Permission configuration method and device, electronic equipment and computer program product

Abstract

The embodiment of the invention discloses a permission configuration method and device, electronic equipment and a computer program product. The method comprises the following steps: creating a first scheduling object in a virtual machine; configuring a first access permission of the first scheduling object corresponding to a first data resource in the virtual machine; other scheduling objects in the virtual machine do not have the authority of accessing the first data resource; configuring a second access permission of the first scheduling object corresponding to a second data resource in the virtual machine; at least one other scheduling object in the virtual machine has the authority of accessing the second data resource. According to the permission configuration method and device, the electronic equipment and the computer program product, safe and isolated environments are set for the multiple scheduling objects in the same virtual machine, resources occupied by safe operation of the scheduling objects are effectively reduced, and the performance of the electronic equipment is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a permission configuration method, device, electronic device and computer program product. Background Art

[0002] In order to improve the operational security of electronic devices, a secure and isolated virtual environment can be created in the operating system of the electronic device based on virtualization technology, and applications and / or system services can be run in a secure and isolated virtual environment to prevent potential security threats. The current security isolation solution has the problem of occupying too many resources. Summary of the invention

[0003] The embodiments of the present application disclose a permission configuration method, device, electronic device and computer program product, which can respectively set up a secure and isolated environment for multiple scheduling objects in the same virtual machine, effectively reduce the resources occupied by the safe operation of the scheduling objects, and improve the performance of the electronic device.

[0004] The present application discloses a permission configuration method, including:

[0005] Creating a first scheduling object in the virtual machine;

[0006] configuring a first access permission corresponding to the first data resource in the virtual machine and the first scheduling object; other scheduling objects in the virtual machine do not have the permission to access the first data resource;

[0007] The first scheduling object is configured with a second access permission corresponding to a second data resource in the virtual machine; and at least one other scheduling object in the virtual machine has permission to access the second data resource.

[0008] The present application discloses a permission configuration device, which includes:

[0009] A creation module, used to create a first scheduling object in the virtual machine;

[0010] a permission configuration module, configured to configure a first access permission corresponding to the first scheduling object and the first data resource in the virtual machine; other scheduling objects in the virtual machine do not have permission to access the first data resource;

[0011] The permission configuration module is further used to configure the second access permission corresponding to the first scheduling object and the second data resource in the virtual machine; there is at least one other scheduling object in the virtual machine that has the permission to access the second data resource.

[0012] An embodiment of the present application discloses an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor implements the method described above.

[0013] An embodiment of the present application discloses a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method described above is implemented.

[0014] An embodiment of the present application discloses a computer program product, including a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0015] The permission configuration method, device, electronic device and computer program product disclosed in the embodiment of the present application, create a first scheduling object in a virtual machine, configure the first scheduling object and the first data resource in the virtual machine with a first access right, and other scheduling objects in the virtual machine do not have the right to access the first data resource, and configure the first scheduling object and the second access right corresponding to the second data resource in the virtual machine, and at least one other scheduling object in the virtual machine has the right to access the second data resource. In the embodiment of the present application, for the first data resource of the privacy of the first scheduling object, only the first scheduling object itself is configured to have the corresponding first access right, which can avoid tampering with the privacy of the first data resource by other scheduling objects in the virtual machine, and can set a safe and isolated environment for the first scheduling object, so that it can be realized that multiple scheduling objects are run in the virtual machine and a safe and isolated environment is set for each scheduling object respectively, and there is no need to create and start a virtual machine for each scheduling object separately, which can effectively reduce the resources occupied by the safe operation of the scheduling object, and by configuring the second access right of multiple scheduling objects in the virtual machine to the shared second data resource, multiple scheduling objects can access the shared second data resource, which can effectively save the occupied storage space, further reduce the resources occupied by running multiple scheduling objects, and improve the performance of the electronic device. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1A An application scenario diagram of a permission configuration method in an embodiment;

[0018] Figure 1B A system architecture diagram of a method for configuring permissions in an embodiment;

[0019] Figure 1C A schematic diagram of permissions of various scheduling objects in a virtual machine to data resources in one embodiment;

[0020] Figure 2 A flowchart of a method for configuring permissions in one embodiment;

[0021] Figure 3 A schematic diagram of permissions of various scheduling objects in a virtual machine to data resources in another embodiment;

[0022] Figure 4 A flowchart of configuring permissions of a scheduling object in a virtual machine in one embodiment;

[0023] Figure 5 A flowchart of configuring a first access permission corresponding to a first scheduling object and a first data resource in a virtual machine in one embodiment;

[0024] Figure 6 A flowchart of configuring access rights to a scheduling object and a shared second data resource in a virtual machine in one embodiment;

[0025] Figure 7 A block diagram of a permission configuration device in an embodiment;

[0026] Figure 8 FIG. 4 is a structural block diagram of an electronic device in an embodiment. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0029] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first scheduling object may be referred to as a second scheduling object, and similarly, a second scheduling object may be referred to as a first scheduling object. Both the first scheduling object and the second scheduling object are scheduling objects, but they are not necessarily the same scheduling object. The term "plurality" used in this application refers to two or more. The term "and / or" used in this application refers to one of the schemes, or any combination of multiple schemes.

[0030] The following are some explanations and descriptions of some terms that may be involved in this application:

[0031] Process: It is an operation of a program in a computer on a certain data set and is the basic unit for resource allocation and scheduling in the system.

[0032] Thread: It is the smallest unit that the operating system can schedule operations on and is usually included in a process.

[0033] Task: It refers to the basic working unit scheduled and managed by the operating system, which is used to execute specific programs or operations. A task can be a process or a thread.

[0034] Virtual machine: refers to a computer system that has complete hardware system functions and runs in a completely isolated environment, simulated by software.

[0035] RBAC (Role-Based Access Control): manages the permissions of users (such as user processes) by defining roles. Users (such as user processes) are assigned to one or more roles, and roles have specific access rights.

[0036] MAC (Mandatory Access Control): A type of access control constrained by the operating system, the goal of which is to limit the ability of a subject or initiator to access or perform certain operations on an object.

[0037] In related technologies, in order to improve the operational security of electronic devices, a secure and isolated virtual environment can be created in the operating system of the electronic device based on virtualization technology, and applications and / or system services can be placed in a secure and isolated virtual environment for operation. Taking the AVF (Android Virtualization Framework) provided by the Android operating system as an example, AVF provides a technical solution that can realize a lightweight, secure and isolated virtual environment.

[0038] In the current security isolation solution, only one application is supported to create and start one virtual machine. That is, when multiple applications need to run in a secure and isolated environment, multiple independent virtual machines need to be started, and each virtual machine runs a scheduling object (such as running a process or executing a task, etc.), thereby providing a secure and isolated environment for the business. However, starting multiple independent virtual machines will result in a large consumption of resources such as storage space (such as disk, memory, etc.), and different scheduling objects need to communicate across virtual machines, which makes the communication between scheduling objects complicated.

[0039] The embodiments of the present application disclose a permission configuration method, device, electronic device, and computer program product, which respectively set up a secure and isolated environment for multiple scheduling objects in the same virtual machine, effectively reducing the resources occupied by the safe operation of the scheduling objects and improving the performance of the electronic device. In addition, multiple scheduling objects of the same virtual machine do not need to communicate across virtual machines, reducing the complexity of communication between scheduling objects.

[0040] Figure 1A FIG. 1 is an application scenario diagram of a method for configuring permissions in an embodiment. Figure 1A As shown, the permission configuration method can be applied to electronic devices 100, which may include but are not limited to mobile phones, wearable devices (such as smart watches, smart glasses, etc.), vehicle-mounted terminals, tablet computers, laptops, PCs (Personal Computers), smart home devices (such as smart speakers, smart lights, smart door locks, etc.), and other devices.

[0041] Optionally, the electronic device 100 may be installed with an operating system, which may include but is not limited to one or more of Android, Linux, IOS, Windows, RTOS (Real Time Operate System), FreeRTOS, etc.

[0042] Figure 1B FIG. 1 is a system architecture diagram of a method for configuring permissions in an embodiment. Figure 1B As shown, a virtual machine 110 can be started and run in the electronic device 100. The virtual machine 110 has independent operating resources, such as memory resources, processor resources, etc. An independent operating system can be run in the virtual machine 110. For example, the operating system running in the virtual machine 110 can be any one of Android, Linux, IOS, Windows, real-time operating system RTOS, FreeRTOS, etc.

[0043] One or more scheduling objects 112 may be created and run in the virtual machine 110. The scheduling object 112 may refer to an object managed and scheduled by the operating system in the virtual machine 110. For example, the scheduling object 112 may include a process, a task, or a thread. Optionally, the scheduling object 112 may be different for different operating systems. For example, if a relatively complex operating system such as Android, Linux, IOS, or Windows is run in the virtual machine 110, the scheduling object 112 may be a process. If a lightweight operating system such as RTOS or FreeRTOS is run in the virtual machine 110, the scheduling object 112 may be a task or a thread, but is not limited thereto. The operating system of the virtual machine 110 may ensure the normal operation of the application and / or system services by managing and scheduling one or more scheduling objects 112.

[0044] In the embodiment of the present application, each time a scheduling object 112 is created in the virtual machine 110, the corresponding permissions of the scheduling object 112 may be allocated. Taking the creation of the first scheduling object in the virtual machine 110 as an example, the first access permission corresponding to the first data resource in the virtual machine 110 may be configured for the first scheduling object. The first data resource may be understood as a data resource that is private to the first scheduling object, and no other scheduling object in the virtual machine 110 has the permission to access the first data resource. The second access permission corresponding to the second data resource in the virtual machine 110 may also be configured for the first scheduling object. The second data resource may be understood as a shared data resource, and at least one other scheduling object in the virtual machine 110 has the permission to access the second data resource.

[0045] For example, Figure 1C FIG. 1 is a schematic diagram of the permissions of each scheduling object in a virtual machine to data resources in an embodiment. Figure 1CAs shown, each scheduling object 112 in the virtual machine 110 has access rights to private data resources, and different scheduling objects 112 cannot access each other's private data resources. For example, scheduling object 1 has access rights to private data resource 1, and other scheduling objects (such as scheduling object 2) do not have access rights to private data resource 1; scheduling object 2 has access rights to private data resource 2, and other scheduling objects (such as scheduling object 1) do not have access rights to private data resource 1. At the same time, multiple scheduling objects 112 in the virtual machine 110 can access shared data resources, for example, both scheduling object 1 and scheduling object 2 can access shared data resources. A safe and isolated environment can be set for each scheduling object 112 in the virtual machine 110, and there is no need to create and start a virtual machine for each scheduling object separately, thereby effectively reducing the resources occupied by the safe operation of the scheduling object, and multiple scheduling objects 112 in the virtual machine 110 can access shared data resources, which can effectively save the occupied storage space, further reduce the resources occupied by running multiple scheduling objects, and improve the performance of the electronic device.

[0046] like Figure 2 As shown, in one embodiment, a permission configuration method is provided, which can be applied to the above electronic device, and the method may include the following steps:

[0047] Step 210: Create a first scheduling object in the virtual machine.

[0048] When an electronic device starts an application or an application is running, a scheduling object is created in the virtual machine, and the scheduling object is used to execute related activities of the application to achieve different functions or services, completely specific tasks, etc. In the embodiment of the present application, the scheduling object in the virtual machine can be used as a basic unit for permission configuration. By configuring permissions for the scheduling object, a safe and isolated environment can be provided for the scheduling object to run, so as to ensure the security of the scheduling object during operation.

[0049] Optionally, the electronic device may create a scheduling object corresponding to each application and / or system service in the virtual machine when starting or executing all application programs and / or system services.

[0050] Optionally, the electronic device may also create scheduling objects corresponding to some applications and / or system services in the virtual machine when starting or executing some applications and / or system services. For example, some applications and / or system services with higher security requirements can be used as applications and / or system services that need to run in the virtual machine, and corresponding scheduling objects can be created in the virtual machine. For example, payment applications, face verification and other applications and / or system services with higher security requirements can be used as applications and / or system services that need to run in the virtual machine, but are not limited to this. It should be noted that whether the scheduling object corresponding to the application or system service needs to run in the virtual machine can be set according to actual business needs and is not limited here.

[0051] In some embodiments, the scheduling objects running in the virtual machine may include processes, tasks, or threads, etc. Furthermore, since different operating systems have different basic units for management and scheduling, the scheduling objects for permission configuration in the virtual machine may also be different if the operating system running in the virtual machine is a relatively complex operating system such as Android, Linux, IOS, Windows, etc., then the scheduling object for permission configuration in the virtual machine may be a process; if the operating system running in the virtual machine is a lightweight operating system such as RTOS, FreeRTOS, etc., then the scheduling object for permission configuration in the virtual machine may be a task or thread. It can adapt to the needs of different operating systems, and for lightweight operating systems such as RTOS, FreeRTOS, etc., it can also provide a safe and isolated environment for scheduling objects, and the solution has wider adaptability.

[0052] Step 220, configure a first access permission corresponding to a first data resource in a first scheduling object and a virtual machine; other scheduling objects in the virtual machine do not have permission to access the first data resource.

[0053] For a newly created scheduling object in a virtual machine, the permissions of the scheduling object may be configured, and the permissions may refer to the permissions of the scheduling object to access data resources in the virtual machine, and the data resources may refer to data such as directories and / or files in the virtual machine. Configuring the permissions of the scheduling object may include configuring the permissions of the scheduling object to its own private data resources and / or configuring the permissions of the scheduling object to shared data resources.

[0054] Taking the creation of a first scheduling object in a virtual machine as an example, the first scheduling object can be any scheduling object created in the virtual machine, for example, any process created in the virtual machine, or any task created in the virtual machine, etc., and the first access permission corresponding to the first data resource in the virtual machine can be configured for the first scheduling object. The first data resource can be a private data resource of the first scheduling object itself, and other scheduling objects in the virtual machine do not have the permission to access the first data resource.

[0055] The first access permission may refer to the permission of the first scheduling object to access the first data resource. Furthermore, for different access operations, the access operations allowed by the first scheduling object to the first data resource may be configured. Exemplarily, the access operations to the data resource may include but are not limited to one or more of a read operation, a write operation, and an execute operation, wherein a read operation refers to reading data from a data resource (such as a directory or a file), a write operation refers to writing new data to a data resource (such as a directory or a file), and an execute operation may refer to executing a file in a data resource.

[0056] The first access right of the first scheduling object to the first data resource may be configured, including the permission to allow the first scheduling object to perform all access operations on the first data resource; or the first access right of the first scheduling object to the first data resource may be configured, including the permission to allow the first scheduling object to perform partial access operations on the first data resource. The specific access right may be configured according to actual business needs and is not limited here.

[0057] Step 230, configure the first scheduling object and the second access permission corresponding to the second data resource in the virtual machine; there is at least one other scheduling object in the virtual machine that has the permission to access the second data resource.

[0058] When the virtual machine creates the first scheduling object, it can also configure the second access permission corresponding to the second data resource of the first scheduling object, wherein the second access permission may refer to the permission of the first scheduling object to access the second data resource.

[0059] The second data resource may refer to data resources shared in the virtual machine, such as shared directories, files and other resources, such as shared libraries that can be loaded and run by multiple scheduling objects. The shared library may be a library file of the operating system, which may contain functions, variables or other resources that can be used simultaneously by multiple programs without having to compile these resources into the executable file of each program separately.

[0060] There may also be at least one other scheduling object in the virtual machine that has the authority to access the second data resource, which means that multiple scheduling objects in the virtual machine are allowed to access the second data resource. Optionally, the second data resource can be a data resource accessible to all scheduling objects in the virtual machine, or it can be a data resource shared by some scheduling objects in the virtual machine, which is not limited here. In the related art, only the scheduling object that creates the shared data resource (such as the process that creates the directory of the shared library) has access rights to the shared data resource, and other processes have no access rights to the shared data resource. In the embodiment of the present application, by configuring the access rights of each scheduling object in the virtual machine to the shared data resource, multiple scheduling objects can access the shared data resource, thereby saving memory space and disk space.

[0061] In some embodiments, for different access operations, the access operations allowed by the first scheduling object to the second data resource can be configured. The second access permission of the first scheduling object to the second data resource can be configured, including the permission to allow the first scheduling object to perform all access operations on the second data resource; or, the second access permission of the first scheduling object to the second data resource can be configured, including the permission to allow the first scheduling object to perform partial access operations on the second data resource. The specific access permission can be configured according to actual business needs and is not limited here.

[0062] Optionally, the first access permission of the first scheduling object to the first data resource may be the same as or different from the second access permission of the first scheduling object to the second data resource. For example, the first access permission may include a read permission and a write permission, and / or the second access permission may include a read permission and an execute permission.

[0063] The first scheduling object has read and write permissions for its own private first data resource, so the first scheduling object can read data from the first data resource and write new data to the first data resource, ensuring that the first scheduling object can perform business processing and not allowing other scheduling objects to access the first data resource, thereby achieving effective isolation of data resources, and other scheduling objects will not tamper with the first data resource of the first scheduling object's privacy, thereby setting up a safe and isolated environment for the first scheduling object. The first scheduling object has read and execute permissions for the shared second data resource, so the first scheduling object can read and execute the shared second data resource, which can facilitate the first scheduling object to load and run shared libraries and other data resources, saving the storage space occupied by the virtual machine.

[0064] For example, Figure 3 FIG. 1 is a schematic diagram of the permissions of each scheduling object in a virtual machine to data resources in another embodiment. Figure 3As shown, each scheduling object in the virtual machine 110 has the read permission and write permission to the private data resource. For example, scheduling object 1 has the read permission and write permission to the private data resource 1, and other scheduling objects (such as scheduling object 2) do not have the access permission to the private data resource 1. At the same time, multiple scheduling objects in the virtual machine 110 have the read permission and execution permission to the shared data resources. For example, scheduling object 1 and scheduling object 2 both have the read permission and execution permission to the shared data resources. For different data resources, the access permission of the scheduling object to different data resources is flexibly configured to ensure the normal processing and operation of the business by the scheduling object.

[0065] It should be noted that the sequence of steps for configuring the first access permission corresponding to the first scheduling object and the first data resource and configuring the second access permission corresponding to the first scheduling object and the second data resource is not limited in the embodiments of the present application. For example, the first access permission may be configured first and then the second access permission, or the second access permission may be configured first and then the first access permission, or both may be configured at the same time.

[0066] In some embodiments, multiple scheduling objects running in the virtual machine may belong to the same application; and / or, there are at least two objects in the virtual machine that belong to different applications.

[0067] Exemplarily, the operating system running in the virtual machine may be a lightweight operating system such as FreeRTOS. The FreeRTOS may be regarded as an application program that implements management and scheduling using tasks as scheduling units. The multiple scheduling objects running in the virtual machine may be multiple tasks and may be considered to belong to the same application program.

[0068] Exemplarily, the operating system running in the virtual machine may be a complex operating system such as Android, in which multiple applications may be installed, and each application may create a corresponding process when it is started. Then, the multiple scheduling objects running in the virtual machine may be multiple processes, and the multiple processes may belong to different applications respectively, or some processes may belong to the same application, etc., which are not limited here. It is realized that multiple scheduling objects of one or more applications are run in the virtual machine, and a safe and isolated environment is set for each scheduling object respectively. It is not necessary to create and start a virtual machine separately for each scheduling object or each application, which can effectively reduce the resources occupied by the safe operation of the scheduling object.

[0069] Moreover, since multiple scheduling objects can be placed in one virtual machine to run, the complexity of communication between multiple scheduling objects can also be simplified. Optionally, the communication method between multiple scheduling objects running in the virtual machine is not limited here. For example, the communication between multiple scheduling objects can be achieved through any method such as pipes, shared memory, message queues, etc., but is not limited thereto.

[0070] In an embodiment of the present application, for the private first data resource of the first scheduling object, only the first scheduling object itself is configured with the corresponding first access right, so that other scheduling objects in the virtual machine can be prevented from tampering with the private first data resource, and a safe and isolated environment can be set for the first scheduling object, so that multiple scheduling objects can be run in the virtual machine and a safe and isolated environment can be set for each scheduling object respectively. There is no need to create and start a virtual machine separately for each scheduling object, which can effectively reduce the resources occupied by the safe operation of the scheduling objects, and by configuring the second access rights of multiple scheduling objects in the virtual machine to the shared second data resources, multiple scheduling objects can access the shared second data resources, which can effectively save the occupied storage space, further reduce the resources occupied by running multiple scheduling objects, and improve the performance of the electronic device.

[0071] In some embodiments, Figure 4 As shown, configuring the permissions of the scheduling object in the virtual machine may include the following steps:

[0072] Step 402: store permission information corresponding to the first scheduling object in a configuration file, the permission information including object information of the first scheduling object, first resource information of a first data resource in the virtual machine, and a first access permission corresponding to the first resource information.

[0073] The configuration file may be a file for storing permission information corresponding to each scheduling object in the virtual machine. The permission information corresponding to the scheduling object may be used to describe the data resources that the scheduling object is allowed to access. When the virtual machine creates a first scheduling object, the first access permission corresponding to the first scheduling object and its own private first data resource is configured. Then, the permission information corresponding to the first scheduling object may be stored in the configuration file. The permission information corresponding to the first scheduling object may include object information of the first scheduling object, first resource information of the first data resource in the virtual machine, and first access permission corresponding to the first resource information.

[0074] The object information of the first scheduling object may include, but is not limited to, the object name of the first scheduling object, and / or the object identifier and other information. The first resource information of the first data resource may include, but is not limited to, the resource name of the first data resource (such as the directory name of the data directory to which the first data resource belongs, etc.), and / or the storage path of the first data resource (such as the path of the data directory to which the first data resource belongs, etc.). The first access permission corresponding to the first resource information may be a specific access permission of the first scheduling object to the first resource information, such as read permission, write permission, execute permission, etc. Exemplarily, permissions for different access operations may be represented by different characters, such as read permission may be represented by r, write permission may be represented by w, execute permission may be represented by x, etc.; or, read permission may be represented by 1, write permission may be represented by 2, etc., but is not limited thereto.

[0075] As an implementation method, the permission information corresponding to the first scheduling object can be stored in the configuration file according to a preset structure. For example, taking the scheduling object as a task, the permission information corresponding to the first scheduling object can be stored in the configuration file according to {"Task1", ​​{"Resource1", "rw"}}, where Task1 represents the object name of the first scheduling object, Resource1 represents the resource name of the first data resource, r represents read permission, w represents write permission, etc.

[0076] Optionally, if the first data resource of the first scheduling object itself is private, including the first data resources under multiple data directories, then for each data directory, the first resource information of the first data resource of each data directory can be saved in the above-mentioned structure. Exemplarily, the permission information corresponding to the first scheduling object can be stored in the configuration file according to {"Task1", ​​{"Resource1", "rw"}, {"Resource2", "rw"}}, then Resource1 represents the resource name of the first data resource under one data target, Resource2 represents the resource name of the first data resource under another data target, and so on. It should be noted that for the first data resources under different data directories, the corresponding first access rights can be the same or different, and can be configured according to actual needs.

[0077] Step 404: Add the second resource information of the second data resource in the virtual machine and the second access permission corresponding to the second resource information to the permission information corresponding to the first scheduling object.

[0078] When the virtual machine creates a first scheduling object, the second access permission corresponding to the first scheduling object and the shared second data resource can also be configured. The second resource information of the second data resource in the virtual machine and the second access permission corresponding to the second resource information can be added to the permission information corresponding to the first scheduling object and saved in the configuration file.

[0079] The second resource information of the second data resource may include, but is not limited to, the resource name of the second data resource (such as the directory name of the data directory to which the second data resource belongs, etc.), and / or the storage path of the second data resource (such as the path of the data directory to which the first data resource belongs, etc.). The second access permission corresponding to the second resource information may be the specific access permission of the first scheduling object to the first resource information, such as read permission, write permission, execute permission, etc.

[0080] As an implementation method, the second resource information of the second data resource in the virtual machine and the second access permission corresponding to the second resource information can be added to the preset structure corresponding to the first scheduling object mentioned above. Exemplarily, taking the scheduling object as a task, the permission information corresponding to the first scheduling object can be stored in the configuration file according to {"Task1", ​​{"Resource1", "rw"}, {"Resource3", "rx"}}, where Resource3 represents the resource name of the second data resource, r represents the read permission, x represents the execute permission, etc.

[0081] Optionally, the permission information related to the first scheduling object and the first data resource, and the permission information related to the first scheduling object and the second data resource can be stored in different structures. For example, structure 1: {"Task1", ​​{"Resource1", "rw"}}, and structure 2: {"Task1", ​​{"Resource3", "rx"}} can be stored in the configuration file.

[0082] By saving the permission information corresponding to each scheduling object in the configuration file through a preset structure, the permissions of each scheduling object running in the virtual machine can be managed more conveniently, thereby improving the accuracy of permission management.

[0083] As an implementation method, two configuration files can also be saved in the virtual machine, one of which is used to store the permission information of each scheduling object related to its own private data resources, and the other configuration file can be used to store the permission information of each scheduling object related to shared data resources. By managing the permissions of each scheduling object to private data resources and shared data resources separately through the two configuration files, the convenience and flexibility of management can be further improved, and the accuracy of permission management can be improved.

[0084] During the process of the virtual machine running the first scheduling object, the resource access of the first scheduling object can be managed based on the permission information corresponding to the first scheduling object stored in the configuration file, and the first scheduling object is only allowed to access data resources with access rights, thereby realizing effective isolation of data resources between different scheduling objects.

[0085] In an embodiment of the present application, the access rights of each scheduling object in the virtual machine to private data resources and shared data resources can be configured through a configuration file. The method of configuring permissions is simpler and more convenient. For lightweight operating systems such as FreeRTOS that do not have complex security mechanisms, a secure and isolated environment can also be provided for multiple scheduling objects running in the virtual machine, effectively reducing the possibility of mutual attacks between multiple scheduling objects. There is no need to start multiple virtual machines, which can reduce consumed resources.

[0086] In some embodiments, the permission control of the scheduling object in the virtual machine can also be implemented using the RBAC mechanism and / or the MAC mechanism. Figure 5 As shown, the step of configuring the first scheduling object and the first access permission corresponding to the first data resource in the virtual machine may include:

[0087] Step 502: Create a data directory corresponding to the first scheduling object, where the data directory includes a first data resource in the virtual machine.

[0088] When creating a first scheduling object in a virtual machine, a data directory corresponding to the first scheduling object can be created. The data directory can serve as a working directory for the first scheduling object. The data directory can include the first data resource in the virtual machine, that is, the private first data resource of the first scheduling object can be placed under the data directory.

[0089] Step 504: set the directory permission corresponding to the data directory to allow only the first scheduling object to access, and / or set the access control permission corresponding to the first scheduling object to allow access to the data directory.

[0090] The first access permission corresponding to the first scheduling object and the first data resource in the virtual machine can be configured. As an implementation, since the data directory corresponding to the first scheduling object includes the first data resource of the privacy of the first scheduling object, the directory permission corresponding to the data directory can be configured. The directory permission can refer to the permission that the directory is allowed to access or the permission that the directory is not allowed to access.

[0091] The directory permissions corresponding to the data directory corresponding to the first scheduling object can be set to allow only the first scheduling object to access it. Then other scheduling objects in the virtual machine (i.e., scheduling objects other than the first scheduling object) are not allowed to access the data directory corresponding to the first scheduling object, thereby preventing other scheduling objects in the virtual machine from tampering with the private first data resources of the first scheduling object.

[0092] As an implementation mode, the data directory corresponding to the first scheduling object may be bound to the object identifier of the first scheduling object, and the directory permission corresponding to the data directory may be set so that other scheduling objects have no access rights to the data directory.

[0093] The object identifier of the first scheduling object can be used to identify the first scheduling object, and different scheduling objects running in the virtual machine can correspond to different object identifiers. The object identifier can be a number, ID (Identity document, identity identification code), etc. Taking the scheduling object as a process as an example, the object identifier of the first scheduling object can include the UID (User ID, user ID) of the process and the GID (group ID) of the process. Optionally, the object identifier of the first scheduling object can also be the PID (Process ID, process ID) of the process, etc.

[0094] After creating the data directory corresponding to the first scheduling object, the data directory can be bound to the object identifier of the first scheduling object. For example, the UID and GID of the data directory can be set to the UID and GID of the first scheduling object, indicating that the owner of the data directory is the first scheduling object, so that the first scheduling object has access rights to the data directory.

[0095] Furthermore, the directory permission corresponding to the data directory can also be set so that other scheduling objects have no access rights to the data directory. For example, the directory permission of the data directory can be set to 0770, which means that other users except the owner of the data directory are not allowed to access the data directory.

[0096] In the above implementation, by binding the data directory to the object identifier of the first scheduling object and setting the directory permissions corresponding to the data directory so that other scheduling objects have no access to the data directory, the RBAC mechanism can be used to implement permission control of the scheduling objects in the virtual machine to their own private data resources.

[0097] As an implementation manner, configuring the first access permission corresponding to the first scheduling object and the first data resource in the virtual machine may also be setting the access control permission corresponding to the first scheduling object to allow access to the data directory.

[0098] The access control permission corresponding to the first scheduling object may be set, and the access control permission may be used to define the specific data resources that the first scheduling object can access, as well as the specific access permissions. Exemplarily, the first scheduling object may be a process, and the SELinux (Security-Enhanced Linux) permission corresponding to the process may be set. The SELinux is a specific implementation of a MAC mechanism, and the SELinux permission corresponding to the process may be set to allow access to the data directory. Furthermore, the SELinux permission corresponding to the process may be set to allow access operations such as reading and writing to the data directory.

[0099] By setting the access control permission corresponding to the first scheduling object to allow access to the data directory, the MAC mechanism can be used to implement permission control of the scheduling object in the virtual machine to its own private data resources.

[0100] In some embodiments, when creating a first scheduling object in a virtual machine, a namespace corresponding to the first scheduling object may also be created, and a connection library path corresponding to the namespace may be set. Among them, a namespace is an implementation of environmental isolation, and a namespace may be understood as a container. The first scheduling object may be placed in the container and run, and may be isolated from other scheduling objects. Exemplarily, the path of the data directory corresponding to the first scheduling object may be set to the connection library path corresponding to the namespace, and the executable file of the first scheduling object, such as a binary bin file, may be opened and executed in the namespace, and the first scheduling object may be run, and the first data resource under the data directory corresponding to the first scheduling object may be accessed through the connection library path corresponding to the namespace. In this way, a safe and isolated environment may be strictly set for each scheduling object in the virtual machine, thereby improving the security of multiple scheduling objects running in the same virtual machine.

[0101] In an embodiment of the present application, an RBAC mechanism and / or a MAC mechanism can be used to set up a secure and isolated environment for each scheduling object in the virtual machine, and strict access control measures are provided. It is possible to run multiple scheduling objects in one virtual machine, thereby reducing resource consumption and reducing the possibility of mutual attacks between different scheduling objects in the virtual machine, thereby ensuring operational safety.

[0102] In some embodiments, the permission control of the shared data resources corresponding to the multiple scheduling objects in the virtual machine can also be implemented using the RBAC mechanism and / or the MAC mechanism. Figure 6As shown, before the step of configuring the second access permission corresponding to the first scheduling object and the second data resource in the virtual machine, the above method may also include steps 602 to 604. Further, the step of configuring the second access permission corresponding to the first scheduling object and the second data resource in the virtual machine may include step 606.

[0103] Step 602: Create a shared directory, where the shared directory includes a second data resource in the virtual machine.

[0104] In some embodiments, after the virtual machine is started, or when the virtual machine creates the first scheduling object, a shared directory can be created, which may include a second data resource in the virtual machine, and the second data resource in the virtual machine that can be shared by multiple scheduling objects can be placed under the shared directory.

[0105] Step 604: configure a group ID corresponding to the shared directory, and set the directory permission of the shared directory to allow the scheduling object under the target group corresponding to the group ID to access the shared directory.

[0106] The directory permissions corresponding to the shared directory can be set to allow multiple scheduling objects divided into a group to access. The group ID corresponding to the shared directory can be configured. For example, the GID corresponding to the shared directory can be set, and the directory permissions of the shared directory can be set to allow the scheduling objects under the target group corresponding to the group ID to access the shared directory. Exemplarily, the directory permissions of the shared directory can be set to 0750. The directory permissions of 0750 indicate that member users belonging to the same group are allowed to access the shared directory.

[0107] Step 606: based on the group identifier, add the first scheduling object to the target group corresponding to the group identifier, and / or set the access control permission corresponding to the first scheduling object to allow access to the shared directory.

[0108] When the virtual machine creates the first scheduling object, the second access permission of the first scheduling object to the shared second data resource can be configured. As an implementation, the first scheduling object can be added to the target group based on the group identifier of the shared directory so that the first scheduling object has the permission to access the shared directory.

[0109] When the virtual machine creates the first scheduling object, the group ID corresponding to the first scheduling object can be set to be the same as the group ID of the shared directory, and then the first scheduling object can be added to the target group corresponding to the group ID based on the group ID. Since the directory permission of the shared directory allows the scheduling object under the target group corresponding to the group ID to access the shared directory, after the first scheduling object is added to the target group corresponding to the group ID, the first scheduling object becomes a member of the target group and has access rights to the shared directory.

[0110] In this implementation, a group identifier of a shared directory can be set, and the directory permissions of the shared directory can be set to allow the scheduling objects under the target group corresponding to the group identifier to access the shared directory. By adding the first scheduling object to the target group, the first scheduling object can access the second data resource shared under the shared directory. The RBAC mechanism can be used to implement permission control of multiple scheduling objects in a virtual machine to shared data resources.

[0111] As an implementation manner, configuring the second access permission of the first scheduling object to the shared second data resource may also be to set the access control permission corresponding to the first scheduling object to allow access to the shared directory.

[0112] In the access control permissions corresponding to the first scheduling object, it can be set that the first scheduling object can access the shared directory. Exemplarily, the first scheduling object can be a process, and the SELinux permissions corresponding to the process can be set to allow access to the shared directory. Further, the SELinux permissions corresponding to the process can be set to allow access operations such as reading and executing the shared directory.

[0113] By setting the access control permission corresponding to the first scheduling object to allow access to the shared directory, the MAC mechanism can be used to implement permission control of multiple scheduling objects in the virtual machine to the shared data resources.

[0114] In some embodiments, when the virtual machine creates a namespace corresponding to the first scheduling object, the path of the shared directory can also be set to the connection library path corresponding to the namespace, so that the first scheduling object running in the namespace can accurately access the second data resource under the shared directory.

[0115] In an embodiment of the present application, an RBAC mechanism and / or a MAC mechanism may be used to enable different scheduling objects in a virtual machine to access a second data resource shared in a shared directory, thereby saving memory space and disk space, improving memory utilization efficiency, reducing occupied storage space, and simplifying software updates and maintenance.

[0116] In some embodiments, the permissions of multiple scheduling objects running in the virtual machine may also be checked to ensure the accuracy of permission control of each scheduling object.

[0117] As an implementation mode, the above method may further include: creating a daemon process in the virtual machine, which may be used to check whether each scheduling object running in the virtual machine has any super-privileged resource access behavior according to a target period, and killing the second scheduling object when it is detected that the second scheduling object has any super-privileged resource access behavior.

[0118] Optionally, the electronic device may create a daemon process in the virtual machine when starting the virtual machine, and the daemon process may be used to manage and control the permissions of each scheduling object running in the virtual machine. The daemon process may check whether each scheduling object running in the virtual machine has super-authorized resource access behavior according to the target period. Among them, resource access behavior may refer to the operation of the scheduling object to access data resources, and super-authorized resource access behavior refers to resource access behavior that exceeds the permission of the scheduling object, for example, the scheduling object accesses data resources for which it does not have access rights, or the scheduling object performs access operations on data resources without corresponding permissions, etc.

[0119] As an implementation method, a permission check function may be pre-set, and the permission check function may be used to check whether the scheduling object in the virtual machine has the permission to access the requested data resource. Further, the permission check function may determine whether the scheduling object has the permission to access the requested data resource based on the object information of the scheduling object, the resource information of the data resource requested to be accessed by the scheduling object, and the like.

[0120] The daemon process can traverse each scheduling object running in the virtual machine according to the target cycle to obtain the object information of each scheduling object and the resource information of the data resource currently requested to be accessed by each scheduling object. The daemon process can call the permission check function to determine whether each scheduling object has the access right to the data resource currently requested to be accessed based on the object information of each scheduling object and the resource information of the data resource currently requested to be accessed by each scheduling object.

[0121] Exemplarily, the daemon process may call the permission check function, which may search the configuration file for permission information corresponding to each scheduling object based on the object information of each scheduling object and the resource information of the data resources currently requested to be accessed by each scheduling object, and determine whether each scheduling object has access rights to the data resources currently requested to be accessed based on the permission information corresponding to each scheduling object.

[0122] In some embodiments, the virtual machine may generate log data for each scheduling object, and the log data may include access information of each scheduling object to data resources, and the access information may include object information of the scheduling object (such as object identification, etc.), resource information of the data resource requested to be accessed by the scheduling object (such as the directory path to which the data resource belongs, etc.), and the requested access operation (such as read operation, write operation or execute operation), etc. The daemon process may obtain the log data in the current cycle according to the target cycle, and determine whether there is a scheduling object with super-authorized resource access behavior in the current cycle based on the log data. By analyzing the log data of a cycle, the daemon process of the virtual machine can more comprehensively and accurately manage and control the permissions of each scheduling object in the virtual machine.

[0123] If the daemon process detects that the second scheduling object in the virtual machine has super-authorized resource access behavior, for example, the data resource currently accessed by the second scheduling object is a data resource that the second scheduling object is not allowed to access, such as the data resource currently requested to be accessed by the second scheduling object is a private data resource of the third scheduling object, then the second scheduling object has super-authorized resource access behavior; or, the second scheduling object does not have the relevant permissions for the currently requested access to the data resource, such as the second scheduling object only has read and write permissions for its own private data resources, and the current request is to perform an operation on its own private data resources, etc., but not limited to this, the daemon process may kill the second scheduling object.

[0124] Among them, killing the second scheduling object may refer to closing and deleting the second scheduling object, thereby preventing super-authorized resource access in the virtual machine, avoiding mutual attacks or tampering of privacy data resources between different scheduling objects, and strictly ensuring the isolation and security environment of each scheduling object.

[0125] It should be noted that the target period can be set according to actual needs, such as checking once every 1 second, or checking once every 3 seconds, etc., which is not limited here.

[0126] In an embodiment of the present application, a daemon process can be run in a virtual machine. The daemon process can periodically detect whether each scheduling object running in the virtual machine has any super-privileged resource access behavior, and can promptly discover and kill the second scheduling object with super-privileged resource access behavior. This can prevent super-privileged resource access behavior from occurring in the virtual machine, avoid mutual attacks between different scheduling objects or tampering with private data resources, and strictly ensure the isolation and security environment of each scheduling object.

[0127] As an implementation mode, the above method may further include: when the first scheduling object performs an access operation on the target data resource, determining whether the first scheduling object has access rights to perform the access operation on the target data resource; if the first scheduling object does not have access rights to perform the access operation on the target data resource, rejecting the access operation.

[0128] When accessing data resources, each scheduling object of the virtual machine can also check whether it has the corresponding access rights. Taking the first scheduling object as an example, when the first scheduling object performs an access operation on the target data resource, the first scheduling object can determine whether it has the corresponding access rights. The target data resource refers to the data resource that the first scheduling object currently requests to access.

[0129] In some embodiments, when the first scheduling object performs an access operation on the target data resource, the permission check function may be called to determine whether the first scheduling object has the access permission to perform the access operation on the target data resource.

[0130] Exemplarily, a permission check function may be added to the code of the executable file of the first scheduling object. When the executable file is executed and the target data resource is accessed, the permission check function may be called. The permission check function may determine whether the first scheduling object has the access right to access the target data resource based on the object information of the first scheduling object, the resource information of the target data resource that the first scheduling object currently requests to access, and the access operation performed. For example, the permission check function may be called to search in a configuration file whether the first scheduling object has the access right to access the target data resource. Through the permission check function, it is possible to accurately determine whether the first scheduling object has the access right to access the target data resource, thereby improving the accuracy of the permission check.

[0131] If it is determined that the first scheduling object does not have access rights to perform access operations on the target data resource, the access operation may be denied; if it is determined that the first scheduling object has access rights to perform access operations on the target data resource, the access operation may be allowed.

[0132] It should be noted that the virtual machine uses a daemon process to periodically check whether each scheduling object has any super-privileged resource access behavior, and each scheduling object can detect whether it has access rights to data resources during operation. This allows the permissions of each scheduling object running in the virtual machine to be strictly managed and controlled from multiple angles, ensuring that each scheduling object runs in a safe and isolated environment.

[0133] In an embodiment of the present application, during the operation of each scheduling object of the virtual machine, if the scheduling object accesses data resources, it can be determined whether it has the corresponding access rights, ensuring that the scheduling object can access the data resources only if it has the corresponding access rights. The permissions of each scheduling object are strictly controlled and managed, further improving the security of the operation of each scheduling object in the virtual machine.

[0134] like Figure 7 As shown, in one embodiment, a permission configuration device 700 is provided, which can be applied to the above-mentioned electronic device. The permission configuration device 700 includes a creation module 710 and a permission configuration module 720.

[0135] The creation module 710 is used to create a first scheduling object in the virtual machine.

[0136] The permission configuration module 720 is used to configure a first access permission corresponding to a first scheduling object and a first data resource in the virtual machine; other scheduling objects in the virtual machine do not have the permission to access the first data resource.

[0137] The permission configuration module 720 is further used to configure the second access permission corresponding to the first scheduling object and the second data resource in the virtual machine; there is at least one other scheduling object in the virtual machine that has the permission to access the second data resource.

[0138] In some embodiments, the permission configuration module 720 is also used to store permission information corresponding to the first scheduling object in the configuration file, the permission information including object information of the first scheduling object, first resource information of the first data resource in the virtual machine, and a first access permission corresponding to the first resource information; and to add second resource information of the second data resource in the virtual machine and a second access permission corresponding to the second resource information to the permission information corresponding to the first scheduling object.

[0139] In some embodiments, the permission configuration module 720 is also used to create a data directory corresponding to the first scheduling object, the data directory including the first data resource in the virtual machine; set the directory permissions corresponding to the data directory to allow only the first scheduling object to access, and / or set the access control permissions corresponding to the first scheduling object to allow access to the data directory.

[0140] In some embodiments, the permission configuration module 720 is further used to bind the data directory to the object identifier of the first scheduling object, and set the directory permission corresponding to the data directory so that other scheduling objects have no access rights to the data directory.

[0141] In some embodiments, the permission configuration device 700 also includes a shared directory creation module.

[0142] The shared directory creation module is used to create a shared directory, which includes a second data resource in the virtual machine; configure a group identifier corresponding to the shared directory, and set the directory permissions of the shared directory to allow the scheduling object under the target group corresponding to the group identifier to access the shared directory.

[0143] The permission configuration module 720 is further configured to add the first scheduling object to the target group based on the group identifier, and / or set the access control permission corresponding to the first scheduling object to allow access to the shared directory.

[0144] In some embodiments, the first access permission includes a read permission and a write permission; and / or,

[0145] The second access permission includes a read permission and an execute permission.

[0146] In some embodiments, the permission configuration device 700 also includes a daemon process creation module.

[0147] The daemon process creation module is used to create a daemon process in the virtual machine. The daemon process is used to check whether each scheduling object running in the virtual machine has any super-authorized resource access behavior according to the target period, and kill the second scheduling object when it is detected that the second scheduling object has any super-authorized resource access behavior.

[0148] In some embodiments, the permission configuration device 700 further includes a permission determination module.

[0149] The permission judgment module is used to judge whether the first scheduling object has the access permission to access the target data resource when the first scheduling object performs an access operation on the target data resource; and to deny the access operation if the first scheduling object does not have the access permission to access the target data resource.

[0150] In some embodiments, the permission determination module is further used to call a permission check function to determine whether the first scheduling object has the access authority to perform access operations on the target data resource.

[0151] In some embodiments, the multiple scheduling objects running in the virtual machine belong to the same application; and / or, there are at least two scheduling objects in the virtual machine that belong to different applications.

[0152] In some embodiments, the scheduling object of the virtual machine operation includes a process, a task, or a thread;

[0153] The operating system running on the virtual machine includes any one of Android, Linux, IOS, Windows, real-time operating system RTOS, and FreeRTOS.

[0154] In an embodiment of the present application, for the private first data resource of the first scheduling object, only the first scheduling object itself is configured with the corresponding first access right, so that other scheduling objects in the virtual machine can be prevented from tampering with the private first data resource, and a safe and isolated environment can be set for the first scheduling object, so that multiple scheduling objects can be run in the virtual machine and a safe and isolated environment can be set for each scheduling object respectively. There is no need to create and start a virtual machine separately for each scheduling object, which can effectively reduce the resources occupied by the safe operation of the scheduling objects, and by configuring the second access rights of multiple scheduling objects in the virtual machine to the shared second data resources, multiple scheduling objects can access the shared second data resources, which can effectively save the occupied storage space, further reduce the resources occupied by running multiple scheduling objects, and improve the performance of the electronic device.

[0155] Figure 8FIG. 1 is a structural block diagram of an electronic device in an embodiment. Figure 8 As shown, the electronic device 800 may include one or more of the following components: a processor 810, and a memory 820 coupled to the processor 810, wherein the memory 820 may store one or more computer programs, and the one or more computer programs may be configured to implement the methods described in the above embodiments when executed by one or more processors 810.

[0156] The processor 810 may include one or more processing cores. The processor 810 uses various interfaces and lines to connect various parts of the entire electronic device 800, and executes various functions and processes data of the electronic device 800 by running or executing instructions, programs, code sets or instruction sets stored in the memory 820, and calling data stored in the memory 820. Optionally, the processor 810 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 810 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 810, but may be implemented separately through a communication chip.

[0157] The memory 820 may include a random access memory (RAM) or a read-only memory (ROM). The memory 820 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 820 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the electronic device 800 during use, etc.

[0158] It can be understood that the electronic device 800 may include more or fewer structural elements than those in the above structural block diagram, for example, a radio frequency module, a power module, physical buttons, a WiFi (Wireless Fidelity) module, a speaker, a Bluetooth module, a sensor, etc., and no limitation is made here.

[0159] An embodiment of the present application discloses a computer-readable storage medium storing a computer program, wherein the computer program implements the methods described in the above embodiments when executed by a processor.

[0160] An embodiment of the present application discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program can be executed by a processor to implement the methods described in the above embodiments.

[0161] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a ROM, etc.

[0162] As used herein, any reference to memory, storage, database, or other medium may include nonvolatile and / or volatile memory. Suitable nonvolatile memory may include ROM, programmable ROM (Programmable ROM, PROM), erasable PROM (Erasable PROM, EPROM), electrically erasable PROM (Electrically Erasable PROM, EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which is used as an external cache memory. By way of illustration and not limitation, RAM may be in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), memory bus direct RAM (RDRAM) and direct memory bus dynamic RAM (DRDRAM).

[0163] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. Those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required for the present application.

[0164] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the above-mentioned processes does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0165] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0166] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0167] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The above is a detailed introduction to a permission configuration method, device, electronic device and computer program product disclosed in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. At the same time, for those of ordinary skill in the art, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A permission configuration method, characterized in that: include: Creating a first scheduling object in the virtual machine; Configure a first access permission corresponding to the first scheduling object and the first data resource in the virtual machine; Other scheduling objects in the virtual machine do not have permission to access the first data resource; The first scheduling object is configured with a second access permission corresponding to a second data resource in the virtual machine; and at least one other scheduling object in the virtual machine has permission to access the second data resource.

2. The method according to claim 1, characterized in that The configuring the first scheduling object and the first access permission corresponding to the first data resource in the virtual machine includes: In the configuration file, permission information corresponding to the first scheduling object is stored, where the permission information includes object information of the first scheduling object, first resource information of a first data resource in the virtual machine, and a first access right corresponding to the first resource information; The configuring the first scheduling object and the second access permission corresponding to the second data resource in the virtual machine includes: The second resource information of the second data resource in the virtual machine and the second access permission corresponding to the second resource information are added to the permission information corresponding to the first scheduling object.

3. The method according to claim 1, characterized in that The configuring the first scheduling object and the first access permission corresponding to the first data resource in the virtual machine includes: Creating a data directory corresponding to the first scheduling object, wherein the data directory includes a first data resource in the virtual machine; The directory permission corresponding to the data directory is set to allow only the first scheduling object to access, and / or the access control permission corresponding to the first scheduling object is set to allow access to the data directory.

4. The method according to claim 3, characterized in that The step of setting the directory permission corresponding to the data directory to be accessed only by the first scheduling object includes: The data directory is bound to the object identifier of the first scheduling object, and the directory permission corresponding to the data directory is set so that other scheduling objects have no access permission to the data directory.

5. The method according to claim 1, characterized in that Before configuring the second access permission corresponding to the first scheduling object and the second data resource in the virtual machine, the method further includes: Creating a shared directory, wherein the shared directory includes a second data resource in the virtual machine; Configure a group ID corresponding to the shared directory, and set directory permissions of the shared directory to allow a scheduling object under a target group corresponding to the group ID to access the shared directory; The configuring the first scheduling object and the first access permission corresponding to the first data resource in the virtual machine includes: Based on the group identifier, the first scheduling object is added to the target group, and / or the access control permission corresponding to the first scheduling object is set to allow access to the shared directory.

6. The method according to any one of claims 1 to 5, characterized in that: The first access permission includes a read permission and a write permission; and / or, The second access permission includes a read permission and an execute permission.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: A daemon process is created in the virtual machine, and the daemon process is used to check whether each scheduling object running in the virtual machine has any super-authorized resource access behavior according to a target period, and kill the second scheduling object if it is detected that the second scheduling object has any super-authorized resource access behavior.

8. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: In the case where the first scheduling object performs an access operation on the target data resource, determining whether the first scheduling object has access rights to perform the access operation on the target data resource; If the first scheduling object does not have access rights to perform the access operation on the target data resource, the access operation is rejected.

9. The method according to claim 8, characterized in that The determining whether the first scheduling object has access rights to perform the access operation on the target data resource includes: A permission check function is called to determine whether the first scheduling object has access rights to perform the access operation on the target data resource.

10. The method according to claim 1, characterized in that The multiple scheduling objects run by the virtual machine belong to the same application; and / or, There are at least two scheduling objects in the virtual machine that belong to different application programs.

11. The method according to any one of claims 1 to 5, 9 to 10, characterized in that: The scheduling object of the virtual machine operation includes a process, a task or a thread; The operating system running on the virtual machine includes any one of Android, Linux, IOS, Windows, real-time operating system RTOS, and FreeRTOS.

12. A permission configuration device, characterized in that: The device comprises: A creation module, used to create a first scheduling object in the virtual machine; a permission configuration module, configured to configure a first access permission corresponding to the first scheduling object and the first data resource in the virtual machine; other scheduling objects in the virtual machine do not have permission to access the first data resource; The permission configuration module is further used to configure the second access permission corresponding to the first scheduling object and the second data resource in the virtual machine; there is at least one other scheduling object in the virtual machine that has the permission to access the second data resource.

13. An electronic device, characterized in that: The electronic device comprises a memory, a processor and a transceiver unit. The memory stores a computer program. When the computer program is executed by the processor, the electronic device implements the method according to any one of claims 1 to 11.

14. A computer program product, characterized in that The method comprises a computer program, and when the computer program is executed by a processor in an electronic device, the electronic device implements the method according to any one of claims 1 to 11.

Images