment may be used to execute instructions in the memory 510 to implement the method shown above. The memory 510 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0085] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0086] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0087] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for accessing Linux files, characterized in that: include: Reading the operation performed by the business application end on the virtual directory file, generating an operation event, wherein the operation event includes: at least one of operation process information, operator information, operation file information and operation time; Performing authority determination on the operation event according to the authority control rule to determine the determination result, wherein the determination result is: allowing the operation or denying the operation; The determination result is sent to the service application end.

2. The method according to claim 1, characterized in that Before the reading of the operation performed by the service application end on the virtual directory file, the method further includes: Receive the actual operation directory, virtual mapping directory and the permission control rules sent by the permission management end, wherein the actual operation directory stores the data files generated by the operation, and the virtual mapping directory is used by the business application end to perform read and write operations on the virtual directory file.

3. The method according to claim 1 or 2, characterized in that The authority control rules include: process rules, user rules, directory rules and effectiveness rules.

4. The method according to claim 1 or 2, characterized in that: The performing authority determination on the operation event by using the authority control rule and determining the determination result includes: If it is determined that each operation information in the operation event complies with the authority control rule, the determination result is the permitted operation; If it is determined that the operation event contains information that does not comply with the authority control rule, the determination result is the rejection of the operation.

5. A Linux file access device, characterized in that: include: A reading module is configured to read the operation performed by the business application end on the virtual directory file and generate an operation event, wherein the operation event includes at least one of: operation process information, operator information, operation file information and operation time; A determination module is configured to perform permission determination on the operation event according to permission control rules and determine a determination result, wherein the determination result is: allowing the operation or denying the operation; The sending module is configured to send the determination result to the service application end.

6. The device according to claim 5, characterized in that Before the reading module, the device further includes: a configuration receiving module; the configuration receiving module is configured to: Receive the actual operation directory, virtual mapping directory and the permission control rules sent by the permission management end, wherein the actual operation directory stores the data files generated by the operation, and the virtual mapping directory is used by the business application end to perform read and write operations on the virtual directory file.

7. A Linux file access system, characterized in that: include: Business application end and permission control end; among them, The business application end is used to operate the files in the virtual mapping directory; The permission control end is used to read the operation and generate an operation event, wherein the operation event includes: at least one of: operation process information, operator information, operation file information and operation time; perform permission determination on the operation event through permission control rules to determine a determination result, wherein the determination result is: allowing the operation or denying the operation; and send the determination result to the business application end.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 4 when executed by a processor.

9. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 4 when being run by the processor.

10. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 4 when executed by a processor.

Images