A dynamic executable file management method and system for Linux system

Abstract

The present invention discloses a dynamic executable file management method and system for a Linux system, the method comprising: monitoring the behavior of a newly generated dynamic executable file when the system is running; when the behavior of the newly generated dynamic executable file when the system is running is monitored, recording the dynamic executable file is jointly implemented according to the process inheritance relationship of the dynamic executable file and the ownership relationship of the software package, and the dynamic executable file record is linked to be uninstalled and updated when the application is uninstalled and updated, so as to realize the full management of the application. The present invention has low overhead loss, good practicality and security, provides more comprehensive maintenance and management for the application, and reduces the generation of residual data.

Description

Technical Field

[0001] The present invention relates to the field of system security management, and in particular to a dynamic executable file management method and system for a Linux system. Background Art

[0002] With the rapid development of computer technology, more and more applications are developed and adapted for Linux systems, but the quality of applications varies greatly. There is no unified standard for the installation, execution and uninstallation of application software. Most applications will generate temporary file data during installation or operation, but when the application is uninstalled, these temporary executable files are not recorded in the software package list and do not form a dependency and subordinate relationship with the software package. Therefore, these files will be left in the operating system to form residual data. If these residual data are not handled correctly, it may cause system instability or performance problems.

[0003] Therefore, managing dynamic executable files and temporary data to avoid residual data from the root is a security problem that needs to be solved urgently. From the perspective of the operating system, it is necessary to ensure the functional correctness of the application running, and to ensure that the files generated by the application are effectively managed, so that there will be no residual data when the application is uninstalled, further ensuring the security and reliability of the system.

[0004] From the current existing technology, the problem of multi-platform application management has been solved, but the management of temporarily released dynamic executable files has not been realized. For example, the Chinese patent application document with publication number CN118295704A discloses an application management method, device and computing device that supports multiple systems, which describes instantiating the application management plug-in of the target operating system according to the type of application, and the application management plug-in inherits the class abstracted from the installation package; calling the application management interface to generate the application installation file or universal installation file corresponding to the target operating system; using the application management interface to complete the installation processing of the application installation file or universal installation file, and realize the installation of application installation packages of different operating systems and other management functions. The Chinese patent application document with publication number CN118228234A discloses an application management method, in which the application management method described can open the required target application in different operating environments through the portal application through the authorization token and the user's target environment; improves the operating efficiency and convenience of the application. The Chinese patent application document with publication number CN117667372A discloses an application management method, electronic equipment and storage medium, which describes the design of the opening and running mode of non-compressed state applications and compressed state applications, which helps to reduce the memory occupation of the application.

[0005] In summary, the existing technologies currently solve the management problems of installing and running applications on multiple platforms, but do not manage the temporary executable files generated during the system operation when the software is uninstalled or updated. How to manage the temporary executable files dynamically released during the application execution from the perspective of the entire process of system operation and reduce the residual files in the system, considering not only its practicality and security, but also its impact on system performance, is still a key technical problem that needs to be solved urgently. Summary of the invention

[0006] The technical problem to be solved by the present invention is as follows: In view of the above-mentioned problems in the prior art, a dynamic executable file management method and system for a Linux system are provided, which has low overhead loss, good practicality and security, provides more comprehensive maintenance and management for applications, and reduces the generation of residual data.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0008] A dynamic executable file management method for a Linux system, comprising:

[0009] Monitor the behavior of newly generated dynamic executable files when the system is running;

[0010] When monitoring the behavior of newly generated dynamic executable files during system runtime, the dynamic executable files are recorded jointly according to their process inheritance relationship and software package ownership relationship. When the applications are uninstalled and updated, the records of the dynamic executable files are uninstalled and updated in conjunction, so as to achieve full management of the applications.

[0011] Optionally, the monitoring of the behavior of newly generated dynamic executable files when the system is running includes: when installing an application, monitoring the events of dynamically creating files by the program installer through the kernel module, and identifying the behavior events of temporary dynamic executable files created by the installation script during the installation process of the application.

[0012] Optionally, monitoring the behavior of the newly generated dynamic executable file when the system is running includes: during the execution of the application, monitoring the write events of the application through the kernel module, and identifying the behavior events of the dynamic executable file generated and created during the execution of the application.

[0013] Optionally, the identification of behavioral events of temporary dynamic executable files created by the installation script during the installation process of the application or the identification of behavioral events of dynamic executable files generated and created by the application during the execution process includes: when the kernel module monitors the event of the program installer dynamically creating a file or the write event of the application, the event is notified to the daemon service of the application layer through the intra-kernel and extra-kernel communication mechanism; when the daemon service receives the event, it queries a preset whitelist based on the subject and object information of the creation event, wherein the subject is the installation or application, and the object is the file corresponding to the event of dynamically creating a file or the write event. If the subject and object information are both in the whitelist, the event is determined to be a behavioral event of a temporary dynamic executable file created by the installation script during the installation process of the identified application or a behavioral event of a dynamic executable file generated and created by the application during the execution process.

[0014] Optionally, the recording of the dynamic executable file based on the process inheritance relationship of the dynamic executable file and the ownership relationship of the software package includes: recording the dynamic executable file in the form of an item in a dependency table consisting of the dynamic executable file, the application, and the software package, and simultaneously associating the software list database of the software manager; wherein the dependency relationship between the dynamic executable file and its corresponding application is determined based on the process inheritance relationship between the process of the dynamic executable file and the process of the application that creates the dynamic executable file, and the dependency relationship between the application and its corresponding software package is determined based on the record when the application is installed.

[0015] Optionally, the record of uninstalling and updating the dynamic executable file in conjunction with the application uninstallation and update includes: when the application is uninstalled, according to the software package that needs to be uninstalled in the software list database of the software manager, deleting the table entry of the dependency table consisting of the dynamic executable file, application and software package corresponding to the software package.

[0016] Optionally, the record of uninstalling and updating the dynamic executable file in conjunction with the application program uninstallation and update includes: when the application program is updated, based on the software package that needs to be updated in the software list database of the software manager, updating the entries in the dependency table consisting of the dynamic executable file, application program, and software package corresponding to the software package, including deleting invalid entries of the software package and modifying changed entries of the software package.

[0017] The present invention also proposes a dynamic executable file management system for a Linux system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute any one of the dynamic executable file management methods for a Linux system.

[0018] The present invention also proposes a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute any one of the dynamic executable file management methods for the Linux system through a processor.

[0019] The present invention also proposes a computer program product, comprising a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute any one of the dynamic executable file management methods for the Linux system through a processor.

[0020] Compared with the prior art, the present invention mainly has the following advantages:

[0021] When the present invention monitors the behavior of a newly generated dynamic executable file when the system is running, it jointly implements the recording of the dynamic executable file according to the process inheritance relationship of the dynamic executable file and the ownership relationship of the software package, and realizes the full management of the application by increasing the management of temporary dynamic executable files. When the application is uninstalled and updated, the record of the dynamic executable file is linked to be uninstalled and updated, which can more comprehensively control the dynamic executable file when the application is uninstalled and updated, reduce residual data from the root, and reduce the risk of illegal destruction of system resource data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flow chart of an embodiment of the present invention.

[0023] Figure 2 The diagram is a schematic diagram of the ownership relationship of dynamic executable files and their linkage with system software packages in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] Embodiment 1

[0025] This embodiment proposes a dynamic executable file management method for a Linux system, aiming to implement a control method for monitoring and managing system dynamic executable files with low overhead loss, good practicality and security, realize full management of applications, and reduce the generation of residual data.

[0026] like Figure 1 As shown, the method of this embodiment includes the following steps:

[0027] S101, monitoring the behavior of a newly generated dynamic executable file when the system is running;

[0028] S102, when monitoring the behavior of a newly generated dynamic executable file during system operation, jointly implement recording of the dynamic executable file according to the process inheritance relationship of the dynamic executable file and the ownership relationship of the software package, and jointly uninstall and update the record of the dynamic executable file when the application is uninstalled and updated, so as to achieve full management of the application. Among them:

[0029] The software package ownership relationship includes the relationship between the installed software package and the executable file temporarily created during the installation process when the application installer installs the software package. The software package ownership relationship supports that the temporary files generated by the installation script during the application installation process should be associated with the installed application program, rather than the installation program;

[0030] The process inheritance relationship refers to the relationship between the application and the temporary executable file that is recorded when the dynamic executable file is released and created during the execution of the application.

[0031] Each step is described in detail below.

[0032] Step S101 of this embodiment implements monitoring of the release of dynamic executable files by the application program through the kernel module. Monitoring of the behavior events of the application program is divided into two situations:

[0033] One is the monitoring of the system installation manager program. The location of this type of program in the system is fixed. This embodiment can efficiently identify and monitor this type of application through a whitelist mechanism. Then, during the configuration phase before and after the installed application, the events of dynamically created files are monitored to complete the behavioral event monitoring of dynamic executable file creation during the installation phase.

[0034] The other is the monitoring of the application running process. By monitoring the write events of such programs, the performance loss introduced by monitoring can be effectively reduced, and the behavioral event monitoring of the creation of dynamic executable files during the application running phase can be completed.

[0035] Therefore, in step S101 of this embodiment, monitoring the behavior of the newly generated dynamic executable file when the system is running includes:

[0036] When installing an application, the kernel module monitors the events of the program installer dynamically creating files, and identifies the behavior events of temporary dynamic executable files created by the installation script during the installation process of the application. Such files are not in the software package list and are not recorded in the software package database.

[0037] During the execution of the application, the kernel module monitors the write events of the application and identifies the behavior events of the dynamic executable files generated and created during the execution of the application. Such files are not included in the software package list.

[0038] When the kernel module monitors the creation of a dynamic executable file, it notifies the application layer daemon service of the event through the intra-kernel and extra-kernel communication mechanisms. When the daemon service receives the event, it optimizes according to the subject and object information of the creation event, filters the object events that meet the requirements, and stores more accurate event data information.

[0039] Specifically, the identification of behavioral events of temporary dynamic executable files created by installation scripts during the installation process of an application or the identification of behavioral events of dynamic executable files generated and created by an application during execution includes: when the kernel module monitors the event of a program installer dynamically creating a file or an application write event, the event is notified to the daemon service of the application layer through the intra-kernel and extra-kernel communication mechanism; when the daemon service receives the event, it queries a preset whitelist based on the subject and object information of the creation event, wherein the subject is the installation or application, and the object is the file corresponding to the event of dynamically creating a file or the write event; if the subject and object information are both in the whitelist, then the event is determined to be a behavioral event of a temporary dynamic executable file created by the installation script during the installation process of the identified application or a behavioral event of a dynamic executable file generated and created by the application during execution.

[0040] In step S102 of this embodiment, a relational database is constructed to describe the relationship among dynamic executable files, applications, and software packages, and the installation, uninstallation, and update processes of the software packages are linked, and management of temporary dynamic executable files is added to achieve full management of the software packages. When the kernel module monitors that the application releases and creates a temporary executable file, the relationship between the application and the temporary executable file is recorded. In addition, the kernel module monitors and records the relationship between the installed software package and the executable file temporarily created during the installation process.

[0041] like Figure 2 As shown, the data record form of this embodiment is a subordinate relationship table of dynamic executable files, applications, and software packages, and is associated with the software list database of the software manager. By constructing a relational database to describe the subordinate relationship of dynamic executable files, applications, and software packages, the installation, uninstallation, and update processes of the software packages are linked, and the management of temporary dynamic executable files is added to achieve full management of the software packages.

[0042] Therefore, in step S102, the recording of the dynamic executable file according to the process inheritance relationship of the dynamic executable file and the ownership relationship of the software package includes: recording the dynamic executable file in the form of an item in a dependency table consisting of the dynamic executable file, the application program, and the software package, and simultaneously associating the software list database of the software manager; wherein the dependency relationship between the dynamic executable file and its corresponding application program is determined according to the process inheritance relationship between the process of the dynamic executable file and the process of the application program that creates the dynamic executable file, and the dependency relationship between the application program and its corresponding software package is determined according to the record when the application program is installed.

[0043] In addition, in step S102 of this embodiment, by recording the relationship between the application and the temporarily generated executable program, and linking with the system software package management, a relationship diagram between the software package and the application is generated with the application as the associated object, which is used for full query and uninstall management of the software package. The created dynamic executable file database is linked to the software package list database of the system installation manager and is associated with the installation, uninstallation, and update process of the software package installer for the application; when the application is uninstalled and updated, the dynamic executable file is linked to be uninstalled and updated, reducing residual data in the system and reducing the risk of being exploited by attacks.

[0044] Specifically, the records of uninstalling and updating the dynamic executable file in conjunction with uninstalling and updating the application include:

[0045] When the application is uninstalled, according to the software package to be uninstalled in the software list database of the software manager, the table entry of the dependency relationship table consisting of the dynamic executable file, the application and the software package corresponding to the software package is deleted;

[0046] When the application is updated, the items in the dependency table consisting of the dynamic executable file, application and software package corresponding to the software package that needs to be updated in the software list database of the software manager are updated, including deleting the invalid items of the software package and modifying the changed items of the software package.

[0047] Embodiment 2

[0048] This embodiment provides a dynamic executable file management system for a Linux system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the dynamic executable file management method for a Linux system in the first embodiment.

[0049] In this embodiment, the microprocessor includes the following functional modules:

[0050] An application behavior monitoring unit is used to monitor and mark the behavior of newly generated dynamic executable files during system operation;

[0051] The dynamic file recording unit records the dynamic executable files according to the inheritance relationship of the process and the ownership relationship of the software package when the executable files are dynamically generated during system operation, so as to realize the full management of the application.

[0052] This embodiment further proposes a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the dynamic executable file management method of the Linux system of the first embodiment through a processor.

[0053] This embodiment further provides a computer program product, including a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the dynamic executable file management method of the Linux system of the first embodiment through a processor.

[0054] In summary, the invention discloses a dynamic executable file management method and system for a Linux system, which monitors and marks the behavior of dynamic executable files temporarily generated during system operation, and associates the system software management configuration tool to achieve linkage management. When an executable file is dynamically generated during system operation, the dynamic executable file is recorded in conjunction with the inheritance relationship of its process and the ownership relationship of the software package to achieve full management of the application software package. Compared with the prior art, the present invention has the following advantages:

[0055] More comprehensive software management: The method of the present invention includes linking the system software package management library according to the information of dynamic executable files, applications, software packages, etc., which can more comprehensively control the dynamic executable files when uninstalling and updating applications, reduce residual data from the source, and reduce the risk of illegal destruction of system resource data.

[0056] Small performance impact: The monitoring of the system installation program and the application program operation of the present invention is implemented by marking in the kernel module, so the performance loss of the system is very small when the monitoring of specific files is implemented in the kernel.

[0057] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0058] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A dynamic executable file management method for a Linux system, characterized in that: include: Monitor the behavior of newly generated dynamic executable files when the system is running; When the behavior of a newly generated dynamic executable file during system operation is monitored, the dynamic executable file is recorded jointly according to the process inheritance relationship of the dynamic executable file and the ownership relationship of the software package, including: recording the dynamic executable file in the form of an item in a dependency table consisting of the dynamic executable file, the application program, and the software package, and simultaneously associating the software list database of the software manager; and linking the uninstallation and update of the dynamic executable file record when the application is uninstalled and updated to achieve full management of the application, and the linkage uninstallation and update of the dynamic executable file record when the application is uninstalled and updated includes: when the application is uninstalled, according to the software package that needs to be uninstalled in the software list database of the software manager, deleting the item in the dependency table consisting of the dynamic executable file, the application program, and the software package corresponding to the software package; when the application is updated, according to the software package that needs to be updated in the software list database of the software manager, updating the item in the dependency table consisting of the dynamic executable file, the application program, and the software package corresponding to the software package, including deleting the invalid item of the software package and modifying the changed item of the software package.

2. The method for managing dynamic executable files in a Linux system according to claim 1, characterized in that: The monitoring of the behavior of the newly generated dynamic executable file when the system is running includes: when installing the application, monitoring the event of the program installer dynamically creating the file through the kernel module, and identifying the behavior event of the temporary dynamic executable file created by the installation script during the installation process of the application.

3. The method for managing dynamic executable files of a Linux system according to claim 2, characterized in that: The monitoring of the behavior of the newly generated dynamic executable file during system operation includes: during the execution of the application, monitoring the write events of the application through the kernel module, and identifying the behavior events of the dynamic executable file generated and created during the execution of the application.

4. The method for managing dynamic executable files of a Linux system according to claim 3, characterized in that: The method for identifying the behavior event of a temporary dynamic executable file created by an installation script during the installation process of an application or identifying the behavior event of a dynamic executable file generated and created by an application during the execution process includes: when the kernel module monitors the event of a program installer dynamically creating a file or a write event of an application, notifying the application layer's daemon service of the event of a program installer dynamically creating a file or the write event of an application through an intra-kernel and extra-kernel communication mechanism; when the daemon service receives the event of a program installer dynamically creating a file or the write event of an application, querying a preset whitelist based on the subject and object information of the creation event, wherein the subject is the installation script or the application, and the object is the file corresponding to the event of a dynamic file creation or the write event; if the subject and object information are both in the whitelist, it is determined that the event of a program installer dynamically creating a file or the write event of an application is a behavior event of a temporary dynamic executable file created by the installation script during the installation process of the identified application or a behavior event of a dynamic executable file generated and created by the application during the execution process.

5. The method for managing dynamic executable files in a Linux system according to claim 1, characterized in that: In the dependency table consisting of dynamic executable files, applications, and software packages, the dependency between dynamic executable files and their corresponding applications is determined based on the process inheritance relationship between the process of the dynamic executable file and the process of the application that creates the dynamic executable file, and the dependency between the application and its corresponding software package is determined based on the records when the application is installed.

6. A dynamic executable file management system for a Linux system, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the dynamic executable file management method for a Linux system as described in any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the dynamic executable file management method for a Linux system as claimed in any one of claims 1 to 5 through a processor.

8. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the dynamic executable file management method for a Linux system as claimed in any one of claims 1 to 5 through a processor.

Images