A method and device for preventing file deletion in Linux file system

Abstract

The present invention discloses a method and device for preventing files from being deleted in a Linux file system, and relates to the technical field of cloud computing. The method and device comprise the following steps: step 1: creating an anti-deletion configuration file based on a Linux operating system, and loading the configuration file into an operating system kernel, recording configuration information through the configuration file, wherein each item of configuration information includes a matching rule, each matching rule includes a file path or a regular expression, a protection policy, and priority information of the rule, checking the syntax and validity of the matching rules, and whether there are conflicts in paths and priorities between the matching rules, and adding the matching rules that pass the inspection to a rule set; step 2: monitoring and intercepting any request for attempting to delete a file, parsing the path of the file requested to be deleted, reading a rule set, matching the file path requested to be deleted with the file path in the matching rule in descending order of priority, executing the protection policy if the match is successful, otherwise allowing the operating system to continue to execute the original deletion operation, and step 3: displaying and notifying a user of deletion requests that require protection intervention, issuing a warning message, and recording each attempt to delete a protected file.

Description

Technical Field

[0001] The invention discloses a method and device for preventing file deletion in a Linux file system, and relates to the technical field of cloud computing. Background Art

[0002] With the development of cloud computing, big data, and AI technologies, the value and importance of data continues to increase, and the demand for data protection technologies is also growing. In particular, shared and distributed file systems in cloud environments place higher demands on fine-grained access control and intelligent protection mechanisms.

[0003] In both corporate and personal environments, it's common for users to accidentally delete files. This can be caused by operational errors, software bugs, malware, or unfamiliarity with commands. Losing important files can lead to service interruptions, data inconsistencies, or even complete system failure.

[0004] Currently, simply using permission management for file access control cannot fundamentally prevent accidental deletion of file data. Even the root user can accidentally delete data. Other methods, such as backup and recovery, and the Recycle Bin mechanism, are only remedial measures after accidental deletion. They cannot immediately prevent ongoing erroneous deletions and can still cause brief business system interruptions or data loss. Summary of the Invention

[0005] In view of the problems in the prior art, the present invention provides a method and device for preventing file deletion in a Linux file system. The specific solution proposed by the present invention is:

[0006] The present invention provides a method for preventing files from being deleted in a Linux file system, comprising:

[0007] Step 1: Based on the Linux operating system, create an anti-deletion configuration file and load the configuration file into the operating system kernel. The configuration information is recorded in the configuration file. Each entry of the configuration information includes a matching rule. Each matching rule contains the file path or regular expression, the protection policy, and the priority information of the rule.

[0008] Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between matching rules.

[0009] Add the correct matching rules to the rule set;

[0010] Step 2: Listen and intercept any request to delete a file, parse the path of the file requested for deletion, read the rule set, and match the file path requested for deletion with the file path in the matching rule in descending order of priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue the original deletion operation.

[0011] Step 3: Display a deletion request that notifies the user that protection intervention is required, issue a warning message, and log each attempt to delete a protected file.

[0012] Furthermore, step 1 of the Linux file system file deletion prevention method includes checking the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules, including:

[0013] Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input.

[0014] Check path and priority conflicts: Check whether there are conflicts between matching rules. In particular, check whether the regular expressions of the matching rules cover the same or overlapping file paths, causing confusion in rule execution. And check which rule takes precedence in the case of conflict.

[0015] Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception and judgment.

[0016] Furthermore, in step 2 of the Linux file system file deletion prevention method, if the match is successful, the protection policy is executed, including:

[0017] If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to block deletion, an error code or signal is directly returned to the requester to block the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

[0018] Furthermore, in step 3 of the Linux file system file deletion prevention method, notifying the user of a deletion request requiring protection intervention and issuing a warning message includes: displaying a prominent message, sending a system notification, and writing to a log file for regular review, wherein the warning message includes the specific content of the request for tracking and auditing, and the specific content of the request includes command line parameters, user ID, and timestamp;

[0019] In step 3, each attempt to delete the protected file is recorded, including: recording in a log, the record content includes the operation time, the operating user, the target file path, and the source of the deletion request.

[0020] The present invention also provides a device for preventing files from being deleted in a Linux file system, comprising a configuration module, an interception module and a display module.

[0021] The configuration module is based on the Linux operating system, creates an anti-deletion configuration file, and loads the configuration file into the operating system kernel. The configuration information is recorded in the configuration file. Each entry of the configuration information includes a matching rule. Each matching rule contains the file path or regular expression, the protection policy, and the priority information of the rule.

[0022] Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between matching rules.

[0023] Add the correct matching rules to the rule set;

[0024] The interception module listens to and intercepts any request to delete a file, parses the path of the file requested to be deleted, reads the rule set, and matches the file path requested to be deleted with the file path in the matching rule in descending order of priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue the original deletion operation.

[0025] The display module displays deletion requests that require protection intervention to inform the user and issues a warning message, while also recording each attempt to delete a protected file.

[0026] Furthermore, the configuration module of the device for preventing file deletion in a Linux file system checks the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules, including:

[0027] Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input.

[0028] Check path and priority conflicts: Check whether there are conflicts between matching rules. In particular, check whether the regular expressions of the matching rules cover the same or overlapping file paths, causing confusion in rule execution. And check which rule takes precedence in the case of conflict.

[0029] Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception and judgment.

[0030] Furthermore, the interception module of the device for preventing file deletion in a Linux file system executes a protection strategy if the match is successful, including:

[0031] If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to block deletion, an error code or signal is directly returned to the requester to block the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

[0032] Furthermore, the display module of the device for preventing file deletion in a Linux file system displays and notifies a user of a deletion request requiring protection intervention and issues a warning message, including: displaying a prominent message, sending a system notification, and writing to a log file for regular review, wherein the warning message includes the specific content of the request for tracking and auditing, and the specific content of the request includes command line parameters, user ID, and timestamp;

[0033] The display module records each attempt to delete a protected file, including: using logs to record the operation time, operating user, target file path, and the source of the deletion request.

[0034] The benefits of the method of the present invention are:

[0035] (1) Hot loading and non-interruption service: The core of this method is to run in the form of a kernel module, which means that the anti-deletion function can be enabled or disabled at any time without restarting the system or interrupting the ongoing service, minimizing the impact of deploying security measures on business continuity and ensuring the continuous operation of the business system.

[0036] (2) Configuration flexibility: The Configurator component allows administrators to set anti-deletion policies for specific directories or files, which means that protection is not a one-size-fits-all approach but can be flexibly configured based on actual needs. This includes deciding which files or directories need protection and defining the conditions under which the protection mechanism is triggered (such as warning only, complete blocking, etc.).

[0037] (3) Dynamic Interception and Response: The interceptor component is the key executor in the entire system, responsible for monitoring and intercepting system calls for file deletion. Once an attempt to delete a protected file is detected, it can immediately take action based on the configured rules, such as blocking the operation and logging it, or simply issuing a warning to the user but allowing the operation to continue.

[0038] (4) Transparent monitoring and feedback: Recording abnormal behaviors provides a basis for system management and auditing. This not only enhances users’ awareness of file protection measures, but also facilitates subsequent analysis and review, thus improving the transparency of security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 It is a schematic diagram of the interaction of system modules of the present invention.

[0041] Figure 2 It is a configuration processing flow chart of the method of the present invention.

[0042] Figure 3 It is a flowchart of the interception processing method of the present invention. DETAILED DESCRIPTION

[0043] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention.

[0044] Example 1

[0045] The present invention provides a method for preventing files from being deleted in a Linux file system, comprising:

[0046] Step 1: Create an anti-deletion configuration file, / proc / file_protection_list, based on the Linux operating system. This allows you to set up anti-deletion protection for specific directories or files in the system. This allows you to define which files or directories cannot be deleted and set detailed anti-deletion rules, such as whether to completely prohibit deletion or simply issue a warning and log before deletion. This pre-set mechanism provides a proactive strategy for file protection.

[0047] The configuration file / proc / file_protection_list is loaded into the operating system kernel, the / proc / file_protection_list file is initialized, and the permissions of the / proc / file_protection_list file are ensured to allow only the root or users with specific permissions to perform read and write operations.

[0048] After loading is complete, the subsequent real-time writing of the configuration file will take effect. The specific processing flow is as follows:

[0049] (1) Configuration information is recorded in a configuration file. Each entry includes a matching rule. Each matching rule contains a file path or regular expression, a protection policy, and the priority of the rule. Administrators can also write new or updated configuration information to / proc / file_protection_list using command line tools or scripts.

[0050] (2) Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between the matching rules. Automatically check whether each rule written complies with the path format or regular expression specifications, and exclude invalid or malformed input.

[0051] Check for conflicts between matching rules. This includes checking whether the regular expressions in the matching rules cover the same or overlapping file paths, which could cause confusion in rule execution. Furthermore, the system checks which rule takes precedence in the event of a conflict. In particular, it checks whether newly added rules conflict with existing rules.

[0052] Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception and judgment.

[0053] (3) Add the correct matching rules to the rule set. Ensure that any update operation on / proc / file_protection_list is reflected in the rule set in real time.

[0054] Step 2: Monitor and intercept any attempts to delete files. Interception operations may include:

[0055] (1) Parse the file path and operation type requested for deletion, primarily involving files or directories. During system startup or module loading, specific hooks registered for the file system can be called, including the deletion entry point at the VFS (Virtual File System) layer, such as the unlink and rmdir system calls. Subsequent calls by users or programs to the relevant system are first intercepted.

[0056] (2) Read the contents of the / proc / file_protection_list file saved in the cache, obtain the currently configured rule set for protected files / directories, and match the file path requested for deletion with the file path in the matching rule in descending order of priority. If the match is successful, the protection policy is executed; otherwise, the operating system is allowed to continue executing the original deletion operation.

[0057] If the match is successful, the protection strategy is executed, including:

[0058] If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to block deletion, an error code or signal is directly returned to the requester to block the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

[0059] Furthermore, performance monitoring can be performed during the processing process to minimize the impact on system performance and avoid system delays caused by frequent rule matching. Interception can be performed without affecting the normal operation of the system, enabling real-time monitoring and flexible control of file deletion operations, effectively preventing the accidental deletion of important files and improving the system's data security.

[0060] Step 3: Display a deletion request that notifies the user that protection intervention is required, issue a warning message, and log each attempt to delete a protected file.

[0061] It displays and notifies users of deletion requests that require protection intervention and issues a warning message, including: displaying a prominent message, sending a system notification, and writing to a log file for regular review. The warning message includes the specific content of the request for tracking and auditing purposes, including command line parameters, user ID, and timestamp;

[0062] Record every attempt to delete protected files, including: using logs to record the operation time, operating user, target file path, the source of the deletion request (such as command line and application), interception results, etc.

[0063] Displayed behaviors, such as the format of warning messages and the level of detail, are configurable to suit different environments. Configuration allows for adjustment of display behavior policies, including but not limited to detailed logging and immediate email alerts. Recording abnormal behavior provides a basis for system management and auditing, enhancing user awareness of file protection measures, facilitating subsequent analysis and review, and improving transparency in security management.

[0064] Example 2

[0065] The present invention also provides a device for preventing files from being deleted in a Linux file system, comprising a configuration module, an interception module and a display module.

[0066] The configuration module is based on the Linux operating system, creates an anti-deletion configuration file, and loads the configuration file into the operating system kernel. The configuration information is recorded in the configuration file. Each entry of the configuration information includes a matching rule. Each matching rule contains the file path or regular expression, the protection policy, and the priority information of the rule.

[0067] Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between matching rules.

[0068] Add the correct matching rules to the rule set;

[0069] The interception module listens to and intercepts any request to delete a file, parses the path of the file requested to be deleted, reads the rule set, and matches the file path requested to be deleted with the file path in the matching rule in descending order of priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue the original deletion operation.

[0070] The display module displays deletion requests that require protection intervention to inform the user and issues a warning message, while also recording each attempt to delete a protected file.

[0071] Since the information interaction, execution process and other contents between the modules of the above-mentioned device are based on the same concept as the embodiment of the method of the present invention, the specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0072] Likewise, the device of the present invention is beneficial in that:

[0073] (1) Hot loading and non-interruption service: The core of this method is to run in the form of a kernel module, which means that the anti-deletion function can be enabled or disabled at any time without restarting the system or interrupting the ongoing service, minimizing the impact of deploying security measures on business continuity and ensuring the continuous operation of the business system.

[0074] (2) Configuration flexibility: The Configurator component allows administrators to set anti-deletion policies for specific directories or files, which means that protection is not a one-size-fits-all approach but can be flexibly configured based on actual needs. This includes deciding which files or directories need protection and defining the conditions under which the protection mechanism is triggered (such as warning only, complete blocking, etc.).

[0075] (3) Dynamic Interception and Response: The interceptor component is the key executor in the entire system, responsible for monitoring and intercepting system calls for file deletion. Once an attempt to delete a protected file is detected, it can immediately take action based on the configured rules, such as blocking the operation and logging it, or simply issuing a warning to the user but allowing the operation to continue.

[0076] (4) Transparent monitoring and feedback: Recording abnormal behaviors provides a basis for system management and auditing. This not only enhances users’ awareness of file protection measures, but also facilitates subsequent analysis and review, thus improving the transparency of security management.

[0077] It should be noted that not all steps and modules in the above-mentioned processes and device structures are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.

[0078] The above embodiments are merely preferred embodiments for the purpose of fully illustrating the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are within the scope of protection of the present invention. The scope of protection of the present invention shall be subject to the claims.

Claims

1. A method for preventing files from being deleted in a Linux file system, characterized by: include: Step 1: Based on the Linux operating system, create an anti-deletion configuration file and load the configuration file into the operating system kernel. The configuration information is recorded in the configuration file. Each entry of the configuration information includes a matching rule. Each matching rule contains the file path or regular expression, the protection policy, and the priority information of the rule. Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between matching rules. Add the correct matching rules to the rule set; Step 2: Listen and intercept any request to delete a file, parse the path of the file requested for deletion, read the rule set, and match the file path requested for deletion with the file path in the matching rule in descending order of priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue the original deletion operation. Step 3: Display a deletion request that notifies the user that protection intervention is required, issue a warning message, and log each attempt to delete a protected file.

2. A method for preventing file deletion in a Linux file system according to claim 1, characterized in that In step 1, check the syntax and validity of the matching rules, and whether there are any path and priority conflicts between the matching rules, including: Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input. Check path and priority conflicts: Check whether there are conflicts between matching rules. In particular, check whether the regular expressions of the matching rules cover the same or overlapping file paths, causing confusion in rule execution. And check which rule takes precedence in the case of conflict. Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception and judgment.

3. A method for preventing files from being deleted in a Linux file system according to claim 1, characterized in that If the match succeeds in step 2, the protection strategy is executed, including: If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to block deletion, an error code or signal is directly returned to the requester to block the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

4. A method for preventing file deletion in a Linux file system according to claim 1, characterized in that Step 3 notifies the user of a deletion request requiring protection intervention and issues a warning message, including: displaying a prominent message, sending a system notification, and writing to a log file for periodic review. The warning message includes the specific content of the request for tracking and auditing purposes, including command line parameters, user ID, and timestamp. In step 3, each attempt to delete the protected file is recorded, including: recording in a log, the record content includes the operation time, the operating user, the target file path, and the source of the deletion request.

5. A device for preventing files from being deleted in a Linux file system, characterized in that Including configuration module, interception module and display module, The configuration module is based on the Linux operating system, creates an anti-deletion configuration file, and loads the configuration file into the operating system kernel. The configuration information is recorded in the configuration file. Each entry of the configuration information includes a matching rule. Each matching rule contains the file path or regular expression, the protection policy, and the priority information of the rule. Check the syntax and validity of the matching rules, and whether there are path and priority conflicts between matching rules. Add the correct matching rules to the rule set; The interception module listens to and intercepts any request to delete a file, parses the path of the file requested to be deleted, reads the rule set, and matches the file path requested to be deleted with the file path in the matching rule in descending order of priority. If the match is successful, the protection policy is executed, otherwise the operating system is allowed to continue the original deletion operation. The display module displays deletion requests that require protection intervention to inform the user and issues a warning message, while also recording each attempt to delete a protected file.

6. The device for preventing file deletion in a Linux file system according to claim 5, wherein: The configuration module checks the syntax and validity of matching rules, as well as whether there are path and priority conflicts between matching rules, including: Check the syntax and validity of matching rules: Automatically check whether each entry matching rule conforms to the path format or regular expression specification, and exclude invalid or malformed input. Check path and priority conflicts: Check whether there are conflicts between matching rules. In particular, check whether the regular expressions of the matching rules cover the same or overlapping file paths, causing confusion in rule execution. And check which rule takes precedence in the case of conflict. Real-time update of matching rules: Verified matching rules take effect immediately, and the rule set is updated for subsequent file deletion request interception and judgment.

7. The device for preventing files from being deleted in a Linux file system according to claim 5, wherein: If the interception module successfully matches, it will execute the protection strategy, including: If the match is successful, the next operation is determined according to the protection policy. If the protection policy is set to block deletion, an error code or signal is directly returned to the requester to block the deletion operation. If the protection policy is set to warn, a prompt message is popped up to the user, asking whether to continue the deletion operation and waiting for user confirmation.

8. The device for preventing files from being deleted in a Linux file system according to claim 5, wherein: The display module displays and notifies users of deletion requests that require protection intervention and issues warning information, including: displaying a prominent message, sending a system notification, and writing to a log file for regular review. The warning information contains the specific content of the request for tracking and auditing purposes. The specific content of the request includes command line parameters, user ID, and timestamp. The display module records each attempt to delete a protected file, including: using logs to record the operation time, operating user, target file path, and the source of the deletion request.

Images