File anti-deletion method and device for linux file system

Abstract

The invention discloses a method and a device for preventing files of a linux file system from being deleted, and relates to the technical field of cloud computing. Comprising the steps that 1, based on a linux operating system, an anti-deletion configuration file is created, the configuration file is loaded into an operating system kernel, configuration information is recorded through the configuration file, each item configuration information comprises a matching rule, each matching rule comprises a file path or a regular expression, a protection strategy and priority information of the rule, and the file path or the regular expression is matched with the protection strategy; checking grammar and validity of the matching rules and whether path and priority conflicts exist among the matching rules, and adding the matching rules checked to be correct into a rule set; 2, monitoring and intercepting any request for trying to delete the file, analyzing the path of the file requested to be deleted, reading the rule set, matching the path of the file requested to be deleted with the path of the file in the matching rule according to the priority from high to low, if the matching succeeds, executing the protection strategy, otherwise, allowing the operating system to continue to execute the original deletion operation, and otherwise, executing the original deletion operation. And 3, displaying a deletion request for notifying the user of needing protection intervention, sending out warning information, and recording the behavior of trying to delete the protected file each time.

Description

Technical Field

[0001] The invention discloses a method and a device for preventing deletion of files in a Linux file system, and relates to the technical field of cloud computing. Background Art

[0002] With the development of cloud computing, big data and AI technologies, the value and importance of data are constantly increasing, and the demand for data protection technology is also growing. In particular, shared and distributed file systems in cloud environments have put forward higher requirements for fine-grained access control and intelligent protection mechanisms.

[0003] In both corporate and personal use scenarios, it is not uncommon for users to accidentally delete files. This may be caused by operational errors, software bugs, malicious programs, or unfamiliarity with commands. Once important files are lost, it may lead to service interruptions, data inconsistencies, or even paralysis of the entire system.

[0004] Currently, simply using permission management to control file access cannot fundamentally prevent file data from being accidentally deleted. Even the root user may accidentally delete data. Other methods such as backup and recovery, and the recycle bin mechanism are all remedial measures after accidental deletion. They cannot immediately prevent ongoing erroneous deletion operations and will still cause a brief business system interruption or data loss. Summary of the invention

[0005] The present invention aims at solving the problems in the prior art and provides a method and device for preventing files from being deleted in a Linux file system. The specific solution proposed by the present invention is:

[0006] The present invention provides a method for preventing files from being deleted in a Linux file system, comprising:

[0007] Step 1: Based on the Linux operating system, create an anti-deletion configuration file and load the configuration file into the operating system kernel. Record the configuration information through the configuration file. Each entry of configuration information includes a matching rule. Each matching rule contains a file path or regular expression, a protection strategy, and the priority information of this rule.

[0008] Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules.

[0009] Add the matching rules that have been checked to the rule set;

[0010] Step 2: Listen and intercept any request to delete a file, parse the path of the file requested to be deleted, read the rule set, and match the file path requested to be deleted with the file path in the matching rule from high to low priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue to execute the original deletion operation.

[0011] Step 3: Display a deletion request that notifies the user of protection intervention and issues a warning message, while also logging every attempt to delete a protected file.

[0012] Furthermore, in step 1 of the method for preventing file deletion in a Linux file system, checking the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules, includes:

[0013] Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input.

[0014] Check path and priority conflicts: Check whether there are conflicts between matching rules, including checking whether the regular expressions of matching rules cover the same or overlapping file paths, causing confusion in rule execution; and check which rule takes priority in case of conflict;

[0015] Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception judgment.

[0016] Furthermore, in step 2 of the method for preventing file deletion in a Linux file system, if the match is successful, the protection strategy is executed, including:

[0017] If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to prevent deletion, an error code or signal is directly returned to the requester to prevent the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

[0018] Furthermore, in step 3 of the method for preventing file deletion in a Linux file system, a deletion request requiring protection intervention is displayed to notify the user, and a warning message is issued, including: displaying a striking message, sending a system notification, and writing a log file for regular review, wherein the warning message includes the specific content of the request for tracking and auditing, and the specific content of the request includes command line parameters, user ID, and timestamp;

[0019] In step 3, each attempt to delete the protected file is recorded, including: recording using a log, and the recorded content includes the operation time, the operation user, the target file path, and the source of the deletion request.

[0020] The present invention also provides a device for preventing files from being deleted in a Linux file system, comprising a configuration module, an interception module and a display module.

[0021] The configuration module creates an anti-deletion configuration file based on the Linux operating system, and loads the configuration file into the operating system kernel. The configuration information is recorded through the configuration file. Each item of configuration information includes a matching rule. Each matching rule contains a file path or regular expression, a protection strategy, and the priority information of this rule.

[0022] Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules.

[0023] Add the matching rules that have been checked to the rule set;

[0024] The interception module listens to and intercepts any request to delete a file, parses the path of the file requested to be deleted, reads the rule set, and matches the file path requested to be deleted with the file path in the matching rule from high to low priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue to execute the original deletion operation.

[0025] The display module displays deletion requests that require protection intervention to inform the user and issues a warning message, while also recording each attempt to delete a protected file.

[0026] Furthermore, the configuration module of the device for preventing file deletion in a Linux file system checks the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules, including:

[0027] Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input.

[0028] Check path and priority conflicts: Check whether there are conflicts between matching rules, including checking whether the regular expressions of matching rules cover the same or overlapping file paths, causing confusion in rule execution; and check which rule takes priority in case of conflict;

[0029] Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception judgment.

[0030] Furthermore, if the interception module of the device for preventing file deletion in a Linux file system successfully matches, the protection strategy is executed, including:

[0031] If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to prevent deletion, an error code or signal is directly returned to the requester to prevent the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

[0032] Furthermore, the display module of the device for preventing file deletion in a Linux file system displays and notifies a user of a deletion request that requires protection intervention and issues a warning message, including: displaying a striking message, sending a system notification, and writing a log file for regular review, wherein the warning message includes the specific content of the request for tracking and auditing, and the specific content of the request includes command line parameters, user ID, and timestamp;

[0033] The display module records each attempt to delete a protected file, including: using logs to record the operation time, operation user, target file path, and the source of the deletion request.

[0034] The benefits of the method of the present invention are:

[0035] (1) Hot loading and non-interruption service: The core of this method is to run in the form of a kernel module, which means that the anti-deletion function can be enabled or disabled at any time without restarting the system or interrupting ongoing services. This minimizes the impact of deploying security measures on business continuity and ensures the continuous operation of the business system.

[0036] (2) Configuration flexibility: The Configurator component allows administrators to set anti-deletion policies for specific directories or files, which means that protection is not one-size-fits-all, but can be flexibly configured according to actual needs. This includes deciding which files or directories need to be protected and defining under what conditions (such as warning only, complete blocking, etc.) the protection mechanism is triggered.

[0037] (3) Dynamic interception and response: The interceptor component is the key executor in the entire system, responsible for monitoring and intercepting system calls to delete files. Once an attempt to delete a protected file is detected, it can immediately take action based on the configured rules, such as blocking the operation and logging it, or simply issuing a warning to the user but allowing the operation to continue.

[0038] (4) Transparent monitoring and feedback: Recording related abnormal behaviors provides a basis for system management and auditing. This not only enhances users’ awareness of file protection measures, but also facilitates subsequent analysis and review, thus improving the transparency of security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 It is a schematic diagram of the interaction of system modules of the present invention.

[0041] Figure 2 It is a flow chart of configuration processing of the method of the present invention.

[0042] Figure 3 It is a flowchart of interception processing of the method of the present invention. DETAILED DESCRIPTION

[0043] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it, but the embodiments are not intended to limit the present invention.

[0044] Example 1

[0045] The present invention provides a method for preventing files from being deleted in a Linux file system, comprising:

[0046] Step 1: Based on the Linux operating system, create an anti-deletion configuration file / proc / file_protection_list, which can set anti-deletion protection for specific directories or files in the system in advance, allowing users to define which files or directories cannot be deleted, and set detailed anti-deletion rules, such as whether to completely prohibit deletion operations, or only give warnings and log before deletion. This preset mechanism provides a proactive strategy for file protection.

[0047] The configuration file / proc / file_protection_list is loaded into the operating system kernel, the / proc / file_protection_list file is initialized, and the permission of the / proc / file_protection_list file is ensured to allow only the root or a user with specific permission to perform read and write operations.

[0048] After loading is complete, the subsequent real-time writing of the configuration file will take effect. The specific processing flow is as follows:

[0049] (1) Record configuration information through configuration files. Each entry of configuration information includes a matching rule. Each matching rule contains the file path or regular expression, protection policy, and the priority information of this rule. Administrators can also write new or updated configuration information to / proc / file_protection_list through command line tools or scripts.

[0050] (2) Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules. Automatically check whether each rule written complies with the path format or regular expression specifications to exclude invalid or malformed input.

[0051] Check whether there are conflicts between matching rules, including checking whether the regular expressions of matching rules cover the same or overlapping file paths, causing confusion in rule execution; and check which rule is executed first in the case of conflicts. In particular, check whether the newly added rules conflict with the existing rules.

[0052] Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception judgment.

[0053] (3) Add the matching rules that have been checked to the rule set. And ensure that any update operation on / proc / file_protection_list can be reflected in the rule set in real time.

[0054] Step 2: Monitor and intercept any requests to delete files, and perform interception operations, which may include:

[0055] (1) Parse the path and operation type of the file requested to be deleted, mainly involving files or directories. When the system is started or the module is loaded, a specific hook registered for the file system can be called, and the deletion operation entry of the VFS (Virtual File System) layer, such as the unlink and rmdir system calls. When the user or program calls the relevant system later, they are first intercepted.

[0056] (2) Read the contents of the / proc / file_protection_list file saved in the cache, obtain the currently configured rule set for protected files / directories, and match the file path requested to be deleted with the file path in the matching rule in descending order of priority. If the match is successful, execute the protection policy; otherwise, allow the operating system to continue to execute the original deletion operation.

[0057] If the match is successful, the protection strategy is executed, including:

[0058] If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to prevent deletion, an error code or signal is directly returned to the requester to prevent the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

[0059] In addition, during the processing, performance monitoring can be performed to ensure that the impact on system performance is minimized and system delays caused by frequent rule matching are avoided. Interception is performed without affecting the normal operation of the system, achieving real-time monitoring and flexible control of file deletion operations, effectively preventing the accidental deletion of important files, and improving the data security level of the system.

[0060] Step 3: Display a deletion request that notifies the user of protection intervention and issues a warning message, while also logging every attempt to delete a protected file.

[0061] It displays and notifies the user of the deletion request that requires protection intervention and issues a warning message, including: displaying a striking message, sending a system notification, and writing to a log file for regular review. The warning message contains the specific content of the request for tracking and auditing. The specific content of the request includes command line parameters, user ID, and timestamp;

[0062] Record every attempt to delete protected files, including: using logs to record the operation time, operation user, target file path, source of the deletion request such as command line and application, interception results, etc.

[0063] The displayed behaviors, such as the format of warning information and the level of detail of records, are also configurable to meet the needs of different environments. The displayed behavior strategy can be adjusted through configuration, including but not limited to detailed logging and instant email alert mechanisms. Recording related abnormal behaviors provides a basis for system management and auditing, which not only enhances users' awareness of file protection measures, but also facilitates later analysis and review, and improves the transparency of security management.

[0064] Example 2

[0065] The present invention also provides a device for preventing files from being deleted in a Linux file system, comprising a configuration module, an interception module and a display module.

[0066] The configuration module creates an anti-deletion configuration file based on the Linux operating system, and loads the configuration file into the operating system kernel. The configuration information is recorded through the configuration file. Each item of configuration information includes a matching rule. Each matching rule contains a file path or regular expression, a protection strategy, and the priority information of this rule.

[0067] Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules.

[0068] Add the matching rules that have been checked to the rule set;

[0069] The interception module listens to and intercepts any request to delete a file, parses the path of the file requested to be deleted, reads the rule set, and matches the file path requested to be deleted with the file path in the matching rule from high to low priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue to execute the original deletion operation.

[0070] The display module displays deletion requests that require protection intervention to inform the user and issues a warning message, while also recording each attempt to delete a protected file.

[0071] As the information interaction and execution process between the modules of the above-mentioned device are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0072] Likewise, the benefits of the device of the present invention are:

[0073] (1) Hot loading and non-interruption service: The core of this method is to run in the form of a kernel module, which means that the anti-deletion function can be enabled or disabled at any time without restarting the system or interrupting ongoing services. This minimizes the impact of deploying security measures on business continuity and ensures the continuous operation of the business system.

[0074] (2) Configuration flexibility: The Configurator component allows administrators to set anti-deletion policies for specific directories or files, which means that protection is not one-size-fits-all, but can be flexibly configured according to actual needs. This includes deciding which files or directories need to be protected and defining under what conditions (such as warning only, complete blocking, etc.) the protection mechanism is triggered.

[0075] (3) Dynamic interception and response: The interceptor component is the key executor in the entire system, responsible for monitoring and intercepting system calls to delete files. Once an attempt to delete a protected file is detected, it can immediately take action based on the configured rules, such as blocking the operation and logging it, or simply issuing a warning to the user but allowing the operation to continue.

[0076] (4) Transparent monitoring and feedback: Recording related abnormal behaviors provides a basis for system management and auditing. This not only enhances users’ awareness of file protection measures, but also facilitates subsequent analysis and review, thus improving the transparency of security management.

[0077] It should be noted that not all steps and modules in the above-mentioned processes and device structures are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

[0078] The above-described embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Equivalent substitutions or changes made by those skilled in the art based on the present invention are within the protection scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A method for preventing files from being deleted in a Linux file system, characterized in that include: Step 1: Based on the Linux operating system, create an anti-deletion configuration file and load the configuration file into the operating system kernel. Record the configuration information through the configuration file. Each entry of configuration information includes a matching rule. Each matching rule contains a file path or regular expression, a protection strategy, and the priority information of this rule. Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules. Add the matching rules that have been checked to the rule set; Step 2: Listen and intercept any request to delete a file, parse the path of the file requested to be deleted, read the rule set, and match the file path requested to be deleted with the file path in the matching rule from high to low priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue to execute the original deletion operation. Step 3: Display a deletion request that notifies the user of protection intervention and issues a warning message, while also logging every attempt to delete a protected file.

2. A method for preventing files from being deleted in a Linux file system according to claim 1, characterized in that In step 1, check the syntax and validity of the matching rules, and whether there are any path and priority conflicts between the matching rules, including: Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input. Check path and priority conflicts: Check whether there are conflicts between matching rules, including checking whether the regular expressions of matching rules cover the same or overlapping file paths, causing confusion in rule execution; and check which rule takes priority in case of conflict; Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception judgment.

3. A method for preventing files from being deleted in a Linux file system according to claim 1, characterized in that If the match succeeds in step 2, the protection strategy is executed, including: If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to prevent deletion, an error code or signal is directly returned to the requester to prevent the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

4. A method for preventing files from being deleted in a Linux file system according to claim 1, characterized in that Step 3 shows notifying the user of the deletion request that requires protection intervention and issuing a warning message, including: displaying a striking message, sending a system notification, and writing to a log file for regular review. The warning message contains the specific content of the request for tracking and auditing. The specific content of the request includes command line parameters, user ID, and timestamp; In step 3, each attempt to delete the protected file is recorded, including: recording using a log, and the recorded content includes the operation time, the operation user, the target file path, and the source of the deletion request.

5. A device for preventing files from being deleted in a Linux file system, characterized in that Including configuration module, interception module and display module, The configuration module creates an anti-deletion configuration file based on the Linux operating system, and loads the configuration file into the operating system kernel. The configuration information is recorded through the configuration file. Each item of configuration information includes a matching rule. Each matching rule contains a file path or regular expression, a protection strategy, and the priority information of this rule. Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules. Add the matching rules that have been checked to the rule set; The interception module listens to and intercepts any request to delete a file, parses the path of the file requested to be deleted, reads the rule set, and matches the file path requested to be deleted with the file path in the matching rule from high to low priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue to execute the original deletion operation. The display module displays deletion requests that require protection intervention to inform the user and issues a warning message, while also recording each attempt to delete a protected file.

6. The device for preventing files from being deleted in a Linux file system according to claim 5, characterized in that The configuration module checks the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules, including: Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input. Check path and priority conflicts: Check whether there are conflicts between matching rules, including checking whether the regular expressions of matching rules cover the same or overlapping file paths, causing confusion in rule execution; and check which rule takes priority in case of conflict; Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception judgment.

7. The device for preventing files from being deleted in a Linux file system according to claim 5, characterized in that If the interception module matches successfully, it will execute the protection strategy, including: If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to prevent deletion, an error code or signal is directly returned to the requester to prevent the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

8. The device for preventing files from being deleted in a Linux file system according to claim 5, characterized in that The display module displays and notifies the user of the deletion request that requires protection intervention and issues a warning message, including: displaying a striking message, sending a system notification, and writing a log file for regular review. The warning message contains the specific content of the request for tracking and auditing. The specific content of the request includes command line parameters, user ID, and timestamp; The display module records each attempt to delete a protected file, including: using logs to record the operation time, operation user, target file path, and the source of the deletion request.

Images