Process authority management method and device, electronic equipment and readable storage medium

Abstract

The embodiment of the invention provides a process permission management method and device, electronic equipment and a readable storage medium, and relates to the technical field of containers. According to the specific implementation scheme, in the process of creating a container sub-process in a first container, a security label of a target container process is determined as the security label of the container sub-process, the target container process is used for starting the first container, and security enhanced Li < nux > is forbidden in the first container; and performing authority management on the container sub-process based on the security label of the container sub-process. Based on the scheme, authority management can be carried out by taking a single process as granularity, and refined authority management on the process is realized.

Description

Technical Field

[0001] The present application relates to the field of container technology. Specifically, the present application relates to a process permission management method, device, electronic device and readable storage medium. Background Art

[0002] Containers are a type of sandbox technology that runs applications in them and isolates them from the outside world, making it easier for the sandbox to be transferred to other host machines. Containers can simplify the process of building, deploying, and running applications.

[0003] Security-Enhanced Linux (SELinux) is a security subsystem of Linux that aims to enhance the security of traditional Linux operating systems. SELinux restricts the access of processes, users, and applications to system resources through the mandatory access control (MAC) mechanism, thereby reducing the risk of system attacks.

[0004] Currently, SELinux's permission management of processes is not very precise. How to effectively implement refined permission management of processes has become an important technical issue. Summary of the invention

[0005] The present application provides a process permission management method, device, electronic device and readable storage medium, aiming to solve at least one of the above technical defects. The technical solution adopted by the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a process permission management method, the method comprising:

[0007] In the process of creating a container child process in the first container, the security label of the target container process is determined as the security label of the container child process, the target container process is used to start the first container, and Security Enhanced Linux is disabled in the first container;

[0008] Based on the security label of the container subprocess, the permission of the container subprocess is managed.

[0009] In a second aspect, an embodiment of the present application provides a process permission management device, the device comprising:

[0010] A security label determination module is used to determine the security label of a target container process as the security label of the container subprocess during the process of creating a container subprocess in the first container, the target container process is used to start the first container, and Security Enhanced Linux is disabled in the first container;

[0011] The permission management module is used to manage the permissions of container subprocesses based on the security labels of container subprocesses.

[0012] In a third aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, which implements the steps of the above-mentioned process permission management method when executed by a processor.

[0013] In a fourth aspect, an embodiment of the present application provides an electronic device, the electronic device comprising:

[0014] one or more processors; and

[0015] A memory associated with the one or more processors, the memory is used to store program instructions, and when the program instructions are read and executed by the one or more processors, the steps of the process permission management method are executed.

[0016] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above-mentioned process permission management method when executed by a processor.

[0017] The beneficial effects of the technical solution provided by the embodiment of the present application are:

[0018] The solution provided by the embodiment of the present application is to disable Security Enhanced Linux in the first container started by the target container process, and in the process of creating a container subprocess in the first container, determine the security label of the target container process as the security label of the container subprocess, thereby performing permission management on the container subprocess based on the security label of the container subprocess. Based on this solution, permission management can be performed at the granularity of a single process, thereby realizing refined permission management of the process. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0020] Figure 1 A system architecture diagram applicable to the embodiments of the present application;

[0021] Figure 2 A flowchart of a process permission management method provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of the structure of the container environment provided in the embodiment of the present application;

[0023] Figure 4 A flowchart of a specific implementation method of the container permission management method in the embodiment of the present application;

[0024] Figure 5 This is a schematic diagram of the structure of the second container provided in an embodiment of the present application.

[0025] Figure 6 This is a schematic diagram of the structure of the first container provided in an embodiment of the present application.

[0026] Figure 7 A schematic diagram of the structure of a process authority management device provided in an embodiment of the present application;

[0027] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0029] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0030] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0031] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0032] First, let’s introduce and explain several terms involved in this application:

[0033] Security-Enhanced Linux (SELinux) is a security subsystem of Linux that aims to enhance the security of traditional Linux operating systems. SELinux restricts the access of processes, users, and applications to system resources through the mandatory access control (MAC) mechanism, thereby reducing the risk of system attacks.

[0034] Systemd is a system and service manager in Linux. It is responsible for initializing the system, managing system services, maintaining system status, controlling system resources, and providing a range of other features to simplify system management. Systemd can be used to generate all other processes.

[0035] Containers are a type of sandbox technology, the main purpose of which is to run applications in them and isolate them from the outside world, while facilitating the transfer of the sandbox to other host machines. In essence, a container is a special process that provides a lightweight virtualization environment, allowing applications to run in an isolated environment without interfering with each other.

[0036] Podman is an open source container runtime project available on most Linux platforms.

[0037] Basic environment: refers to the basic environment of the embedded system, on which the container environment and SELinux environment are deployed.

[0038] Parent process and child process. In Linux, there is a parent-child relationship between the parent process and the child process, that is, the child process is created by the parent process.

[0039] Shell: It is the software layer between the user and the operating system. It is responsible for processing the interaction between user commands and the operating system kernel. When the user enters a command and executes it, the shell interprets the command and passes it to the kernel, and then returns the kernel output to the user.

[0040] Currently, when SELinux manages permissions for processes, it classifies them into security categories and isolates permissions for different processes through security categories, so that processes in the same security category are given the same operating permissions. In this way, the granularity of permission management cannot be refined to each process, making the precision of process permission management poor and not meeting the minimum permission rule. Therefore, how to perform fine permission management on processes at the granularity of a single process has become an important technical issue.

[0041] In addition, as a sandbox technology, the main purpose of the container is to isolate the inside and outside of the container to form a certain security protection. SELinux manages permissions based on security labels, and the scope of management covers all files in the system, which conflicts with the security protection provided by the container itself. Therefore, the compatibility issue between the container and SELinux cannot be ignored.

[0042] In related technologies, in order to solve the compatibility problem between containers and SELinux, container management tools provide the function option of configuring security labels, such as configuring security labels in the security option (security-opt) of Podman. This method may not be able to complete the configuration of security labels in some specific scenarios, and may also have compatibility issues with older versions of SELinux.

[0043] The above-mentioned container and SELinux compatibility solutions fail to deeply combine the container and SELinux, and have a poor effect in solving the compatibility problem between the container and SELinux.

[0044] In view of this, the present application provides a new idea. In order to facilitate the understanding of the present application, the system architecture on which the present application is based is first described. Figure 1 An exemplary system architecture to which the embodiments of the present application can be applied is shown. Figure 1 As shown in , the system architecture may include: a user terminal, a network and a server.

[0045] The network is a medium used to provide a communication link between the server and the user terminal. The network can include various connection types, such as wired, wireless communication links or fiber optic cables, etc.

[0046] It is understandable that the process permission management device provided in the embodiment of the present application can be set on a host machine with a container environment, and the host machine can be set on the server side or the user terminal. When the process permission management device is on the server side, the user can initiate an operation instruction through the user terminal, and the user terminal sends the operation instruction to the server side through the network.

[0047] like Figure 1 The server side shown can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms. The user terminal can be a smart terminal such as a smartphone, tablet computer, laptop computer, desktop computer, smart TV, etc.

[0048] Figure 2A schematic diagram of a process permission management method provided by an embodiment of the present application is shown. The method can be performed by Figure 1 The process authority management device in the system shown is executed. Figure 2 As shown, the method may mainly include:

[0049] Step S210: in the process of creating a container subprocess in the first container, the security label of the target container process is determined as the security label of the container subprocess, the target container process is used to start the first container, and SELinux is disabled in the first container;

[0050] Step S220: performing permission management on the container subprocess based on the security label of the container subprocess.

[0051] The target container process is a process created in the basic environment in order to create and start the first container.

[0052] As an example, a target container process may be created in response to a container creation instruction, and after the target container process is created, the first container may be created and started by the target container process.

[0053] Security labels, also known as SELinux security identifiers (SID), are labeling mechanisms used for permission control in SELinux. Security control can be achieved by giving each process, file, or other resource a unique security label.

[0054] After the first container is started, when a container child process is created in the first container, a security label needs to be determined for the container child process in the first container. The target container process is the parent process of the container child process in the first container, and the security label of the target container process is determined as the security label of the container child process, so that the container child process in the first container can inherit the security label of the target container process, and further enables the container child process in the first container to inherit the permissions of the target container process.

[0055] In the embodiment of the present application, SELinux is disabled in the first container, so that the first container becomes a SELinux-free environment. Systemd is not deployed in the first container, and SELinux will not be started by systemd, thereby disabling SELinux.

[0056] In the related art, when a process is created, the SELinux mechanism automatically assigns a security label to the created process. In the embodiment of the present application, when a container child process is created in the first container, since SELinux has been disabled, the security label of the container child process will no longer be determined based on the SELinux mechanism, but the container child process will inherit the security label of the target container process and have the same permissions as the target container process. The label of the target container process can be defined according to the permission requirements of the service running in the first container, so that the security label of the container child process in the first container can also meet the corresponding permission requirements.

[0057] In the embodiment of the present application, the first container can be used as a service container, and the sub-process in the first container can be used as a service process to provide corresponding container services. The first container can provide a layer of container isolation for these service processes.

[0058] In the embodiment of the present application, by effectively managing the permissions of the container subprocesses in the first container, the granularity of permission management is refined to a single process, satisfying the permission minimization rule.

[0059] The method provided in the embodiment of the present application disables SELinux in the first container started by the target container process, and in the process of creating a container subprocess in the first container, determines the security label of the target container process as the security label of the container subprocess, thereby performing permission management on the container subprocess based on the security label of the container subprocess. Based on this solution, permission management can be performed at the granularity of a single process, thereby achieving refined permission management of the process.

[0060] In the embodiment of the present application, the permission management of the container subprocess in the first container has nothing to do with SELinux, which can effectively reduce the compatibility issues between the container and SELinux, and no longer need to rely on the function options for configuring security labels provided by the container management tool, such as security-opt in Podman. This solution can achieve a deep integration of containers and SELinux, and implement more effective permission management for container processes.

[0061] In an optional manner of the embodiment of the present application, before creating the first container, the method further includes:

[0062] During the creation of the target container process, a security label of the target container process is determined based on the container related information of the first container.

[0063] In the embodiment of the present application, the security label of the target container process determines the security label of the container subprocess in the first container. Therefore, the security label of the container subprocess in the first container can be defined by defining the security label of the target container process.

[0064] In order to achieve accurate matching of the security label, a security label may be determined for the target container process based on the container-related information of the first container, so that the determined security label can match the permission requirement of the container subprocess in the first container.

[0065] In an optional manner of the embodiment of the present application, determining the security label of the target container process based on the container-related information of the first container includes:

[0066] Based on a preset matching relationship between the container-related information and the object tag, matching the container-related information of the first container to obtain a matching result;

[0067] Determine the label of the object to be converted based on the matching result;

[0068] Perform domain conversion on the object label to be converted to obtain the security label of the target container process.

[0069] In the embodiment of the present application, a preset matching relationship between the container-related information and the object tag may be configured to match the container-related information with the object tag.

[0070] The preset matching relationship can be configured according to actual needs. By configuring the preset matching relationship, the permission configuration of the target container process can be achieved.

[0071] After matching the container-related information of the first container, a matching result can be obtained, and the object label to be converted can be determined based on the matching result.

[0072] In SELinux, the object label to be converted needs to be domain converted to obtain the security label of the target container process. Domain conversion refers to the process of converting from one domain to another in SELinux policy. In SELinux, domain conversion can be performed by modifying SELinux policy or using the security context conversion function in the application.

[0073] In an optional manner of the embodiment of the present application, the matching result is that there is a target object tag that matches the container-related information of the first container, and determining the object tag to be converted based on the matching result includes:

[0074] Get the default object label corresponding to the creation command of the target container process;

[0075] Change the default object label corresponding to the create command to the target object label;

[0076] The creation command is executed so that the target object tag is determined as the object tag to be converted.

[0077] In the embodiment of the present application, when the container-related information of the first container is matched successfully, it indicates that there is a target object tag that matches the container-related information of the first container.

[0078] The command to create the target container process can be taken as an example of the Podman command. By default, the Podman command will correspond to a default object label, which can be understood as the file label of the Podman command. By default, when the Podman command is executed to create a process, the default object label will be used as the object label to be converted of the target container process, and then the default object label will be domain-converted to the security label of the created container process.

[0079] In an embodiment of the present application, the default object label corresponding to the Podman command can be modified to realize the configuration of the object label to be converted. Specifically, the default object label corresponding to the Podman command can be modified to the target object label, that is, the file label of the Podman command is modified to the target object label. When the Podman command is executed to create the target container process, the target object label will be used as the object label to be converted of the target container process, and then the domain conversion is performed to obtain the security label of the target container process.

[0080] By modifying the default object label corresponding to the Podman command, the target object label matching the container-related information of the first container can be used as the object label to be converted, and the security label of the target container process is obtained through domain conversion, thereby realizing effective configuration of the security label of the target container process.

[0081] In an optional manner of the embodiment of the present application, after performing domain conversion on the object label to be converted to obtain the security label of the target container process, the method further includes:

[0082] Change the target object label corresponding to the create command to the default object label.

[0083] In the embodiment of the present application, when the target object label is successfully matched based on the container-related information of the first container, the target object label can be modified by modifying the default object label corresponding to the Podman command to assign a matching security label to the target container process. After the default object label corresponding to the Podman command is modified, it is necessary to modify it again so that the Podman command can correspond to the default object label again, that is, the file label of the Podman command is restored to the default object label, so that Podman can support subsequent use.

[0084] In an embodiment of the present application, the modification of the default object label corresponding to the Podman command can be completed using the chcon command.

[0085] In an optional manner of the embodiment of the present application, the matching result is that there is no target security tag matching the container related information of the first container, and determining the object tag to be converted based on the matching result includes:

[0086] Get the default object label corresponding to the creation command of the target container process;

[0087] The create command is executed so that the default object label is designated as the object label to be converted.

[0088] In an embodiment of the present application, when the container-related information of the first container fails to match, it indicates that there is no target object label that matches the container-related information of the first container. At this time, it can be considered that the security label is not configured for the target container process. At this time, the default label corresponding to the create command may not be modified. The default object label is used as the label to be converted, and the default object label is domain-converted to obtain the security label of the target container process. In this way, when the container-related information of the first container fails to match, the configuration of the security label of the target container process can be implemented.

[0089] In an optional manner of an embodiment of the present application, the first container runs on a basic environment, SELinux is enabled in the basic environment, SELinux includes a container security policy module, and the container security policy module is used to configure an object label.

[0090] In the embodiment of the present application, the Systemd running on the basic environment will enable SELinux. The SELinux container in this example can add a container security policy module in the policy module to provide basic container support.

[0091] As an example, a set of default labels related to containers can be used in the container security policy module, which should at least include: security labels for processes (i.e., object labels), security labels for binary files used for domain conversion, security labels for temporary files, and security labels for configuration files.

[0092] The container security policy module can also configure basic container-related permissions, such as domain conversion and whether the subject can access the object of this module.

[0093] External permissions can also be configured in the container security policy module, such as supporting access to files involved in the container security policy module in other system modules, allowing access to other modules with low security requirements but not accessing other modules with high security requirements, etc.

[0094] In an optional manner of the embodiment of the present application, after the target container process is created, the method further includes:

[0095] In response to detecting a start command of the first container, a target container process is called to start the first container.

[0096] In the embodiment of the present application, after the target container process is created, the first container can be started according to the image of the first container.

[0097] In an optional manner of the embodiment of the present application, the above method further includes:

[0098] The second container is started through the daemon process, the second container runs SELinux, the container subprocesses in the second container include a shell process, the container subprocesses of the first container include a service process of a specified type, and the service process of the specified type does not include a shell process.

[0099] In the embodiment of the present application, SELinux can be run in the second container, and permission management in the second container is implemented based on SELinux.

[0100] The second container can be configured in the same way as the basic environment. Systemd can be deployed in the second container, and systemd automatically starts SELinux.

[0101] When the second container is started, a default label is assigned to the second container. The default label has the permission to start other processes and can be used by the user to enter the second container to perform the user's shell operation.

[0102] It is understandable that running a shell process in the second container to support user shell operations is a typical application of the second container. The second container can also support running a variety of other processes with different permissions, which is not limited in this application.

[0103] Some file directories on the basic environment, such as configuration files, policy module files, etc., can be mapped to the second container according to actual needs, thereby ensuring that the second container is consistent with the basic environment.

[0104] Multiple unrelated container subprocesses can run in the second container. These container subprocesses can be started by the user or automatically started according to actual needs. With the help of Systemd deployed in the second container, the SELinux service is automatically started, and the security label is initialized in the second container. After initialization, the second container is similar to the basic environment. Each container subprocess has a subject label, and each accessed file also has an object label. It can also start container subprocesses with different labels through domain conversion. The processes in the second container can perform permission management based on SELinux, meet MAC protection, and meet the minimum permission rules.

[0105] In the embodiment of the present application, the second container can be used to perform shell operations of the user, so that all shell operations of the logged-in user are isolated in the large container, and the logged-in user label is consistent with the basic environment. After logging in, the user will enter the second container by default and inherit the label of the login shell of the basic environment. The permission management during operations in the second container will also follow SELinux.

[0106] The solution provided by the embodiment of the present application can provide two types of containers in the container environment: a first container and a second container. The second container is disguised to be consistent with the basic environment outside the container. After the user logs in, the second container is entered by default, and the second container is identified as the basic environment for user operations, so that the user operations can be isolated from the basic environment. The first container is only used to start a specified type of service process to provide corresponding container services. The specified type of service process does not include a shell process, that is, the container service provided in the first container does not include the user's shell operation. By deploying SELinux security protection on the container environment, and at the same time matching the characteristics of the first container and the second container, the label binding of the container and SELinux is decoupled from the container tool side, and a "container-Systemd-SELinux" relationship bond is formed, the container and SELinux are deeply integrated to achieve dual security protection of the container and SELinux.

[0107] The execution logic involved in the container permission management method in the embodiment of the present application can be packaged as a toolkit in the form of a script, and the toolkit is added to the Podman container environment. The toolkit can be named container-tool. At the same time, a container policy module is added to SELinux in the basic environment to support the matching of container process security labels.

[0108] In an optional implementation manner of the embodiment of the present application, the container-related information includes at least one of the following:

[0109] The image identifier of the container image corresponding to the first container;

[0110] The label of the first container indicates information.

[0111] The first container is started based on a corresponding container image, and the image identifier of the container image can be used to identify the first container. Therefore, a preset matching relationship can be established between the image identifier and the object tag.

[0112] The label indication information may be customized information in this case, which is used to specify the information of the object label that matches the first container, and a preset matching relationship may be established between the label indication information and the object label.

[0113] As an example, Figure 3It is a schematic diagram of the structure of the container environment provided in the embodiment of the present application.

[0114] like Figure 3 As shown in , the container environment in this case uses Podman. The Podman command can be encapsulated and named as container-tool, and SELinux support can be added at the same time.

[0115] The container tool may include a series of scripts for implementing the container permission management method in the present application, as well as Podman commands. Among them, the container tool may include some commands for the second container, which are used to start the second container with the default label, map SELinux inside and outside the second container, and keep the second container consistent with the basic environment. The container tool may also include some commands for the first container, which are used to implement the step of determining the security label of the target container process, including: determining whether there is a target object label that matches the image identifier of the first container; if there is a matching target object label, the target object label is domain converted to obtain the security label of the target container process; if there is no matching target object label, the default object label is domain converted to obtain the security label of the target container process.

[0116] In the second container, Systemd is deployed to automatically start SELinux. The label refresh service in the container is started, that is, the security label of the process in the second container is refreshed based on SELinux.

[0117] like Figure 3 As shown in the figure, processes A, B, C, etc. are all container subprocesses in the second container, and these processes are all assigned security labels based on the SELinux service. Among them, the security label of process A is u:r:a_t:s0, the security label of process B is u:r:b_t:s0, and the security label of process C is u:r:c_t:s0.

[0118] If Systemd is not deployed in the first container, SELinux will not be started. Figure 3 As shown, the security label of the container subprocess running in the first container X is u:r:X_t:s0.

[0119] The solution provided by the embodiment of the present application deeply combines the container with SELinux, and adopts different permission management solutions for specific usage scenarios. For example, for user operation scenarios, the user logs in to enter the second container, and provides permission management based on SELinux. For a separate service process, the first container can be used for implementation. The container subprocess in the first container is used as a separate service process to provide services, and the service process inherits the security label of the target service process, thereby realizing permission management.

[0120] The solution provided in the embodiment of the present application can decouple the support for security-opt on the container tool side. It only requires the container to technically support SELinux, and can achieve the same effect as before the decoupling on the tool side. It is also easier to expand the number of containers, and can provide a permission minimization solution in a complex container environment.

[0121] As an example, Figure 4 It is a flowchart of a specific implementation method of the container permission management method in the embodiment of the present application.

[0122] like Figure 4 As shown, the first containers started by the target container process are container-xxx, container-xxx1, and container-xxx2. The container image repository stores the images of the containers. Among them, the image of container-xxx can be obtained from the path Localhost / container-xxx, the image of container-xxx1 can be obtained from the path Localhost / container-xxx1, and the image of container-xxx2 can be obtained from the path Localhost / container-xxx2.

[0123] The SELinux policy module includes the container policy module, which specifically includes the xxx1 module and the xxx2 module. Among them, the xxx1 module corresponds to the module label xxx1_t, and after the module label xxx1_t is domain-converted, the process label xxx can be obtained; the xxx2 module corresponds to the module label xxx2_t, and after the module label xxx2_t is domain-converted, the process label xxx2 can be obtained. In this example, the module label is the aforementioned object label, and the process label is the security label of the target container process.

[0124] Through the container tool, the container image name can be matched with the container policy module, and the security label of the target container process can be determined based on the matching result. Figure 4As shown, the container image name xxx cannot be matched successfully with the module in the container policy module. In this case, the module default label container_runtime_t can be domain-converted to obtain the process label Container. There is a module xxx1 in the container policy module, and the container image name matches the module xxx1 successfully. In this case, the module label xxx1_t corresponding to the module xxx1 can be domain-converted to obtain the process label xxx1. There is a module xxx2 in the container policy module, and the container image name matches the module xxx2 successfully. In this case, the module default label xxx2_t can be domain-converted to obtain the process label xxx2. It is understandable that.

[0125] As an example, Figure 5 It is a schematic diagram of the structure of the second container provided in the embodiment of the present application.

[0126] like Figure 5 As shown in , SELinux is automatically started in the second container by deploying systemd.

[0127] The second container runs process A of service A, whose security label is u:r:a_t:s0. The second container also runs process B of service B, whose security label is u:r:b_t:s0.

[0128] After logging in, the user can enter the second container. All shell operations of the user are isolated in the second container. Process C and other processes are used to execute the user's shell operations.

[0129] As an example, Figure 6 It is a schematic diagram of the structure of the first container provided in the embodiment of the present application.

[0130] If Systemd is not deployed in the first container, SELinux will not be started. Figure 6 As shown, the X service can be run in the first container through the container process (ie, the container child process), and the security label of the container process is u:r:X_t:s0.

[0131] In actual use, multiple first containers can be started, and each first container can be responsible for independently running different services.

[0132] Based on Figure 2 The same principle as shown in the method, Figure 7 A schematic diagram of the structure of a process authority management device provided by an embodiment of the present application is shown. Figure 7 As shown, the process authority management device 70 may include:

[0133] A security label determination module 710 is used to determine the security label of a target container process as the security label of the container subprocess during the process of creating a container subprocess in the first container, the target container process is used to start the first container, and SELinux is disabled in the first container;

[0134] The permission management module 720 is used to manage the permissions of the container subprocess based on the security label of the container subprocess.

[0135] Optionally, the security tag determination module is further used to:

[0136] Before creating the first container, during the creation of the target container process, a security label of the target container process is determined based on container related information of the first container.

[0137] Optionally, when the security label determination module determines the security label of the target container process based on the container related information of the first container, it is specifically used to:

[0138] Based on a preset matching relationship between the container-related information and the object tag, matching the container-related information of the first container to obtain a matching result;

[0139] Determine the label of the object to be converted based on the matching result;

[0140] Perform domain conversion on the object label to be converted to obtain the security label of the target container process.

[0141] Optionally,

[0142] The matching result is that there is a target object tag that matches the container related information of the first container, and determining the object tag to be converted based on the matching result includes:

[0143] Get the default object label corresponding to the creation command of the target container process;

[0144] Change the default object label corresponding to the create command to the target object label;

[0145] The creation command is executed so that the target object tag is determined as the object tag to be converted.

[0146] Optionally, the above device further includes:

[0147] The command restoration module performs domain conversion on the object label to be converted and obtains the security label of the target container process.

[0148] Get the default object label corresponding to the creation command of the target container process;

[0149] The create command is executed so that the default object label is designated as the object label to be converted.

[0150] Optionally, the matching result is that there is no target security tag matching the container related information of the first container, and the security tag determination module determines the object tag to be converted based on the matching result, specifically for:

[0151] Get the default object label corresponding to the creation command of the target container process;

[0152] The create command is executed so that the default object label is designated as the object label to be converted.

[0153] Optionally, the first container runs on a basic environment, SELinux is enabled in the basic environment, SELinux includes a container security policy module, and the container security policy module is used to configure an object label.

[0154] Optionally, the device further comprises:

[0155] The first container startup module is used to call the target container process to start the first container in response to detecting a startup command of the first container after the target container process is created.

[0156] Optionally, the device further comprises:

[0157] The second container startup module is used to start the second container through the daemon process, the second container runs SELinux, the container subprocess in the second container includes a shell process, the container subprocess of the first container includes a service process of a specified type, and the service process of the specified type does not include a shell process.

[0158] Optionally, the container-related information includes at least one of the following:

[0159] The image identifier of the container image corresponding to the first container;

[0160] The label of the first container indicates information.

[0161] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described above is merely schematic, in which the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0162] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0163] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the method embodiments described above.

[0164] Compared with the prior art, the computer-readable storage medium provided in the embodiment of the present application disables SELinux in the first container started by the target container process, and in the process of creating a container subprocess in the first container, determines the security label of the target container process as the security label of the container subprocess, thereby performing permission management on the container subprocess based on the security label of the container subprocess. Based on this solution, permission management can be performed at the granularity of a single process, thereby realizing refined permission management of the process.

[0165] The present application also provides an electronic device, including:

[0166] one or more processors; and

[0167] A memory associated with the one or more processors, the memory being used to store program instructions, which, when read and executed by the one or more processors, executes the steps of any one of the method embodiments described above.

[0168] Compared with the prior art, the electronic device provided by the embodiment of the present application disables SELinux in the first container started by the target container process, and in the process of creating a container subprocess in the first container, determines the security label of the target container process as the security label of the container subprocess, thereby performing permission management on the container subprocess based on the security label of the container subprocess. Based on this solution, permission management can be performed at the granularity of a single process, thereby realizing refined permission management of the process.

[0169] As an example, Figure 8 A schematic diagram of the structure of an electronic device applicable to the embodiment of the present application is shown. Figure 8As shown, the electronic device 2000 includes: a processor 2001 and a memory 2003. The processor 2001 and the memory 2003 are connected, such as through a bus 2002. Optionally, the electronic device 2000 may also include a transceiver 2004. It should be noted that in actual applications, the transceiver 2004 is not limited to one, and the structure of the electronic device 2000 does not constitute a limitation on the embodiments of the present application.

[0170] The processor 2001 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 2004 may include a receiver and a transmitter. The transceiver 2004 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0171] Processor 2001 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 2001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0172] The bus 2002 may include a path to transmit information between the above components. The bus 2002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 2002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0173] The memory 2003 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0174] Optionally, the memory 2003 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 2001. The processor 2001 is used to execute the application code stored in the memory 2003 to implement the steps of any one of the methods in the aforementioned method embodiments.

[0175] The present application also provides a computer program product, including a computer program, which implements the steps of any one of the method embodiments described above when executed by a processor.

[0176] Compared with the prior art, the computer program product provided in the embodiment of the present application disables SELinux in the first container started by the target container process, and in the process of creating a container subprocess in the first container, determines the security label of the target container process as the security label of the container subprocess, thereby performing permission management on the container subprocess based on the security label of the container subprocess. Based on this solution, permission management can be performed at the granularity of a single process, thereby realizing refined permission management of the process.

[0177] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0178] The above are only some embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A process rights management method, characterized in that: include: In the process of creating a container child process in the first container, determining the security label of a target container process as the security label of the container child process, the target container process is used to start the first container, and security-enhanced Linux is disabled in the first container; Based on the security label of the container subprocess, permission management is performed on the container subprocess.

2. The method according to claim 1, characterized in that Before creating the first container, the method further includes: During the creation of the target container process, a security label of the target container process is determined based on container related information of the first container.

3. The method according to claim 2, characterized in that The determining the security label of the target container process based on the container related information of the first container includes: Based on a preset matching relationship between the container-related information and the object tag, matching the container-related information of the first container to obtain a matching result; Determining a label of an object to be converted based on the matching result; Domain conversion is performed on the object label to be converted to obtain a security label of the target container process.

4. The method according to claim 3, characterized in that The matching result is that there is a target object tag that matches the container related information of the first container, and determining the object tag to be converted based on the matching result includes: Obtaining a default object tag corresponding to the creation command of the target container process; Modify the default object tag corresponding to the create command to the target object tag; The creation command is executed so that the target object tag is determined as the object tag to be converted.

5. The method according to claim 4, characterized in that After performing domain conversion on the object label to be converted to obtain the security label of the target container process, the method further includes: The target object tag corresponding to the create command is modified to the default object tag.

6. The method according to claim 3, characterized in that The matching result is that there is no target security tag that matches the container related information of the first container, and determining the object tag to be converted based on the matching result includes: Obtaining a default object tag corresponding to the creation command of the target container process; The creation command is executed so that the default object tag is designated as the object tag to be converted.

7. The method according to any one of claims 3 to 6, characterized in that: The first container runs on a basic environment, in which security-enhanced Linux is enabled, and the security-enhanced Linux includes a container security policy module, and the container security policy module is used to configure the object label.

8. The method according to any one of claims 1 to 6, characterized in that After the target container process is created, the method further includes: In response to detecting the start command of the first container, calling the target container process to start the first container.

9. The method according to any one of claims 1 to 6, characterized in that: Also includes: A second container is started through a daemon process, the second container runs a security-enhanced Linux, the container subprocesses in the second container include a shell process, the container subprocesses of the first container include a service process of a specified type, and the service process of the specified type does not include the shell process.

10. The method according to any one of claims 1 to 6, characterized in that: The container related information includes at least one of the following: The image identifier of the container image corresponding to the first container; The label of the first container indicates information.

11. A process authority management device, characterized in that: include: a security label determination module, configured to determine, during a process of creating a container subprocess in a first container, a security label of a target container process as the security label of the container subprocess, wherein the target container process is used to start the first container, and security-enhanced Linux is disabled in the first container; The permission management module is used to perform permission management on the container subprocess based on the security label of the container subprocess.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

13. An electronic device, characterized in that: include: one or more processors; as well as A memory associated with the one or more processors, the memory being used to store program instructions, wherein the program instructions, when read and executed by the one or more processors, execute the steps of the method described in any one of claims 1 to 10.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images