Type conflict detection method and device, equipment and storage medium
By extracting AVC alarm information, configuring the SELinux security policy file and converting the node relationship of the TE rule set into a graph structure, the type conflict detection problem is solved, and convenient and efficient security policy configuration is achieved, reducing configuration costs and improving system security.
Patent Information
- Application Number
- CN202411094111.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-09
- Publication Date
- 2025-01-07
AI Technical Summary
When configuring SELinux security policy files, users often encounter type conflict problems, resulting in complex configuration and high cost, affecting system security.
By extracting AVC alarm information, configure security policy files, convert the node relationship in the TE rule set into a graph structure, and compare the relationship structure types of new and old policies, judge type conflicts, and provide type conflict detection methods and devices to facilitate and efficient configuration of security policies.
Effectively judge the type conflict between the new security policy and the original policy, help users to configure security policy files conveniently and efficiently, reduce configuration costs, and improve the security of developing software.
Smart Images
Figure CN119272280A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the computer field, and further to the SELinux system security field, and in particular to a type conflict detection method, apparatus, device and storage medium. Background Art
[0002] As the manager of various resources in the computer system, the operating system directly determines whether the information in the system is safe. Only when the operating system can run safely can the security of various information and other resources in the system be guaranteed. SELinux is a security-enhanced Linux operating system that changes the security policy of autonomous access control in the Linux system, strengthens the restrictions on access control in the system, and proposes a mandatory access control policy.
[0003] In the past information security field, avc errors often occurred when accessing resources, requiring users to add new types and configure security policies according to prompts. However, after the users configured themselves, they often encountered neverallow errors. At this time, users were required to analyze the relationship between the types they configured and the existing types. Summary of the invention
[0004] The present disclosure provides a type conflict detection method, apparatus, device and storage medium, which solve the technical problem that type conflicts often occur when users configure security policy files.
[0005] According to a first aspect of the present disclosure, a type conflict detection method is provided. The method comprises:
[0006] Configure the security policy file of the program according to the AVC alarm information of the program, and then obtain a policy set after the newly added security policy configuration;
[0007] Extracting the TE rule set in the policy set after the newly added security policy is configured;
[0008] Convert the node relationship in the TE rule set into a graph structure to obtain the relationship structure type between the nodes in the TE rule set;
[0009] The relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy is determined according to the relationship structure type.
[0010] According to the above aspects and any possible implementation manner, an implementation manner is further provided, wherein before configuring the security policy file of the program according to the AVC alarm information of the program and then obtaining the policy set after the newly added security policy configuration, the method further includes:
[0011] Get the policy set;
[0012] The original TE rule set in the policy set is extracted, the node relationship in the original TE rule set is converted into a graph structure, and the relationship structure type between the nodes in the original TE rule set is obtained.
[0013] According to the above aspects and any possible implementation manner, an implementation manner is further provided, wherein the method for configuring the security policy file of the program includes:
[0014] Create a new security policy file and add a tag to the security policy file in the file_contexts file;
[0015] Parse the file_contexts file and declare its node pointer type;
[0016] Create a new te file for the security policy file and perform customization operations.
[0017] According to the above aspects and any possible implementation manner, an implementation manner is further provided, wherein judging the relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy according to the relationship structure type includes:
[0018] The relationship structure type between nodes in the original TE rule set is compared with the relationship structure type between nodes in the TE rule set to determine whether the type corresponding to the newly added security policy conflicts with the type corresponding to the original security policy.
[0019] According to the above aspects and any possible implementation manner, an implementation manner is further provided, wherein the comparing the relationship structure type between the nodes in the original TE rule set with the relationship structure type between the nodes in the TE rule set includes:
[0020] Compare whether the relationship structure type between nodes in the TE rule set is the same as the relationship structure type between nodes in the original TE rule set;
[0021] If the relationship structure types are the same, there is no conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
[0022] According to the above aspects and any possible implementation manner, an implementation manner is further provided, wherein the method further includes:
[0023] If the relationship structure types are different, there is a conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
[0024] According to a second aspect of the present disclosure, a type conflict detection device is provided. The device comprises:
[0025] A configuration module, used to configure the security policy file of the program according to the AVC alarm information of the program, and then obtain a policy set after the newly added security policy configuration;
[0026] An extraction module, used to extract a TE rule set from a policy set after the newly added security policy is configured;
[0027] A conversion module, used to convert the node relationship in the TE rule set into a graph structure, and obtain the relationship structure type between the nodes in the TE rule set;
[0028] The judgment module is used to judge the relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy according to the relationship structure type.
[0029] According to the above aspects and any possible implementation manner, there is further provided an implementation manner, wherein the apparatus further includes:
[0030] An acquisition module is used to obtain a policy set;
[0031] The display module is used to extract the original TE rule set in the policy set, convert the node relationship in the original TE rule set into a graph structure, and obtain the relationship structure type between the nodes in the original TE rule set.
[0032] According to a third aspect of the present disclosure, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.
[0033] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method according to the first aspect and / or the second aspect of the present disclosure is implemented.
[0034] In the embodiments of the present disclosure, first, the security policy file of the program can be configured according to the AVC alarm information of the program, and then the policy set after the newly configured security policy is obtained. Secondly, the TE rule set in the policy set after the newly configured security policy can be extracted, and the node relationship in the TE rule set can be converted into a graph structure to obtain the relationship structure type between the nodes in the TE rule set. Finally, the relationship between the type corresponding to the new security policy and the type corresponding to the original security policy can be judged according to the relationship structure type. In this way, when adding a new security policy, the user can judge whether the type corresponding to the new security policy conflicts with the type corresponding to the original security policy, thereby helping the user to configure the security policy file of the program conveniently and efficiently, reduce configuration costs, and improve the security of developed software.
[0035] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:
[0037] Figure 1 A flow chart of a type conflict detection method provided by an embodiment of the present disclosure is shown;
[0038] Figure 2 A structural diagram of a type of conflict detection device provided by an embodiment of the present disclosure is shown;
[0039] Figure 3 A structural diagram of an exemplary electronic device capable of implementing an embodiment of the present disclosure is shown. DETAILED DESCRIPTION
[0040] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.
[0041] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.
[0042] In the present disclosure, firstly, the security policy file of the program can be configured according to the AVC alarm information of the program, and then the policy set after the new security policy is configured can be obtained. Secondly, the TE rule set in the policy set after the new security policy is configured can be extracted, and the node relationship in the TE rule set can be converted into a graph structure to obtain the relationship structure type between the nodes in the TE rule set. Finally, the relationship between the type corresponding to the new security policy and the type corresponding to the original security policy can be judged according to the relationship structure type. In this way, when adding a new security policy, the user can judge whether the type corresponding to the new security policy conflicts with the type corresponding to the original security policy, thereby helping the user to configure the security policy file of the program conveniently and efficiently, reduce configuration costs, and improve the security of the developed software.
[0043] In conjunction with the accompanying drawings, a type of conflict detection method, apparatus, device and storage medium provided by an embodiment of the present disclosure will be described in detail below through specific embodiments.
[0044] Figure 1 A flow chart of a type conflict detection method provided by an embodiment of the present disclosure is shown. Figure 1 As shown, the type conflict detection method 100 may include the following steps:
[0045] S110, configuring a security policy file of the program according to the AVC alarm information of the program, and then obtaining a policy set after the newly added security policy configuration.
[0046] Exemplarily, extract preset keywords in the AVC alarm information; determine the subject tag and object tag corresponding to the program based on the preset keywords; search the database for the permission statement to be added corresponding to the reason type; the preset keywords may include at least one of name, scontext, tcontext, class and perms.
[0047] In some embodiments, the method of configuring the security policy file of the program includes:
[0048] Create a new security policy file and add a tag to the security policy file in the file_contexts file;
[0049] Parse the file_contexts file and declare its node pointer type;
[0050] Create a new te file for the security policy file and perform customization operations.
[0051] S120: Extract the TE rule set in the policy set after the newly added security policy is configured.
[0052] Exemplarily, the allow type policy set extracted by the SELinux system consists of multiple TE rules, each of which consists of five variable values: authorization type, subject domain type, object type, object category, and operation set, and each part is separated by a space, ":" or "{}".
[0053] S130, converting the node relationship in the TE rule set into a graph structure to obtain the relationship structure type between the nodes in the TE rule set;
[0054] S140: Determine, according to the relationship structure type, the relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
[0055] In some embodiments, by comparing the relationship structure type between nodes in the original TE rule set with the relationship structure type between nodes in the TE rule set, it is determined whether the type corresponding to the newly added security policy conflicts with the type corresponding to the original security policy.
[0056] Exemplarily, comparing whether the relationship structure type between the nodes in the TE rule set is the same as the relationship structure type between the nodes in the original TE rule set;
[0057] If the relationship structure types are the same, there is no conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy; if the relationship structure types are different, there is a conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
[0058] In the embodiments of the present disclosure, first, the security policy file of the program can be configured according to the AVC alarm information of the program, and then the policy set after the newly configured security policy is obtained. Secondly, the TE rule set in the policy set after the newly configured security policy can be extracted, and the node relationship in the TE rule set can be converted into a graph structure to obtain the relationship structure type between the nodes in the TE rule set. Finally, the relationship between the type corresponding to the new security policy and the type corresponding to the original security policy can be judged according to the relationship structure type. In this way, when adding a new security policy, the user can judge whether the type corresponding to the new security policy conflicts with the type corresponding to the original security policy, thereby helping the user to configure the security policy file of the program conveniently and efficiently, reduce configuration costs, and improve the security of developed software.
[0059] In some embodiments, for ease of management, the type conflict detection method 100 may further include:
[0060] Get the policy set;
[0061] The original TE rule set in the policy set is extracted, the node relationship in the original TE rule set is converted into a graph structure, and the relationship structure type between the nodes in the original TE rule set is obtained.
[0062] The following is a detailed description of the type conflict detection method 100 provided in the embodiment of the present disclosure in conjunction with a specific embodiment, as shown below:
[0063] Step 1: Get the policy set from the SELinux system and perform data cleaning on the obtained policy set, including: cleaning up data that is not related to this algorithm, mainly deleting data with missing values in the audit log, removing log entries in the audit log whose type (type) is not equal to the access vector cache (AVC) type (indicating that the system request is rejected by the AVC (Access Vector Cache) cache), and removing policy rules related to type transition rules (type_transition) in the policy set (the relevant ones are rules starting with type_transition, such as: type_transition user_t passwd_exec_t:process passwd_t;). (type_transition) is a type conversion statement that allows the subject or object to transfer the type in the security context to a specified type when the conditions are met.
[0064] The original TE rule set in the policy set is extracted, the node relationship in the original TE rule set is converted into a graph structure, and the relationship structure type between the nodes in the original TE rule set is obtained.
[0065] Step 2: Extract the preset keywords in the AVC alarm information; determine the subject tag and object tag corresponding to the program based on the preset keywords; search the database for the permission statement to be added corresponding to the cause type; the preset keywords may include at least one of name, scontext, tcontext, class, and perms. Search the preset data table for the adding position that matches the subject tag and object tag corresponding to the program; generate a permission configuration plan based on the permission statement to be added and the adding position.
[0066] A new security policy file is created, and a label is added to the security policy file in the file_contexts file according to the permission configuration scheme; the file_contexts file is parsed, and its node pointer type is declared; a new te file of the security policy file is created and customized operations are performed, such as defining domains and their labels, so as to obtain a policy set after the new security policy configuration is added, and the policy set after the new security policy configuration includes the new te file of the security policy file and the sum of TE rules in the original te file.
[0067] Step 3: The allow type policy set extracted by the SELinux system consists of multiple TE rules. Each TE rule consists of five variable values: authorization type, subject domain type, object type, object category, and operation set. Each part is separated by a space, ":" or "{}". By extracting the TE rule set from the policy set after the newly added security policy configuration; converting the node relationship in the TE rule set into a graph structure, the relationship structure type between the nodes in the TE rule set can be obtained;
[0068] Step 4: By comparing the relationship structure type between the nodes in the original TE rule set with the relationship structure type between the nodes in the TE rule set, it is determined whether the type corresponding to the newly added security policy conflicts with the type corresponding to the original security policy.
[0069] Exemplarily, comparing whether the relationship structure type between the nodes in the TE rule set is the same as the relationship structure type between the nodes in the original TE rule set;
[0070] If the relationship structure types are the same, there is no conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy; if the relationship structure types are different, there is a conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
[0071] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.
[0072] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.
[0073] Figure 2FIG. 4 shows a structural diagram of a type of conflict detection device provided by an embodiment of the present disclosure, such as Figure 2 As shown, the type conflict detection device 200 may include:
[0074] Configuration module 210, configured to configure the security policy file of the program according to the AVC alarm information of the program, thereby obtaining a policy set after the newly added security policy configuration;
[0075] An extraction module 220, configured to extract a TE rule set from the policy set after the newly added security policy is configured;
[0076] A conversion module 230, configured to convert the node relationship in the TE rule set into a graph structure, and obtain a relationship structure type between the nodes in the TE rule set;
[0077] The judgment module 240 is used to judge the relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy according to the relationship structure type.
[0078] In some embodiments, the method of configuring the security policy file of the program includes:
[0079] Create a new security policy file and add a tag to the security policy file in the file_contexts file;
[0080] Parse the file_contexts file and declare its node pointer type;
[0081] Create a new te file for the security policy file and perform customization operations.
[0082] In some embodiments, the determination module 240 is specifically used to:
[0083] The relationship structure type between nodes in the original TE rule set is compared with the relationship structure type between nodes in the TE rule set to determine whether the type corresponding to the newly added security policy conflicts with the type corresponding to the original security policy.
[0084] In some embodiments, the type conflict detection device 200 further includes:
[0085] An acquisition module, used to acquire a policy set;
[0086] The display module is used to extract the original TE rule set in the policy set, convert the node relationship in the original TE rule set into a graph structure, and obtain the relationship structure type between the nodes in the original TE rule set.
[0087] Understandably, Figure 2Each module / unit in the type conflict detection device 200 shown has the following functions: Figure 1 The functions of the various steps in the type conflict detection method 100 shown can achieve their corresponding technical effects, and for the sake of brevity, they will not be repeated here.
[0088] Figure 3 A block diagram of an exemplary electronic device capable of implementing an embodiment of the present disclosure is shown. The electronic device 300 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 300 may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.
[0089] like Figure 3 As shown, the electronic device 300 may include a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 may also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.
[0090] A number of components in the electronic device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0091] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as method 100. For example, in some embodiments, the method 100 may be implemented as a computer program product, including a computer program, which is tangibly contained in a computer-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 300 via the ROM 302 and / or the communication unit 309. When the computer program is loaded into the RAM 303 and executed by the computing unit 301, one or more steps of the method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the method 100 in any other appropriate manner (e.g., by means of firmware).
[0092] The various embodiments described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs, which may be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general programmable processor, which may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0093] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0094] In the context of the present disclosure, a computer-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0095] It should be noted that the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute method 100 and achieve the corresponding technical effect achieved by the embodiments of the present disclosure executing the method. For the sake of brevity, they are not repeated here.
[0096] In addition, the present disclosure also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method 100 is implemented.
[0097] To provide interaction with a user, the above-described embodiments may be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0098] The embodiments described above can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.
[0099] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.
[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.
[0101] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.
Claims
1. A type conflict detection method, comprising: Configure the security policy file of the program according to the AVC alarm information of the program, and then obtain a policy set after the newly added security policy configuration; Extracting the TE rule set in the policy set after the newly added security policy is configured; Convert the node relationship in the TE rule set into a graph structure to obtain the relationship structure type between the nodes in the TE rule set; The relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy is determined according to the relationship structure type.
2. The method according to claim 1, characterized in that Before configuring the security policy file of the program according to the AVC alarm information of the program, and then obtaining the policy set after the newly added security policy configuration, the method also includes: Get the policy set; The original TE rule set in the policy set is extracted, the node relationship in the original TE rule set is converted into a graph structure, and the relationship structure type between the nodes in the original TE rule set is obtained.
3. The method according to claim 1, characterized in that The method for configuring the security policy file of the program includes: Create a new security policy file and add a tag to the security policy file in the file_contexts file; Parse the file_contexts file and declare its node pointer type; Create a new te file for the security policy file and perform custom operations; 4. The method according to claim 2, characterized in that: The determining, according to the relationship structure type, of the relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy includes: The relationship structure type between nodes in the original TE rule set is compared with the relationship structure type between nodes in the TE rule set to determine whether the type corresponding to the newly added security policy conflicts with the type corresponding to the original security policy.
5. The method according to claim 4, characterized in that The comparing the relationship structure type between nodes in the original TE rule set with the relationship structure type between nodes in the TE rule set includes: Compare whether the relationship structure type between nodes in the TE rule set is the same as the relationship structure type between nodes in the original TE rule set; If the relationship structure types are the same, there is no conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
6. The method according to claim 5, characterized in that The method further comprises: If the relationship structure types are different, there is a conflict between the type corresponding to the newly added security policy and the type corresponding to the original security policy.
7. A type conflict detection device, comprising: A configuration module, used to configure the security policy file of the program according to the AVC alarm information of the program, and then obtain a policy set after the newly added security policy configuration; An extraction module, used to extract a TE rule set from a policy set after the newly added security policy is configured; A conversion module, used to convert the node relationship in the TE rule set into a graph structure, and obtain the relationship structure type between the nodes in the TE rule set; The judgment module is used to judge the relationship between the type corresponding to the newly added security policy and the type corresponding to the original security policy according to the relationship structure type.
8. The device according to claim 7, characterized in that Also includes: An acquisition module, used to acquire a policy set; The display module is used to extract the original TE rule set in the policy set, convert the node relationship in the original TE rule set into a graph structure, and obtain the relationship structure type between the nodes in the original TE rule set.
9. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 6.
10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 6.