Process protection method and device of Linux system, equipment and storage medium

Abstract

The invention discloses a process protection method and device of a Linux system, equipment and a storage medium, and belongs to the field of process protection. The method comprises the following steps: acquiring a protection process list and a privileged process list which are maintained in real time; wherein the privileged process list contains a plurality of privileged processes for normally ending the protection process; intercepting a behavior of stopping the target process by the user in real time by utilizing a hook function; and based on the protection process list and the privileged process list, judging whether the behavior has the right to stop the target process or not. According to the method and the device, a specific process can be accurately protected from being maliciously killed, and the process can be normally ended in a scene required by production. Besides, during the first use and any subsequent operation time, the protection and normal exit of each process can be realized only by maintaining the protection process list and the privileged process list at any time, so that the use is convenient and flexible, and the universality is high.

Description

Technical Field

[0001] The present invention relates to the technical field of process protection, and in particular to a process protection method, device, equipment and storage medium for a Linux system. Background Art

[0002] At present, most industries use Linux operating system for production automation control, so the process security based on Linux operating system is particularly important. The necessary processes required for production are running on the server. In order to prevent the process from being killed without knowing it and affecting business and production, a process protection mechanism needs to be set up.

[0003] However, the existing process protection method of Linux system is not flexible enough and does not have universality, and only proposes a method for protecting the process, but does not provide a method for terminating the process under normal user authorization.

[0004] Therefore, there is an urgent need to provide a new process protection method for Linux system. Summary of the invention

[0005] In order to solve the problem that the existing process protection method of Linux system is not universal and cannot end the process under normal user authorization, the embodiment of the present invention provides a process protection method, device, equipment and storage medium of Linux system.

[0006] On the one hand, a process protection method for a Linux system is provided, the method comprising:

[0007] Acquire a protected process list and a privileged process list maintained in real time; wherein the privileged process list contains a number of privileged processes for causing the protected process to terminate normally;

[0008] Use the hook function to intercept the user's behavior of stopping the target process in real time;

[0009] Based on the protection process list and the privileged process list, it is determined whether the behavior has the right to stop the target process.

[0010] On the other hand, a process protection device for a Linux system is provided, which is used to implement the steps described in any method embodiment of the specification, and the device includes:

[0011] An acquisition unit, used for acquiring a protected process list and a privileged process list maintained in real time; wherein the privileged process list contains a number of privileged processes for causing the protected process to terminate normally;

[0012] The interception unit is used to intercept the user's behavior of stopping the target process in real time by using the hook function;

[0013] A judging unit is used to judge whether the behavior has the right to stop the target process based on the protected process list and the privileged process list.

[0014] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method.

[0015] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0016] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0017] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0018] The kernel obtains the latest protection process list and privileged process list in real time, uses the hook function to intercept the behavior of stopping the target process, and judges whether to allow the behavior to kill the target process according to the process protection list and the privileged process list, thereby achieving the purpose of protecting the process, and also supports authorized privileged processes to kill protected processes in the protection process list. The present invention can not only accurately protect specific processes from being maliciously killed, but also terminate the process normally in the scenario required by production. In addition, during the first use and any subsequent running time, it only needs to maintain the protection process list and the privileged process list at any time to achieve the protection and normal exit of each process. It is convenient and flexible to use and has high versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 This is a flow chart of a process protection method for a Linux system provided by an embodiment of the present invention;

[0021] Figure 2 This is a structural diagram of a process protection device for a Linux system provided by an embodiment of the present invention;

[0022] Figure 3It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] The specific implementation of the above concept is described below.

[0025] Please refer to Figure 1 , an embodiment of the present invention provides a process protection method for a Linux system, the method comprising:

[0026] Step 100: obtaining a protected process list and a privileged process list maintained in real time; wherein the privileged process list contains a number of privileged processes for causing the protected process to terminate normally;

[0027] Step 102: using the hook function to intercept the user's behavior of stopping the target process in real time;

[0028] Step 104: Based on the protection process list and the privileged process list, determine whether the behavior has the right to stop the target process.

[0029] As mentioned above, there are two process protection methods in the prior art. First, the process protection identifier is written into the elf data segment of the program file. When the program file is executed, the kernel needs to read the file content to obtain the elf data segment information, so as to achieve the purpose of protecting the process. This method requires the kernel to read the file content to identify the protected process when the program is executed, which will greatly increase the system overhead and affect the system performance; and this method can only protect processes in a specific elf format specified by the method. The elf data segment can be set when the program file is generated. When it is used later, it is very inconvenient to add the protection identifier to the elf data segment. Therefore, it is not flexible enough to use and is not universal. At the same time, this method only proposes a method for protecting the process, so there is no method for ending the process under normal user authorization.

[0030] Secondly, the process name is randomly selected through the system core process, and the process name is modified by calling to disguise the process name, so that the intruder cannot query the process through top, ps, ls conventional means, and then cannot kill the process through killall and kill, thereby achieving the protection purpose. This method is not suitable for illegal operations by users familiar with the Linux system. They can directly go to the data source of ps to check, which will cause the problem of disguise failure; and this method is only for the system-specific built-in hidden function to open the mark, which is not universal. At the same time, this method only proposes a method to protect the process, and does not provide a method to end the process under normal user authorization.

[0031] In an embodiment of the present invention, the kernel obtains the latest protection process list and privileged process list in real time, uses a hook function to intercept the behavior of stopping the target process, and determines whether the behavior is allowed to kill the target process based on the process protection list and the privileged process list, thereby achieving the purpose of protecting the process, and also supports authorized privileged processes to kill protected processes in the protection process list. The present invention can not only accurately protect specific processes from being maliciously killed, but also terminate the process normally in the scenario required by production. In addition, during the first use and any subsequent running time, it only needs to maintain the protection process list and the privileged process list at any time to achieve the protection and normal exit of each process, which is convenient and flexible to use and has high versatility.

[0032] Described below Figure 1 How the various steps are performed.

[0033] For step 100:

[0034] In this embodiment, the protected process list can achieve the purpose of protecting the processes in the list, which means that the processes in the protected process list need to be protected and cannot be killed. The privileged process in the privileged process list can kill the protected process in the protected process list, allowing the process to exit normally.

[0035] In some implementations, the protected process list is maintained as follows:

[0036] When generating the list of protected processes for the first time, scan the system in a safe state;

[0037] For each process running in the system, the process ID of the process is obtained from the proc file system of the Linux system, and the process ID is added to the protected process list; the process includes user processes and system processes;

[0038] During subsequent operation, the user adds the process name and process number to the protected process list to perform real-time maintenance of the protected process list.

[0039] In this embodiment, a protection process list can be generated by automatically adding process numbers and manually adding them. At any subsequent running time, you only need to manually add protection processes at any time to achieve accurate protection of each process. It is easy and flexible to use and has high versatility.

[0040] In some implementations, privileged processes in the privileged process list are modified, added, and deleted by administrators and users.

[0041] In this embodiment, at any running time, each protected process can be normally exited simply by manually adding a privileged process, which is convenient and flexible to use and has high versatility.

[0042] Regarding step 102:

[0043] In some implementations, the hook function is set as follows:

[0044] The kernel enters the syscall hander through the system soft terminal and searches the system global sys_call_table call table;

[0045] Modify the function address of the call table to add a hook function for intercepting the user's behavior of stopping the process.

[0046] In this embodiment, the kernel enters the syscall hander through the system soft terminal, and then enters the global system call table sys_call_table to find the specific system call, and adds a hook function by modifying the function address of the system call table to intercept the user's behavior of stopping the target process, such as kill, killall and other command behaviors.

[0047] Regarding step 104:

[0048] In some implementations, step 104 may include:

[0049] Based on the privileged process list, determine whether the parent process of the behavior is a privileged process;

[0050] If it is a privileged process, the behavior is executed;

[0051] Otherwise, based on the protected process list, determine whether the target process is a protected process;

[0052] If it is a protected process, the action is refused to be executed;

[0053] If it is not a protected process, then execute the action.

[0054] In this embodiment, it is first determined whether the parent process of the behavior is a privileged process. If so, it means that the behavior has been authorized to execute so that the target process ends normally. If not, it is also necessary to determine whether the target process is a protected process. If so, it means that the target process needs to be protected, and the behavior is not authorized by the privileged process, so the behavior cannot kill the target process. If it is not a protected process, it means that the target process is not a process that needs to be protected, and the behavior can kill the target process.

[0055] In some implementations, step 104 may include:

[0056] Based on the privileged process list, determine whether the parent process of the behavior is a privileged process;

[0057] If it is a privileged process, the behavior is executed;

[0058] Otherwise, based on the protected process list, determine whether the target process is a protected process;

[0059] If it is a protected process, the action is refused to be executed;

[0060] If it is not a protection process, no intervention will be made and the behavior will be released. The original behavior processing flow will decide whether to execute it.

[0061] It should be noted that this solution intercepts the user's behavior of stopping the target process, and uses the protection process list and the privileged process list to determine whether the behavior can be executed. The behavior can be executed or not directly based on the judgment result, or the behavior can be released without action, allowing it to continue to enter the processing flow of the original behavior in the system sys_call_table, and the system decides whether to execute the behavior or not.

[0062] Since the system may determine whether the target process is a fixed system process, such processes cannot be killed anyway. Therefore, if the parent process of the behavior is not a privileged process and the target process is not a protected process, no intervention is required and the behavior is released directly. The original behavior processing flow of the system determines whether the behavior is executed. Therefore, this solution is suitable for business production environments in various scenarios and has the characteristics of high efficiency and security.

[0063] Please refer to Figure 2 The embodiment of the present invention provides a process protection device for a Linux system, which is used to implement the steps of any method embodiment in the specification, and the device includes:

[0064] The acquisition unit 201 is used to acquire a protected process list and a privileged process list maintained in real time; wherein the privileged process list contains a number of privileged processes used to terminate the protected process normally;

[0065] The interception unit 202 is used to intercept the user's behavior of stopping the target process in real time by using a hook function;

[0066] The judgment unit 203 is used to judge whether the behavior has the right to stop the target process based on the protection process list and the privileged process list.

[0067] In one embodiment of the present invention, the protected process list in the acquisition unit 201 is maintained in the following manner:

[0068] When generating the list of protected processes for the first time, scan the system in a safe state;

[0069] For each process running in the system, the process ID of the process is obtained from the proc file system of the Linux system, and the process ID is added to the protected process list; the process includes user processes and system processes;

[0070] During subsequent operation, the user adds the process name and process number to the protected process list to perform real-time maintenance of the protected process list.

[0071] In one embodiment of the present invention, the privileged processes in the privileged process list of the acquisition unit 201 are modified, added, and deleted by administrators and users.

[0072] In one embodiment of the present invention, the hook function of the interception unit 202 is set in the following manner:

[0073] The kernel enters the syscall hander through the system soft terminal and searches the system global sys_call_table call table;

[0074] Modify the function address of the call table to add a hook function for intercepting the user's behavior of stopping the process.

[0075] In one embodiment of the present invention, the determination unit 203 is configured to execute:

[0076] Based on the privileged process list, determine whether the parent process of the behavior is a privileged process;

[0077] If it is a privileged process, the behavior is executed;

[0078] Otherwise, based on the protected process list, determine whether the target process is a protected process;

[0079] If it is a protected process, the action is refused to be executed;

[0080] If it is not a protected process, then execute the action.

[0081] In one embodiment of the present invention, the determination unit 203 is configured to execute:

[0082] Based on the privileged process list, determine whether the parent process of the behavior is a privileged process;

[0083] If it is a privileged process, the behavior is executed;

[0084] Otherwise, based on the protected process list, determine whether the target process is a protected process;

[0085] If it is a protected process, the action is refused to be executed;

[0086] If it is not a protection process, no intervention will be made and the behavior will be released. The original behavior processing flow will decide whether to execute it.

[0087] It should be noted that the process protection device for the Linux system provided in the above embodiment is only illustrated by the division of the above functional units. In actual applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. In addition, the above device embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0088] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the process protection method of the Linux system provided by the above-mentioned method embodiments.

[0089] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the process protection method of the Linux system provided by the above-mentioned method embodiments.

[0090] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the process protection method of the Linux system in any of the above embodiments.

[0091] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0092] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application or some parts of the embodiments.

[0093] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0094] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A process protection method for a Linux system, characterized in that: The method comprises: Acquire a protected process list and a privileged process list maintained in real time; wherein the privileged process list contains a number of privileged processes for causing the protected process to terminate normally; Use the hook function to intercept the user's behavior of stopping the target process in real time; Based on the protection process list and the privileged process list, it is determined whether the behavior has the right to stop the target process.

2. The method according to claim 1, characterized in that The protected process list is maintained in the following manner: When generating the list of protected processes for the first time, scan the system in a safe state; For each process running in the system, the process ID of the process is obtained from the proc file system of the Linux system, and the process ID is added to the protected process list; wherein the process includes user processes and system processes; During subsequent operation, the user adds the process name and process number to the protected process list to perform real-time maintenance of the protected process list.

3. The method according to claim 1, characterized in that The privileged processes in the privileged process list are modified, added, and deleted by administrators and users.

4. The method according to claim 1, characterized in that The hook function is set as follows: The kernel enters the syscall hander through the system soft terminal and searches the system global sys_call_table call table; The function address of the call table is modified to add a hook function for intercepting the user's behavior of stopping the process.

5. The method according to claim 1, characterized in that The determining whether the behavior has the right to stop the target process based on the protected process list and the privileged process list includes: Based on the privileged process list, determining whether the parent process of the behavior is a privileged process; If it is a privileged process, the above behavior is executed; Otherwise, based on the protected process list, determining whether the target process is a protected process; If it is a protected process, refuse to perform the described behavior; If it is not a protected process, the above behavior is performed.

6. The method according to claim 1, characterized in that The determining whether the behavior has the right to stop the target process based on the protected process list and the privileged process list includes: Based on the privileged process list, determining whether the parent process of the behavior is a privileged process; If it is a privileged process, the above behavior is executed; Otherwise, based on the protected process list, determining whether the target process is a protected process; If it is a protected process, refuse to perform the described behavior; If it is not a protection process, no intervention is made and the behavior is released, and the original behavior processing flow determines whether to execute it.

7. A process protection device for a Linux system, used to implement the steps of the method described in any one of claims 1 to 6, characterized in that: The device comprises: An acquisition unit, used for acquiring a protected process list and a privileged process list maintained in real time; wherein the privileged process list contains a number of privileged processes for causing the protected process to terminate normally; The interception unit is used to intercept the user's behavior of stopping the target process in real time by using the hook function; A judging unit is used to judge whether the behavior has the right to stop the target process based on the protected process list and the privileged process list.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-6.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images