Multi-window-based content display isolation implementation method and system under Linux system

Abstract

The invention provides a multi-window-based content display isolation realization method and system under a Linux system, and relates to the technical field of system security isolation, and the method comprises the steps: dividing the Linux system into a host machine namespace and a sandbox namespace, starting an independent xorg process in the sandbox namespace to provide a display service for a desktop application in a sandbox, isolating the xorg process from a display service of a host machine, and converting data isolation in the xorg process into isolation of two xorg processes; wherein the host machine namespace is a space which is automatically created during starting, and the sandbox namespace is a space which is called and created by the management application. According to the method, the new xorg process is started in the sandbox namespace to provide the display service for the desktop application in the sandbox, so that the problem of data isolation in the xorg process is converted into the problem of isolation of two processes.

Description

Technical Field

[0001] The present disclosure relates to the technical field of system security isolation, and in particular to a method and system for implementing content display isolation based on multiple windows in a Linux system. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] A security sandbox is a virtual environment used to isolate applications. The sandbox can provide file systems, networks, desktop systems and other resources that are isolated from the host system, allowing isolated applications to run in a virtual environment, thereby limiting the application's operations and data within the sandbox without affecting the host environment outside the sandbox.

[0004] With the gradual development of domestic operating systems, security requirements under Linux systems have also developed. Namespace is a mechanism provided by the Linux kernel for process isolation. By creating an independent namespace, you can create a network, file system, inter-process communication and other environments that are isolated from the host system. In Linux systems, a new namespace is usually created for the sandbox, so that the processes in the sandbox and the host processes are in different namespaces, thereby isolating the sandbox's file system, network, inter-process communication, etc.

[0005] At present, the sandbox display service of the localized Linux system usually provides display services for the sandbox by creating a new XClient as XServer. Since the interface applications inside the sandbox and the interface applications outside the sandbox are connected to the same xorg, it is difficult to isolate the interaction information of the XClient in the xorg process, which will cause the following problems:

[0006] 1. The clipboard content of the application in the sandbox will be passed to the outside of the sandbox through the xorg service.

[0007] 2. The screenshot application outside the sandbox can obtain the application interface inside the sandbox, thereby obtaining the data inside the sandbox. Summary of the invention

[0008] In order to solve the above problems, the present disclosure proposes a method and system for implementing content display isolation based on multiple windows under a Linux system. By starting a new xorg process in a sandbox namespace to provide display services for desktop applications in the sandbox, the data isolation problem within an xorg process is converted into an isolation problem of two processes, the xorg process of the host desktop and the xorg process of the desktop in the sandbox, thereby isolating the display service of the host machine.

[0009] According to some embodiments, the present disclosure adopts the following technical solutions:

[0010] The method for implementing content display isolation based on multiple windows in Linux system includes:

[0011] The Linux system is divided into a host namespace and a sandbox namespace. An independent xorg process is started in the sandbox namespace to provide display services for the desktop applications in the sandbox and isolate it from the display service of the host. The data isolation within one xorg process is converted into the isolation of two xorg processes.

[0012] The host namespace is the space that is automatically created when the machine is started, and the sandbox namespace is the space that is created when the management application is called.

[0013] According to some embodiments, the present disclosure adopts the following technical solutions:

[0014] The content display isolation implementation system based on multiple windows under Linux system includes:

[0015] The space creation module is used to divide the Linux system into the host namespace and the sandbox namespace;

[0016] The isolation module is used to start an independent xorg process in the sandbox namespace to provide display services for the desktop applications in the sandbox and isolate it from the display services of the host machine, converting the data isolation within an xorg process into the isolation of two xorg processes;

[0017] The host namespace is the space that is automatically created when the machine is started, and the sandbox namespace is the space that is created when the management application is called.

[0018] According to some embodiments, the present disclosure adopts the following technical solutions:

[0019] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method for implementing content display isolation based on multiple windows under the Linux system is implemented.

[0020] According to some embodiments, the present disclosure adopts the following technical solutions:

[0021] An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the method for implementing content display isolation based on multiple windows under the Linux system.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] The present invention discloses a method for implementing content display isolation based on multiple windows in a Linux system. By starting a new xorg process in a sandbox namespace to provide display services for desktop applications in the sandbox, the data isolation problem within an xorg process is converted into an isolation problem of two processes, so that the clipboard content of the application in the sandbox will not be transmitted to the outside of the sandbox through the xorg service, and the screenshot application outside the sandbox cannot obtain the application interface in the sandbox, and thus cannot obtain the data in the sandbox.

[0024] The present invention discloses a method for implementing content display isolation based on multiple windows in a Linux system, which provides display services for desktop applications in a sandbox by starting an independent xorg in a sandbox namespace, thereby isolating the display services of the host machine and avoiding the same xorg from sharing clipboard and image information. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0026] Figure 1 A diagram of a sandbox namespace isolation component according to an embodiment of the present disclosure;

[0027] Figure 2 The present invention is a flow chart of a method for implementing content display isolation based on multiple windows in a Linux system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0029] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0030] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0031] Example 1

[0032] In one embodiment of the present disclosure, a method for implementing content display isolation based on multiple windows in a Linux system is provided, which starts a new xorg process in a sandbox namespace to provide display services for desktop applications in the sandbox, thereby converting the data isolation problem within an xorg process into the isolation problem of two processes, including:

[0033] The Linux system is divided into a host namespace and a sandbox namespace. An independent xorg process is started in the sandbox namespace to provide display services for the desktop applications in the sandbox and isolate it from the display service of the host. The data isolation within one xorg process is converted into the isolation of two xorg processes.

[0034] The host namespace is the space that is automatically created when the machine is started, and the sandbox namespace is the space that is created when the management application is called.

[0035] Specifically, Figure 1 As shown in the figure, the system is divided into two namespaces, Ns0 is the host namespace, and Ns1 is the sandbox namespace. Ns0 is the space automatically created when the host system starts, and Ns1 is manually created by the sandbox management application. The sandbox desktop user system of the sandbox namespace includes the desktop session manager, window manager, file manager, and taskbar application; the host desktop user system of the host namespace includes the desktop session manager, window manager, file manager, and taskbar application. The processes in the two spaces can be isolated.

[0036] Each desktop system starts the desktop session manager, and the desktop session manager starts a window manager, a file manager, and a taskbar application.

[0037] like Figure 2 As shown, an independent xorg process is started in the sandbox namespace to provide display services for the desktop applications in the sandbox, including:

[0038] Step 1: Create a sandbox common user (group) and xauthority file;

[0039] Step 2: Call the clone system call to create and switch to the sandbox namespace, thereby isolating the processes inside the sandbox from those outside the sandbox;

[0040] Step 3: Start the xorg service and specify the virtual terminal and user authentication parameters;

[0041] Step 4: Switch the user id to a common user (group) in the sandbox;

[0042] Step 5: Initialize the sandbox environment variables;

[0043] Step 6: Start multiple processes of the desktop system, including starting the desktop system session manager process. The session manager will start desktop components such as the window manager, file manager, and taskbar.

[0044] Step 7: End.

[0045] The present disclosure uses multiple xorg processes to isolate the sandbox desktop display system, and the xorg process in the sandbox namespace and the xorg process in the host namespace do not share clipboard and image information.

[0046] Example 2

[0047] In one embodiment of the present disclosure, a system for implementing content display isolation based on multiple windows in a Linux system is provided, including:

[0048] The space creation module is used to divide the Linux system into the host namespace and the sandbox namespace;

[0049] The isolation module is used to start an independent xorg process in the sandbox namespace to provide display services for the desktop applications in the sandbox and isolate it from the display services of the host machine, converting the data isolation within an xorg process into the isolation of two xorg processes;

[0050] The host namespace is the space that is automatically created when the machine is started, and the sandbox namespace is the space that is created when the management application is called.

[0051] Specifically, Figure 1 As shown in the figure, the system is divided into two namespaces, Ns0 is the host namespace, and Ns1 is the sandbox namespace. Ns0 is the space automatically created when the host system starts, and Ns1 is manually created by the sandbox management application. The sandbox desktop user system of the sandbox namespace includes the desktop session manager, window manager, file manager, and taskbar application; the host desktop user system of the host namespace includes the desktop session manager, window manager, file manager, and taskbar application. The processes in the two spaces can be isolated.

[0052] Each desktop system starts the desktop session manager, and the desktop session manager starts a window manager, a file manager, and a taskbar application.

[0053] like Figure 2 As shown, an independent xorg process is started in the sandbox namespace to provide display services for the desktop applications in the sandbox, including:

[0054] Step 1: Create a sandbox common user (group) and xauthority file;

[0055] Step 2: Call the clone system call to create and switch to the sandbox namespace;

[0056] Step 3: Start the xorg service and specify the virtual terminal and user authentication parameters;

[0057] Step 4: Switch the user id to a common user (group) in the sandbox;

[0058] Step 5: Initialize the sandbox environment variables;

[0059] Step 6: Start multiple processes of the desktop system, including starting the desktop system session manager process. The session manager will start desktop components such as the window manager, file manager, and taskbar.

[0060] Step 7: End.

[0061] The present disclosure uses multiple xorg processes to isolate the sandbox desktop display system, and the xorg process in the sandbox namespace and the xorg process in the host namespace do not share clipboard and image information.

[0062] Example 3

[0063] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method for implementing content display isolation based on multiple windows under the Linux system is implemented.

[0064] Example 4

[0065] In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the method for implementing content display isolation based on multiple windows under the Linux system.

[0066] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0067] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0068] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A method for implementing content display isolation based on multiple windows in a Linux system, characterized in that: include: The Linux system is divided into a host namespace and a sandbox namespace. An independent xorg process is started in the sandbox namespace to provide display services for the desktop applications in the sandbox and isolate it from the display service of the host. The data isolation within one xorg process is converted into the isolation of two xorg processes. The host namespace is the space that is automatically created when the machine is started, and the sandbox namespace is the space that is created when the management application is called.

2. The method for implementing content display isolation based on multiple windows in a Linux system according to claim 1, characterized in that: Start an independent xorg process in the sandbox namespace to provide display services for the desktop applications in the sandbox, including: Step 1: Create a sandbox user and xauthority file; Step 2: Call the clone system call to create and switch to the sandbox namespace; Step 3: Start the xorg service and specify the virtual terminal and user authentication parameters; Step 4: Switch the user id to a normal user in the sandbox; Step 5: Initialize the sandbox environment variables; Step 6: Start multiple processes on the desktop system.

3. The method for implementing content display isolation based on multiple windows in a Linux system according to claim 1, characterized in that: The host desktop user system of the host namespace includes a desktop session manager, a window manager, a file manager, and a taskbar application.

4. The method for implementing content display isolation based on multiple windows in a Linux system according to claim 1, characterized in that: The sandbox desktop user system of the sandbox namespace includes a desktop session manager, a window manager, a file manager, and a taskbar application.

5. The method for implementing content display isolation based on multiple windows in a Linux system according to any one of claims 3 or 4, characterized in that: Each desktop system starts the desktop session manager, and the desktop session manager starts a window manager, a file manager, and a taskbar application.

6. The method for implementing content display isolation based on multiple windows in a Linux system according to claim 1, characterized in that: The xorg process in the sandbox namespace does not share clipboard and image information with the xorg process in the host namespace.

7. The method for implementing content display isolation based on multiple windows in a Linux system according to claim 1, characterized in that: Multiple xorg processes are used to isolate the sandbox desktop display system.

8. A system for implementing content display isolation based on multiple windows under Linux system, characterized in that: include: The space creation module is used to divide the Linux system into the host namespace and the sandbox namespace; The isolation module is used to start an independent xorg process in the sandbox namespace to provide display services for the desktop applications in the sandbox and isolate it from the display services of the host machine, converting the data isolation within an xorg process into the isolation of two xorg processes; The host namespace is the space that is automatically created when the machine is started, and the sandbox namespace is the space that is created when the management application is called.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the method for implementing content display isolation based on multiple windows under the Linux system as described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the method for implementing content display isolation based on multiple windows under a Linux system as described in any one of claims 1 to 7.

Images