Capability detection method, device, equipment, storage medium and program product

Abstract

The present application discloses a capability detection method, device, equipment, storage medium and program product. The method comprises: configuring all permissions of the operating system for the program to be detected, and loading the kernel module of the operating system; registering the permission detection function in the security module of the kernel module of the operating system; running the program to be detected, and obtaining the capability information of the process corresponding to the program through the permission detection function, and storing the capability information in a pre-created storage space; parsing the capability information to obtain the capability detection result of the program to be detected. The use of this method can ensure that complete and accurate capability information of the program to be detected is obtained.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a capability detection method, apparatus, device, storage medium and program product. Background Art

[0002] Linux Capabilities is a fine-grained permission management mechanism that is used to divide the privileges of the root user into specific function sets. It allows some root privileges to be granted to non-root processes to ensure the normal operation of non-root user programs. When configuring capabilities for a program, it is necessary to ensure that the program can run normally while complying with the principle of least privilege to avoid potential risks caused by excessive permissions and security issues. Therefore, it is necessary to detect and organize the capabilities required by the program at runtime.

[0003] The Berkeley Packet Filter Compiler Collection (BCC) is primarily used to build the Berkeley Packet Filter (BPF) software, especially the extended Berkeley Packet Filter (Extern BPF, eBPF).

[0004] Currently, BCC is often used to obtain the capabilities used during program operation. However, BCC detects program capabilities based on the application layer, and the detection process is limited by the kernel version, so there is a problem that the corresponding capabilities of the program cannot be obtained. Summary of the invention

[0005] In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide a capability detection method, apparatus, device, storage medium and program product that can ensure that complete and accurate capability information of a program to be detected is obtained.

[0006] In a first aspect, the present application provides a capability detection method. The method comprises:

[0007] Configure all permissions of the operating system for the program to be detected and load the kernel module of the operating system;

[0008] Add permission detection functions to the kernel module of the operating system;

[0009] Run the program to be detected, obtain the capability information of the program to be detected through the permission detection function, and store the capability information in the pre-created storage space;

[0010] Parse the capability information to obtain the capability test result of the program to be tested;

[0011] Add permission detection functions to the kernel module of the operating system, including:

[0012] Register the permission detection function to the security module of the kernel module of the operating system.

[0013] In combination with the first aspect, in a possible implementation, when the operating system is a Linux system, the permission detection function is registered in the security module of the kernel module of the operating system, including: registering the permission detection function in the lightweight universal access control framework of the Linux system.

[0014] In combination with the first aspect, in a possible implementation method, the capability information of the process corresponding to the program is obtained through a permission detection function, including: determining the process generated during the running of the program to be detected; for each process, obtaining the capability information corresponding to the process through a permission detection function; and parsing the capability information corresponding to each process to obtain the capability information corresponding to the program to be detected.

[0015] In combination with the first aspect, in a possible implementation method, the capability information is parsed to obtain the capability test result of the program to be tested, including: screening the capability information of the program to be tested based on screening conditions to obtain candidate capability information; deduplicating the candidate capability information to obtain the capability test result of the program to be tested; the capability test result represents the minimum capability strategy of the program to be tested.

[0016] In combination with the first aspect, in a possible implementation, before configuring all permissions of the operating system for the program to be detected, the method further includes: backing up the default capabilities of the program to be detected to obtain a default capability backup file of the program to be detected.

[0017] In combination with the first aspect, in a possible implementation, after obtaining the capability detection result of the program to be detected, the method further includes: restoring the capability configuration information corresponding to the program to be detected according to the default capability backup file of the program to be detected.

[0018] In a second aspect, the present application also provides a capability detection device. The device comprises:

[0019] A configuration module is used to configure all permissions of the operating system for the program to be detected and load the kernel module of the operating system;

[0020] Add a module to add permission detection functions to the kernel module of the operating system;

[0021] The detection module is used to run the program to be detected, obtain the capability information of the program to be detected through the permission detection function, and store the capability information in a pre-created storage space;

[0022] The parsing module is used to parse the capability information and obtain the capability test result of the program to be tested;

[0023] Add a module specifically for registering the permission detection function into the security module of the kernel module of the operating system.

[0024] In a third aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0025] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0026] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0027] The embodiments of the present application provide a capability detection method, device, equipment, storage medium and program product, which can configure all permissions of the operating system for the program to be detected, and load the kernel module of the operating system; register the permission detection function in the security module of the kernel module of the operating system, so that after running the program to be detected, the capability information of the program to be detected can be obtained through the permission detection function. The capability information is stored in a pre-created storage space, and the capability information is parsed to obtain the capability detection result of the program to be detected. The method provided by the embodiment of the present application can realize the capability detection of the program to be detected based on the kernel layer by modifying the operating system kernel and adding a permission detection function in the kernel to ensure that the capability detection is not limited by the operating system kernel version, and ensure that the capability information of the program to be detected is obtained. Moreover, before the capability detection, the present application configures full capabilities for the program to be detected to ensure that the program to be detected runs without restriction, so that more complete and accurate capability information can be obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0029] Figure 1 1 is a flow chart of a capability detection method in one embodiment;

[0030] Figure 2 Another schematic diagram of a process flow of a capability detection method in one embodiment;

[0031] Figure 3 Another schematic diagram of a process flow of a capability detection method in one embodiment;

[0032] Figure 4 is another schematic diagram of a flow chart of a capability detection method in one embodiment;

[0033] Figure 5 is a structural block diagram of a capability detection device in one embodiment;

[0034] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0035] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0036] It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. In addition, the term "and / or" herein is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order of objects.

[0037] Linux Capabilities is a fine-grained permission management mechanism that is used to divide the privileges of the root user into specific function sets. It allows some root privileges to be granted to non-root processes to ensure the normal operation of non-root user programs. When configuring capabilities for a program, it is necessary to ensure that the program can run normally while complying with the principle of least privilege to avoid potential risks caused by excessive permissions and security issues. Therefore, it is necessary to detect and organize the capabilities required by the program at runtime.

[0038] The BPF Compiler Collection (BCC) is primarily used to build the Berkeley Packet Filter (BPF) software, especially the Extended Berkeley Packet Filter (Extern, eBPF).

[0039] Currently, BCC is often used to obtain the capabilities used during program operation. However, BCC detects program capabilities based on the application layer, and the detection process is limited by the kernel version, so there is a problem that the corresponding capabilities of the program cannot be obtained. Moreover, the BCC method cannot obtain the program path, and there is a problem that the corresponding capabilities of the program cannot be accurately obtained for different programs with the same program name.

[0040] In one embodiment, Figure 1 As shown, a capability detection method is provided. This embodiment uses the method applied to a server as an example for illustration. It can be understood that the method can also be applied to a server cluster, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0041] Step 101: configure all permissions of the operating system for the program to be detected, and load the kernel module of the operating system.

[0042] In the embodiment of the present application, the user can create a program list based on the programs to be tested and store the program list locally. When the user has a need to test the capabilities of the program, all or part of the programs to be tested in the program list can be selected through the operation interface for capability testing.

[0043] When performing capability detection on a program to be detected, the kernel module of the operating system is loaded first, so that when the program to be detected is subsequently run, the capability detection of the program to be detected can be implemented based on the functions in the kernel module.

[0044] At the same time, in order to ensure the normal operation of the program to be detected and not be restricted by the permissions of the operating system, so as to fully obtain the capabilities used by the program to be detected, it is necessary to configure all permissions of the operating system for the program to be detected, that is, to configure full capabilities for the program to be detected.

[0045] In a possible implementation, before configuring all permissions of the operating system for the program to be detected, the default capabilities of the program to be detected are backed up to obtain a default capability backup file of the program to be detected. After obtaining the capability test result of the program to be detected, the capability configuration information corresponding to the program to be detected is restored according to the default capability backup file of the program to be detected. That is, after completing the capability test of the program to be detected, the default capabilities of the program to be detected are restored to avoid security risks caused by excessive permissions of the program to be detected.

[0046] Step 102: Add the permission detection function to the kernel module of the operating system.

[0047] In an embodiment of the present application, in order to ensure that the capabilities of the program to be detected are obtained, a permission detection function can be added to the kernel module of the operating system. When the kernel module runs to the location of the permission detection function, the capability information of the program to be detected returned by the permission detection function can be obtained.

[0048] In a possible implementation, adding the permission detection function to the kernel module of the operating system includes: registering the permission detection function to the security module of the kernel module of the operating system to implement the addition of the permission detection function to the kernel module of the operating system and ensure the normal function of the permission detection function. For example, the permission detection function can be registered in the lightweight general access control framework (Linux Security Module, LSM) of the Linux system.

[0049] In a possible implementation, the permission detection function may be a capable() function.

[0050] In one embodiment, the permission detection function can also be added to the kernel module of the operating system in advance, and then the kernel module of the operating system is loaded, and all permissions of the operating system are configured for the program to be detected. This application does not limit this, as long as it is ensured that the kernel module with the permission detection function added is loaded before the program to be detected runs.

[0051] Step 103: Run the program to be detected, obtain capability information of the program to be detected through a permission detection function, and store the capability information in a pre-created storage space.

[0052] In the embodiment of the present application, after configuring full capabilities for the program to be detected, the program to be detected is run, and the capability information corresponding to the program to be detected is obtained through the permission detection function in the kernel module. Among them, the capability information includes at least one of the user identification (UID) of the program to be detected, the program name, the path, and the capability. The path can ensure the uniqueness of the capability information when the program name is the same, thereby ensuring the accuracy of the correspondence between the program and the capability.

[0053] Then, the capability information corresponding to the program to be detected is stored in the pre-created storage space. Specifically, the capability information can be stored in a pre-set data structure, for example, the capability information can be stored in the form of a linked list.

[0054] In a possible implementation, the capability information may be obtained by running the program to be detected multiple times, or may be obtained by running the program to be detected within a period of time.

[0055] Step 104: parse the capability information to obtain the capability test result of the program to be tested.

[0056] In an embodiment of the present application, after the capability information of the program to be detected is stored in a preset data structure, the data in the data structure can be parsed to determine the type of each data, and a mapping relationship between the data type and the data can be constructed to form a capability information file. For example, the data in the data structure is parsed to determine that a certain data is a file path, then a mapping relationship between the data and the file path is established and stored in the capability information file, thereby obtaining the complete capability information of the program to be detected, that is, the capability detection result of the program to be detected. Among them, the data type is the above-mentioned program name, path, capability, etc.

[0057] In a possible implementation, a thread may be created in a kernel module of an operating system for parsing a data structure.

[0058] In one possible implementation, after completing the capability information detection of the program to be detected, the permission detection function added to the kernel module and the thread created in the kernel for parsing the data structure can be deleted, so that the operating system can be restored to the original system environment, avoiding the above-mentioned modifications to the operating system from affecting the normal functions of the operating system (except for capability detection).

[0059] The embodiment of the present application provides a capability detection method, which can configure all permissions of the operating system for the program to be detected, and load the kernel module of the operating system; add the permission detection function to the kernel module of the operating system, so that after running the program to be detected, the capability information of the program to be detected can be obtained through the permission detection function. The capability information is stored in a pre-created storage space, and the capability information is parsed to obtain the capability detection result of the program to be detected. The method provided by the embodiment of the present application can realize the capability detection of the program to be detected based on the kernel layer by modifying the operating system kernel and adding a permission detection function in the kernel to ensure that the capability detection is not limited by the operating system kernel version, and ensure that the capability information of the program to be detected is obtained. Moreover, before the capability detection, the present application configures full capabilities for the program to be detected to ensure that the operation of the program to be detected is not restricted, so that more complete and accurate capability information can be obtained.

[0060] The above-mentioned embodiment provides a scheme for obtaining the capability information of the process corresponding to the program through the permission detection function. In another embodiment of the present application, the capability information of the program can be determined based on the capability information of the process generated by the program running. This embodiment includes the following: Figure 2 Steps shown:

[0061] Step 201: Determine the process generated during the execution of the program to be detected.

[0062] Step 202: For each process, obtain the capability information corresponding to the process through the permission detection function.

[0063] Step 203: parse the capability information corresponding to each process to obtain the capability information corresponding to the program to be detected.

[0064] In the embodiment of the present application, at least one process is generated during the operation of the program to be detected. Different processes have different capabilities required during the execution process. Therefore, the process corresponding to the program to be detected can be determined based on the information of the processes being executed in the operating system. Then, for each process corresponding to the program to be detected, the capability information corresponding to the process is obtained through the permission detection function, and the capabilities corresponding to each process are analyzed and integrated to obtain the capability information corresponding to the program to be detected.

[0065] At this time, the capability information may include at least one of a UID, a process identifier (Process Identifier, PID), a program name, a program path, and a capability.

[0066] The embodiment of the present application comprehensively determines the capability information of the program to be detected based on the process information corresponding to the program to be detected and the capability information corresponding to each process, thereby effectively ensuring the integrity and validity of the capability information.

[0067] The above-mentioned embodiment introduces a solution for parsing capability information to obtain a capability information file as a capability detection result. In another embodiment of the present application, the capabilities in the capability information file can be further processed to generate a minimum capability strategy for the program to be detected. This embodiment includes the following: Figure 3 Steps shown:

[0068] Step 301: Screen the capability information of the program to be detected based on the screening conditions to obtain candidate capability information.

[0069] Step 302: De-duplicate the candidate capability information to obtain the capability test result of the program to be tested.

[0070] The capability detection result represents the minimum capability strategy of the program to be detected.

[0071] In an embodiment of the present application, after the capability information of each process of the program to be detected is parsed and integrated to obtain the capability information file corresponding to the program to be detected, the capabilities in the capability information file can be filtered according to certain filtering conditions based on user needs or the application environment of the program to be detected. For example, the capabilities corresponding to the same capability type can be filtered out to obtain candidate capability information; or the capabilities corresponding to the same process can be filtered out to obtain candidate capability information.

[0072] In a possible implementation, when capability tests are performed on multiple programs to be tested at the same time, so that the capability information file includes capability information of multiple programs to be tested, the capabilities corresponding to the same program to be tested can be first screened out, and then the capabilities can be screened according to certain screening conditions to obtain candidate capability information. Alternatively, no further screening is performed, and the capabilities corresponding to the same program to be tested are directly used as candidate capability information of the program to be tested.

[0073] Since different processes may have some of the same capabilities, the candidate capability information may be further deduplicated to obtain the capability detection result of the program to be detected, that is, the minimum capability strategy of the program to be detected.

[0074] The method provided in the embodiment of the present application can screen the capability information of the program to be detected based on the screening conditions to obtain candidate capability information; then the candidate capability information is deduplicated to obtain the capability detection result of the program to be detected, that is, the minimum capability strategy of the program to be detected. The embodiment of the present application can generate the minimum capability strategy of the program to be detected, so that the program can run normally based on the minimum permissions, ensuring the security of program operation and operating system.

[0075] In one embodiment, Figure 4 As shown, a capability detection method is provided, the method comprising the following steps:

[0076] The capability configuration unit 1 determines the program to be detected from the pre-established program list 4;

[0077] The operating system determines, based on condition 5, that the capability test c of the program to be tested is not yet completed, and then performs a capability backup of the default capability of the program to be tested (i.e., capability backup function 6), and obtains a default capability backup file of the program to be tested (i.e., program capability backup file 7); at the same time, configures all permissions of the operating system for the program to be tested (i.e., configure capability function 8).

[0078] If the operating system determines according to condition 5 that the capability detection r of the program to be detected has been completed, the capability configuration information of the program to be detected is restored according to the default capability backup file of the program to be detected (ie, capability restoration function 9).

[0079] The process capability detection unit 2 loads the kernel module and initializes the kernel module 10 to prevent the modification of the kernel module in the last capability detection from affecting the current capability detection process.

[0080] Then, create storage space (i.e. create process information data structure 11), add permission detection function to the kernel module (i.e. obtain process information function module function 14, and register the module function to the LSM framework 15); at the same time, create a kernel thread 13.

[0081] Next, the program to be detected can be run. After the permission detection function obtains the capability information of the program to be detected, the capability information is stored in a pre-created storage space (i.e., the process information data structure); the kernel thread 13 parses the data in the data structure (i.e., the parsing and outputting process capability information function 16) to obtain the capability information file of the program to be detected (the process capability information original file 17).

[0082] In addition, after completing the capability, the kernel module can be unloaded, that is, deleting the permission detection function added in the kernel module (deleting the module function 18 registered in the LSM framework), and deleting the thread created in the kernel for parsing the data structure (destroying the kernel thread 19).

[0083] The program capability strategy output unit 3 can filter the capability information in 17 according to the filtering condition 20 (a-output all capabilities; p-program name; c-capability type; u-UID) (parsing capability information list function 21) to obtain candidate capability information (capability information data structure 22); further, the candidate capability information can be deduplicated (output program capability strategy function 23) to obtain the capability detection result of the program to be detected (i.e., the minimum capability strategy), and form a program capability strategy file 24.

[0084] It should be noted that although the operations of the method of the present invention are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted in the flow chart can be performed in a different order. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0085] In one embodiment, Figure 5 As shown, a capability detection device is provided, including: a configuration module 401, an adding module 402, a detection module 403 and a parsing module 404, wherein:

[0086] The configuration module 401 is used to configure all permissions of the operating system for the program to be detected and load the kernel module of the operating system.

[0087] Adding module 402 is used to add the permission detection function to the kernel module of the operating system.

[0088] The detection module 403 is used to run the program to be detected, obtain the capability information of the program to be detected through the permission detection function, and store the capability information in a pre-created storage space.

[0089] The parsing module 404 is used to parse the capability information and obtain the capability test result of the program to be tested;

[0090] The adding module 402 is specifically used to register the permission detection function into the security module of the kernel module of the operating system.

[0091] In one embodiment, when the operating system is a Linux system, a module 402 is added, which is specifically used to register the permission detection function into a lightweight universal access control framework of the Linux system.

[0092] In one embodiment, the detection module 403 is specifically used to determine the processes generated during the running of the program to be detected; for each process, obtain the capability information corresponding to the process through the permission detection function; and parse the capability information corresponding to each process to obtain the capability information corresponding to the program to be detected.

[0093] In one embodiment, the parsing module 404 is specifically used to filter the capability information of the program to be detected based on the filtering conditions to obtain candidate capability information; deduplicate the candidate capability information to obtain the capability detection result of the program to be detected; and the capability detection result represents the minimum capability strategy of the program to be detected.

[0094] In one embodiment, the capability detection device further includes a backup module, which is used to back up the default capabilities of the program to be detected and obtain a default capability backup file of the program to be detected.

[0095] In one embodiment, the capability detection device further includes a restoration module, which is used to restore the capability configuration information corresponding to the program to be detected according to the default capability backup file of the program to be detected.

[0096] It should be understood that the units or modules described in the capability detection device are similar to those described in the reference Figure 1 The various steps in the described method correspond to each other. Therefore, the operations and features described above for the method are also applicable to the capability detection device and the units contained therein, and will not be repeated here. The capability detection device can be pre-implemented in a browser or other security application of an electronic device, or can be loaded into a browser or its security application of an electronic device by downloading or the like. The corresponding units in the capability detection device can cooperate with the units in the electronic device to implement the scheme of the embodiment of the present application.

[0097] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 500 of a terminal device or server suitable for implementing an embodiment of the present application.

[0098] like Figure 6As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0099] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0100] In particular, according to the embodiments of the present disclosure, the above reference Figure 1 The described processes may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising a computer program for executing Figure 1 In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 509 , and / or installed from the removable medium 511 .

[0101] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium such as a computer-readable storage medium that can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0102] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a different order from the order marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] The units or modules involved in the embodiments described in the present application may be implemented by software or by hardware. The units or modules described may also be arranged in a processor, for example, it may be described as: a processor includes XX unit, YY unit and ZZ unit. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0104] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the computer device described in the above embodiment, or may exist independently without being installed in the computer device. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the method described in the present application. For example, it can be executed Figure 1 The individual steps of the method are shown.

[0105] The present application embodiment provides a computer program product, which includes instructions. When the instructions are executed, the method described in the present application embodiment is executed. For example, Figure 1 The individual steps of the method are shown.

[0106] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0107] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the present application.

Claims

1. A capability detection method, characterized in that: The method comprises: Configure all permissions of the operating system for the program to be detected, and load the kernel module of the operating system; Adding a permission detection function to a kernel module of the operating system; Run the program to be detected, and obtain capability information of the program to be detected through the permission detection function, and store the capability information in a pre-created storage space; the capability information includes the capability of the program to be detected, and the capability represents the authority of the program to be detected in the operating system; Parsing the capability information to obtain a capability detection result of the program to be detected; the capability detection result represents a minimum capability strategy of the program to be detected, and the minimum capability strategy is the minimum authority required for the normal operation of the program to be detected; The step of adding the permission detection function to the kernel module of the operating system comprises: The permission detection function is registered in the security module of the kernel module of the operating system.

2. The method according to claim 1, characterized in that When the operating system is a Linux system, registering the permission detection function in a security module of a kernel module of the operating system includes: Register the permission detection function into the lightweight universal access control framework of the Linux system.

3. The method according to claim 1, characterized in that The obtaining capability information of the process corresponding to the program through the permission detection function includes: Determine the process generated during the running of the program to be detected; For each of the processes, obtaining capability information corresponding to the process through the permission detection function; The capability information corresponding to each of the processes is parsed to obtain the capability information corresponding to the program to be detected.

4. The method according to claim 1, characterized in that: The parsing of the capability information to obtain the capability detection result of the program to be detected includes: Screening the capability information of the program to be detected based on the screening conditions to obtain candidate capability information; The candidate capability information is deduplicated to obtain a capability detection result of the program to be detected.

5. The method according to claim 1, characterized in that Before configuring all permissions of the operating system for the program to be detected, the method further includes: The default capability of the program to be detected is backed up to obtain a default capability backup file of the program to be detected.

6. The method according to claim 5, characterized in that After obtaining the capability test result of the program to be tested, the method further includes: The capability configuration information corresponding to the program to be detected is restored according to the default capability backup file of the program to be detected.

7. A capability detection device, characterized in that: The device comprises: A configuration module, used to configure all permissions of the operating system for the program to be detected and load the kernel module of the operating system; Adding a module, used to add a permission detection function to the kernel module of the operating system; A detection module, used for running the program to be detected, obtaining capability information of the program to be detected through the permission detection function, and storing the capability information in a pre-created storage space; the capability information includes the capability of the program to be detected, and the capability represents the authority of the program to be detected in the operating system; A parsing module, used to parse the capability information to obtain a capability test result of the program to be tested; the capability test result represents a minimum capability strategy of the program to be tested, and the minimum capability strategy is the minimum authority required for the normal operation of the program to be tested; The adding module is specifically used to register the permission detection function into the security module of the kernel module of the operating system.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images