File repairing method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a file repairing method and device, a storage medium and electronic device.The file repairing method comprises the steps that an agent program which is written for a first file with vulnerabilities through target equipment and used for repairing the first file is received; the agent program and the starting script of the agent program are copied into a container before the container is initialized, so that under the condition that the container needs to execute the first file, the first file in the container is repaired through the agent program and the starting script, and the container comprises the first file. Therefore, the problem that in the related technology, in a micro-service containerization deployment scene, the repairing effect on vulnerabilities occurring in the software delivery process is poor can be solved. And the repairing effect on the vulnerabilities occurring in the delivery process of the software is better.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of microservice technology, and specifically, to a file repair method and device, a storage medium, and an electronic device. Background Art

[0002] More and more applications are delivered in a containerized manner. Currently, the most mainstream container management platform is k8s. The release and deployment of microservice applications need to be packaged into images and use k8s for automated deployment and operation. Various vulnerabilities are inevitable in the software delivery process. For example, an urgent vulnerability is found in the production system and needs to be fixed as soon as possible. In order to solve this vulnerability, the existing methods for implementing repairs in containerized microservice applications are:

[0003] Re-making the image: The conventional steps to solve the vulnerability are for developers to modify the Java code, re-make the image, and upgrade the version. In the scenario where R&D and delivery are located in different places, if the container image is repackaged, tested, and released every time, not only will the entire process be very long, but also because the release package is very large, the communication and transmission time is long, and it is impossible to meet the timeliness requirements for rapid defect repair.

[0004] Modify the container to download and replace the Class file before starting the process. This method does not require remaking the image. Instead, put a special program (usually a script) in the container and modify the container startup command. Execute this script before starting the container. In the script, pull the Class file from the external storage, merge it into the Jar file, and then start the original Java process. This method does not require remaking the image, but because the Class file is replaced, there is also a risk of the scope of change spreading. In addition, the original program startup command needs to be modified, which has certain limitations.

[0005] Regarding related technologies, the problem of poor repair effects for vulnerabilities that occur during the software delivery process in microservice containerized deployment scenarios has not yet been effectively solved. Summary of the invention

[0006] The embodiments of the present application provide a file repair method and device, a storage medium, and an electronic device to at least solve the problem of poor repair effect of vulnerabilities that occur in the software delivery process in a microservice containerized deployment scenario in the related art.

[0007] According to one embodiment of the present application, a file repair method is provided, which is applied to a host machine, and the host machine communicates with a target device. The method includes: receiving an agent program written by the target device for a first file with a vulnerability and used to repair the first file; copying the agent program and a startup script of the agent program into a container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, wherein the container includes: the first file.

[0008] In an exemplary embodiment, before receiving an agent program written by the target device for repairing a first file having a vulnerability, the method further includes: determining the first file having a vulnerability based on a root cause of the vulnerability; and instructing a target object to write the agent program for repairing the first file through the target device.

[0009] In an exemplary embodiment, the agent program and the startup script of the agent program are copied to the container before the container is initialized, including: determining whether there is a first initialization container corresponding to the container, wherein the first initialization container is a container that needs to be run before the main container of the Pod corresponding to the container is started; if there is a first initialization container corresponding to the container, performing a first modification operation on the Deployment corresponding to the container to modify the configuration information of the first initialization container to obtain a second initialization container; if there is no first initialization container corresponding to the container, performing a second modification operation on the Deployment corresponding to the container to add the second initialization container; and copying the agent program and the startup script to the inside of the container through the second initialization container.

[0010] In an exemplary embodiment, the agent program and the startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, including: determining whether there is a first hook function corresponding to the container, wherein the first hook function is a function for executing an initialization task after the container is started; if there is the first hook function corresponding to the container, performing a third modification operation on the Deployment corresponding to the container to modify the configuration information of the first hook function to obtain a second hook function, wherein the second hook function is used to start the agent program; if there is no first hook function corresponding to the container, performing a fourth modification operation on the Deployment corresponding to the container to add the second hook function; when the agent program and the startup script have been copied to the inside of the container and the container startup is completed, executing the startup script through the hook function to start the agent program; and repairing the first file in the container by the started agent program.

[0011] In an exemplary embodiment, the startup script is executed through the hook function to start the agent program, including: determining the process identifier of the first file recorded in the startup script; binding the agent program to the service process corresponding to the first file in the container through the process identifier, and starting the bound agent program to obtain the started agent program.

[0012] In an exemplary embodiment, repairing the first file in the container by using a started agent program includes: when the container needs to execute the first file, intercepting a first bytecode corresponding to the first file by using the started agent program; and modifying the first bytecode by using the started agent program to obtain a second bytecode to repair the first file in the container.

[0013] In an exemplary embodiment, the agent program and the startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, after the first file in the container is repaired by the agent program and the startup script, the method further includes: when the agent program needs to be uninstalled, obtaining an uninstall script written by the target device; and uninstalling the agent program and the startup script from the container by using the uninstall script.

[0014] According to another embodiment of the present application, a file repair device is provided, which is applied to a host machine, and the host machine communicates with a target device, and the device includes: a receiving module, which is used to receive an agent program written by the target device for a first file with a vulnerability and used to repair the first file; a copying module, which is used to copy the agent program and the startup script of the agent program to a container before the container is initialized, so as to repair the first file in the container through the agent program and the startup script when the container needs to execute the first file, wherein the container includes: the first file.

[0015] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0016] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0017] According to another embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0018] Through the present application, a method for repairing a file is provided, which is applied to a host machine, and the host machine communicates with a target device; the method receives an agent program written by the target device for a first file with a vulnerability and used to repair the first file; the agent program and the startup script of the agent program are copied to the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, wherein the container includes: the first file. Therefore, the problem of poor repair effect for vulnerabilities that occur in the software delivery process in the microservice containerized deployment scenario in the related art can be solved. The repair effect of vulnerabilities that occur in the software delivery process is better. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a hardware structure block diagram of a computer terminal of a file repair method according to an embodiment of the present application;

[0020] Figure 2 is a flowchart of a method for repairing a file according to an embodiment of the present application;

[0021] Figure 3is another flow chart of a method for repairing a file according to an embodiment of the present application;

[0022] Figure 4 is a schematic diagram of a repair process of a file repair method according to an embodiment of the present application;

[0023] Figure 5 It is a structural block diagram of a file repair device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0026] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a computer terminal as an example, Figure 1 1 is a hardware structure block diagram of a computer terminal of a file repair method according to an embodiment of the present application. Figure 1 As shown, the computer terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0027] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for allocating load resources in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0028] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0029] Figure 2 is a flowchart of a method for repairing a file according to an embodiment of the present application, which is applied to a host machine, wherein the host machine communicates with a target device, such as Figure 2 As shown, the process includes the following steps:

[0030] Step S202, receiving an agent program written by the target device for the first file having a vulnerability and used to repair the first file;

[0031] Step S204, copying the agent program and the startup script of the agent program into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container can be repaired by the agent program and the startup script, wherein the container includes: the first file.

[0032] Through the above steps, an agent program for repairing a first file with a vulnerability written by the target device is received; the agent program and the startup script of the agent program are copied to the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, wherein the container includes: the first file. Therefore, the problem of poor repair effect for vulnerabilities that occur in the software delivery process in the microservice containerized deployment scenario in the related technology can be solved. This makes the repair effect of vulnerabilities that occur in the software delivery process better.

[0033] In an exemplary embodiment, before receiving an agent program written by the target device for repairing a first file having a vulnerability, the method further includes: determining the first file having a vulnerability based on a root cause of the vulnerability; and instructing a target object to write the agent program for repairing the first file through the target device.

[0034] By determining the first file with a vulnerability through the root cause of the vulnerability, an agent program can be accurately written for the first file, which facilitates the subsequent accurate repair of the agent file.

[0035] In an exemplary embodiment, the agent program and the startup script of the agent program are copied to the container before the container is initialized, including: determining whether there is a first initialization container corresponding to the container, wherein the first initialization container is a container that needs to be run before the main container of the Pod corresponding to the container is started; if there is a first initialization container corresponding to the container, performing a first modification operation on the Deployment corresponding to the container to modify the configuration information of the first initialization container to obtain a second initialization container; if there is no first initialization container corresponding to the container, performing a second modification operation on the Deployment corresponding to the container to add the second initialization container; and copying the agent program and the startup script to the inside of the container through the second initialization container.

[0036] Optionally, both the first initialization container and the second initialization container are init containers, which are containers to be run before the main container of the Pod corresponding to the container is started, mainly to perform some pre-work for the main container. If the first initialization container exists, the configuration information of the first initialization container is modified through the first modification operation to obtain the second initialization container; otherwise, the second modification operation is performed through the Deployment corresponding to the container to directly add the second initialization container.

[0037] In the case where the second initialization container exists, the agent program and the startup script may be copied to the inside of the container through the second initialization container.

[0038] Therefore, by modifying the first initialization container and / or directly initializing the second container, the agent program and the startup script can be copied into the container, so that the agent program can repair the first file of the container.

[0039] In an exemplary embodiment, the agent program and the startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, including: determining whether there is a first hook function corresponding to the container, wherein the first hook function is a function for executing an initialization task after the container is started; if there is the first hook function corresponding to the container, performing a third modification operation on the Deployment corresponding to the container to modify the configuration information of the first hook function to obtain a second hook function, wherein the second hook function is used to start the agent program; if there is no first hook function corresponding to the container, performing a fourth modification operation on the Deployment corresponding to the container to add the second hook function; when the agent program and the startup script have been copied to the inside of the container and the container startup is completed, executing the startup script through the hook function to start the agent program; and repairing the first file in the container by the started agent program.

[0040] Optionally, the first hook function and the second hook function are both post start. It should be noted that poststart is a k8s hook function, which is executed after the container is created. If it fails, the container will be restarted; post start is called after the container is started, and can be used to perform some initialization tasks after startup, such as sending a startup completion signal, recording logs, etc.

[0041] It can be further understood that the startup script of the agent program in the embodiment of the present application needs to be started through the second hook function. In the case where the first hook function corresponding to the container exists, the configuration information of the first hook function is modified to obtain the second hook function; in the case where the first hook function corresponding to the container does not exist, the second hook function is directly added through the Deployment corresponding to the container. Therefore, the embodiment of the present application realizes the startup of the startup script by adding the hook function, and then the agent program can be started through the startup script later.

[0042] In an exemplary embodiment, the startup script is executed through the hook function to start the agent program, including: determining the process identifier of the first file recorded in the startup script; binding the agent program to the service process corresponding to the first file in the container through the process identifier, and starting the bound agent program to obtain the started agent program.

[0043] It should be noted that the process identifier corresponding to the first file in the container is added to the startup script during the writing of the startup script. Therefore, the embodiment of the present application binds the agent program to the service process corresponding to the first file in the container through the process identifier in the startup script, so that the agent program can accurately repair the first file.

[0044] In an exemplary embodiment, repairing the first file in the container by using a started agent program includes: when the container needs to execute the first file, intercepting a first bytecode corresponding to the first file by using the started agent program; and modifying the first bytecode by using the started agent program to obtain a second bytecode to repair the first file in the container.

[0045] It should be noted that the agent program in the embodiment of the present application repairs the first file during the execution of the first file; specifically, the agent program intercepts the first bytecode corresponding to the execution of the first file and modifies the first bytecode to achieve the purpose of repairing the first file. Thus, the purpose of repairing the first file can be achieved without changing the original code of the first file, so that when the original code of the first file is not changed, the scope of the code change will not have the problem of scope creep.

[0046] In an exemplary embodiment, the agent program and the startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, after the first file in the container is repaired by the agent program and the startup script, the method further includes: when the agent program needs to be uninstalled, obtaining an uninstall script written by the target device; and uninstalling the agent program and the startup script from the container by using the uninstall script.

[0047] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0048] In order to better understand the process of the above-mentioned file repair method, the implementation process of the above-mentioned file repair method is described below in combination with an optional embodiment, but it is not used to limit the technical solution of the embodiment of the present application.

[0049] In view of some defects of the traditional method, the optional embodiment of the present application proposes a method for quickly repairing vulnerabilities by dynamically enhancing the bytecode of the loaded class (for example, the first bytecode in the above embodiment) during the operation of the microservice based on the Java agent dynamic addition technology in a microservice containerized deployment scenario; this solution has the following advantages: no need to modify the original code, no need to remake the image, and no need to modify the program startup command; no intrusion to the system, and the scope of impact is controllable; full use of the expansion capability of k8s to associate the agent program with the service process in the container, and the agent program will be reloaded after the Pod is restarted;

[0050] More specifically, an optional embodiment of the present application proposes an emergency method for non-invasively repairing production environment vulnerabilities in a containerized scenario based on Java agent dynamic addition technology (equivalent to a file repair method in the above embodiment). Java agent technology can obtain information about the bytecodes before the Java Virtual Machine (JVM) executes the bytecodes, and modify the bytecodes through a bytecode converter to complete the repair of the vulnerabilities. After the agent program is developed, the initialization container (init container) and hook function (post start) of k8s are used to integrate the agent program into the container and mount it together with the microservice program (the program to be repaired). The overall vulnerability repair process is as follows: Figure 3 As shown, including:

[0051] Step S31, developing a Java agent program;

[0052] According to the root cause of the vulnerability, the java files and methods that need to be modified are confirmed (the java files and methods are equivalent to the first files in the above embodiment). A Java agent program (the Java agent program is equivalent to the agent program in the above embodiment) is written to dynamically modify the java files and methods that need to be modified.

[0053] Step S32, packaging the agent program and writing an agent startup script;

[0054] The agent program is packaged and written, usually as a jar package. Write the agent startup script. The main function of the script is to obtain the process identifier (PID) of the container process and start the agent program.

[0055] Step S33, upload the agent program and the startup script to the K8s host machine (the K8s host machine is equivalent to the host machine in the above embodiment);

[0056] Upload the packaged jar package and startup script to the K8s host.

[0057] Step S34, modifying the Deployment, and using initContainers to copy the agent program into the container;

[0058] Modify the service Deployment of the vulnerability to be repaired, modify or add initContainers (equivalent to the first modification operation or the second modification operation performed in the above embodiment), and use the initialization container to copy the proxy repair program and the startup script into the container before the container is initialized.

[0059] Step S35, modify Dep1oyment, use postStart to obtain the process PID after the container is started, and start the agent program;

[0060] Modify the service Deployment of the vulnerability to be repaired, modify or add a hook function (equivalent to the third modification operation or the fourth modification operation performed in the above embodiment), and use postStart to start the proxy repair program after the container is started.

[0061] The agent repair program is started by using postStart after the container is started, including: starting the container; using the postStart hook function to execute the startup script, obtaining the service process ID in the container, binding with the agent program, and starting the agent repair program.

[0062] Step S36: After the Dep|oyment modification is completed, restart the container.

[0063] More specifically, in the optional embodiment of the present application, it is necessary to explain the development of the Java agent repair program: an ordinary java agent program can be run through the main function, or specified as a startup class after being packaged into a jar package. To put it more simply, after calling the execution command, the jvm will load the class file through the class loader and then run it. The java agent program can intercept the bytecode and make modifications before the program (equivalent to the program corresponding to the first file) is executed. The specific process is as follows Figure 4 shown.

[0064] Java agent has two entry functions. One is public static void premain(StringagentArgs, Instrumentation inst); when the Java virtual machine starts, before executing the main function, the JVM will first run the premain method of the Premain-Class class in the jar package specified by -javaagent. The premain method can also dynamically fix vulnerabilities, but the original program startup command needs to be modified. The other main method is public static voidagentmain(String agentOps, Instrumentation inst); agentmain is a new feature of JDK SE6. When the java program is running, the jar package can be bound to the jvm process through VirtualMachine to dynamically change the behavior of the class. The optional embodiment of the present application mainly uses the agentmain method.

[0065] Furthermore, the development steps of the Java agent vulnerability repair program (equivalent to the agent program in the above embodiment) in the optional embodiment of the present application include:

[0066] Step 41: Construct the agent class. The agent class of agentmain mode must provide agentmain method;

[0067] Step 42: Set MANNIFEST.MF Set the MANIFEST.MF file and specify the agent class (Agent-Class).

[0068] Step 43: Write a Transformer. Create a bytecode transformer MyTransformer to intercept and modify the bytecode.

[0069] Step 44: Bind to the target VM. After compiling and packaging the agent class and MANIFEST.MF file into a jar, since the agent main method cannot specify the agent jar in the command line like the premain method, it is necessary to use the AttachTools API to write the agent startup class. Load the agent jar package and associate it with the vulnerability service to be repaired.

[0070] Step 45: Write a proxy startup script. Generally speaking, for a single-container Pod, the process ID in the PID namespace of the container is 1, which can directly receive and process signals. If there are multiple process instances in a pod, you need to obtain the service process ID (PID) inside the container and pass the PID as a parameter to the proxy startup program you wrote.

[0071] Furthermore, the K8s Deployment configuration modification includes:

[0072] 1) Modify initContainers: The initialization container is a container that runs before the main container of the Pod is started. It mainly performs some pre-work for the main container. Therefore, before the main container is started, use initContainers to move the proxy repair program and its startup program (i.e., startup script) into the k8s pod.

[0073] 2) Modify postStart: Kubernetes provides a postStart hook function after the main container is started, which is mainly used for some operations after the container is started. After the container is started, use postStart to execute the agent startup script. Get the main container process PID and start the agent.

[0074] Therefore, the optional embodiment of the present application updates the traditional vulnerability repair method, and uses Java proxy technology to dynamically repair vulnerable programs in containerized scenarios, which has the following advantages: 1) There is no need to re-make the container image, avoiding the process and time-consuming problems caused by upgrading the image; 2) The impact of the change is small, and only the methods in certain files are dynamically modified, which can accurately control the impact range; 3) The original program does not need to be modified, and some problems in scenarios such as chaotic management of existing source code and large gaps between code and on-site versions can be solved. 4) It is efficient and flexible, and vulnerabilities can be modified without modifying the original image, and print output can be added to facilitate the investigation of production problems. 5) It is pluggable and can be used to fix some temporary problems. To uninstall the agent program, you only need to stop the agent, and the original program is not affected. It can be used for some temporary adjustments to avoid a large number of if statements in the code and re-making the image.

[0075] Among them, the embodiments of the present application can not only be used for temporary vulnerability repairs, but also can be used to dynamically increase log printing for troubleshooting problems in the production environment; utilizing the pluggable characteristics of the embodiments of the present application, dynamic adjustment of some specific needs can also be achieved, such as discounts during activities, etc., using this solution to dynamically adjust prices during the activity, and uninstall the agent program after the activity ends to restore the price.

[0076] In the present embodiment, a file repair device is also provided, which is used to implement the above-mentioned embodiment and preferred implementation mode, and the descriptions have been made no further. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

[0077] Figure 5 is a structural block diagram of a file repair device according to an embodiment of the present application, the device is applied to a host machine, the host machine communicates with a target device, such as Figure 5 As shown, the device comprises:

[0078] A receiving module 52, configured to receive an agent program written by the target device for the first file having a vulnerability and used to repair the first file;

[0079] A copy module 54 is used to copy the agent program and the startup script of the agent program into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container can be repaired through the agent program and the startup script, wherein the container includes: the first file.

[0080] Through the above-mentioned device, an agent program for repairing a first file with a vulnerability written by the target device is received; the agent program and the startup script of the agent program are copied to the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, wherein the container includes: the first file. Therefore, the problem of poor repair effect for vulnerabilities that occur in the software delivery process in the microservice containerized deployment scenario in the related technology can be solved. This makes the repair effect of vulnerabilities that occur in the software delivery process better.

[0081] In an exemplary embodiment, before receiving an agent program written by the target device for repairing a first file having a vulnerability, the apparatus further includes a vulnerability determination module, which is used to: determine the first file having a vulnerability according to a root cause of the vulnerability; and instruct a target object to write the agent program for repairing the first file through the target device.

[0082] In an exemplary embodiment, the replication module 54 is also used to: determine whether there is a first initialization container corresponding to the container, wherein the first initialization container is a container that needs to be run before the main container of the Pod corresponding to the container is started; if there is a first initialization container corresponding to the container, perform a first modification operation on the Deployment corresponding to the container to modify the configuration information of the first initialization container to obtain a second initialization container; if there is no first initialization container corresponding to the container, perform a second modification operation on the Deployment corresponding to the container to add the second initialization container; and copy the agent program and the startup script to the inside of the container of the container through the second initialization container.

[0083] In an exemplary embodiment, the replication module 54 is also used to: determine whether there is a first hook function corresponding to the container, wherein the first hook function is a function used to perform initialization tasks after the container is started; if there is a first hook function corresponding to the container, perform a third modification operation on the Deployment corresponding to the container to modify the configuration information of the first hook function to obtain a second hook function, wherein the second hook function is used to start the agent program; if there is no first hook function corresponding to the container, perform a fourth modification operation on the Deployment corresponding to the container to add the second hook function; when the agent program and the startup script have been copied to the inside of the container and the container startup is complete, execute the startup script through the hook function to start the agent program; and repair the first file in the container through the started agent program.

[0084] In an exemplary embodiment, the replication module 54 is also used to: determine the process identifier of the first file recorded in the startup script; bind the agent program to the service process corresponding to the first file in the container through the process identifier, and start the bound agent program to obtain the started agent program.

[0085] In an exemplary embodiment, the copy module 54 is also used to: when the container needs to execute the first file, intercept the first bytecode corresponding to the first file through the started agent program; modify the first bytecode through the started agent program to obtain a second bytecode to repair the first file in the container.

[0086] In an exemplary embodiment, the agent program and the startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, after the first file in the container is repaired by the agent program and the startup script, the device also includes an uninstall module, which is used to: when the agent program needs to be uninstalled, obtain an uninstall script written by the target device; and uninstall the agent program and the startup script from the container by using the uninstall script.

[0087] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0088] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0089] S1, receiving an agent program written by the target device for a first file having a vulnerability and used to repair the first file;

[0090] S2, copying the agent program and the startup script of the agent program into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container can be repaired by the agent program and the startup script, wherein the container includes: the first file.

[0091] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0092] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0093] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0094] S1, receiving an agent program written by the target device for a first file having a vulnerability and used to repair the first file;

[0095] S2, copying the agent program and the startup script of the agent program into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container can be repaired by the agent program and the startup script, wherein the container includes: the first file.

[0096] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0097] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above method embodiments are implemented.

[0098] Optionally, in this embodiment, the computer program product may be configured to perform the following steps through a computer program:

[0099] S1, receiving an agent program written by the target device for a first file having a vulnerability and used to repair the first file;

[0100] S2, copying the agent program and the startup script of the agent program into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container can be repaired by the agent program and the startup script, wherein the container includes: the first file.

[0101] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0102] An embodiment of the present application also provides a computer program, which includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in any one of the above method embodiments.

[0103] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0104] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0105] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for repairing a file, characterized in that: Applied to a host machine, the host machine communicates with a target device, the method comprising: Receive an agent program written by the target device for a first file with a vulnerability and used to repair the first file; copy the agent program and a startup script of the agent program into a container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, wherein the container includes: the first file.

2. The method according to claim 1, characterized in that Before receiving an agent program written by the target device for the first file having a vulnerability and used to repair the first file, the method further includes: Determine the first file having a vulnerability according to the root cause of the vulnerability; The target object is instructed to write the agent program for repairing the first file through the target device.

3. The method according to claim 1, characterized in that The agent program and the agent program startup script are copied into the container before the container is initialized, including: Determine whether there is a first initialization container corresponding to the container, wherein the first initialization container is a container that needs to be run before the main container of the Pod corresponding to the container is started; If there is a first initialization container corresponding to the container, perform a first modification operation on the Deployment corresponding to the container to modify configuration information of the first initialization container to obtain a second initialization container; In a case where the first initialization container corresponding to the container does not exist, performing a second modification operation on the Deployment corresponding to the container to add the second initialization container; The agent program and the startup script are copied to the container of the container through the second initialization container.

4. The method according to claim 1, characterized in that: The agent program and a startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container is repaired by the agent program and the startup script, including: Determine whether there is a first hook function corresponding to the container, wherein the first hook function is a function for executing an initialization task after the container is started; In the case where there is a first hook function corresponding to the container, a third modification operation is performed on the Deployment corresponding to the container to modify configuration information of the first hook function to obtain a second hook function, wherein the second hook function is used to start the agent program; In a case where the first hook function corresponding to the container does not exist, performing a fourth modification operation on the Deployment corresponding to the container to add the second hook function; When the agent program and the startup script have been copied into the container and the container is started, the startup script is executed through the hook function to start the agent program; The first file in the container is repaired by the started agent program.

5. The method according to claim 4, characterized in that Executing the startup script through the hook function to start the agent program includes: Determine the process identifier of the first file recorded in the startup script; The agent program is bound to the service process corresponding to the first file in the container through the process identifier, and the bound agent program is started to obtain the started agent program.

6. The method according to claim 4, characterized in that Repairing the first file in the container by using the started agent program includes: When the container needs to execute the first file, intercepting a first bytecode corresponding to the first file by the started agent program; The first bytecode is modified by the started agent program to obtain a second bytecode to repair the first file in the container.

7. The method according to claim 1, characterized in that The agent program and the startup script of the agent program are copied into the container before the container is initialized, so that when the container needs to execute the first file, after repairing the first file in the container by the agent program and the startup script, the method further includes: When the agent program needs to be uninstalled, obtaining an uninstallation script written by the target device; The agent program and the startup script are uninstalled from the container by the uninstall script.

8. A file repair device, characterized in that: Applied to a host machine, the host machine communicates with a target device, the apparatus comprises: A receiving module, configured to receive an agent program written by the target device for the first file having a vulnerability and used to repair the first file; A copy module is used to copy the agent program and the startup script of the agent program into the container before the container is initialized, so that when the container needs to execute the first file, the first file in the container can be repaired through the agent program and the startup script, wherein the container includes: the first file.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 7 are implemented.

Images