Linux system privileged user limiting method and system, medium and product

Abstract

The invention discloses a Linux system privileged user limiting method and system, a medium and a product. The Linux system privileged user limiting method comprises the steps that an authority control strategy is issued to a kernel layer in a user layer; storing an authority control strategy in a kernel layer; and when any access operation process accesses the access object, limiting the access of the system privileged user to the private data of the non-privileged user according to the effective user information uid of the access operation process and the user information uid of the controlled object in combination with an authority control strategy. The invention aims to solve the problem of incomplete protection of the private data of the user in the prior art, not only can limit the access of the privileged user to the private data of the non-privileged user, but also can customize the private data catalog or file needing to be protected according to the demand, and can also limit the specified operation authority of the specified catalog according to the demand, so that the user experience is improved. Therefore, different requirements of the user on private data protection in different scenes can be met.

Description

Technical Field

[0001] The present invention relates to the field of operating system security technology, and in particular to a Linux system privileged user restriction method, system, medium and product. Background Art

[0002] With the promotion of domestic systems, more and more units have begun to use domestic Linux systems for office and production, etc. Most of them have strict requirements for the security and confidentiality of information, so they have high requirements for the security of the operating system, especially the privacy and integrity protection of system users' private data. Even if the system is attacked by malicious attacks such as viruses and Trojans, resulting in the privileged user rights of the system being obtained by malicious programs, the security of the private data of ordinary users (non-privileged users) of the system must be ensured to prevent their data from being illegally obtained or tampered with by malicious programs. In high-security operating systems, it is often required that the owner of the object has absolute access rights to the object, and others cannot modify it. However, in Linux systems, there are usually privileged users (root super users) who can access all data in the entire system, including the private data of non-privileged users, which makes it impossible to meet the requirements. Therefore, a permission restriction mechanism for privileged users is proposed here to achieve the purpose of protecting user private data. A Chinese patent document with publication number CN103065100A discloses a container-based user private data protection method, which describes the need to first create a user container directory and then protect the user private data for the container directory, which means that only the user private data in the container directory can be protected, and there is no fine-grained permission control for file operation types, which cannot completely restrict privileged users from accessing or tampering with all private data of non-privileged users. This method can only protect user private data under a specific directory, and cannot protect specified directories and specify operation permission restrictions, nor can it protect all private data belonging to non-privileged users. Summary of the invention

[0003] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a method, system, medium and product for restricting privileged users in a Linux system are provided. The present invention aims to solve the problem that the prior art does not fully protect user private data. It can not only restrict privileged users' access to non-privileged users' private data, but also customize private data directories or files that need to be protected as required, and can also restrict specified operation permissions for specified directories as required, so as to meet the different needs of users for private data protection in different scenarios.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for restricting privileged users in a Linux system comprises the following steps: S1, sends permission control policies from the user layer to the kernel layer; S2, stores the permission control policy in the kernel layer; S3, when any access operation process accesses its access object, the system privileged user's access to the non-privileged user's private data is restricted according to the effective user information uid of the access operation process, the user information uid of the controlled object and the permission control policy.

[0005] Optionally, each record of the permission control policy in step S1 includes an access operation type and a controlled object, the access operation type being read, write, delete, rename or attribute modification, the attribute modification referring to modifying the owner, group or ACL attribute of the controlled object, and the controlled object being a directory or a file.

[0006] Optionally, in step S1, sending the permission control policy from the user layer to the kernel layer is to use the ebpf program at the user layer to directly write the permission control policy into the kernel layer to avoid security issues introduced by using the kernel internal and external interaction interface.

[0007] Optionally, directly writing the permission control policy into the kernel layer by using the ebpf program at the user layer includes: writing the permission control policy into the ebpf program, and then writing the permission control policy into the kernel layer by executing the ebpf program.

[0008] Optionally, in step S3, limiting the access of the system privileged user to the private data of the non-privileged user according to the valid user information uid of the access operation process and the user information uid of the controlled object in combination with the permission control policy includes: S3.1, enter the permission restriction check and obtain the stored permission control policy; S3.2, determine whether the access operation process has a matching access operation type in the permission control policy. If no access operation type exists, jump to step S3.6; otherwise, jump to the next step; S3.3, determine whether the valid user information uid of the access operation process is a privileged user, if not, jump to step S3.6; otherwise, jump to the next step; S3.4, determine whether the user information uid of the controlled object is a non-privileged user, if not, jump to step S3.6; otherwise, jump to the next step; S3.5, determine whether the access operation type of the access operation process and its access object have matching records in the permission control policy (for example, the permission control policy contains a record that all executable programs under the file path or directory to which the access object belongs cannot be executed by privileged users. When the access operation type is execution and the access object is an execution program, a record with a permission control policy is matched. If a matching record exists, the access operation process is prohibited from accessing its access object, and the process ends and exits; otherwise, jump to the next step; S3.6, exit the permission restriction check.

[0009] Optionally, in step S3, access to private data of non-privileged users by system privileged users is restricted according to the effective user information uid of the access operation process and the user information uid of the controlled object in combination with the permission control policy, which is implemented as an LSM hook function based on the LSM kernel security framework.

[0010] Optionally, in step S3, when any access operation process accesses its access object, it is automatically implemented by triggering the LSM hook function corresponding to the access operation of the access operation process. In step S3.6, exiting the permission restriction check refers to exiting the corresponding LSM hook function, so that the access operation process is allowed to continue to perform the access operation on its access object.

[0011] In addition, the present invention also provides a Linux system privileged user restriction system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the Linux system privileged user restriction method.

[0012] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the Linux system privileged user restriction method through a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program or an instruction, wherein the computer program or the instruction is programmed or configured to execute the Linux system privileged user restriction method through a processor.

[0014] Compared with the prior art, the present invention mainly has the following advantages: The present invention includes the following steps: S1, issuing a permission control policy from the user layer to the kernel layer; S2, storing the permission control policy in the kernel layer; S3, when any access operation process accesses its access object, limiting the access of the system privileged user to the private data of the non-privileged user according to the effective user information uid of the access operation process, the user information uid of the controlled object and the permission control policy. The present invention can solve the problem of incomplete protection of user private data in the prior art, not only can it limit the access of privileged users to the private data of non-privileged users, but also can send different control policies from the user layer to the kernel layer according to the needs to define the specific private data directory or file that needs to be protected, and can also limit the specified operation permissions of the specified directory according to the needs, so as to meet the different needs of users for private data protection in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0016] Figure 2 Schematic diagram of the basic flow of step S3 of the method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0018] like Figure 1 As shown, the Linux system privileged user restriction method of this embodiment includes the following steps: S1, sends permission control policies from the user layer to the kernel layer; S2, stores the permission control policy in the kernel layer; S3, when any access operation process accesses its access object, the system privileged user's access to the non-privileged user's private data is restricted according to the effective user information uid of the access operation process, the user information uid of the controlled object and the permission control policy.

[0019] The Linux system privileged user restriction method of this embodiment can not only restrict the privileged user's access to the non-privileged user's private data, but also send different control policies from the user layer to the kernel layer to customize the need to protect specific private data directories or files, and can also limit the specified operation permissions of the specified directory as needed, so as to meet the different needs of users for private data protection in different scenarios, and protect the user's private data more comprehensively.

[0020] To ensure comprehensive coverage of privileged user permission restrictions, each record of the permission control policy in step S1 of this embodiment includes an access operation type and a controlled object. The access operation type is read, write, delete, rename, or attribute modification. Attribute modification refers to modifying the owner, group, or ACL attribute of the controlled object. The controlled object is a directory or a file.

[0021] In order to reduce the security risks introduced by the intra-kernel and extra-kernel interactive interface and improve security, in step S1 of this embodiment, the permission control policy is sent from the user layer to the kernel layer by using the ebpf program at the user layer to directly write the permission control policy into the kernel layer to avoid security issues introduced by using the intra-kernel and extra-kernel interactive interface.

[0022] As an optional implementation mode, this embodiment uses the ebpf program in the user layer to directly write the permission control policy into the kernel layer, including: writing the permission control policy into the ebpf program, and then writing the permission control policy into the kernel layer by executing the ebpf program.

[0023] like Figure 2 As shown, as an optional implementation method, in step S3 of this embodiment, limiting the access of the system privileged user to the private data of the non-privileged user according to the valid user information uid of the access operation process and the user information uid of the controlled object in combination with the permission control policy includes: S3.1, enter the permission restriction check and obtain the stored permission control policy; S3.2, determine whether the access operation process has a matching access operation type in the permission control policy. If no access operation type exists, jump to step S3.6; otherwise, jump to the next step; S3.3, determine whether the valid user information uid of the access operation process is a privileged user, if not, jump to step S3.6; otherwise, jump to the next step; S3.4, determine whether the user information uid of the controlled object is a non-privileged user, if not, jump to step S3.6; otherwise, jump to the next step; S3.5, determine whether the access operation type of the access operation process and its access object have matching records in the permission control policy. If there are matching records, prohibit the access operation process from accessing its access object, end and exit; otherwise, jump to the next step; S3.6, exit the permission restriction check.

[0024] The LSM framework allows permission control policies to be freely loaded and unloaded in the kernel layer without the need to recompile the kernel layer. To improve the flexibility of permission control, step S3 of this embodiment limits the access of system privileged users to non-privileged users' private data based on the effective user information uid of the access operation process and the user information uid of the managed object in combination with the permission control policy, which is implemented as an LSM hook function based on the LSM kernel security framework.

[0025] As an optional implementation method, in step S3 of this embodiment, when any access operation process accesses its access object, it is automatically implemented by triggering the LSM hook function corresponding to the access operation of the access operation process. In step S3.6, exiting the permission restriction check refers to exiting the corresponding LSM hook function, so that the access operation process is allowed to continue to perform the access operation on its access object.

[0026] This embodiment also provides a Linux system privileged user restriction system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute a Linux system privileged user restriction method.

[0027] This embodiment also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the Linux system privileged user restriction method through a processor.

[0028] This embodiment also provides a computer program product, including a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute a Linux system privileged user restriction method through a processor.

[0029] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0030] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for restricting privileged users in a Linux system, characterized in that: The steps include: S1, sends permission control policies from the user layer to the kernel layer; S2, stores the permission control policy in the kernel layer; S3, when any access operation process accesses its access object, the system privileged user's access to the non-privileged user's private data is restricted according to the effective user information uid of the access operation process, the user information uid of the controlled object and the permission control policy.

2. The Linux system privileged user restriction method according to claim 1, characterized in that: Each record of the permission control policy in step S1 includes an access operation type and a controlled object. The access operation type is read, write, delete, rename or attribute modification. The attribute modification refers to modifying the owner, group or ACL attribute of the controlled object. The controlled object is a directory or a file.

3. The Linux system privileged user restriction method according to claim 2, characterized in that: In step S1, sending the permission control policy from the user layer to the kernel layer is to use the ebpf program in the user layer to directly write the permission control policy into the kernel layer to avoid security issues introduced by using the kernel internal and external interaction interface.

4. The Linux system privileged user restriction method according to claim 3, characterized in that: The method of directly writing the permission control policy into the kernel layer by using the ebpf program in the user layer includes: writing the permission control policy into the ebpf program, and then writing the permission control policy into the kernel layer by executing the ebpf program.

5. The Linux system privileged user restriction method according to claim 2, characterized in that: In step S3, according to the valid user information uid of the access operation process and the user information uid of the controlled object, combined with the permission control policy, the access of the system privileged user to the private data of the non-privileged user is restricted, including: S3.1, enter the permission restriction check and obtain the stored permission control policy; S3.2, determine whether the access operation process has a matching access operation type in the permission control policy. If no access operation type exists, jump to step S3.6; otherwise, jump to the next step; S3.3, determine whether the valid user information uid of the access operation process is a privileged user, if not, jump to step S3.6; otherwise, jump to the next step; S3.4, determine whether the user information uid of the controlled object is a non-privileged user, if not, jump to step S3.6; otherwise, jump to the next step; S3.5, determine whether the access operation type of the access operation process and its access object have matching records in the permission control policy. If there are matching records, prohibit the access operation process from accessing its access object, end and exit; otherwise, jump to the next step; S3.6, exit the permission restriction check.

6. The Linux system privileged user restriction method according to claim 5, characterized in that: In step S3, the access of system privileged users to non-privileged users' private data is restricted according to the effective user information uid of the access operation process and the user information uid of the controlled object in combination with the permission control policy, which is implemented as an LSM hook function based on the LSM kernel security framework.

7. The Linux system privileged user restriction method according to claim 6, characterized in that: In step S3, when any access operation process accesses its access object, it is automatically implemented by triggering the LSM hook function corresponding to the access operation of the access operation process. In step S3.6, exiting the permission restriction check refers to exiting the corresponding LSM hook function, so that the access operation process is allowed to continue to perform the access operation on its access object.

8. A Linux system privileged user restriction system, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the Linux system privileged user restriction method described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the Linux system privileged user restriction method described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the Linux system privileged user restriction method described in any one of claims 1 to 7 through a processor.

Images