Program running control method and device, computer equipment and storage medium
By performing multi-layer verification of programs to be run in the Docker environment to ensure their legality and security, the problem of insufficient security of program operation in the Docker environment is solved, and the effect of effectively intercepting the execution of illegal programs is achieved.
Patent Information
- Application Number
- CN202411967906.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-04-25
AI Technical Summary
In the Docker environment, there is a lack of control and security management of program operation, resulting in risks such as data leakage, system resource abuse, malicious attacks, and host security vulnerabilities.
Only by performing whitelist verification, container information verification and path information verification on the running program to be run will it ensure the legality and security of the program before executing the running program.
Effectively intercept the execution of illegal programs, improve the security of program operation in the Docker environment, and prevent data leakage and other security risks.
Smart Images
Figure CN119883515A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of program execution control, and in particular to a program execution control method, device, computer equipment and storage medium. Background Art
[0002] With the development of container technology, Docker technology is being used in more and more scenarios and has gradually become an important part of modern IT infrastructure. Docker's advantages such as lightweight, portability and fast startup have made it widely used in various scenarios. This also makes it increasingly important to implement operation control for the Docker environment, because although the containerized environment is lightweight and flexible, its isolation and shared resource characteristics also bring security challenges. The lack of control and security management of program operation in the Docker environment may lead to risks such as data leakage, system resource abuse, malicious attacks and host security vulnerabilities. Summary of the invention
[0003] The present application provides a program running control method, apparatus, computer equipment and storage medium to solve the problem of how to improve the security of program running in a Docker environment.
[0004] In a first aspect, the present application provides a program execution control method, the method comprising:
[0005] When a program to be run is detected, a whitelist check is performed on the program to be run to obtain a whitelist check result;
[0006] When the whitelist verification result is verification passed, verifying the container information corresponding to the program to be run to obtain a container verification result;
[0007] When the container verification result is verification passed, verify the path information corresponding to the program to be run to obtain a path verification result;
[0008] When the path verification result is verification passed, the program to be run is executed.
[0009] In a second aspect, the present application provides a program operation control device, the program operation control device comprising:
[0010] A first verification module is used to perform a whitelist verification on the program to be run when a program to be run is detected, and obtain a whitelist verification result;
[0011] A second verification module is used to verify the container information corresponding to the program to be run when the whitelist verification result is verification passed, and obtain a container verification result;
[0012] A third verification module is used to verify the path information corresponding to the program to be run when the container verification result is verification passed, and obtain a path verification result;
[0013] The execution module is used to execute the program to be run when the path verification result is verification passed.
[0014] In a third aspect, the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned program execution control method when executing the computer program.
[0015] In a fourth aspect, the present application also provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the above-mentioned program running control method.
[0016] The above-mentioned technical scheme provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application, when a program to be run is detected, performs a whitelist check on the program to be run to obtain a whitelist check result; when the whitelist check result is a pass, performs a check on the container information corresponding to the program to be run to obtain a container check result; when the container check result is a pass, performs a check on the path information corresponding to the program to be run to obtain a path check result; when the path check result is a pass, executes the program to be run.
[0017] Based on the above method, the whitelist verification, container information verification, and path information verification are performed on the program to be run in turn, so as to determine the execution security of the program to be run in multiple dimensions. The program to be run is executed only when it is ensured to be complete, safe and reliable. The execution of illegal programs can be effectively intercepted to solve the problem of how to improve the security of program running in the Docker environment and avoid problems such as data leakage, system resource abuse, malicious attacks and host security vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0020] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.
[0021] Figure 1 A flowchart of a program execution control method provided in an embodiment of the present application;
[0022] Figure 2 A flowchart of a program execution control method provided in an embodiment of the present application;
[0023] Figure 3 A flowchart of a program execution control method provided in an embodiment of the present application;
[0024] Figure 4 A structural block diagram of a program execution control device provided in an embodiment of the present application;
[0025] Figure 5 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0027] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.
[0028] In one embodiment, Figure 1 FIG. 1 is a flow chart of a program operation control method in an embodiment, referring to FIG. Figure 1 , a program running control method is provided. This embodiment mainly uses the method applied to a program running control device as an example, and the program running control method specifically includes the following steps:
[0029] Step S210, when a program to be run is detected, a whitelist check is performed on the program to be run to obtain a whitelist check result.
[0030] Specifically, before the program to be run is run, multiple layers of verification are performed on the program to be run to ensure the legality, security and reliability of the program to be run. A whitelist verification is performed on the program to be run to determine whether the program to be run meets the execution requirements corresponding to the whitelist. If the whitelist verification result is a verification failure, it means that the program to be run does not meet the execution requirements corresponding to the whitelist, and the program to be run is refused to be executed. If the whitelist verification result is a verification pass, it means that the program to be run meets the execution requirements corresponding to the whitelist.
[0031] Step S220, when the whitelist verification result is verification passed, verify the container information corresponding to the program to be run to obtain a container verification result.
[0032] Specifically, when the whitelist verification result is passed, the container information corresponding to the program to be run is further verified to determine whether the container information of the program to be run meets the expected container requirements to obtain the container verification result. If the container verification result is a verification failure, it means that the container information of the program to be run does not meet the expected container requirements, and the program to be run is refused to be executed; if the container verification result is a verification pass, it means that the container information of the program to be run meets the expected container requirements.
[0033] Step S230, when the container verification result is verification passed, verify the path information corresponding to the program to be run to obtain a path verification result.
[0034] Specifically, when the container verification result is that the verification is passed, the path information of the program to be run is further verified to determine whether the path information of the program to be run meets the expected path requirements. If the path verification result is that the verification fails, it means that the path information of the program to be run does not meet the expected path requirements, and the program to be run is refused to be executed; if the path verification result is that the verification is passed, it means that the path information of the program to be run meets the expected path requirements.
[0035] Step S240: When the path verification result is verification passed, the program to be run is executed.
[0036] Specifically, after the program to be run has successfully passed the whitelist verification, container information verification, and path information verification in sequence, it is determined that the program to be run is complete and safe and reliable, and then the program to be run is executed. This can ensure the execution security of the program to be run, and can effectively intercept the execution of illegal programs, so as to solve the problem of how to improve the security of program running in the Docker environment, and avoid data leakage, system resource abuse, malicious attacks, and host security vulnerabilities.
[0037] In one embodiment, when a program to be run is detected, a whitelist check is performed on the program to be run to obtain a whitelist check result, including:
[0038] When a program to be run is detected, calculating a first completeness corresponding to the program to be run;
[0039] Querying the target file information corresponding to the program to be run in the whitelist benchmark library;
[0040] When the target file information corresponding to the program to be run is queried in the whitelist benchmark library, and the second integrity in the target file information is consistent with the first integrity, determining that the whitelist verification result is a verification pass; or,
[0041] When the target file information corresponding to the program to be run is not found in the whitelist benchmark library, or the second integrity of the target file information found in the whitelist benchmark library is inconsistent with the first integrity, the whitelist verification result is determined to be a verification failure.
[0042] Specifically, refer to Figure 2 The whitelist benchmark library is used to store file information corresponding to legitimate programs. The target file information corresponding to the program to be run is queried in the whitelist benchmark library. If the target file information corresponding to the program to be run is queried, it means that the program to be run meets the whitelist standard corresponding to the whitelist benchmark library. Then, the second integrity corresponding to the program to be run is further queried in the target file information. The second integrity is the integrity calculated when the program to be run is added to the whitelist benchmark library as a legitimate program, and the first integrity is the integrity calculated when the execution judgment is made on the program to be run at this time. The two integrity are calculated using the same calculation method.
[0043] When the target file information corresponding to the program to be run is queried in the whitelist benchmark library, the first integrity is compared with the second integrity in the whitelist benchmark library. If the first integrity is the same as the second integrity, it means that the integrity of the program to be run has not changed, and the whitelist verification result is determined to be a passed verification; if the first integrity is different from the second integrity, it means that the program to be run has been tampered with and changed, and the whitelist verification result is determined to be a failed verification.
[0044] If the target file information corresponding to the program to be run is not found in the whitelist benchmark library, it means that the program to be run is an illegal program, and the whitelist verification result is determined to be a verification failure. The program to be run with a whitelist verification result of verification failure is intercepted to prevent the execution of illegal programs from causing data leakage, system resource abuse, malicious attacks, and host security vulnerabilities.
[0045] In one embodiment, when the whitelist verification result is verification passed, the container information corresponding to the program to be run is verified to obtain the container verification result, including:
[0046] When the whitelist verification result is verification passed, determining whether the container tag in the target file information is empty;
[0047] When the container tag in the target file information is not empty, determining whether the file system type in the target file information is a container type;
[0048] When the file system type in the target file information is a container type, determining that the container verification result is a verification pass; or,
[0049] When the container tag in the target file information is empty, or the file system type in the target file information is a non-container type, it is determined that the container verification result is a verification failure.
[0050] Specifically, refer to Figure 2 , the program to be run that has passed the whitelist verification result is released to continue to verify its container information, that is, the container label and container type in the target file information are used to determine the container verification result. The target file information also includes container information, and the container information includes container label and file system type.
[0051] When the whitelist verification result of the program to be run is passed, determine whether the container tag in the target file information corresponding to the program to be run is empty. If the container tag is not empty, it means that the program to be run belongs to the container corresponding to the container tag. Then further determine whether the file system type in the target file information is a container type. The container type is overlay or overlay2. If the file system type is overlay or overlay2, it means that the program file corresponding to the program to be run is still in the mounted partition. Then determine that the container verification result of the program to be run is passed. If the file system type is not a container type, determine that the container verification result of the program to be run is failed, and need to output audit information for the program to be run, so as to facilitate exception management of the program to be run.
[0052] If the container tag is empty (NUL), it means that the program to be run does not belong to the container, then the container verification result of the program to be run is determined to be a verification failure, and the program to be run is released, so that other verification methods can be used to perform security verification on the program to be run that does not belong to the container in the future, so as to determine whether to execute the program to be run.
[0053] In one embodiment, when the container verification result is verification passed, verifying the path information corresponding to the program to be run to obtain the path verification result includes:
[0054] When the container verification result is verification passed, obtaining first path information of the program to be run;
[0055] When the second path information in the target file information is consistent with the first path information, determining that the path verification result is a verification pass; or,
[0056] When the second path information in the target file information is inconsistent with the first path information, it is determined that the path verification result is a verification failure.
[0057] Specifically, refer to Figure 2 , when the container verification result of the program to be run is passed, the first path information corresponding to the program to be run is obtained, and the first path information is compared with the second path information in the target file information. If the first path information is consistent with the second path information, it means that the path information of the program to be run is safe and reliable, and then it is determined that the path verification result of the program to be run is passed.
[0058] If the first path information is inconsistent with the second path information, it means that the path information of the program to be run has changed. At this time, the path information of the program to be run is unreliable, and the path verification result of the program to be run is determined to be a verification failure. The program to be run with a path verification result of a verification failure is regarded as an illegal program and is intercepted to avoid the execution of illegal programs, which may lead to data leakage, system resource abuse, malicious attacks, and host security vulnerabilities.
[0059] In one embodiment, when a program to be run is detected, a whitelist check is performed on the program to be run, and before a whitelist check result is obtained, the method further includes:
[0060] Get the mount directory of all enabled containers in the deployment system corresponding to the target product;
[0061] Generate a container home directory based on the mount directories of all the enabled containers;
[0062] Obtaining each program file in the deployment system corresponding to the target product;
[0063] Determine the program file that meets the whitelist standard as the first target file;
[0064] Determining a container tag of the first target file according to a matching relationship between the second path information of the first target file and the container home directory;
[0065] The second integrity corresponding to the first target file is calculated, and the file tag, the second integrity, the second path information and the container tag corresponding to the first target file are added to the whitelist benchmark library as the file information of the first target file.
[0066] Specifically, refer to Figure 3 Before making a safe execution judgment on the running program, first collect the mount directories of all enabled containers in the system deployed by the target product and generate a container home directory. The container home directory includes relevant information of all enabled containers, including mount directories, container labels, and program files related to containers. Perform a global scan on the deployment system corresponding to the target product to obtain multiple program files, and use the program files that meet the whitelist standard as the first target file. According to the matching relationship between the second path information of each first target file and the container home directory, determine the container label corresponding to the first target file.
[0067] The second integrity is calculated for each first target file, and the second integrity, container tag, file tag, and second path information corresponding to the first target file are added to the whitelist benchmark library as file information corresponding to the first target file, so as to facilitate subsequent use of the file information corresponding to each first target file in the whitelist benchmark library to perform different types of pre-execution checks on the program to be run, so as to ensure the safe execution of the program to be run.
[0068] In one embodiment, determining the container tag of the first target file according to the matching relationship between the second path information of the first target file and the container home directory includes:
[0069] When the second path information of the first target file belongs to the container home directory, using the container tag of the container to which the first target file belongs as the container tag of the first target file; or,
[0070] When the second path information of the first target file does not belong to the container home directory, it is determined that the container tag of the first target file is empty.
[0071] Specifically, refer to Figure 3 When the second path information of the first target file belongs to the container home directory, it means that the first target file belongs to the container, and the container tag of the container to which the first target file belongs is used as the container tag of the first target file, and the container tag is recorded as the container ID. When the second path information of the first target file does not belong to the container home directory, it means that the first target file does not belong to the container, and the container tag corresponding to the first target file is set to empty.
[0072] In one embodiment, after calculating the second integrity corresponding to the first target file, and adding the file tag, the second integrity, the second path information, and the container tag corresponding to the first target file as the file information of the first target file to the whitelist reference library, the method further includes:
[0073] When a container to be enabled is detected, the mount directory of the container to be enabled is added to the container home directory;
[0074] According to the path information corresponding to the container to be enabled, it is determined in sequence whether the program files related to the container to be enabled meet the whitelist standard;
[0075] Determine the program file that meets the whitelist standard as the second target file;
[0076] determining a container tag of the second target file according to a matching relationship between the second path information of the second target file and the container home directory;
[0077] The second integrity corresponding to the second target file is calculated, and the file tag, the second integrity, the second path information and the container tag corresponding to the second target file are added to the whitelist benchmark library as the file information of the second target file.
[0078] Specifically, when a new container to be enabled is subsequently added, the program files in the container to be enabled are judged according to the whitelist standard according to the aforementioned whitelisting process, so that the file information corresponding to the program files in the container to be enabled that meet the whitelist standard is added to the whitelist reference library, that is, the file information in the whitelist reference library can be dynamically added.
[0079] When a container deletion event is detected, the file information in the whitelist benchmark library is deleted according to the container tag corresponding to the container deletion event, so as to ensure the timeliness of the update of the whitelist benchmark library.
[0080] Based on the above method, it is possible to achieve targeted and differentiated operation control of different containers for the same operating system environment and the same container image, so as to meet the differentiated management of containers. It can effectively differentiate container management to ensure that the executable programs running in the container are in line with expectations. It ensures the security of the container operating environment, and can effectively block the execution of binary programs from illegal sources in the container.
[0081] Figures 1 to 3 FIG. 1 is a flow chart of a program operation control method in one embodiment. It should be understood that although Figures 1 to 3The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figures 1 to 3 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.
[0082] In one embodiment, Figure 4 As shown, a program running control device is provided, comprising:
[0083] The first verification module 310 is used to perform a whitelist verification on the program to be run when a program to be run is detected, and obtain a whitelist verification result;
[0084] The second verification module 320 is used to verify the container information corresponding to the program to be run when the whitelist verification result is verification passed, and obtain a container verification result;
[0085] The third verification module 330 is used to verify the path information corresponding to the program to be run when the container verification result is verification passed, and obtain a path verification result;
[0086] The execution module 340 is used to execute the program to be run when the path verification result is verification passed.
[0087] In one embodiment, the first verification module 310 is used to:
[0088] When a program to be run is detected, calculating a first completeness corresponding to the program to be run;
[0089] Querying the target file information corresponding to the program to be run in the whitelist benchmark library;
[0090] When the target file information corresponding to the program to be run is queried in the whitelist benchmark library, and the second integrity in the target file information is consistent with the first integrity, determining that the whitelist verification result is a verification pass; or,
[0091] When the target file information corresponding to the program to be run is not found in the whitelist benchmark library, or the second integrity of the target file information found in the whitelist benchmark library is inconsistent with the first integrity, the whitelist verification result is determined to be a verification failure.
[0092] In one embodiment, the second verification module 320 is used to:
[0093] When the whitelist verification result is verification passed, determining whether the container tag in the target file information is empty;
[0094] When the container tag in the target file information is not empty, determining whether the file system type in the target file information is a container type;
[0095] When the file system type in the target file information is a container type, determining that the container verification result is a verification pass; or,
[0096] When the container tag in the target file information is empty, or the file system type in the target file information is a non-container type, it is determined that the container verification result is a verification failure.
[0097] In one embodiment, the third verification module 330 is used to:
[0098] When the container verification result is verification passed, obtaining first path information of the program to be run;
[0099] When the second path information in the target file information is consistent with the first path information, determining that the path verification result is a verification pass; or,
[0100] When the second path information in the target file information is inconsistent with the first path information, it is determined that the path verification result is a verification failure.
[0101] In one embodiment, the apparatus further comprises a generating module, configured to:
[0102] Get the mount directory of all enabled containers in the deployment system corresponding to the target product;
[0103] Generate a container home directory based on the mount directories of all the enabled containers;
[0104] Obtaining each program file in the deployment system corresponding to the target product;
[0105] Determine the program file that meets the whitelist standard as the first target file;
[0106] Determining a container tag of the first target file according to a matching relationship between the second path information of the first target file and the container home directory;
[0107] The second integrity corresponding to the first target file is calculated, and the file tag, the second integrity, the second path information and the container tag corresponding to the first target file are added to the whitelist benchmark library as the file information of the first target file.
[0108] In one embodiment, the generating module is further used for:
[0109] When the second path information of the first target file belongs to the container home directory, using the container tag of the container to which the first target file belongs as the container tag of the first target file; or,
[0110] When the second path information of the first target file does not belong to the container home directory, it is determined that the container tag of the first target file is empty.
[0111] In one embodiment, the generating module is further used for:
[0112] When a container to be enabled is detected, the mount directory of the container to be enabled is added to the container home directory;
[0113] According to the path information corresponding to the container to be enabled, it is determined in sequence whether the program files related to the container to be enabled meet the whitelist standard;
[0114] Determine the program file that meets the whitelist standard as the second target file;
[0115] determining a container tag of the second target file according to a matching relationship between the second path information of the second target file and the container home directory;
[0116] The second integrity corresponding to the second target file is calculated, and the file tag, the second integrity, the second path information and the container tag corresponding to the second target file are added to the whitelist benchmark library as the file information of the second target file.
[0117] like Figure 5 As shown, an embodiment of the present application provides a computer device, including a processor 711, a communication interface 712, a memory 713 and a communication bus 714, wherein the processor 711, the communication interface 712, and the memory 713 communicate with each other through the communication bus 714;
[0118] Memory 713, used for storing computer programs;
[0119] The processor 711 is used to implement the program running control method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 713.
[0120] Those skilled in the art will understand that Figure 5The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0121] In one embodiment, the program execution control device provided by the present application can be implemented in the form of a computer program. The computer program can be Figure 5 The computer device shown in the figure is run on the computer device. The memory of the computer device can store various program modules that constitute the program running control device, such as: Figure 4 The first verification module 310, the second verification module 320, the third verification module 330 and the execution module 340 are shown. The computer program composed of each program module enables the processor to execute the program execution control method of each embodiment of the present application described in this specification.
[0122] Figure 5 The computer device shown can be Figure 4 The first verification module 310 in the program running control device shown executes a whitelist verification on the program to be run when a program to be run is detected to obtain a whitelist verification result. The computer device can execute through the second verification module 320 to verify the container information corresponding to the program to be run when the whitelist verification result is a verification pass, and obtain a container verification result. The computer device can execute through the third verification module 330 to verify the path information corresponding to the program to be run when the container verification result is a verification pass, and obtain a path verification result. The computer device can execute through the execution module 340 to execute the program to be run when the path verification result is a verification pass.
[0123] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the program execution control method provided by any of the aforementioned method embodiments is implemented.
[0124] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0126] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative can be used.
[0127] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A program operation control method, characterized in that: The method comprises: When a program to be run is detected, a whitelist check is performed on the program to be run to obtain a whitelist check result; When the whitelist verification result is verification passed, verifying the container information corresponding to the program to be run to obtain a container verification result; When the container verification result is verification passed, verify the path information corresponding to the program to be run to obtain a path verification result; When the path verification result is verification passed, the program to be run is executed.
2. The method according to claim 1, characterized in that When a program to be run is detected, a whitelist check is performed on the program to be run to obtain a whitelist check result, including: When a program to be run is detected, calculating a first degree of completeness corresponding to the program to be run; Querying the target file information corresponding to the program to be run in the whitelist benchmark library; When the target file information corresponding to the program to be run is queried in the whitelist benchmark library, and the second integrity in the target file information is consistent with the first integrity, determining that the whitelist verification result is a verification pass; or, When the target file information corresponding to the program to be run is not found in the whitelist benchmark library, or the second integrity of the target file information found in the whitelist benchmark library is inconsistent with the first integrity, the whitelist verification result is determined to be a verification failure.
3. The method according to claim 2, characterized in that When the whitelist verification result is that the verification is passed, the container information corresponding to the program to be run is verified to obtain a container verification result, including: When the whitelist verification result is verification passed, determining whether the container tag in the target file information is empty; When the container tag in the target file information is not empty, determining whether the file system type in the target file information is a container type; When the file system type in the target file information is a container type, determining that the container verification result is a verification pass; or, When the container tag in the target file information is empty, or the file system type in the target file information is a non-container type, it is determined that the container verification result is a verification failure.
4. The method according to claim 2, characterized in that: When the container verification result is a verification pass, verifying the path information corresponding to the program to be run to obtain a path verification result includes: When the container verification result is verification passed, obtaining first path information of the program to be run; When the second path information in the target file information is consistent with the first path information, determining that the path verification result is a verification pass; or, When the second path information in the target file information is inconsistent with the first path information, it is determined that the path verification result is a verification failure.
5. The method according to claim 1, characterized in that: When a program to be run is detected, a whitelist check is performed on the program to be run, and before a whitelist check result is obtained, the method further includes: Get the mount directory of all enabled containers in the deployment system corresponding to the target product; Generate a container home directory based on the mount directories of all the enabled containers; Obtaining each program file in the deployment system corresponding to the target product; Determine the program file that meets the whitelist standard as the first target file; Determining a container tag of the first target file according to a matching relationship between the second path information of the first target file and the container home directory; The second integrity corresponding to the first target file is calculated, and the file tag, the second integrity, the second path information and the container tag corresponding to the first target file are added to the whitelist benchmark library as the file information of the first target file.
6. The method according to claim 5, characterized in that The determining the container tag of the first target file according to the matching relationship between the second path information of the first target file and the container home directory includes: When the second path information of the first target file belongs to the container home directory, using the container tag of the container to which the first target file belongs as the container tag of the first target file; or, When the second path information of the first target file does not belong to the container home directory, it is determined that the container tag of the first target file is empty.
7. The method according to claim 5, characterized in that After calculating the second integrity corresponding to the first target file, and adding the file tag, the second integrity, the second path information, and the container tag corresponding to the first target file as the file information of the first target file to the whitelist reference library, the method further includes: When a container to be enabled is detected, the mount directory of the container to be enabled is added to the container home directory; According to the path information corresponding to the container to be enabled, it is determined in sequence whether the program files related to the container to be enabled meet the whitelist standard; Determine the program file that meets the whitelist standard as the second target file; determining a container tag of the second target file according to a matching relationship between the second path information of the second target file and the container home directory; The second integrity corresponding to the second target file is calculated, and the file tag, the second integrity, the second path information and the container tag corresponding to the second target file are added to the whitelist benchmark library as the file information of the second target file.
8. A program operation control device, characterized in that: The program operation control device comprises: A first verification module is used to perform a whitelist verification on the program to be run when a program to be run is detected, and obtain a whitelist verification result; A second verification module is used to verify the container information corresponding to the program to be run when the whitelist verification result is verification passed, and obtain a container verification result; A third verification module is used to verify the path information corresponding to the program to be run when the container verification result is verification passed, and obtain a path verification result; The execution module is used to execute the program to be run when the path verification result is verification passed.
9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.