File monitoring method and device
By adding immutable attributes to the monitoring file and mounting its partition as a read-only partition, the problem that the existing technology cannot prevent illegal file operations is solved, and higher security is achieved.
Patent Information
- Application Number
- CN202411856892.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-17
- Publication Date
- 2025-04-11
AI Technical Summary
The prior art cannot effectively prevent illegal file operations, affecting security.
By adding immutable attributes to the monitoring file under the monitoring partition and mounting the monitoring partition as a read-only partition, the current partition mount situation is used to perform a blocking mechanism to prevent illegal modification of the request.
It realizes effective blocking of illegal file operations and improves system security.
Smart Images
Figure CN119806404A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a file monitoring method and device. Background Art
[0002] In the prior art, inotify (file change notification mechanism) is used to monitor file system operations, such as reading, writing and creating, which can only play a monitoring role but cannot prevent illegal actions; or fanotify (file access notification) is used to monitor file modification and other operations, and blocking measures can be taken before trying to open a file or access a file (such as reading, writing, etc.), but it cannot determine whether it is an illegal opening, affecting the opening operation in legal operation; or, mount is used to mount a read-only partition, and a read-only partition can be mounted as a read-write partition, but illegal operations cannot be prevented. Summary of the invention
[0003] In view of this, the purpose of the present application is to provide at least a file monitoring method and device, by adding an immutable attribute to the monitoring file under the monitoring partition, and then mounting the monitoring partition as a read-only partition, so that when a modification request for the monitoring file is received, the current partition mounting status of the monitoring partition to which the monitoring file belongs can be used to prevent the execution of the modification request according to the corresponding blocking mechanism, thereby solving the technical problem that illegal operations cannot be prevented in the prior art and achieving the technical effect of improving security.
[0004] This application mainly includes the following aspects:
[0005] In a first aspect, an embodiment of the present application provides a file monitoring method, the method comprising: adding an immutable attribute to a monitoring file under a monitoring partition, and mounting the monitoring partition as a read-only partition; when receiving a modification request for the monitoring file, determining the current mounted partition of the monitoring partition; and based on the current mounted partition, executing a blocking mechanism for the modification request.
[0006] Optionally, the blocking mechanism for the modification request is executed based on the currently mounted partition, including: if the currently mounted partition of the monitoring partition is a read-only partition, the modification request is blocked because the monitoring file belongs to the read-only partition; if the currently mounted partition of the monitoring partition is a read-write partition, the modification request is blocked based on the immutable attribute added by the monitoring file.
[0007] Optionally, the method also includes: when receiving an open request for the monitored file, monitoring whether the monitored file is in an open permission authentication state; if it is monitored that the monitored file is in an open permission authentication state, determining the current mounted partition of the monitored partition; and determining whether to open the monitored file based on the current mounted partition of the monitored partition.
[0008] Optionally, the open request includes a direct open request or an indirect open request, wherein the direct open request is used to indicate a direct request to open the monitoring file, and the indirect open request is used to indicate an open request triggered when modifying an immutable attribute of the monitoring file.
[0009] Optionally, whether to open the monitoring file is determined in the following manner: if the currently mounted partition of the monitoring partition is a read-only partition, the monitoring file is opened; if the currently mounted partition of the monitoring partition is a read-write partition, the monitoring file is prevented from being opened.
[0010] Optionally, if the currently mounted partition of the monitoring partition is a readable and writable partition, the method further includes: remounting the monitoring partition to the read-only partition.
[0011] Optionally, an immutable attribute is added to the monitoring file under the monitoring partition in the following manner: the monitoring partition is mounted to a readable and writable partition, so as to add an immutable attribute to the monitoring file when the monitoring partition is in the readable and writable partition.
[0012] In the second aspect, an embodiment of the present application also provides a file monitoring device, which includes: a setting module, used to add an immutable attribute to the monitoring file under the monitoring partition, and mount the monitoring partition as a read-only partition; a determination module, used to determine the current mounted partition of the monitoring partition when receiving a modification request for the monitoring file; and an execution module, used to execute a blocking mechanism for the modification request based on the currently mounted partition.
[0013] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the file monitoring method described in the first aspect or any possible implementation manner of the first aspect.
[0014] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the file monitoring method described in the first aspect or any possible implementation manner of the first aspect are executed.
[0015] The embodiment of the present application provides a file monitoring method and device, the method comprising: adding an immutable attribute to the monitoring file under the monitoring partition, and mounting the monitoring partition as a read-only partition; when receiving a modification request for the monitoring file, determining the current mounted partition of the monitoring partition; and executing a blocking mechanism for the modification request based on the current mounted partition. By adding an immutable attribute to the monitoring file under the monitoring partition, and then mounting the monitoring partition as a read-only partition, when receiving a modification request for the monitoring file, the current partition mounting status of the monitoring partition to which the monitoring file belongs can be used to prevent the execution of the modification request according to the corresponding blocking mechanism, thereby solving the technical problem of the inability to prevent illegal operations in the prior art and achieving the technical effect of improving security.
[0016] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0018] Figure 1 A flow chart of a file monitoring method provided in an embodiment of the present application is shown.
[0019] Figure 2 A functional module diagram of a file monitoring device provided in an embodiment of the present application is shown.
[0020] Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0021] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art, under the guidance of the content of the present application, can add one or more other operations to the flowchart, or remove one or more operations from the flowchart.
[0022] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.
[0023] In the prior art, in order to monitor whether the access is illegal, inotify (file change notification mechanism) is used to monitor file system operations, such as reading, writing and creating, which can only play a monitoring role but cannot prevent illegal actions; or fanotify (file access notification) is used to monitor file modification and other operations, and blocking measures can be taken before trying to open the file open or access the file (such as reading, writing, etc.), but it cannot determine whether it is an illegal opening, which affects the opening operation in legal operation; or, using mount to mount as a read-only partition, a read-only partition can be mounted as a read-write partition, which cannot prevent illegal operations.
[0024] Based on this, the embodiment of the present application provides a file monitoring method and device, by adding an immutable attribute to the monitoring file under the monitoring partition, and then mounting the monitoring partition as a read-only partition, so that when a modification request for the monitoring file is received, the current partition mounting status of the monitoring partition to which the monitoring file belongs can be used to prevent the execution of the modification request according to the corresponding blocking mechanism, thereby solving the technical problem that illegal operations cannot be prevented in the prior art, and achieving the technical effect of improving security, which is specifically as follows:
[0025] See also Figure 1 , Figure 1A flowchart of a file monitoring method provided by an embodiment of the present application. Figure 1 As shown, the file monitoring method provided in the embodiment of the present application includes the following steps:
[0026] S101: adding an immutable attribute to the monitoring file under the monitoring partition, and mounting the monitoring partition as a read-only partition.
[0027] Specifically, a Linux system has multiple partitions, and a partition can be connected to a mount point in the system's directory tree through the Mount command to store the data under the mount point in the connected partition, making it easier to access the content in the partition.
[0028] The immutable attribute is added to the monitoring file under the monitoring partition in the following manner: the monitoring partition is mounted to the readable and writable partition, so as to add the immutable attribute to the monitoring file when the monitoring partition is in the readable and writable partition.
[0029] That is, the monitoring partition contains monitoring files, and the monitoring partition is first mounted as read-write, so that the chattr+i command can be used to add immutable attributes to the monitoring files under the monitoring partition, and the monitoring files are protected by the immutable attributes. After adding the immutable attributes to the monitoring files, the monitoring partition is remounted as a read-only partition to limit the files in the monitoring partition to read-only.
[0030] S103: When receiving a modification request for the monitoring file, determining a currently mounted partition of the monitoring partition.
[0031] That is, after adding an immutable attribute to the monitoring file and mounting the monitoring partition as a read-only partition, monitoring is performed to determine whether a modification request for the monitoring file is received. When a modification request for the monitoring file is received, the current mounted partition of the monitoring partition is determined.
[0032] Among them, the attacker can remount the monitoring partition from a read-only partition to a read-write partition. Then, when receiving a modification request, it is necessary to confirm the currently mounted partition of the monitoring partition, so as to confirm whether to remount it as a read-write partition through the currently mounted partition. Then, if the attacker remounts the monitoring partition from a read-only partition to a read-write partition, the currently mounted partition of the monitoring partition will be a read-write partition. If the attacker does not remount the monitoring partition to a read-write partition, the currently mounted partition of the monitoring partition will still be a read-only partition.
[0033] S103: Execute a blocking mechanism for the modification request according to the currently mounted partition.
[0034] Specifically, the blocking mechanism for the modification request is executed based on the currently mounted partition, including: if the currently mounted partition of the monitoring partition is a read-only partition, the modification request is blocked because the monitoring file belongs to the read-only partition; if the currently mounted partition of the monitoring partition is a read-write partition, the modification request is blocked based on the immutable attribute added by the monitoring file.
[0035] That is to say, if an attacker issues a modification request for a monitoring file, and the attacker has not remounted the monitoring partition from a read-only partition to a read-write partition, it is determined that the currently mounted partition of the monitoring partition is a read-only partition, which means that the monitoring file is still a read-only file and the modification request cannot be executed; if the attacker remounts the monitoring partition from a read-only partition to a read-write partition, it is determined that the currently mounted partition of the monitoring partition is a read-write partition, which means that the attacker modified the monitoring file from read-only to read-write. Since the immutable attribute of the monitoring file has been added in advance, the modification request cannot be executed, that is, the monitoring file is still not a read-write file.
[0036] Furthermore, regardless of whether the attacker remounts the monitoring partition to a readable and writable partition, the modification request can be blocked, and the blocking mechanism executed when the monitoring partition is in different currently mounted partitions is also different, thereby blocking modification requests for the monitoring files and preventing illegal operations.
[0037] Specifically, the method also includes: when receiving an open request for the monitored file, monitoring whether the monitored file is in an open permission authentication state; if it is monitored that the monitored file is in an open permission authentication state, determining the current mounted partition of the monitored partition; and determining whether to open the monitored file based on the current mounted partition of the monitored partition.
[0038] Among them, after adding an immutable attribute to the monitoring file and mounting the monitoring partition as a read-only partition, monitoring is implemented to see whether an open request for the monitoring file is received. If an open request for the monitoring file is received, fanotify is used to monitor the open permission authentication state (FAN_OPEN_PERM state) of the monitoring file. The open permission authentication state can be understood as an event flag that a process attempts to open a file monitored by fanotify, that is, when a process attempts to open a file monitored by fanotify, the open permission authentication state will be triggered. In other words, if the open permission authentication state is monitored, it means that the open operation attempts to open the file monitored by fanotify (i.e., the monitoring file of this application).
[0039] Furthermore, when it is monitored that the monitored file is in an open permission authentication state, the currently mounted partition of the monitored partition is determined, thereby determining whether to respond to the open request to open the monitored file through the currently mounted partition of the monitored partition.
[0040] Specifically, the open request includes a direct open request or an indirect open request, the direct open request is used to indicate a direct request to open the monitoring file, and the indirect open request is used to indicate an open request triggered when modifying an immutable attribute of the monitoring file.
[0041] That is, the open request can be a direct request to open the monitoring file, or it can be an open request issued when the attacker finds that the monitoring file has an immutable attribute and needs to modify the monitoring file. That is, the attacker wants to remove the immutable attribute of the monitoring file through the chattr -i command, and to remove the immutable attribute, the monitoring file must be opened for operation. Furthermore, the open request will also be triggered when the attacker wants to modify the immutable attribute of the monitoring file.
[0042] Among them, whether the open request is to directly view the monitored file or to modify the immutable properties of the monitored file, an open request must be issued, and then the open request will be accepted.
[0043] Specifically, whether to open the monitoring file is determined in the following manner: if the currently mounted partition of the monitoring partition is a read-only partition, the monitoring file is opened; if the currently mounted partition of the monitoring partition is a read-write partition, the monitoring file is prevented from being opened.
[0044] If the currently mounted partition of the monitoring partition is a readable and writable partition, the method further includes: remounting the monitoring partition to the read-only partition.
[0045] That is to say, when the FAN_OPEN_PERM status of the monitored file is monitored, the mounting status of the monitored partition where the monitored file is located is determined. If the currently mounted partition of the monitored partition is a read-only partition, it means that the open request is legal and can be determined to be normal operation. The monitoring file is agreed to be opened. If the currently mounted partition of the monitored partition is a read-write partition, it means that the attacker remounts the monitored partition to the read-write partition. The open request can be determined to be an illegal request, and the monitoring file is refused to be opened. The monitoring partition where the monitored file is located is remounted as a read-only partition to prevent the attacker from opening the monitoring file.
[0046] That is to say, by setting the immutable attribute of the monitoring file and mounting the monitoring partition to which the monitoring file belongs to the read-only partition, it is possible to prevent illegal operations in many cases, and it is possible to determine whether the request is triggered by normal operation or by intrusion modification.
[0047] Exemplarily, when an open request for a monitored file is received, the open permission authentication status of the monitored file is monitored through fanotify. If the monitored file is not monitored to be in the open permission authentication state, the open permission authentication status of the monitored file can be continuously monitored; if the monitored file is monitored to be in the open permission authentication state, the mounting status of the monitoring partition is confirmed; when the monitoring partition is mounted as a read-only partition, it means that the open request is legal, and the monitoring file is opened in a read-only manner; when it is determined that the monitoring partition is mounted as a read-write partition, it means that the attacker has mounted the monitoring partition as read-write, and the open request is considered illegal, and the monitoring file is not opened.
[0048] Exemplarily, if a modification request for a monitoring file is directly received, it is necessary to check the mounting status of the monitoring partition; if the monitoring partition is mounted as a read-only partition, the modification request cannot be responded to due to the read-only permission restriction, and illegal modification requests are blocked; if the attacker has mounted the monitoring partition as readable and writable, it is determined that the monitoring partition is mounted as a readable and writable partition, then the monitoring file cannot be modified due to the pre-added immutable attribute, and therefore the modification request cannot be responded to, and illegal modification requests are blocked; when the attacker wants to remove the immutable attribute of the monitoring file due to the discovery of the immutable attribute, an open operation is triggered. At this time, fanotify is used to monitor the open permission authentication status of the monitoring file. If it is monitored that the monitoring file is in the open permission authentication state, the mounting status of the monitoring partition is confirmed again; since the monitoring partition is mounted as a readable and writable partition, it means that the attacker has mounted the monitoring partition as readable and writable, and thus, the open operation is considered to be an illegal operation, and illegal open requests are blocked.
[0049] Based on the same application concept, the embodiment of the present application also provides a file monitoring device corresponding to the file monitoring method provided in the above embodiment. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the file monitoring method in the above embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.
[0050] like Figure 2 As shown, Figure 2 A functional module diagram of a file monitoring device provided in an embodiment of the present application. The file monitoring device 10 comprises: a setting module 101, used to add an immutable attribute to the monitoring file under the monitoring partition, and mount the monitoring partition as a read-only partition; a determination module 102, used to determine the current mounted partition of the monitoring partition when receiving a modification request for the monitoring file; and an execution module 103, used to execute a blocking mechanism for the modification request based on the current mounted partition.
[0051] Based on the same application concept, see Figure 3As shown, it is a structural diagram of an electronic device provided in an embodiment of the present application, the electronic device 20 includes: a processor 201, a memory 202 and a bus 203, the memory 202 stores machine-readable instructions executable by the processor 201, when the electronic device 20 is running, the processor 201 and the memory 202 communicate through the bus 203, and the machine-readable instructions are executed by the processor 201 when running to perform the steps of the file monitoring method as described in any of the above embodiments.
[0052] Specifically, when the machine-readable instructions are executed by the processor 201, the following processing can be performed: adding an immutable attribute to the monitoring file under the monitoring partition, and mounting the monitoring partition as a read-only partition; when receiving a modification request for the monitoring file, determining the current mounted partition of the monitoring partition; and based on the currently mounted partition, executing a blocking mechanism for the modification request.
[0053] Based on the same application concept, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the file monitoring method provided in the above embodiment are executed.
[0054] Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is run, the above-mentioned file monitoring method can be executed, by adding an immutable attribute to the monitoring file under the monitoring partition, and then mounting the monitoring partition as a read-only partition. When a modification request for the monitoring file is received, the current partition mounting status of the monitoring partition to which the monitoring file belongs can be used to prevent the execution of the modification request according to the corresponding blocking mechanism, thereby solving the technical problem that illegal operations cannot be prevented in the prior art and achieving the technical effect of improving security.
[0055] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0056] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0057] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0058] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.
[0059] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A file monitoring method, characterized in that: The method comprises: Add an immutable attribute to the monitoring file under the monitoring partition, and mount the monitoring partition as a read-only partition; When receiving a modification request for the monitoring file, determining a currently mounted partition of the monitoring partition; A blocking mechanism for the modification request is executed according to the currently mounted partition.
2. The method according to claim 1, characterized in that The step of executing a blocking mechanism for the modification request based on the currently mounted partition includes: If the currently mounted partition of the monitoring partition is a read-only partition, the modification request is blocked because the monitoring file belongs to the read-only partition; If the currently mounted partition of the monitoring partition is a readable and writable partition, the modification request is blocked according to the immutable attribute added to the monitoring file.
3. The method according to claim 1 or 2, characterized in that: The method further comprises: When receiving an opening request for the monitored file, monitoring whether the monitored file is in an opening permission authentication state; If it is monitored that the monitoring file is in an open permission authentication state, determining the current mounted partition of the monitoring partition; Determine whether to open the monitoring file based on the currently mounted partition of the monitoring partition.
4. The method according to claim 3, characterized in that The open request includes a direct open request or an indirect open request, The direct open request is used to indicate a direct request to open the monitoring file, and the indirect open request is used to indicate an open request triggered when modifying the immutable attribute of the monitoring file.
5. The method according to claim 3, characterized in that: Whether to open the monitoring file is determined by the following method: If the currently mounted partition of the monitoring partition is a read-only partition, then opening the monitoring file; If the currently mounted partition of the monitoring partition is a readable and writable partition, the monitoring file is prevented from being opened.
6. The method according to claim 5, characterized in that If the currently mounted partition of the monitoring partition is a readable and writable partition, the method further includes: Remount the monitoring partition to the read-only partition.
7. The method according to claim 1, characterized in that Add immutable attributes to the monitoring files under the monitoring partition in the following ways: The monitoring partition is mounted to the readable and writable partition, so as to add an immutable attribute to the monitoring file when the monitoring partition is in the readable and writable partition.
8. A file monitoring device, characterized in that: The device comprises: A setting module, used to add an immutable attribute to the monitoring files under the monitoring partition and mount the monitoring partition as a read-only partition; A determination module, configured to determine a currently mounted partition of the monitoring partition when receiving a modification request for the monitoring file; An execution module is used to execute a blocking mechanism for the modification request according to the currently mounted partition.
9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the file monitoring method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the file monitoring method according to any one of claims 1 to 7 are executed.