Process control method and device, electronic equipment and storage medium

Abstract

The invention provides a process control method and device, electronic equipment and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: in response to a selection operation on at least one customized mode in a terminal, switching a current preset mode of the terminal into the at least one customized mode; on the basis of the mode identifier of the at least one customized mode, forbidding a mandatory access control rule corresponding to the preset mode, and starting the mandatory access control rule corresponding to the at least one customized mode; and for any process in the terminal, responding to a process access request of the process, and executing mandatory access control on the process through the mandatory access control rule corresponding to the at least one customization mode. According to the scheme, different mandatory access control rules can be started in different modes, and switching of security control strategies in various specific scenes is achieved, so that the security of resources in the terminal is better protected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a process control method, device, electronic device and storage medium. Background Art

[0002] Security-Enhanced Linux (SELinux) is a security module of the Linux kernel. With SELinux, terminals can better protect and restrict system services, control process access to application data and system logs, and reduce the impact of malware. Therefore, how to use SELinux to protect the security of user terminals is an important research direction in the current field.

[0003] In the related technology, the terminal can use SELinux to enforce mandatory access control (MAC) on all processes. Under the restrictions of this access control system, only operations that comply with the mandatory access control rules are allowed to be executed, that is, the process can only access the files required in its task, and the system will prohibit the process from accessing files outside the allowed scope.

[0004] However, in the above solution, since the usage scenarios of the terminal are becoming more and more diverse, the security requirements of different usage scenarios are also different. Therefore, when the mandatory access control rules are relatively simple, the security of the terminal will be poor. Summary of the invention

[0005] The embodiments of the present application provide a process control method, device, electronic device and storage medium, which can enable different mandatory access control rules in different modes, achieve the switching of security control strategies in a variety of specific scenarios, and thus better protect the security of resources in the terminal. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a process control method is provided, the method comprising:

[0007] In response to a selection operation of at least one customized mode in the terminal, switching the current preset mode of the terminal to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode;

[0008] Based on the mode identifier of the at least one customized mode, disabling the mandatory access control rule corresponding to the preset mode, and enabling the mandatory access control rule corresponding to the at least one customized mode;

[0009] For any process in the terminal, in response to a process access request of the process, mandatory access control is performed on the process through a mandatory access control rule corresponding to the at least one customized mode, wherein the process access request is used to request access to resources in the terminal.

[0010] According to another aspect of an embodiment of the present application, a process control device is provided, the device comprising:

[0011] a mode switching module, configured to, in response to a selection operation of at least one customized mode in the terminal, switch the preset mode currently in which the terminal is located to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode;

[0012] A rule enabling module, configured to disable the mandatory access control rule corresponding to the preset mode and enable the mandatory access control rule corresponding to the at least one customized mode based on the mode identifier of the at least one customized mode;

[0013] A process control module is used to perform mandatory access control on any process in the terminal in response to a process access request of the process through mandatory access control rules corresponding to at least one customized mode, wherein the process access request is used to request access to resources in the terminal.

[0014] In some embodiments, the at least one customized mode is a plurality of customized modes;

[0015] The rule enabling module includes:

[0016] A first determining unit, configured to determine whether the mandatory access control rules corresponding to the multiple customized modes can be enabled at the same time based on the mode identifiers of the multiple customized modes;

[0017] A rule enabling unit is used to disable the mandatory access control rules corresponding to the preset mode and enable the mandatory access control rules corresponding to the multiple customized modes when the mandatory access control rules corresponding to the multiple customized modes can be enabled at the same time.

[0018] In some embodiments, the rule enabling unit is also used to obtain the enabling priorities of the multiple customized modes when the mandatory access control rules corresponding to the multiple customized modes cannot be enabled at the same time; based on the enabling priorities of the multiple customized modes, when the mandatory access control rules corresponding to the preset mode have been disabled, enable the mandatory access rules corresponding to the first customized mode, the first customized mode being the customized mode with the highest enabling priority among the multiple customized modes.

[0019] In some embodiments, the at least one customized mode is a plurality of customized modes;

[0020] The process control module comprises:

[0021] an acquiring unit, configured to acquire, for any process in the terminal, security levels of the plurality of customized modes in response to a process access request of the process;

[0022] A second determining unit, configured to determine a second customized mode based on the security levels of the multiple customized modes, wherein the second customized mode is a customized mode with the highest security level among the multiple customized modes;

[0023] A process control unit is used to perform mandatory access control on the process through the mandatory access control rules corresponding to the second customized mode.

[0024] In some embodiments, the process control module is used to, for any process in the terminal, in response to a process access request of the process, determine whether the process access request complies with the mandatory access control rules corresponding to the at least one customized mode based on the process identifier of the process and the resource identifier of the target resource that the process requests to access; and if the process access request complies with the mandatory access control rules corresponding to the at least one customized mode, allow the process to access the target resource.

[0025] In some embodiments, the process control module is also used to obtain the working mode of the security-enhanced Linux in the terminal when the process access request does not comply with the mandatory access control rules; when the working mode is a mandatory mode, deny the process access to the target resource; when the working mode is a permissive mode, allow the process to access the target resource and display a warning message, wherein the warning message is used to prompt a suggestion to deny the process access to the target resource.

[0026] In some embodiments, the process control module is also used to display a first prompt message when the working mode is the forced mode and the number of illegal accesses to the process is less than a first quantity threshold, and the first prompt message is used to prompt the working mode to be switched to the tolerant mode; and to display a second prompt message when the working mode is the tolerant mode and the number of illegal accesses to the process is greater than a second quantity threshold, and the second prompt message is used to prompt the working mode to be switched to the forced mode.

[0027] In some embodiments, the mode switching module is further configured to switch at least one customized mode currently in which the terminal is located to the preset mode in response to a selection operation on the preset mode;

[0028] The rule enabling module is further used to disable the mandatory access control rule corresponding to the at least one customized mode and enable the mandatory access control rule corresponding to the preset mode based on the mode identifier of the preset mode;

[0029] The process control module is further configured to, for any process in the terminal, respond to a process access request of the process and perform mandatory access control on the process through a mandatory access control rule corresponding to the preset mode.

[0030] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the process control method as described in the above aspect.

[0031] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method as described in the above aspects.

[0032] According to another aspect of an embodiment of the present application, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip runs on a computer device, it is used to implement the process control method described in the above aspects.

[0033] According to another aspect of an embodiment of the present application, a computer program product is provided, wherein the computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method described in the above aspect.

[0034] The embodiment of the present application provides a process control method, in which the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can switch the mandatory access control rules corresponding to the currently enabled preset mode to the mandatory access control rules corresponding to the customized mode according to the mode identifier of at least one customized mode, so that in a specific scenario, the mandatory access control rules corresponding to the customized mode can be used to perform mandatory access control on the process requesting access to resources. By enabling different mandatory access control rules in different modes, the switching of security control strategies in multiple specific scenarios can be achieved, thereby better protecting the security of resources in the terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 It is a schematic diagram of an implementation environment of a process control method provided in an embodiment of the present application;

[0037] Figure 2 is a flow chart of a process control method provided by an embodiment of the present application;

[0038] Figure 3 is a flow chart of another process control method provided by an embodiment of the present application;

[0039] Figure 4 It is a schematic diagram of a process control flow provided by an embodiment of the present application;

[0040] Figure 5 It is a structural schematic diagram of a process control device provided in an embodiment of the present application;

[0041] Figure 6 is a structural schematic diagram of another process control device provided in an embodiment of the present application;

[0042] Figure 7 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0044] In this article, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0045] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the mode identification, activation priority and security level of the customized mode involved in this application are all obtained with full authorization.

[0046] The process control method provided in the embodiment of the present application can be executed by an electronic device. Taking the electronic device as a terminal as an example, Figure 1 Schematic diagram of an implementation environment of a process control method provided in an embodiment of the present application. Figure 1 , the implementation environment includes a terminal 101 and a server 102. The terminal 101 and the server 102 are connected via a wireless network.

[0047] In some embodiments, the terminal 101 can be a mobile phone, a desktop computer, a laptop computer, a tablet computer, an intelligent voice interaction device, a vehicle-mounted terminal, and other types of terminals. The terminal 101 is provided with multiple modes. By default, the terminal usually runs in a preset mode. For some specific scenarios with high security requirements, the user can enable a security mode customized for a specific scenario, that is, a customized mode of the terminal, such as a child mode, a youth mode, an anti-eavesdropping mode, and the like. The security module SELinux of the terminal in different modes can enable different mandatory access control rules to protect and restrict system services and control the access of processes to application data and system logs.

[0048] In some embodiments, the server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server 102 is used to provide background services for various processes in the terminal 101.

[0049] In some embodiments, the server 102 undertakes the main computing work and the terminal 101 undertakes the secondary computing work; or, the server 102 undertakes the secondary computing work and the terminal 101 undertakes the main computing work; or, the server 102 and the terminal 101 adopt a distributed computing architecture to perform collaborative computing.

[0050] Figure 2is a flow chart of a process control method provided in an embodiment of the present application. The method is executed by an electronic device, and in the present embodiment of the present application, the method is described by taking execution by a terminal as an example. Figure 2 , the method comprising:

[0051] 201. In response to a selection operation of at least one customized mode in a terminal, the terminal switches a current preset mode to at least one customized mode, wherein a security level of the at least one customized mode is higher than a security level of the preset mode.

[0052] In an embodiment of the present application, a plurality of modes are provided in the terminal, including a preset mode and a customized mode. The preset mode is the mode used by the terminal by default under normal circumstances, and the customized mode is a mode suitable for specific scenarios, such as a child mode, a youth mode, a student mode, an elderly mode, an anti-eavesdropping mode, a do not disturb mode, etc. Among them, the security level of the customized mode is higher than the security level of the preset mode. When the user is in a specific scenario with higher security requirements, the user can turn on the customized mode corresponding to the specific scenario, that is, in response to the user's selection operation of at least one customized mode in the terminal, the terminal can switch the preset mode used by default to a customized mode with a higher security level. For example, when the user is in a meeting, the user can turn on the anti-eavesdropping mode and the do not disturb mode suitable for the meeting scenario.

[0053] 202. The terminal disables a mandatory access control rule corresponding to a preset mode and enables a mandatory access control rule corresponding to at least one customized mode based on a mode identifier of at least one customized mode.

[0054] In an embodiment of the present application, when the terminal is in a preset mode, the terminal can enable the mandatory access control rules that come with the security module SELinux, that is, the mandatory access control rules corresponding to the preset mode. Therefore, when the terminal switches the preset mode to at least one customized mode, the terminal can first disable the mandatory access control rules corresponding to the preset mode according to the mode identifier of at least one customized mode, and then enable the mandatory access control rules corresponding to at least one customized mode. Among them, the mandatory access control corresponding to the customized mode is more stringent than the mandatory access control rules corresponding to the preset mode. For example, when the terminal is in anti-eavesdropping mode, the terminal prohibits any process from accessing the microphone, thereby preventing some applications from eavesdropping.

[0055] 203. For any process in the terminal, in response to a process access request of the process, the terminal performs mandatory access control on the process through a mandatory access control rule corresponding to at least one customized mode, where the process access request is used to request access to resources in the terminal.

[0056] In an embodiment of the present application, when the mandatory access control rule corresponding to at least one customized mode is in effect, for any process in the terminal, when the process accesses a resource in the terminal, the terminal can respond to the process access request of the process and perform mandatory access control on the process through the mandatory access control rule currently in effect. Among them, mandatory access control refers to a security mechanism that limits the operations that a process can perform in order to protect resources. When the mandatory access control rule is enabled, whenever a process attempts to access a resource, the mandatory access control rule will be enforced by the operating system kernel of the terminal to check the security attributes of the process and the resource and determine whether the process can access the resource.

[0057] The embodiment of the present application provides a process control method, in which the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can switch the mandatory access control rules corresponding to the currently enabled preset mode to the mandatory access control rules corresponding to the customized mode according to the mode identifier of at least one customized mode, so that in a specific scenario, the mandatory access control rules corresponding to the customized mode can be used to perform mandatory access control on the process requesting access to resources. By enabling different mandatory access control rules in different modes, the switching of security control strategies in multiple specific scenarios can be achieved, thereby better protecting the security of resources in the terminal.

[0058] Figure 3 is a flow chart of another process control method provided in an embodiment of the present application. The method is executed by an electronic device, and in the embodiment of the present application, the method is described by taking the execution by a terminal as an example, see Figure 3 , the method comprising:

[0059] 301. In response to a selection operation of at least one customized mode in a terminal, the terminal switches a current preset mode to at least one customized mode, wherein a security level of the at least one customized mode is higher than a security level of the preset mode.

[0060] In an embodiment of the present application, a plurality of modes are set in the terminal, including a preset mode and a custom mode. The preset mode is the mode used by the terminal by default, and the custom mode is a mode suitable for a specific scene or a specific user group. The custom modes include: child mode, youth mode, elderly mode, anti-eavesdropping mode, do not disturb mode, etc., which are not limited in the embodiment of the present application. Among them, the child mode, the youth mode, and the elderly mode are customized modes set for specific user groups such as children, teenagers, and the elderly, while the anti-eavesdropping mode and the do not disturb mode are customized modes set for users in specific scenes with high security requirements such as meetings and exams. Therefore, when certain specific user groups use the terminal or when the user is in a specific scene with high security requirements, the user can turn on the customized mode corresponding to the specific user group or the customized mode corresponding to the specific scene, that is, in response to the user's selection operation of at least one customized mode in the terminal, the terminal can switch the default preset mode to a customized mode with a higher security level.

[0061] For example, when a user is in a meeting, the user can enable the anti-eavesdropping mode and do not disturb mode applicable to the meeting scenario. When the user currently using the terminal is a minor, the user can enable the youth mode, which regulates the minor's online behavior in terms of terminal usage time, duration, functions and browsing content.

[0062] It should be noted that at least one customized mode in the above step 301 can be one customized mode or multiple customized modes. In the case where at least one customized mode is one customized mode, the terminal can enable the mandatory access control rules corresponding to the customized mode based on the mode identifier of the customized mode, and disable the mandatory access control rules corresponding to the previously used preset mode. Then, the terminal performs mandatory access control on the process requesting access to resources in the terminal through the mandatory access control rules corresponding to the currently enabled customized mode. In the case where at least one customized mode is multiple customized modes, the terminal can execute the following steps 302-307.

[0063] 302. In a case where at least one customized mode is a plurality of customized modes, the terminal determines, based on mode identifiers of the plurality of customized modes, whether mandatory access control rules corresponding to the plurality of customized modes can be enabled simultaneously.

[0064] In an embodiment of the present application, the mandatory access control rules corresponding to different customized modes are different, and the restrictions on the access of processes to resources in the terminal by different mandatory access control rules are also different. For example, for the target resource that a process requests to access, the mandatory access control rules corresponding to some customized modes do not allow the process to access the target resource, but the mandatory access control rules corresponding to some customized modes allow the process to access the target resource. Therefore, in the case where the user chooses to turn on multiple customized modes at the same time, since the mandatory access control rules corresponding to some of the multiple customized modes may conflict with each other, the terminal can determine whether the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time based on the mode identifiers of the multiple customized modes before enabling the mandatory access control rules corresponding to the multiple customized modes, so as to avoid the situation where the process cannot normally access the resources in the terminal due to the conflict of mandatory access rules.

[0065] For example, in the case where multiple customized modes are youth mode and senior mode, the terminal determines, based on the mode identifier of the youth mode and the mode identifier of the senior mode, that the mandatory access control rules corresponding to the youth mode cannot be enabled simultaneously with the mandatory access control rules corresponding to the senior mode; in the case where multiple customized modes are youth mode and anti-eavesdropping mode, the terminal determines, based on the mode identifier of the youth mode and the mode identifier of the anti-eavesdropping mode, that the mandatory access control rules corresponding to the youth mode can be enabled simultaneously with the mandatory access control rules corresponding to the anti-eavesdropping mode.

[0066] Optionally, when the user chooses to enable multiple customized modes at the same time, the terminal can obtain a customized mode configuration file, which includes mode tags of multiple customized modes in the terminal. For any customized mode, the mode tag of the customized mode can indicate the customized mode corresponding to the mandatory access control rules that can be enabled simultaneously with the mandatory access control rules corresponding to the customized mode, or indicate the customized mode corresponding to the mandatory access control rules that cannot be enabled simultaneously with the mandatory access control rules corresponding to the customized mode. Based on the mode identifiers of the multiple customized modes, the terminal can determine the mode tags of the multiple customized modes from the customized mode configuration file, and then determine whether the mandatory access control rules corresponding to the multiple customized modes can be enabled simultaneously according to the mode tags of the multiple customized modes.

[0067] It should be noted that, when the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time, the terminal executes the following steps 303-304; when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, the terminal executes the following steps 305-307.

[0068] 303. When the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time, the terminal disables the mandatory access control rules corresponding to the preset mode and enables the mandatory access control rules corresponding to the multiple customized modes.

[0069] In an embodiment of the present application, when the terminal is in a preset mode, the terminal can enable the mandatory access control rules that come with the security module SELinux, that is, the mandatory access control rules corresponding to the preset mode. Therefore, when the preset mode is switched to multiple customized modes and it is determined that the mandatory access control rules corresponding to multiple customized modes can be enabled at the same time, the terminal can first disable the mandatory access control rules corresponding to the preset mode, and then enable the mandatory access control rules corresponding to multiple customized modes. Among them, the mandatory access control corresponding to the customized mode is more stringent than the mandatory access control rules corresponding to the preset mode. For example, when the terminal is in anti-eavesdropping mode, the terminal prohibits any process from accessing the microphone, thereby preventing some applications from eavesdropping.

[0070] 304. For any process in the terminal, in response to a process access request of the process, the terminal performs mandatory access control on the process through mandatory access control rules corresponding to multiple customized modes, and the process access request is used to request access to resources in the terminal.

[0071] In an embodiment of the present application, when the mandatory access control rules corresponding to multiple customized modes are in effect, for any process in the terminal, when the process accesses a resource in the terminal, the terminal can respond to the process access request of the process and perform mandatory access control on the process through the mandatory access control rules corresponding to the multiple customized modes currently in effect. Among them, mandatory access control refers to a security mechanism that limits the operations that a process can perform in order to protect resources. When the mandatory access control rules are enabled, whenever a process attempts to access a resource, the mandatory access control rules will be enforced by the operating system kernel of the terminal to check the security attributes of the process and the resource and determine whether the process can access the resource.

[0072] In some embodiments, the terminal can perform mandatory access control on the process only through the mandatory access control rules corresponding to the customized mode with the highest security level. Accordingly, the process in which the terminal responds to the process access request of the process and performs mandatory access control on the process through the mandatory access control rules corresponding to multiple customized modes includes: for any process in the terminal, in response to the process access request of the process, the terminal obtains the security levels of multiple customized modes; then, the terminal determines the second customized mode based on the security levels of the multiple customized modes, and the second customized mode is the customized mode with the highest security level among the multiple customized modes; then, the terminal performs mandatory access control on the process through the mandatory access control rules corresponding to the second customized mode. Among them, the security level of the customized mode is used to indicate the security of the mandatory access control rules corresponding to the customized mode. The higher the security level of the customized mode, the higher the security of the mandatory access control rules corresponding to the customized mode, that is, the mandatory access control rules have stricter requirements on access control. The embodiment of the present application performs mandatory access control on the process by determining the mandatory access control rules corresponding to the customized mode with the highest security level from multiple customized modes, which can reduce the operation process of performing mandatory access control on the process through the mandatory access control rules while ensuring the security of the process requesting access to resources, thereby improving the efficiency of the process's access to resources.

[0073] 305. When the mandatory access control rules corresponding to the multiple customized modes cannot be enabled at the same time, the terminal obtains the enabling priorities of the multiple customized modes.

[0074] In an embodiment of the present application, when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, it indicates that the restrictions on process access to resources by the mandatory access control rules corresponding to the multiple customized modes conflict with each other. Therefore, the terminal can determine the mandatory access control rules corresponding to the customized mode to be enabled from the multiple customized modes according to the enabling priorities of the multiple customized modes. Among them, the enabling priority of the customized mode is used to indicate the priority of the terminal to enable the mandatory access control corresponding to the customized mode. The higher the enabling priority of the customized mode, the higher the priority of the terminal to enable the mandatory access control corresponding to the customized mode.

[0075] 306. Based on the activation priorities of the multiple customized modes, the terminal activates the mandatory access rule corresponding to the first customized mode when the mandatory access control rule corresponding to the preset mode is disabled. The first customized mode is the customized mode with the highest activation priority among the multiple customized modes.

[0076] In an embodiment of the present application, when the terminal has disabled the mandatory access control rules corresponding to the preset mode, the terminal can determine the enabling priorities of the mandatory access control rules corresponding to multiple customized modes based on the enabling priorities of multiple customized modes, thereby being able to determine the customized mode corresponding to the mandatory access control rule with the highest enabling priority as the first customized mode, and enabling the mandatory access rules corresponding to the first customized mode.

[0077] For example, in the case where multiple customized modes are youth mode and senior mode, since the mandatory access control rules corresponding to the youth mode cannot be enabled at the same time as the mandatory access control rules corresponding to the senior mode, the terminal can determine the mandatory access control rules corresponding to the customized mode to be enabled according to the enabling priorities of the youth mode and the senior mode. Since the enabling priority of the youth mode is higher than that of the senior mode, the terminal determines the youth mode as the first customized mode and enables the mandatory access control rules corresponding to the youth mode.

[0078] Optionally, when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, in addition to enabling the mandatory access control rules corresponding to the first customized mode with the highest activation priority mentioned above, the terminal can also enable the mandatory access control rules corresponding to the customized mode that can be enabled simultaneously with the mandatory access control rules corresponding to the first customized mode from the mandatory access control rules corresponding to multiple customized modes.

[0079] For example, in the case where multiple customized modes are youth mode, senior mode and do not disturb mode, the mandatory access control rules corresponding to the youth mode, senior mode and do not disturb mode cannot be enabled at the same time, and the activation priority of these multiple customized modes is: youth mode>senior mode>do not disturb mode. Since the mandatory access control rules corresponding to the senior mode cannot be enabled at the same time as the mandatory access control rules corresponding to the youth mode, but the mandatory access control rules corresponding to the do not disturb mode can be enabled at the same time as the mandatory access control rules corresponding to the youth mode. Therefore, the terminal can enable the mandatory access control rules corresponding to the do not disturb mode while enabling the mandatory access control corresponding to the youth mode with the highest activation priority.

[0080] Optionally, when the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, the terminal can determine multiple third customized modes from the multiple customized modes. For any third customized mode, the mandatory access control rules corresponding to the third customized mode can be enabled at the same time as the mandatory access control corresponding to the first customized mode with the highest priority, but the mandatory access control rules corresponding to multiple third customized modes cannot be enabled at the same time. At this time, the terminal can enable the mandatory access control rules corresponding to the first customized mode while enabling the mandatory access control rules corresponding to the third customized mode with the highest priority among the multiple third customized modes.

[0081] For example, in the case where multiple customized modes are anti-eavesdropping mode, senior mode and youth mode, the mandatory access control rules corresponding to the anti-eavesdropping mode, senior mode and youth mode cannot be enabled at the same time, and the activation priority of these multiple customized modes is: anti-eavesdropping mode>youth mode>senior mode. Since the mandatory access control rules corresponding to the anti-eavesdropping mode can be enabled simultaneously with the mandatory access control rules corresponding to the youth mode and the mandatory access control rules corresponding to the senior mode, but the mandatory access control rules corresponding to the youth mode cannot be enabled simultaneously with the mandatory access control rules corresponding to the senior mode. Therefore, the terminal can enable the mandatory access control corresponding to the anti-eavesdropping mode with the highest activation priority, and at the same time, enable the mandatory access control rules corresponding to the youth mode with a higher activation priority than the senior mode.

[0082] Optionally, in the case where the mandatory access control rules corresponding to multiple customized modes cannot be enabled at the same time, there are multiple first customized modes with the highest priority enabled among the multiple customized modes. If the mandatory access control rules corresponding to the multiple first customized modes with the highest priority can be enabled at the same time, the terminal can enable the mandatory access control rules corresponding to the multiple first customized modes at the same time. If the mandatory access control rules corresponding to the multiple first customized modes with the highest priority cannot be enabled at the same time, then for any first customized mode, the terminal can determine the number of customized modes corresponding to the mandatory access control rules that can be enabled at the same time with the mandatory access control rules corresponding to the first customized mode. And determine the first customized mode with the largest number of simultaneous enabled ones from the multiple first customized modes as the customized mode corresponding to the mandatory access control rules to be enabled, so that when the mandatory access control rules corresponding to the first customized mode are enabled, the mandatory access control rules corresponding to the multiple customized modes that can be enabled at the same time with the mandatory access control rules corresponding to the first customized mode can also be enabled.

[0083] For example, in the case where multiple customized modes are A mode, B mode, C mode, D mode and E mode, the mandatory access control rules corresponding to A mode, B mode, C mode, D mode and E mode cannot be enabled at the same time, and the enabling priority of these multiple customized modes is: A mode = B mode > C mode > D mode > E mode. Since the mandatory access control corresponding to A mode and the mandatory access control rules corresponding to B mode cannot be enabled at the same time, the mandatory access control corresponding to A mode can be enabled at the same time with the mandatory access control rules corresponding to C mode and E mode, and the mandatory access control corresponding to B mode can be enabled at the same time with the mandatory access control rules corresponding to D mode. That is, the mandatory access control rules corresponding to A mode, C mode and E mode can be enabled at the same time, and the mandatory access control rules corresponding to B mode and D mode can be enabled at the same time. Therefore, the terminal can enable a larger number of mandatory access control rules corresponding to A mode, C mode and E mode at the same time.

[0084] 307. For any process in the terminal, in response to a process access request of the process, the terminal performs mandatory access control on the process through a mandatory access control rule corresponding to the first customized mode, where the process access request is used to request access to resources in the terminal.

[0085] In an embodiment of the present application, when the mandatory access control rules corresponding to the first customized mode are in effect, for any process in the terminal, when the process accesses resources in the terminal, the terminal can respond to the process access request of the process and perform mandatory access control on the process through the mandatory access control rules corresponding to the first customized mode.

[0086] In order to facilitate understanding of the specific process of the above process control method, the present application embodiment provides a schematic diagram of a process control flow. Figure 4As shown, multiple modes are set in the terminal, including: preset mode and customized mode 1-N. The mode switch has two states, which are used to control the switching between the preset mode and the customized mode 1-N. When the mode switch is in the on state, the terminal switches to the customized mode 1-N; when the mode switch is in the off state, the terminal switches to the preset mode. In order to ensure that the mode switch is not controlled by malicious ROOT, the terminal places the mode switch in a trusted execution environment with a higher authority than EL0 (unprivileged execution exception level). Among them, EL0 is usually used for the execution of user programs, which is executed in the user space and can be called user mode. When the terminal switches to the preset mode, the terminal can enable the system's own mandatory access control rules, that is, the mandatory access control rules corresponding to the preset mode. When the terminal switches to the customized mode 1-N, the terminal can control the opening and closing of the mandatory access control rules corresponding to the customized mode 1 to the customized mode N according to setting an int length object as a switch. Among them, the switch consists of N bits, and each bit has two states "0" or "1", which respectively correspond to the opening and closing of a set of mandatory access control rules corresponding to the customized mode. When the mandatory access control rules corresponding to at least one customized mode are enabled, the terminal disables the mandatory access control rules corresponding to the preset mode. At this time, when a process in the terminal requests access to the target resources in the terminal, the terminal can perform mandatory access control on the process through the mandatory access control rules corresponding to at least one customized mode.

[0087] In some embodiments, the terminal can allow the process to access the target resource if the process access request complies with the mandatory access control rule. Accordingly, the process of the terminal performing mandatory access control on the process through the mandatory access control rule corresponding to at least one customized mode includes: for any process in the terminal, in response to the process access request of the process, the terminal can determine whether the process access request complies with the mandatory access control rule corresponding to at least one customized mode based on the process identifier of the process and the resource identifier of the target resource requested by the process to access; then, if the process access request complies with the mandatory access control rule corresponding to at least one customized mode, the terminal allows the process to access the target resource. Among them, the process access request carries the process identifier of the process and the resource identifier of the target resource requested by the process to access. Based on the process identifier and the resource identifier, the terminal can query whether the process has access rights to the target resource from the mandatory access control rule corresponding to at least one customized mode. If the process has access rights to the target resource, it indicates that the process access request complies with the mandatory access control rule corresponding to at least one customized mode; on the contrary, if the process does not have access rights to the target resource, it indicates that the process access request does not comply with the mandatory access control rule corresponding to at least one customized mode. The embodiment of the present application can determine whether a process has access rights to a target resource through a mandatory access control rule corresponding to at least one customized mode, and allow the process to access the target resource if it has access rights, thereby improving the security of the process's access to resources.

[0088] In some embodiments, the terminal can determine whether to deny the process access to the target resource according to the current working mode of the security-enhanced Linux when the process access request does not comply with the mandatory access control rules. Accordingly, when the process access request does not comply with the mandatory access control rules corresponding to at least one custom mode, the terminal obtains the working mode of the security-enhanced Linux in the terminal; then, when the working mode is the mandatory mode, the terminal denies the process access to the target resource; when the working mode is the permissive mode, the terminal allows the process to access the target resource and displays a warning message, which is used to prompt the suggestion to deny the process access to the target resource. Among them, the working mode of the security-enhanced Linux (SELinux) includes a shutdown mode, a mandatory mode, and a permissive mode. In the shutdown mode, SELinux is turned off, and the terminal enables the discretionary access control (DAC) rules to control the process access. In the mandatory mode, SELinux is enabled, and the terminal will enforce the mandatory access control rules corresponding to at least one custom mode for all processes, that is, when the process access request does not comply with the mandatory access control rules, the terminal can deny the process access to the target resource. In permissive mode, SELinux is enabled, but the mandatory access control rules corresponding to at least one custom mode are not enforced, that is, when the process access request does not comply with the mandatory access control rules, the terminal can still allow the process to access the target resource. In the embodiment of the present application, when the process does not have access rights to the target resource, through the working mode of SELinux, when the working mode is in mandatory mode, the process access is denied, and when the working mode is in permissive mode, the process access is allowed but a warning message is displayed to prompt the user to deny the process access to the target resource, thereby ensuring the security of the process accessing resources.

[0089] In some embodiments, the terminal can prompt the user to switch the SELinux working mode according to the number of violations of the process. Accordingly, when the working mode is the mandatory mode and the number of illegal accesses of the process is less than the first quantity threshold, the terminal displays a first prompt message, and the first prompt message is used to prompt the working mode to be switched to the permissive mode; when the working mode is the permissive mode and the number of illegal accesses of the process is greater than the second quantity threshold, the terminal displays a second prompt message, and the second prompt message is used to prompt the working mode to be switched to the mandatory mode. Among them, when the working mode is the mandatory mode and the number of illegal accesses of the process is less than the first quantity threshold, it means that the user has fewer illegal access operations in the current working mode, so the terminal can prompt the user to switch the working mode to the permissive mode. When the working mode is the permissive mode and the number of illegal accesses of the process is greater than the second quantity threshold, it means that the user has more illegal access operations in the current working mode, so the terminal can prompt the user to switch the working mode to the mandatory mode. The embodiment of the present application detects the number of illegal accesses of the process and prompts the user to switch the current working mode in combination with the current working mode, so as to ensure that when the number of illegal accesses is large, the user is prompted to switch to the forced mode to ensure the terminal security, and when the number of illegal accesses is small, the user is prompted to switch to the tolerant mode to ensure the operating performance of the terminal.

[0090] In some embodiments, the terminal can perform mandatory access control on the process according to the mandatory access control rules corresponding to the preset mode. Accordingly, when the terminal is in the preset mode, the process of mandatory access control on the process includes: in response to the selection operation of the preset mode, the terminal switches at least one customized mode currently in which the terminal is located to the preset mode; then, based on the mode identifier of the preset mode, the terminal disables the mandatory access control rules corresponding to at least one customized mode and enables the mandatory access control rules corresponding to the preset mode; then, for any process in the terminal, in response to the process access request of the process, the terminal performs mandatory access control on the process through the mandatory access control rules corresponding to the preset mode. The embodiment of the present application can determine whether the process can access the resource through the mandatory access control rules corresponding to the preset mode when the mode in which the terminal is located is switched to the preset mode, according to the mode identifier of the preset mode, and enables the mandatory access control rules corresponding to the preset mode, so as to realize the flexible switching of the mandatory access control rules enabled in the preset mode and the customized mode.

[0091] The embodiment of the present application provides a process control method, in which the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can switch the mandatory access control rules corresponding to the currently enabled preset mode to the mandatory access control rules corresponding to the customized mode according to the mode identifier of at least one customized mode, so that in a specific scenario, the mandatory access control rules corresponding to the customized mode can be used to perform mandatory access control on the process requesting access to resources. By enabling different mandatory access control rules in different modes, the switching of security control strategies in multiple specific scenarios can be achieved, thereby better protecting the security of resources in the terminal.

[0092] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0093] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0094] Figure 5 is a schematic diagram of the structure of a process control device provided in an embodiment of the present application. Figure 5 , the device comprises:

[0095] A mode switching module 501, configured to, in response to a selection operation of at least one customized mode in the terminal, switch the preset mode currently in which the terminal is located to at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode;

[0096] A rule enabling module 502, configured to disable a mandatory access control rule corresponding to a preset mode and enable a mandatory access control rule corresponding to at least one customized mode based on a mode identifier of at least one customized mode;

[0097] The process control module 503 is used to perform mandatory access control on any process in the terminal in response to a process access request of the process through a mandatory access control rule corresponding to at least one customized mode, and the process access request is used to request access to resources in the terminal.

[0098] In some embodiments, at least one customized mode is a plurality of customized modes;

[0099] Figure 6 is a schematic diagram of the structure of another process control device provided in an embodiment of the present application. Figure 6 , the rule activation module 502 includes:

[0100] A first determining unit 601 is used to determine whether the mandatory access control rules corresponding to the multiple customized modes can be enabled at the same time based on the mode identifiers of the multiple customized modes;

[0101] The rule enabling unit 602 is used to disable the mandatory access control rules corresponding to the preset mode and enable the mandatory access control rules corresponding to the plurality of customized modes when the mandatory access control rules corresponding to the plurality of customized modes can be enabled at the same time.

[0102] In some embodiments, the rule enabling unit 602 is also used to obtain the enabling priorities of multiple customized modes when the mandatory access control rules corresponding to the multiple customized modes cannot be enabled at the same time; based on the enabling priorities of the multiple customized modes, when the mandatory access control rules corresponding to the preset mode are disabled, the mandatory access rules corresponding to the first customized mode are enabled, and the first customized mode is the customized mode with the highest enabling priority among the multiple customized modes.

[0103] In some embodiments, at least one customized mode is a plurality of customized modes;

[0104] Continue to see Figure 6 , the process control module 503 includes:

[0105] An acquisition unit 603 is used to acquire, for any process in the terminal, security levels of multiple customized modes in response to a process access request of the process;

[0106] A second determining unit 604, configured to determine a second customized mode based on the security levels of the multiple customized modes, wherein the second customized mode is a customized mode with the highest security level among the multiple customized modes;

[0107] The process control unit 605 is used to perform mandatory access control on the process through the mandatory access control rules corresponding to the second customized mode.

[0108] In some embodiments, the process control module 503 is used to, for any process in the terminal, respond to a process access request of the process, determine whether the process access request complies with the mandatory access control rules corresponding to at least one customized mode based on the process identifier of the process and the resource identifier of the target resource that the process requests to access; if the process access request complies with the mandatory access control rules corresponding to at least one customized mode, allow the process to access the target resource.

[0109] In some embodiments, the process control module 503 is also used to obtain the working mode of the security-enhanced Linux in the terminal when the process access request does not comply with the mandatory access control rules; when the working mode is the mandatory mode, deny the process access to the target resources; when the working mode is the permissive mode, allow the process to access the target resources and display a warning message, which is used to prompt a suggestion to deny the process access to the target resources.

[0110] In some embodiments, the process control module 503 is also used to display a first prompt message when the working mode is a forced mode and the number of illegal accesses to the process is less than a first quantity threshold, and the first prompt message is used to prompt the working mode to be switched to a tolerant mode; when the working mode is a tolerant mode and the number of illegal accesses to the process is greater than a second quantity threshold, a second prompt message is displayed, and the second prompt message is used to prompt the working mode to be switched to a forced mode.

[0111] In some embodiments, the mode switching module 501 is further configured to switch at least one customized mode currently in the terminal to a preset mode in response to a selection operation on a preset mode;

[0112] The rule enabling module 502 is further used to disable the mandatory access control rule corresponding to at least one customized mode and enable the mandatory access control rule corresponding to the preset mode based on the mode identifier of the preset mode;

[0113] The process control module 503 is further configured to, for any process in the terminal, respond to a process access request of the process and perform mandatory access control on the process through mandatory access control rules corresponding to a preset mode.

[0114] The embodiment of the present application provides a process control device, and the user switches the preset mode currently in the terminal to at least one customized mode, so that the terminal can switch the mandatory access control rules corresponding to the currently enabled preset mode to the mandatory access control rules corresponding to the customized mode according to the mode identifier of the at least one customized mode, so that in a specific scenario, the mandatory access control rules corresponding to the customized mode can be used to perform mandatory access control on the process requesting access to resources. By enabling different mandatory access control rules in different modes, it is possible to achieve the switching of security control strategies in a variety of specific scenarios, thereby better protecting the security of resources in the terminal.

[0115] It should be noted that the device provided in the above embodiment, when implementing its functions, only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the server is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0116] An embodiment of the present application provides an electronic device, which includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the process control method provided by the above-mentioned various method embodiments.

[0117] Figure 77 is a block diagram of a structure of an electronic device 700 provided according to an embodiment of the present application. In some embodiments, the electronic device 700 is a smart phone, a tablet computer, a computer with wireless communication function, or a wearable device. The electronic device 700 in the present application includes at least one or more of the following components: a processor 710, a memory 720, and at least two wireless links 730.

[0118] In some embodiments, the processor 710 includes one or more processing cores. The processor 710 uses various interfaces and lines to connect various parts of the entire electronic device 700, and executes various functions and processes data of the electronic device 700 by running or executing program codes stored in the memory 720, and calling data stored in the memory 720. In some embodiments, the processor 710 is implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 710 can integrate one or more combinations of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content that needs to be displayed on the display screen; the NPU is used to implement artificial intelligence (AI) functions; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 710, but may be implemented by a separate chip.

[0119] In some embodiments, the processor 710 is used to control the working conditions of at least two wireless links 730. Accordingly, the processor 710 is a processor integrated with a wireless fidelity (Wireless Fidelity, Wi-Fi) chip. The Wi-Fi chip is a chip with dual Wi-Fi processing capabilities. For example, the Wi-Fi chip is a dual-band dual concurrent (Dual Band Dual Concurrent, DBDC) chip, or a dual-band synchronous (Dual Band Simultaneous, DBS) chip, etc.

[0120] In some embodiments, the memory 720 includes a random access memory (RAM), and in some embodiments, the memory 720 includes a read-only memory (ROM). In some embodiments, the memory 720 includes a non-transitory computer-readable storage medium. The memory 720 can be used to store program codes. The memory 720 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.; the data storage area may store data (such as audio data, a phone book) created according to the use of the electronic device 700, etc.

[0121] In some embodiments, the memory 720 stores reception schemes for receiving beacon frames of different wireless links 730, as well as identifiers of access nodes connected to different wireless links 730, identifiers of wireless links 730, and the like.

[0122] The at least two wireless links 730 are used to connect different access points (APs) to receive downlink data sent by the APs, wherein the different access points are access points in the same router or access points in different routers.

[0123] In some embodiments, the electronic device 700 also includes a display screen. The display screen is a display component that displays a user interface. In some embodiments, the display screen is a display screen with a touch function, through which the user can use any suitable object such as a finger or a stylus to perform touch operations on the display screen. In some embodiments, the display screen is generally arranged on the front panel of the electronic device 700. In some embodiments, the display screen is designed to be a full screen, a curved screen, a special-shaped screen, a double-sided screen, or a folding screen. In some embodiments, the display screen is also designed to be a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, etc., which is not limited in this embodiment.

[0124] In addition, those skilled in the art will appreciate that the structure of the electronic device 700 shown in the above figures does not limit the electronic device 700, and the electronic device 700 includes more or fewer components than shown, or combines certain components, or arranges components differently. For example, the electronic device 700 also includes components such as a microphone, a speaker, an input unit, a sensor, an audio circuit, a module, a power supply, and a Bluetooth module, which will not be described in detail here.

[0125] The present application also provides a computer-readable storage medium, which stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the process control method shown in the above embodiments.

[0126] The present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal, it is used to implement the process control method shown in the above embodiments.

[0127] The present application also provides a computer program product, which stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method shown in the above embodiments.

[0128] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0129] Those skilled in the art can understand that all or part of the steps in the process control method of the above embodiment can be completed by hardware, or by a program to instruct the relevant hardware to complete the process control method. The program can be stored in a computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a disk or an optical disk, etc. The above is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A process control method, characterized in that: The method comprises: In response to a selection operation of at least one customized mode in the terminal, switching the current preset mode of the terminal to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode; Based on the mode identifier of the at least one customized mode, disabling the mandatory access control rule corresponding to the preset mode, and enabling the mandatory access control rule corresponding to the at least one customized mode; For any process in the terminal, in response to a process access request of the process, mandatory access control is performed on the process through a mandatory access control rule corresponding to the at least one customized mode, wherein the process access request is used to request access to resources in the terminal.

2. The method according to claim 1, characterized in that The at least one customized mode is a plurality of customized modes; The disabling of the mandatory access control rule corresponding to the preset mode and enabling the mandatory access control rule corresponding to the at least one customized mode based on the mode identifier of the at least one customized mode includes: Based on the mode identifiers of the multiple customized modes, determining whether the mandatory access control rules corresponding to the multiple customized modes can be enabled at the same time; In the case that the mandatory access control rules corresponding to the multiple customized modes can be enabled at the same time, the mandatory access control rules corresponding to the preset mode are disabled, and the mandatory access control rules corresponding to the multiple customized modes are enabled.

3. The method according to claim 2, characterized in that The method further comprises: When the mandatory access control rules corresponding to the multiple customized modes cannot be enabled at the same time, obtaining the enabling priorities of the multiple customized modes; Based on the activation priorities of the multiple customized modes, when the mandatory access control rules corresponding to the preset mode are disabled, the mandatory access rules corresponding to the first customized mode are enabled, and the first customized mode is the customized mode with the highest activation priority among the multiple customized modes.

4. The method according to claim 1, characterized in that: The at least one customized mode is a plurality of customized modes; The step of performing mandatory access control on any process in the terminal in response to a process access request of the process by using a mandatory access control rule corresponding to the at least one customized mode includes: For any process in the terminal, in response to a process access request of the process, obtaining security levels of the plurality of customized modes; Determining a second customized mode based on the security levels of the multiple customized modes, where the second customized mode is a customized mode with the highest security level among the multiple customized modes; Mandatory access control is performed on the process through the mandatory access control rule corresponding to the second customized mode.

5. The method according to claim 1, characterized in that The step of performing mandatory access control on any process in the terminal in response to a process access request of the process by using a mandatory access control rule corresponding to the at least one customized mode includes: For any process in the terminal, in response to a process access request of the process, determining whether the process access request complies with a mandatory access control rule corresponding to the at least one customized mode based on a process identifier of the process and a resource identifier of a target resource that the process requests to access; In a case where the process access request complies with the mandatory access control rule corresponding to the at least one customized mode, the process is allowed to access the target resource.

6. The method according to claim 5, characterized in that The method further comprises: When the process access request does not comply with the mandatory access control rule, obtaining the working mode of the security-enhanced Linux in the terminal; When the working mode is the mandatory mode, denying the process access to the target resource; In the case where the working mode is the permissive mode, the process is allowed to access the target resource and a warning message is displayed, wherein the warning message is used to prompt a suggestion to deny the process from accessing the target resource.

7. The method according to claim 6, characterized in that The method further comprises: When the working mode is the mandatory mode and the number of illegal accesses of the process is less than a first quantity threshold, displaying first prompt information, wherein the first prompt information is used to prompt the working mode to be switched to the permissive mode; When the working mode is the permissive mode and the number of illegal accesses of the process is greater than a second quantity threshold, a second prompt message is displayed, where the second prompt message is used to prompt the working mode to be switched to the mandatory mode.

8. The method according to claim 1, characterized in that The method further comprises: In response to a selection operation of the preset mode, switching at least one customized mode currently in which the terminal is located to the preset mode; Based on the mode identifier of the preset mode, disabling the mandatory access control rule corresponding to the at least one customized mode, and enabling the mandatory access control rule corresponding to the preset mode; For any process in the terminal, in response to a process access request of the process, mandatory access control is performed on the process through the mandatory access control rule corresponding to the preset mode.

9. A process control device, characterized in that: The device comprises: a mode switching module, configured to, in response to a selection operation of at least one customized mode in the terminal, switch the preset mode currently in which the terminal is located to the at least one customized mode, wherein the security level of the at least one customized mode is higher than the security level of the preset mode; A rule enabling module, configured to disable the mandatory access control rule corresponding to the preset mode and enable the mandatory access control rule corresponding to the at least one customized mode based on the mode identifier of the at least one customized mode; A process control module is used to perform mandatory access control on any process in the terminal in response to a process access request of the process through mandatory access control rules corresponding to at least one customized mode, wherein the process access request is used to request access to resources in the terminal.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the process control method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method according to any one of claims 1 to 8.

12. A chip, characterized in that: The chip includes a programmable logic circuit and / or program instructions, and when the chip runs on the terminal, it is used to implement the process control method as described in any one of claims 1 to 8.

13. A computer program product, comprising a computer program, characterized in that The computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the process control method according to any one of claims 1 to 8.

Images