Kernel task execution method, electronic device, readable storage medium and program product

Abstract

The present invention discloses a kernel task execution method, electronic device, readable storage medium and program product, and relates to the field of computer technology. The method includes creating a mapping table structure with at least three nested layers; the first layer mapping table stores the task identifier and its nested relationship with the lower layer, and the other layer mapping tables store the control rules and the corresponding nested relationship. The target task control rule information extracted from the resource policy file is divided into a corresponding number of task execution control rules, which are stored in the mapping table of the corresponding layer, and sent to the kernel state as a task execution control rule storage table. The kernel state controls the kernel task operation layer by layer according to the task execution control rule storage table. The present invention can solve the problem that the related technology eBPF Map cannot be nested in multiple layers, resulting in the inability to store the business needs of the access control rules in the container scenario, and can realize the control of container access in the container scenario.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a kernel task execution method, electronic equipment, computer-readable storage medium, and computer program product. Background Art

[0002] eBPF (Extended Berkeley Packet Filter) allows users to run custom programs in the kernel, efficiently processing data with minimal impact on system performance. The eBPF Map is the data structure used for sharing data between eBPF programs and between eBPF programs and user-space applications.

[0003] The eBPF Map of related technologies cannot match complex rules and cannot implement access control in container scenarios based on eBPF technology. Summary of the Invention

[0004] The present invention provides a kernel task execution method, electronic device, computer-readable storage medium and computer program product. By matching complex rule sets through multi-layer nested eBPF Maps, the business needs of storing complex task control rules are met, data processing in complex business scenarios can be realized, and access control in container scenarios is realized based on eBPF technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] One aspect of the present invention provides a kernel task execution method, comprising:

[0007] In a user-mode environment, at least three nested mapping table structures are created for the extended Berkeley packet filter; the first-layer mapping table stores task identifiers and their mapping relationships with the next-layer mapping table, and the mapping tables of other layers store corresponding task control rules and their mapping relationships with other layers; target task control rule information is extracted from a resource policy file, the target task control rule information is divided into multiple task execution control rules, and stored in the mapping tables of the corresponding layers as task execution control rule storage tables; the task execution control rule storage tables are sent down to the kernel mode, so that the kernel mode controls kernel task operations layer by layer according to the task execution control rule storage tables.

[0008] The present invention also provides an electronic device comprising a memory and a processor, wherein the processor is configured to implement the steps of any one of the above-mentioned kernel task execution methods when executing a computer program stored in the memory.

[0009] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of any one of the above-mentioned kernel task execution methods are implemented.

[0010] Finally, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of any of the above-mentioned kernel task execution methods when executed by a processor.

[0011] The advantage of the technical solution provided by the present invention is that by designing a multi-layer nested eBPF Map structure, there is a mapping relationship between different layers of eBPF Maps, and the complex task control rules corresponding to the kernel tasks that need to control the execution process are decomposed into multiple levels, each level corresponds to an eBPF Map, and these Maps are associated through the inter-layer mapping relationship to form an overall eBPF Map, which can provide the ability to build and process complex rule sets while maintaining the high efficiency of eBPF, thereby meeting the higher requirements of data processing in cloud computing, edge computing, security and other fields, and sending it down to the kernel state. The kernel state filters the kernel tasks layer by layer through the task execution control rule storage table, which can reduce the number of invalid rule traversals and improve the overall kernel task execution performance, thereby solving the business demand of being unable to store access control rules in container scenarios due to the inability to nest eBPF Maps in multiple layers in the eBPF program. It can realize data processing in complex kernel business scenarios and can realize container access control based on eBPF technology in container scenarios.

[0012] In addition, the present invention also provides corresponding electronic devices, computer-readable storage media and computer program products for implementing the kernel task execution method, further making the method more practical, and the electronic devices, computer-readable storage media and computer program products have corresponding advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0014] Figure 1 A schematic diagram of a hardware composition framework applicable to the kernel task execution method provided by the present invention;

[0015] Figure 2 A flowchart of a kernel task execution method provided by the present invention;

[0016] Figure 3A schematic diagram of a multi-layer nested mapping table structure provided by the present invention in an exemplary application scenario;

[0017] Figure 4 A schematic diagram of a mapping table structure update process provided by the present invention;

[0018] Figure 5 A schematic diagram of another mapping table structure update process provided by the present invention;

[0019] Figure 6 A structural framework diagram of an exemplary embodiment of the kernel task execution device provided by the present invention;

[0020] Figure 7 This is a structural diagram of an exemplary embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. The terms "first," "second," "third," "fourth," etc. in the specification and the accompanying drawings are used to distinguish different objects rather than to describe a specific order. Furthermore, the terms "including" and "having," as well as any variations thereof, are intended to cover non-exclusive inclusions. The term "exemplary" means "serving as an example, embodiment, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as superior or better than other embodiments.

[0022] With the development of cloud computing, edge computing, information security, and artificial intelligence technologies, electronic data processing and analysis are becoming increasingly complex. To address these challenges, eBPF allows users to run customized code in the kernel. Programs running in kernel mode can perform real-time, efficient network and system monitoring, security audits, and performance analysis. These operations include processing network packets, tracing system calls, and monitoring kernel events. eBPF is widely used for its powerful data processing capabilities while minimizing the impact on system performance, and its tight integration with the Linux kernel.

[0023] The eBPF Map data structure is used to share data between eBPF programs and between eBPF programs and userspace applications. While designed for simple key-value storage, eBPF Maps provide efficient data storage and retrieval mechanisms and support a variety of data types and operations, such as hash tables, arrays, and stacks. Since eBPF programs must pass static checks by the kernel verifier to ensure there are no risks like memory out-of-bounds and circular references, directly nesting hash tables may prevent the verifier from tracking complex memory relationships, leading to security denials. Furthermore, eBPF limits eBPF Maps to two levels of nesting, with multiple levels currently unsupported. These technical limitations prevent eBPF from flexibly nesting sets, as is possible in high-level languages ​​like Java and Go, to meet business requirements, such as storing matching rules. This significantly limits its expressiveness and flexibility for complex rule sets involving multiple levels of logical relationships, making it unsuitable for building complex rule sets. For some complex business scenarios, in order to enable the kernel to implement security scenarios such as access control and network traffic control by matching rule sets, it has to be restricted by the limitations of the eBPF program itself and sacrifice functions or performance to ensure the normal operation of the program.

[0024] To implement complex business scenarios by matching complex rule sets based on the eBPF map, the related technology establishes BPF hash tables in the four-level architecture of international top-level nodes, second-level nodes, enterprise nodes, and product nodes. These tables store the corresponding Industrial Internet identity resolution address cache. The Industrial Internet identities to be resolved are filtered hierarchically to generate corresponding node data. The data at each level is then compared concurrently with the corresponding BPF hash table to check for a match. If a match is found, the resolution result is directly returned. If no match is found, an identity resolution query is initiated to the next higher-level resolution node. The returned resolution result is then entered into the hash table. This method constructs a BPF table based on four business node types that match the logical architecture. Since these four nodes precisely match the logical architecture, the four nodes are distinguished by the specific representation of the IP (Internet Protocol Address) in the map key value, achieving the purpose of logical association. However, the eBPF Map of this method is four independent eBPF Maps, which are logically related based on the characteristics of the business itself and do not implement four-layer nesting. It can only be applied to scenarios that are the same or related to this type of business and cannot be extended to other business scenarios. It is not universal.

[0025] In view of this, the present invention designs a multi-layer nested eBPF Map structure, and there is an inter-layer correspondence between different layers of eBPF Maps, which decomposes the complex task control rules corresponding to the kernel tasks that need to control the execution process into multiple levels, each level corresponds to an eBPF Map, and forms an overall eBPF Map through the inter-layer mapping relationship, which meets the business needs of storing complex control rules, can realize data processing in complex kernel business scenarios, and can realize container access control based on eBPF technology in container scenarios. In combination with the specific application environment architecture or specific hardware architecture on which the execution of the kernel task execution method depends, the specific application environment architecture or specific hardware architecture is described here. The following is combined with Figure 1 Some possible application scenarios involved in the technical solution of the present invention are introduced by way of example, which may include the following:

[0026] In this embodiment, when the server kernel needs to execute services such as control, detection, and monitoring, the server's operating system switches between kernel mode and user mode during operation based on the task type and operational requirements. The eBPF map is used as the data structure for data exchange between kernel and user modes. User mode creates at least three nested mapping tables for eBPF. The first-level mapping table stores task identifiers and their mapping relationships with the next-level mapping table, while the mapping tables in the other layers store the corresponding task control rules and their mapping relationships with other layers. User mode extracts target task control rule information from the resource policy file, divides the target task control rule information according to the number of layers in the mapping table structure, and stores it in the mapping tables of the corresponding layers, resulting in a task execution control rule storage table. User mode then forwards this task execution control rule storage table to kernel mode, which then controls kernel task operations layer by layer according to the task execution control rule storage table. By introducing a multi-layered eBPF map structure, the server expands the application scope of eBPF technology, improves its ability and flexibility in handling complex rule set services, and provides rule storage and management support for container access control functions.

[0027] For example, assuming a server includes multiple containers, the kernel-mode implementation of container access control based on a three-layer eBPF map structure is as follows: A first-layer map is created, and a third-layer map array is initialized. When updating container access control rules, the container identifier is inserted into the first-layer map key, and a second-layer map is dynamically generated. The corresponding rule data is inserted into the second-layer map key, and permission to use the third-layer map is requested and the rule data is inserted into the third-layer map. When a container access control rule needs to be deleted, the first-layer map key is deleted, and the nested second- and third-layer maps are released. When the second-layer map key is deleted, the nested third-layer map is released. When third-layer maps are insufficient, dynamic creation is performed and added to the map array for use. When sufficient third-layer maps are available, excess maps are released. When kernel-mode rule matching is performed on process data, matching is performed sequentially according to the eBPF map layer. If a match fails at any layer, further matching is discontinued. If all matches are successful, the next action, such as interception or release, is determined based on the value in the third-layer map. By building a three-layer Map structure used in eBPF programs to store container control access rule sets, the demand for rule storage in complex business scenarios such as container access control is met, and the business scenarios of eBPF programs are expanded. Furthermore, by dynamically creating and destroying the second-layer Map, the overall performance is improved; by dynamically managing the third-layer Map array, business needs are met without occupying too many system resources.

[0028] It should be noted that the above application scenarios are only shown to facilitate understanding of the ideas and principles of the present invention, and the embodiments of the present invention are not limited in this respect. On the contrary, the embodiments of the present invention can be applied to any applicable scenario. After introducing the technical solution of the present invention, various non-limiting embodiments of the present invention are described in detail below with reference to the accompanying drawings and specific embodiments. First, please refer to Figure 2 , Figure 2 This is a flowchart of a kernel task execution method provided in this embodiment. This embodiment may include the following contents:

[0029] S201: Creating at least three nested mapping table structures for the extended Berkeley packet filter in a user mode environment.

[0030] The eBPF Map is a data structure in the Linux kernel, commonly used in scenarios where data is shared between user space and kernel space, enabling efficient data exchange between user-space programs and kernel modules. Currently, the eBPF Map supports a maximum of two layers of mapping tables, which cannot meet the needs of storing complex rules. This step constructs a multi-layered nested eBPF Map structure, such as M layers (Layer 1 → Layer 2 → Layer 3 → ... Layer M). This addresses the limitations of traditional single- or two-layer Maps in implementing complex business needs. The first-layer mapping table uses key-value pairs to store task identifiers and their mapping relationships with the mapping tables in the next layer. The mapping tables in the other layers use key-value pairs to store the corresponding task control rules and their mapping relationships with other layers. For example, a key in each Map layer can correspond to an independent Map in the next layer. This layer-by-layer transfer constructs a complex rule tree, with each Map layer storing a filter condition. By storing rules in three to N layers of eBPF Maps, the needs of various business scenarios can be met. Of course, increasing the number of layers will increase performance loss. Those skilled in the art can determine the appropriate number of layers based on actual needs. For example, the eBPF Map structure consists of three layers of maps, supporting filtering in three dimensions. Rules in these three layers are correlated, enabling fast matching. A three-layer eBPF Map structure can achieve at least a 1-N-N² rule correlation. One record in the first-layer Map corresponds to one map in the second layer. When the second-layer Map structure contains N maps, one record in the first layer corresponds to N records in the second layer. Similarly, one record in the second layer corresponds to one map in the third layer. If there are N records in the second layer, there will be N*N records in the third layer. This hierarchical rule correlation is: one task control rule in the first layer → N task control rules in the second layer → N*N task control rules in the third layer. This allows eBPF programs to meet the storage requirements for access control rules in container scenarios. Furthermore, to improve overall system performance, when building a multi-layer eBPF Map structure, second-layer maps are created only when needed and destroyed when not in use. In addition, each layer of the eBPF Map structure can be dynamically expanded according to actual needs to adapt to the rule management requirements of massive Pods (containers), containers, services, and other scenarios in the cloud native environment.

[0031] S202: extracting target task control rule information from the resource policy file, dividing the target task control rule information into multiple task execution control rules, and storing them in a mapping table of a corresponding layer as a task execution control rule storage table.

[0032] Resource policy files are configuration files that define various resources, such as Pods, Deployments, and Services. Configuration content includes resource limits, restart policies, update policies, rules, behaviors, or parameter settings. A target task can be any task running in kernel mode that requires rule matching, such as access control and other security services, including container access control tasks, container-based network access control tasks, kernel monitoring tasks, kernel control execution tasks, kernel detection tasks, and network traffic control tasks. The target task control rule information represents the restrictions or rules that the target task must comply with during kernel mode execution. The target task control rule information can be broken down into multiple matching task execution control rules. The number of levels in the mapping table structure is equal to the total number of task execution control rules. Once the mapping table structure is constructed, the target task control rule information is divided into multiple task execution control rules. If the mapping table structure is dynamically constructed during the task execution control rule population process, the total number of task execution control rules can be determined based on resource and performance requirements, and then divided according to this number. The number of levels in the mapping table structure is continuously increased based on the total number of task execution control rules. Each layer of the multi-layered nested eBPF Map structure in the previous step is a Map, and the number of entries can be flexibly determined based on actual business, system resources, and system performance. Each layer of Map entries includes key-value pairs from all Maps in that layer. Maps use key-value pairs to store content. The Key and Value in a Key-Value pair can store numbers, strings, or a specific object or structure, depending on the target task type. Taking container access control as an example: the first-layer Map structure has a Key: a container identifier, used to identify a container; a Value: pointing to a Map in the second-layer Map structure; a Key: an object path, i.e., the path of the object being accessed or operated on, such as / tmp / syslog.log; a Value: a Map in the third-layer Map structure; a third-layer Map: a Key: a subject path, i.e., the path of the operating process, such as / usr / bin / cat; and a Value: access permissions, such as read, write, execute, delete, and rename.

[0033] To store the complex rule set for the target task in the eBPF Map structure, the complex rule set extracted from the resource policy file can be broken down into multiple levels, with each level corresponding to a map structure in a layer of the eBPF Map structure. These maps are then linked together through program logic to form an organic whole. Taking the three-layer eBPF Map structure as an example, when parsing the target task control rule information, when a key (i.e., one of the matching conditions) is inserted into the first-layer Map, a second-layer Map is dynamically created and used as the value of the first-layer Map. After the first-layer rule filtering is completed, the second-layer rule matching can be performed in the second-layer Map: when a key is inserted into the second-layer Map, an index into the third-layer Map array is requested as the value, and this map is used as the corresponding third-layer Map to record the third-layer matching rule. The concept of storing access rules in three layers of containers can be extended to any eBPF program, using an N-layer eBPF Map structure to store complex rule sets that can be broken down into N layers of matching rules.

[0034] S203: Send the task execution control rule storage table to the kernel state, so that the kernel state controls the kernel task operations layer by layer according to the task execution control rule storage table.

[0035] The above steps S201 and S202 are implemented in the user state. After the target task control rule information corresponding to the target task is split and stored in the N-layer eBPF Map structure in the user state, the N-layer eBPF Map structure is sent to the kernel state. The kernel state monitors the task process information. Every time a task process information is captured, the task control rule corresponding to the task process information is obtained, and it is matched layer by layer with the task control rules stored in each layer of the Map of the task execution control rule storage table. If any layer fails to match, the match will not continue. That is, as long as one layer fails to match, the match will be terminated in the kernel. By filtering layer by layer, the number of invalid rule traversals can be reduced.

[0036] In the technical solution provided in this embodiment, by designing a multi-layer nested eBPF Map structure, there is a mapping relationship between different layers of eBPFMap, and the complex task control rules corresponding to the kernel tasks that need to control the execution process are decomposed into multiple levels, each level corresponds to an eBPF Map, and these Maps are associated through the inter-layer mapping relationship to form an overall eBPF Map, which can provide the ability to build and process complex rule sets while maintaining the high efficiency of eBPF, thereby meeting the higher requirements for data processing in cloud computing, edge computing, security and other fields, and sending it down to the kernel state. The kernel state filters the kernel tasks layer by layer through the task execution control rule storage table, which can reduce the number of invalid rule traversals and improve the overall kernel task execution performance, thereby solving the business demand of being unable to store access control rules in container scenarios due to the inability to nest eBPF Maps in multiple layers in the eBPF program. It can realize data processing in complex kernel business scenarios and can realize container access control based on eBPF technology in container scenarios.

[0037] In the above embodiment, there is no limitation on how to store the target task control rule information in the multi-layer nested eBPFMap structure. Based on the above embodiment, the present invention also provides an exemplary implementation method, which may include the following content:

[0038] The target container access control rule set is divided into a target container identifier, a second-layer filtering rule for screening the executed object, and a third-layer filtering rule for screening the execution subject; the third-layer filtering rule includes at least the subject location information and the subject permission information; the target container identifier is inserted into the key of the first-layer mapping table to generate a first sub-mapping table, and the first sub-mapping table is used as the value of the first-layer mapping table. The first sub-mapping table is the target second-layer mapping table in the second-layer mapping table structure to construct a corresponding nested relationship between the first-layer mapping table structure and the second-layer mapping table structure; the second-layer filtering rule is inserted into A second sub-mapping table is generated in the key of the target second-layer mapping table, and the second sub-mapping table is used as the value of the target second-layer mapping table. The second sub-mapping table is the target third-layer mapping table in the third-layer mapping table structure to construct a corresponding nested relationship between the second-layer mapping table structure and the third-layer mapping table structure; the third-layer filtering rules are respectively inserted into the key-value pairs of the target third-layer mapping table, such as inserting the third-layer filtering rules into the keys of the target third-layer mapping table, and the values ​​of the target third-layer mapping table are subject authority information, such as subject location information and subject authority, such as read authority, write authority, etc.

[0039] In this embodiment, the target task is a container access control task, the target task control rule information is a target container access control rule set, and accordingly, the task identifier is a container identifier. In the container scenario, a host can include multiple containers. In order to facilitate the storage and matching of container rules, Figure 3 As shown, a three-layer eBPF Map can be constructed. The first-layer Map filters containers, and its key is the container identifier. The second-layer Map filters the object path, and the third-layer Map filters the subject path. The target task is a network access control task under the container. The first-layer Map can also filter the container, and its key is the container identifier. The second-layer Map filters the IP address and can store source IP information. The third-layer Map can filter access permissions, such as accessed port information and operation permissions. Exemplarily, the target container access control rule set can be divided into the target container identifier, the object object path to be accessed or operated, the subject object path of the operating subject process, and the subject operation permissions. The target container identifier is used as the key of the first-layer mapping table, and the value of the first-layer mapping table is the corresponding relationship with the target second-layer mapping table in the second-layer mapping table structure; the object object path is used as the key of the target second-layer mapping table, and the value of the target second-layer mapping table is the corresponding relationship with the target third-layer mapping table in the third-layer mapping table structure; the subject object path is used as the key of the target third-layer mapping table, and the value of the target third-layer mapping table is the subject operation permissions.

[0040] For container-based access control tasks, the resource configuration file can be a YAML (a format for expressing serialized data) file, and the corresponding target task control rule information is obtained by parsing the YAML file. For example, an exemplary YAML file is shown below:

[0041] Name: access-control-container-policy;

[0042] Module(mode):access_control;

[0043] Scope: container;

[0044] Action: Monitor (interception, monitoring);

[0045] -selector (selection condition): intersection, all conditions must be met to be considered a match;

[0046] labelsSelector (used to match container labels):

[0047] -ksec / container.name (label of container name): lb*, a, b;

[0048] -namespace_Name(namespace);

[0049] -k:v (label format);

[0050] Container matching conditions (based on which containers the following policy applies to, based on the matching file);

[0051] fileProtectList (file protection list):

[0052] -path file protection;

[0053] processProtectList (process protection list):

[0054] -path process protection;

[0055] processBlackList (process blacklist list):

[0056] -path process blacklist;

[0057] -selector.

[0058] Among them, for the container name ksec, its Value is lb*, a, b, which means it is separated by , and represents 3 values: lb*, a, b. a and b are full word matches, that is, the container name must be equal to a or b. lb* is a wildcard match, as long as the container name starts with lb, it can match, such as lb123, lbabc, and lbdf1d. Parse the policy in the yaml file and match it with the current container list. If the match is successful, add the corresponding rules for the container. The rule content is the content of file and process access. For example, container A matches the policy. Then you need to parse the yaml into records in the Map:

[0059] First layer Map: Key = container A's identifier (pid=xx, mnt=xxx),

[0060] Value = reference to the second-level Map;

[0061] The second layer Map: Key = object path (for example, the file path to be protected: / opt / mysql),

[0062] Value is the identifier of the third-layer Map;

[0063] The third layer Map: Key = subject path, Value is operation permission.

[0064] Processes of different users are isolated by the pid (a namespace), and the same pid can exist in different namespaces. The xx character represents the corresponding content. When a process is placed in a specific directory for execution, the mnt (a namespace) namespace allows processes in different namespaces to see different file structures. The xxx character represents the corresponding content.

[0065] For a container access control task, when the kernel state receives an access control rule set, the layer-by-layer matching process may be as follows: when container access process information is obtained, the container information and access information belonging to the container access process information are obtained from the container access process information; when the container identifier of the container information matches the key of the first-layer mapping table of the container access control rule storage table, the target second-layer mapping table is located according to the value of the first-layer mapping table; when the executed object information in the access information matches the key of the target second-layer mapping table, the target third-layer mapping table is located according to the value of the target second-layer mapping table; when the subject information in the access information matches the key-value pair of the target third-layer mapping table, the container access process information is allowed to be executed in the kernel state. Among them, when the container identifier of the container information does not match the target container identifier of the first-layer mapping table of the container access control rule storage table, the container access process information is allowed to be executed; when the object object path in the access information does not match the object object path of the target second-layer mapping table, or the subject object path and access rights in the access information do not match the key-value pair of the target third-layer mapping table, the container access process information is not allowed to access the target container.

[0066] In this embodiment, the target second-level mapping table is located in the second-level Map structure and is nested within the first-level mapping table that matches the key. The target third-level mapping table is located in the third-level Map structure and is nested within the target second-level mapping table. When a certain access action occurs, the kernel captures the corresponding process information and obtains the corresponding container information, subject path (i.e., the subject process path of the object being operated on), object path (i.e., the file or process path being accessed or operated on), and permissions (such as read, write, execute, rename, and delete) from the captured process information. The layer-by-layer matching process is as follows: First-level Map: The captured process's container identifier is matched against the key at that layer. If no key exists, execution is directly permitted. If a match is successful, the container must comply with access control rules, and a second-level Map match is performed. Second-level Map: The captured process's object path is matched against the key at that layer. If a match is not found, the match is aborted. If a match is successful, the file or process at that object path in the container meets the rules, and a third-level Map match is performed. The third layer Map: The main path of the capture process is matched with the key of this layer, and the operation permission is matched with the value of this layer. That is, the current operation is compared with the restricted access rights. If there is no match, it is intercepted, otherwise it is passed.

[0067] As can be seen from the above, this embodiment uses a three-layer Map structure to store container access control rule sets, solving the limitations of traditional single-layer or double-layer Maps in implementing complex business needs. It can implement container access control based on eBPF technology in container scenarios, reduce the number of invalid rule traversals through a layer-by-layer filtering mechanism, and improve overall performance.

[0068] The present invention also provides another implementation process for storing target task control rule information in a multi-layer nested eBPFMap structure, which, in parallel with the above method, may include the following:

[0069] The network access control rule set is divided into source IP address, destination IP address, source port, destination port and protocol; the source IP address is inserted into the key of the first-layer mapping table, and an innerMap (sub-mapping table) is dynamically generated as the value of the first-layer mapping table, and the innerMap is the target second-layer mapping table; the destination IP address is used as the key of the target second-layer mapping table, and a third-layer mapping table array is requested from the pre-built mapping table array, and the index of the third-layer mapping table array is used as the value of the target second-layer mapping table; the source port is inserted into the key of the target third-layer mapping table, and a fourth-layer mapping table array is requested again from the mapping table array, and the index of the fourth-layer mapping table array is used as the value of the target third-layer mapping table; the destination port is inserted into the key of the target fourth-layer mapping table, and a fifth-layer mapping table array is requested again from the mapping table array, and the index of the fifth-layer mapping table array is used as the value of the target fourth-layer mapping table; the protocol type is inserted into the key of the target fifth-layer mapping table, and the access permission is inserted into the value of the fifth-layer mapping table.

[0070] In this embodiment, the target task control rule information is a network access control rule set, the task identifier is a source IP address, the network access process information is obtained in the kernel state, and the source IP address, destination IP address, source port, destination port and protocol are obtained from the network process information in sequence, and matched with each layer of the network access control rule set in sequence. After a successful match, the network access process information is allowed to execute.

[0071] As can be seen from the above, this embodiment uses a five-layer Map structure to store network access control rule sets, solving the limitations of traditional single-layer or double-layer Maps in implementing complex business needs. It can implement network access control based on eBPF technology in container scenarios, prevent virus intrusion, effectively improve system security, and reduce the number of invalid rule traversals through a layer-by-layer filtering mechanism, thereby improving overall performance.

[0072] The above embodiment does not limit how to create a multi-layer nested eBPF Map structure. Based on the above embodiment, the present invention also provides an exemplary implementation method, which may include the following content:

[0073] Initialize the first-level mapping table structure of the extended Berkeley packet filter's mapping table as a nested hash table, and construct a mapping table array of type nested hash table; after the key of the first-level mapping table in the first-level mapping table structure is filled with content, automatically create a sub-mapping table located in the second-level mapping table structure for the first-level mapping table, and at the same time apply for usage permission for the lower-level nested mapping table of the sub-mapping table from the mapping table array; use the array subscript of the lower-level nested mapping table corresponding to the mapping table array as the index and fill it into the value of the sub-mapping table.

[0074] In this embodiment, the sub-map is the value of the first-level map, and the nested map below it is located in the third-level map structure. In user mode, when the program starts, the first-level map can be initialized as a Hash OF Map (BPF_Map_TYPE_HASH_OF_MapS, a nested hash table). An innerMap is assigned to the first-level map as the value, which points to another eBPF map. However, these restrictions cannot be stacked. A Hash OF Map is a special map type in eBPF, belonging to the Map-in-Map structure. It supports two levels of maps by default and cannot be nested. References to other maps can be stored within the parent map's key-value pairs. The innerMap is a nested structure within BPF_Map_TYPE_HASH_OF_MapS. It is the "value" stored in the outer hash table, that is, another eBPF map. This value can be used to operate on the other eBPF map, such as reading or editing its contents. In user mode, the inner map is a file descriptor (fd) pointing to another eBPF map. In kernel mode, it is a pointer to an eBPF map.

[0075] The mapping table array is a Hash of Map array and can include multiple nested hash tables. This means that during initialization, some maps can be stored within it. For example, 512 Hash of Maps are created by default. When constructing maps for the third level and below, they can be directly retrieved from this array. Each Hash of Map has an array index that identifies its location in the mapping table array. This array index serves as the index of the Hash of Map, meaning that the array index is used when retrieving it. When matching rules in kernel mode, the first-level map is first matched against the key of the first-level map. A successful match retrieves the second-level map. A successful match retrieves the array index of the third-level map. The third-level map is then retrieved from the array using the index. A further rule match is performed against the key of the third-level map. If a successful match is found, the value stored in the Value field is retrieved. This value may represent permissions or further actions. The kernel can then process the obtained value accordingly.

[0076] In this embodiment, the first and second layers of the multi-layer nested eBPF Map structure are implemented using Hash Of Map. Subsequent layers can be completed by combining Hash Of Map and a dynamic mapping table array. Each time a layer is added, an array is requested from the mapping table array as the Map of the currently added layer, and the Value of the previous layer of the newly added layer records the Index of the dynamic array of the next layer. For example, when the target task control rule information is divided into four layers: container-subject-object-user, and the corresponding mapping table structure is also four layers, then two maps in the mapping table array are used to store the content after the third layer. When the target task control rule information is divided into five layers: source IP-destination IP-source port-destination port-protocol, and the corresponding mapping table structure is also five layers, then three maps in the mapping table array are used to store the content after the third layer.

[0077] As can be seen from the above, this embodiment constructs a mapping table structure in a dynamic manner and uses a mapping table array as the third-layer Map, which can simply and conveniently implement dynamic expansion of each layer of Map entries, allowing the eBPF program to meet the storage requirements of various complex matching rules and improve practicality.

[0078] Based on the above embodiment, the present invention further provides an implementation method for dynamically updating the mapping table array, which may include the following contents:

[0079] When the total number of nested hash tables in the mapping table array is less than the first preset number of tables, a request to expand the mapping table array is generated; when the current total number of nested hash tables in the mapping table array is greater than or equal to the first preset number of tables, a target nested hash table is selected from the mapping table array as the lower nested mapping table, and the array index value of the target nested hash table in the mapping table array is fed back to the sub-mapping table. When the total number of nested hash tables in the mapping table array is greater than or equal to the second preset number of tables, a request to shrink the mapping table array is generated; when the current total number of nested hash tables in the mapping table array is less than the second preset number of tables, a target nested hash table is selected from the mapping table array as the lower nested mapping table, and the array index value of the target nested hash table in the mapping table array is fed back to the sub-mapping table.

[0080] The first preset number of tables and the second preset number of tables can be determined based on actual resources and performance. When applying for permission to use the third Map, if the number of mapping tables contained in the mapping table array is insufficient, dynamic expansion of the array size is supported, i.e., expansion processing. If the number of mapping tables contained in the mapping table array exceeds the initial number and the available number is sufficient, in order to save resource usage and improve performance, reduction processing is also supported. The reduction processing of this embodiment includes two methods: one is to reset a new array size and reduce it to the new array size; the other is to delete those Maps that exceed the initial number, such as the initial default number.

[0081] As can be seen from the above, this embodiment flexibly adjusts the number of mapping tables included in the mapping table array according to demand, which not only does not occupy too many resources but also meets business needs and ensures system performance.

[0082] Based on the above embodiment, the present invention further provides an implementation method for adding and deleting operations on the mapping table structure, which may include the following contents:

[0083] For the rule deletion scenario: when a target key deletion request is detected, the target mapping table structure to which the target key corresponding to the target key deletion request belongs is determined; when the target key is located in the first-level target mapping table of the target mapping table structure, the target sub-mapping table created by the first-level target mapping table is determined, the target sub-mapping table is deleted, and the content and usage permissions of the lower-level target mapping table nested in the target sub-mapping table are cleared; when the target key is located in the second-level target mapping table of the target mapping table structure, the content and usage permissions of the lower-level target mapping table nested in the second-level target mapping table are cleared, and the target key of the second-level target mapping table is deleted; when the target key is located in the third-level target mapping table of the target mapping table structure, the content of the third-level target mapping table is updated accordingly.

[0084] In this embodiment, when the user deletes the task control rule, it will start from the first layer Map to query whether there is a task control rule to be deleted. Figure 4 As shown, first check whether the key of the first-level Map needs to be deleted. For ease of description, it is defined as the target key. If it is deleted, the corresponding second-level Map is deleted as a whole, that is, the target sub-mapping table. When deleting the second-level Map, check the third-level Map used, clear the content of the third-level Map, and release the usage permission. If the key in the first-level Map does not need to be deleted, but there is a key in the second-level Map that needs to be deleted, then clear the content of the corresponding third-level Map. After releasing the usage permission, delete the key in the second-level Map. If only the content of the third-level Map is deleted, then only the third-level Map needs to be updated.

[0085] For the scenario of rule addition: when a target key addition request is detected, the target mapping table structure to which the target key corresponding to the target key addition request belongs is determined; when the target key is located in the first-level target mapping table of the target mapping table structure, a target sub-mapping table is automatically generated for the first-level target mapping table, and corresponding usage permissions are applied for the third target mapping table nested in the target sub-mapping table; when the target key is located in the second-level target mapping table of the target mapping table structure, corresponding usage permissions are applied for the third target mapping table nested in the second-level target mapping table.

[0086] like Figure 5As shown, when a task control rule is added, if a key is added to the first-layer Map, then the second-layer Map must be dynamically generated synchronously, such as dynamically creating an innerMap, and applying for permission to use the third-layer Map. If the third-layer Map is insufficient, if the Map is not enough, 50 Maps are dynamically applied for, and dynamic expansion processing is performed according to the method of the above embodiment, and the array is placed for program use. If the third-layer Map is sufficient, such as the available number is greater than 50, and the total number exceeds the initial 512 Maps, the redundant ones are deleted and the mapping table array is updated synchronously.

[0087] As can be seen from the above, this embodiment supports the addition and deletion of task rules and timely clears the content and usage permissions of the third-layer Map, which not only improves the scope of business applicability and enables the eBPF program to meet the storage requirements of more businesses that require matching rules, but also improves overall performance.

[0088] Based on the above embodiment, after the user state sends the task execution control rule set to the kernel state, the kernel state will generate log information during the task control process based on the task execution control rule set. The kernel state stores the log information in the task execution control rule storage table and returns it to the user state. When the log information of the task execution control rule storage table sent by the kernel state is received, the user state obtains the log printing configuration information; according to the log printing configuration information, the log information is printed in the user state, such as printing the log to a file, console, or https (Hypertext Transfer Protocol Secure) according to the configuration, which is convenient for tracing, troubleshooting, and maintenance.

[0089] It should be noted that there is no strict order in which the steps in the present invention are performed. As long as they conform to a logical order, the steps can be performed simultaneously or in a predetermined order. Figure 2 、 Figure 4 and Figure 5 This is just a schematic and does not mean that this is the only execution order.

[0090] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0091] The present invention also provides a corresponding device for the kernel task execution method, which further makes the method more practical. Among them, the device can be described from the perspective of functional modules and hardware. The kernel task execution device provided by the present invention is introduced below. The device is used to implement the kernel task execution method provided by the present invention. In this embodiment, the kernel task execution device may include or be divided into one or more program modules. The one or more program modules are stored in a storage medium and executed by one or more processors to complete the kernel task execution method disclosed in Example 1. The program module referred to in this embodiment refers to a series of computer program instruction segments that can complete specific functions, which is more suitable for describing the execution process of the kernel task execution device in the storage medium than the program itself. The following description will specifically introduce the functions of each program module of this embodiment. The kernel task execution device described below and the kernel task execution method described above can be referenced to each other.

[0092] From the perspective of functional modules, see Figure 6 , Figure 6 This is a structural diagram of a kernel task execution device provided in this embodiment under a specific implementation mode. The device may include:

[0093] A multi-layer nested mapping table structure construction module 601 is used to create at least three layers of nested mapping table structures for the extended Berkeley packet filter in a user-mode environment; the first layer of mapping table stores task identifiers and their mapping relationship with the next layer of mapping table, and the mapping tables of other layers store corresponding task control rules and their mapping relationship with other layers.

[0094] The multi-layer nested mapping table structure generation module 602 is used to extract target task control rule information from the resource policy file, divide the target task control rule information into multiple task execution control rules, and store them in the mapping table of the corresponding layer as a task execution control rule storage table.

[0095] The task level-by-level control module 603 is used to send the task execution control rule storage table to the kernel state, so that the kernel state can control the kernel task operation level by level according to the task execution control rule storage table.

[0096] Illustratively, in some implementations of this embodiment, the multi-layer nested mapping table structure generation module 602 may further be used to: divide the target container access control rule set into a target container identifier, a second-layer filtering rule for filtering executed objects, and a third-layer filtering rule for filtering executing subjects; the third-layer filtering rule includes at least subject location information and subject permission information; insert the target container identifier into the key of the first-layer mapping table to generate a first sub-mapping table, and use the first sub-mapping table as the value of the first-layer mapping table. The first sub-mapping table is the target second-layer mapping table in the second-layer mapping table structure, so as to establish a corresponding nested relationship between the first-layer mapping table structure and the second-layer mapping table structure; insert the second-layer filtering rule into the key of the target second-layer mapping table to generate a second sub-mapping table, and use the second sub-mapping table as the value of the target second-layer mapping table. The second sub-mapping table is the target third-layer mapping table in the third-layer mapping table structure, so as to establish a corresponding nested relationship between the second-layer mapping table structure and the third-layer mapping table structure; and insert the third-layer filtering rule into the key-value pairs of the target third-layer mapping table respectively; wherein the target task control rule information is the target container access control rule set, and the task identifier is the container identifier.

[0097] As an exemplary implementation method of the above embodiment, the above-mentioned task step-by-step control module 603 can also be further used for: when the container access process information is obtained, the container information and access information belonging to it are obtained from the container access process information; when the container identifier of the container information matches the key of the first-layer mapping table of the container access control rule storage table, the target second-layer mapping table is located according to the value of the first-layer mapping table; when the executed object information in the access information matches the key of the target second-layer mapping table, the target third-layer mapping table is located according to the value of the target second-layer mapping table; when the subject information in the access information matches the key-value pair of the target third-layer mapping table, the container access process information is allowed to be executed in kernel mode.

[0098] Exemplarily, in some other implementations of this embodiment, the above-mentioned multi-layer nested mapping table structure generation module 602 can also be used for: the target task control rule information is the target container access control rule set, the task identifier is the container identifier, and the target container access control rule set is divided into the target container identifier, the object path of the object being accessed or operated, the subject object path of the operating subject process and the subject operation authority; the target container identifier is used as the key of the first-layer mapping table, and the value of the first-layer mapping table is the corresponding relationship with the target second-layer mapping table in the second-layer mapping table structure; the object object path is used as the key of the target second-layer mapping table, and the value of the target second-layer mapping table is the corresponding relationship with the target third-layer mapping table in the third-layer mapping table structure; the subject object path is used as the key of the target third-layer mapping table, and the value of the target third-layer mapping table is the subject operation authority.

[0099] As an exemplary implementation method of the above embodiment, the above-mentioned task step-by-step control module 603 can also be further used for: when container access process information is obtained, obtaining the corresponding container information and access information from the container access process information; matching the container identifier of the container information with the target container identifier of the first-level mapping table of the container access control rule storage table; when the container identifier of the container information is consistent with the target container identifier, locating the target second-level mapping table according to the value of the first-level mapping table; matching the object object path in the access information with the key of the target second-level mapping table; when the object object path in the access information is consistent with the object object path of the target second-level mapping table, locating the target third-level mapping table according to the value of the target second-level mapping table; matching the subject object path and access rights in the access information with the key-value pairs of the target third-level mapping table respectively, and allowing the container access process information to execute after the match is successful.

[0100] As another exemplary implementation of the above embodiment, the above-mentioned task step-by-step control module 603 can also be further used for: when the container identifier of the container information does not match the target container identifier of the first-level mapping table of the container access control rule storage table, the container is allowed to access the process information for execution; when the object object path in the access information does not match the object object path of the target second-level mapping table, or the subject object path and access rights in the access information do not match the key-value pair of the target third-level mapping table, the container is not allowed to access the process information to access the target container.

[0101] Exemplarily, in some other implementations of this embodiment, the above-mentioned device may also include a deletion module, which is used to: when a target key deletion request is detected, determine the target mapping table structure to which the target key corresponding to the target key deletion request belongs; when the target key is located in the first-level target mapping table of the target mapping table structure, determine the target sub-mapping table created by the first-level target mapping table, delete the target sub-mapping table, and clear the content and usage permissions of the lower-level target mapping table nested in the target sub-mapping table; when the target key is located in the second-level target mapping table of the target mapping table structure, clear the content and usage permissions of the lower-level target mapping table nested in the second-level target mapping table, and delete the target key of the second-level target mapping table; when the target key is located in the third-level target mapping table of the target mapping table structure, update the content of the third-level target mapping table accordingly.

[0102] Exemplarily, in some other implementations of this embodiment, the above-mentioned device may also include an addition module, which is used to: when a target key addition request is detected, determine the target mapping table structure to which the target key corresponding to the target key addition request belongs; when the target key is located in the first-level target mapping table of the target mapping table structure, automatically generate a target sub-mapping table for the first-level target mapping table, and apply for corresponding usage permissions for the third target mapping table nested in the target sub-mapping table; when the target key is located in the second-level target mapping table of the target mapping table structure, apply for corresponding usage permissions for the third target mapping table nested in the second-level target mapping table.

[0103] Exemplarily, in some other implementations of this embodiment, the above-mentioned device may also include a log printing module, which is used to: when receiving log information of the task execution control rule storage table sent by the kernel state, obtain log printing configuration information in the user state; and print the log information in the user state according to the log printing configuration information.

[0104] Exemplarily, in some other implementations of this embodiment, the above-mentioned multi-layer nested mapping table structure construction module 601 can also be used to: initialize the first-layer mapping table structure of the mapping table of the extended Berkeley packet filter as a nested hash table, and construct a mapping table array of the type of a nested hash table; the mapping table array includes multiple nested hash tables; after the key of the first-layer mapping table in the first-layer mapping table structure is filled with content, a sub-mapping table located in the second-layer mapping table structure is automatically created for the first-layer mapping table, and at the same time, from the mapping table array, the use permission is applied for the lower-layer nested mapping table of the sub-mapping table; the array subscript corresponding to the lower-layer nested mapping table in the mapping table array is used as an index and filled into the value of the sub-mapping table; wherein the sub-mapping table is the value of the first-layer mapping table, and the lower-layer nested mapping table of the sub-mapping table is located in the third-layer mapping table structure.

[0105] As an exemplary implementation of the above embodiment, the above-mentioned multi-layer nested mapping table structure construction module 601 can be further used to: when the total number of nested hash tables in the mapping table array is less than the first preset number of tables, generate a capacity expansion request for the mapping table array; when the current total number of nested hash tables in the mapping table array is greater than or equal to the first preset number of tables, select the target nested hash table from the mapping table array as the lower-level nested mapping table, and feed back the array subscript value of the target nested hash table in the mapping table array to the sub-mapping table.

[0106] As another exemplary implementation of the above embodiment, the above-mentioned multi-layer nested mapping table structure construction module 601 can be further used to: when the total number of nested hash tables in the mapping table array is greater than or equal to the second preset number of tables, generate a reduction request for the mapping table array; when the current total number of nested hash tables in the mapping table array is less than the second preset number of tables, select the target nested hash table from the mapping table array as the lower-level nested mapping table, and feed back the array subscript value of the target nested hash table in the mapping table array to the sub-mapping table.

[0107] The kernel task execution device mentioned above is described from the perspective of functional modules. Furthermore, the present invention also provides an electronic device, which is described from the perspective of hardware. Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present invention in one implementation manner. The electronic device includes a memory 701 and a processor 702. The memory 701 stores a computer program, and the processor 702 is configured to run the computer program to perform the steps of any of the above-mentioned kernel task execution method embodiments.

[0108] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned kernel task execution method embodiments when running.

[0109] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0110] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned kernel task execution method embodiments are implemented.

[0111] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of any of the above-mentioned kernel task execution method embodiments.

[0112] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0113] The above is a detailed introduction to a kernel task execution method, electronic device, computer-readable storage medium, and computer program product provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core ideas of the present application. It should be noted that, for those skilled in the art, without departing from the principles of the present application, several improvements and modifications may be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A kernel task execution method, characterized in that: include: Create at least three nested mapping table structures for the extended Berkeley packet filter in user mode. The first layer mapping table stores the task identifier and its mapping relationship with the next layer mapping table, and the mapping tables of other layers store the corresponding task control rules and the mapping relationship between them and other layers; Extracting target task control rule information from a resource policy file, dividing the target task control rule information into a plurality of task execution control rules, and storing the corresponding information in a mapping table of a corresponding layer as a task execution control rule storage table; wherein the number of layers of the mapping table structure is the same as the total number of task execution control rules; The task execution control rule storage table is sent to the kernel state, so that the kernel state controls the kernel task operation layer by layer according to the task execution control rule storage table.

2. The kernel task execution method according to claim 1, characterized in that: The target task control rule information is a target container access control rule set, and the task identifier is a container identifier. The target task control rule information is divided into multiple task execution control rules, and stored in a mapping table of a corresponding layer as a task execution control rule storage table, including: Dividing the target container access control rule set into a target container identifier, a second-layer filtering rule for filtering the executed object, and a third-layer filtering rule for filtering the executing subject; the third-layer filtering rule at least includes subject location information and subject permission information; Inserting the target container identifier into the key of the first-layer mapping table to generate a first sub-mapping table, and using the first sub-mapping table as a value of the first-layer mapping table to establish a corresponding nested relationship between the first-layer mapping table structure and the second-layer mapping table structure; the first sub-mapping table is the target second-layer mapping table in the second-layer mapping table structure; Inserting the second-layer filtering rule into the key of the target second-layer mapping table to generate a second sub-mapping table, and using the second sub-mapping table as the value of the target second-layer mapping table to establish a corresponding nested relationship between the second-layer mapping table structure and the third-layer mapping table structure; the second sub-mapping table is the target third-layer mapping table in the third-layer mapping table structure; The third layer filtering rules are respectively inserted into the key-value pairs of the target third layer mapping table.

3. The kernel task execution method according to claim 2, characterized in that: The task execution control rule storage table is a container access control rule storage table, and access operations on target container kernel tasks are controlled according to the task execution control rule storage table, including: When the container access process information is obtained, the container information and access information are obtained from the container access process information; When the container identifier of the container information matches the key of the first-layer mapping table of the container access control rule storage table, locating the target second-layer mapping table according to the value of the first-layer mapping table; When the executed object information in the access information matches the key of the target second-layer mapping table, locating the target third-layer mapping table according to the value of the target second-layer mapping table; When the subject information in the access information matches the key-value pair of the target third-layer mapping table, the container access process information is allowed to be executed in the kernel state.

4. The kernel task execution method according to claim 1, wherein: The target task control rule information is a target container access control rule set, and the task identifier is a container identifier. The target task control rule information is divided into multiple task execution control rules and stored in a mapping table of a corresponding layer as a task execution control rule storage table, including: Dividing the target container access control rule set into a target container identifier, an object path of an accessed or operated object, a subject object path of an operating subject process, and subject operation permissions; Using the target container identifier as a key of the first-layer mapping table, and the value of the first-layer mapping table as a correspondence with the target second-layer mapping table in the second-layer mapping table structure; Using the object path as a key of the target layer-2 mapping table, the value of the target layer-2 mapping table is a correspondence with the target layer-3 mapping table in the layer-3 mapping table structure; The subject object path is used as the key of the target third-layer mapping table, and the value of the target third-layer mapping table is the subject operation permission.

5. The kernel task execution method according to claim 4, characterized in that: The task execution control rule storage table is a container access control rule storage table, and kernel task operations are controlled layer by layer according to the task execution control rule storage table, including: When the container access process information is obtained, the container information and access information are obtained from the container access process information; Matching the container identifier of the container information with the target container identifier of the first layer mapping table of the container access control rule storage table; When the container identifier of the container information is consistent with the target container identifier, locating the target second-layer mapping table according to the value of the first-layer mapping table; Matching the object path in the access information with the key of the target second layer mapping table; When the object path in the access information is consistent with the object path in the target layer-2 mapping table, locating the target layer-3 mapping table according to the value in the target layer-2 mapping table; The subject object path and access rights in the access information are matched with the key-value pairs of the target third-layer mapping table respectively, and after a successful match, the container is allowed to access the process information for execution.

6. The kernel task execution method according to claim 5, characterized in that: After obtaining the container information and access information from the container access process information, the method further includes: When the container identifier of the container information does not match the target container identifier of the first-layer mapping table of the container access control rule storage table, allowing the container to access the process information for execution; When the object object path in the access information does not match the object object path of the target second-layer mapping table, or the subject object path and access rights in the access information do not match the key-value pairs of the target third-layer mapping table, the container access process information is not allowed to access the target container.

7. The kernel task execution method according to claim 1, characterized in that: After creating at least three nested mapping table structures for the extended Berkeley packet filter in the user mode environment, it also includes: When a target key deletion request is detected, determining a target mapping table structure to which the target key corresponding to the target key deletion request belongs; When the target key is located in a first-level target mapping table of the target mapping table structure, determining a target sub-mapping table created by the first-level target mapping table, deleting the target sub-mapping table, and clearing the content and usage permissions of the lower-level target mapping tables nested in the target sub-mapping table; When the target key is located in a second-layer target mapping table of the target mapping table structure, clearing the content and usage permissions of the lower-layer target mapping table nested in the second-layer target mapping table, and deleting the target key of the second-layer target mapping table; When the target key is located in the third-level target mapping table of the target mapping table structure, the content of the third-level target mapping table is updated accordingly.

8. The kernel task execution method according to claim 1, wherein: After creating at least three nested mapping table structures for the extended Berkeley packet filter in the user mode environment, it also includes: When a target key addition request is detected, determining a target mapping table structure to which the target key corresponding to the target key addition request belongs; When the target key is located in the first-level target mapping table of the target mapping table structure, a target sub-mapping table is automatically generated for the first-level target mapping table, and corresponding usage permissions are applied for the third target mapping table nested in the target sub-mapping table; When the target key is located in the second-level target mapping table of the target mapping table structure, a corresponding use permission is applied for a third target mapping table nested in the second-level target mapping table.

9. The kernel task execution method according to claim 1, characterized in that: After sending the task execution control rule storage table to the kernel state, the method further includes: When receiving the log information of the task execution control rule storage table sent by the kernel state, obtaining log printing configuration information in the user state environment; The log information is printed in the user mode environment according to the log printing configuration information.

10. The kernel task execution method according to any one of claims 1 to 9, characterized in that: In the user-mode environment, create at least three nested mapping table structures for the extended Berkeley packet filter, including: Initializing a first-level mapping table structure of a mapping table of an extended Berkeley packet filter as a nested hash table, and constructing a mapping table array of the type of the nested hash table; the mapping table array includes a plurality of nested hash tables; After the key of the first-level mapping table in the first-level mapping table structure is filled with content, a sub-mapping table located in the second-level mapping table structure is automatically created for the first-level mapping table, and at the same time, permission to use the nested mapping tables under the sub-mapping table is requested from the mapping table array; Use the array subscript of the lower nested mapping table corresponding to the mapping table array as the index and fill it into the value of the sub-mapping table; The sub-mapping table is a value of the first-layer mapping table, and the lower-layer nested mapping table of the sub-mapping table is located in the third-layer mapping table structure.

11. The kernel task execution method according to claim 10, characterized in that: Applying for permission to use the nested mapping table below the sub-mapping table from the mapping table array includes: When the total number of nested hash tables in the mapping table array is less than a first preset number of tables, generating a request for expanding the mapping table array; When the total number of current nested hash tables in the mapping table array is greater than or equal to a first preset number of tables, a target nested hash table is selected from the mapping table array as the lower nested mapping table, and the array subscript value of the target nested hash table in the mapping table array is fed back to the sub-mapping table.

12. The kernel task execution method according to claim 10, characterized in that: Applying for permission to use the nested mapping table below the sub-mapping table from the mapping table array includes: When the total number of nested hash tables in the mapping table array is greater than or equal to a second preset number of tables, generating a request to shrink the mapping table array; When the total number of current nested hash tables in the mapping table array is less than a second preset number of tables, a target nested hash table is selected from the mapping table array as the lower nested mapping table, and the array subscript value of the target nested hash table in the mapping table array is fed back to the sub-mapping table.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the kernel task execution method according to any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the kernel task execution method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the kernel task execution method according to any one of claims 1 to 12 are implemented.

Images