File processing method, electronic equipment, storage medium and program product

Abstract

The invention discloses a file processing method, electronic equipment, a storage medium and a program product, and relates to the field of data process.The file processing method comprises the steps that when a file needs to be processed, a processing request for a first file can be received; according to the first process, a first namespace and a second namespace corresponding to the first process are determined, the first namespace is used for indicating the number of the first process, and the second namespace is used for indicating the number of a file system of the first process; determining a target rule base corresponding to the first file in a preset rule base according to the first namespace and the second namespace; and processing the first file according to the target rule base. By means of the method, the target rule base corresponding to the first file can be determined and processed according to the first namespace and the second namespace, searching in a full-amount preset rule base is not needed, and therefore the rule searching efficiency is improved, and the file processing efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method for processing documents, an electronic device, a storage medium, and a program product. Background Technology

[0002] With the rapid development of cloud computing and microservice architecture, containerization technology has become a core component of modern electronic information infrastructure.

[0003] In related technologies, container management typically employs a static rule base approach, where host machine rules and container rules are stored together. When processing files, a full search of the mixed rule base is required to find the corresponding rule. However, this method becomes inefficient when the number of mixed rules is large. Summary of the Invention

[0004] This application provides a file processing method, electronic device, storage medium, and program product to at least solve the problem of low efficiency in finding and processing rules corresponding to files.

[0005] This application provides a document processing method, including:

[0006] Receive a processing request for the first file, the processing request including the first process for processing the first file;

[0007] Based on the first process, determine the first namespace and the second namespace corresponding to the first process. The first namespace is used to indicate the number of the first process, and the second namespace is used to indicate the number of the file system of the first process.

[0008] Based on the first namespace and the second namespace, determine the target rule base corresponding to the first file in the preset rule base;

[0009] The first file is processed according to the target rule base.

[0010] This application also provides a document processing apparatus, comprising: a receiving module, a first determining module, a second determining module, and a processing module, wherein,

[0011] The receiving module is used to receive a processing request for the first file, the processing request including a first process for processing the first file;

[0012] The first determining module is used to determine, based on the first process, the first namespace and the second namespace corresponding to the first process, wherein the first namespace is used to indicate the number of the first process and the second namespace is used to indicate the number of the file system of the first process.

[0013] The second determining module is used to determine the target rule library corresponding to the first file in the preset rule library based on the first namespace and the second namespace;

[0014] The processing module is used to process the first file according to the target rule base.

[0015] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described file processing methods.

[0016] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described file processing methods.

[0017] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described file processing methods.

[0018] This application allows for the following mechanism: when file processing is required, a processing request for a first file can be received. The processing request includes a first process for processing the first file. Based on the first process, a first namespace and a second namespace corresponding to the first process are determined. The first namespace indicates the process ID, and the second namespace indicates the file system ID of the first process. Based on the first and second namespaces, a target rule library corresponding to the first file is determined from a preset rule library. Finally, the first file is processed according to the target rule library. This method allows for the determination of the first and second namespaces corresponding to the first process based on the process processing the first file, and the determination of the target rule library based on these namespaces. This eliminates the need to search the entire preset rule library, thus improving the efficiency of rule searching and consequently, the efficiency of file processing. Attached Figure Description

[0019] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the system architecture provided for an embodiment of this application;

[0021] Figure 2 A flowchart illustrating the document processing method provided in this application embodiment;

[0022] Figure 3 A schematic diagram illustrating the process of determining the target rule base provided in this application embodiment;

[0023] Figure 4 A schematic diagram illustrating the process of determining the first rule base and multiple second rule bases provided in the embodiments of this application;

[0024] Figure 5 A schematic diagram illustrating the process of processing the first document provided in the embodiments of this application;

[0025] Figure 6 A schematic diagram illustrating the process of determining target rules provided in this application embodiment;

[0026] Figure 7 A schematic diagram of the structure of the document processing apparatus provided in the embodiments of this application;

[0027] Figure 8 A schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0028] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0029] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0030] In related technologies, container management typically employs a static rule base approach, where host machine rules and container rules are stored together. When processing files, a full search of the mixed rule base is required to find the corresponding rule. However, this method becomes inefficient when the number of mixed rules is large.

[0031] To address the aforementioned issues, in this embodiment, when file processing is required, a processing request for a first file can be received. The processing request includes a first process for processing the first file. Based on the first process, a first namespace and a second namespace corresponding to the first process are determined. The first namespace indicates the number of the first process, and the second namespace indicates the file system number of the first process. Based on the first and second namespaces, a target rule library corresponding to the first file is determined from a preset rule library. This includes: determining a first rule library and multiple second rule libraries in the preset rule library. The first rule library stores general rules, and the second rule libraries store rules corresponding to containers. When the first namespace equals a first preset value, the first rule library is determined as the target rule library corresponding to the first file. When the first namespace does not equal the first preset value, the target rule library corresponding to the first file is determined from multiple second rule libraries based on the first and second namespaces. The first file is then processed according to the target rule library. Using the above method, the first namespace and second namespace corresponding to the first process can be determined based on the process of processing the first file. Based on the first namespace and second namespace, the target rule base corresponding to processing the first file can be determined. In this way, it is not necessary to search through the entire preset rule base, thereby improving the efficiency of rule search and thus improving the efficiency of file processing. At the same time, the preset rule base can be integrated to distinguish between general rules and container rules, thereby further improving the efficiency of rule search.

[0032] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] The specific application environment architecture or hardware architecture upon which the file processing method depends is described here. (References) Figure 1 , Figure 1 This is a schematic diagram of the system architecture provided for an embodiment of this application. Please refer to [link / reference]. Figure 1 This includes electronic devices and a host machine. The electronic device can be a user's electronic device, or a device with on-device computing capabilities, such as a terminal device or a server. The host machine can be an electronic device with computing and storage capabilities; for example, it can be a server. A container can be hosted on the host machine, meaning the container can run on the host machine. The electronic device can send file processing requests to the host machine to process files within the host machine. For example, it can perform operations such as adding, deleting, modifying, and searching files within the host machine. The host machine can determine whether to process the file based on the file processing request.

[0034] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0035] Figure 2 A flowchart illustrating the document processing method provided in this application embodiment is shown below. Figure 2 As shown, embodiments of this application provide a method for processing files, which is described in detail below:

[0036] S201, Receive a request to process the first file.

[0037] The execution subject in this application embodiment can be an electronic device, which can be a device with on-device computing capabilities, such as a server or terminal device. The execution subject can also be a file processing device installed in the electronic device. The file processing device can be implemented through software or a combination of software and hardware.

[0038] It should be noted that this application can be applied to the Extended Berkeley Packet Filter (eBPF) technology.

[0039] The first file processing request can be a request sent by the user's electronic device. The first file processing request can be used to perform processing operations on the first file. For example, the first file processing request can be a request to open the first file, a request to delete the first file, a request to modify the first file, etc.

[0040] The first file can be a file to be processed, or it can be a file stored on the host machine. Understandably, the first file can be a local file stored on the host machine or a file stored in a container on the host machine.

[0041] The request to process the first file may include the first process that processes the first file. It is understood that the first process can refer to a program instance that processes the first file.

[0042] S202. Based on the first process, determine the first namespace and the second namespace corresponding to the first process.

[0043] The first namespace can be used to indicate the number of the first process. In essence, the first namespace can be the process identifier (PID) of the first process. That is, the first namespace can be used by the kernel mechanism to isolate process numbers; processes within each namespace can have independent numbers, and the first namespace can uniquely identify the first process. For example, the first namespace can be 100, which can be understood as the number of the first process being 100.

[0044] The second namespace can be used to indicate the file system number of the first process. It can be understood that the second namespace can be the mount namespace of the first process. The second namespace can also be used to isolate the kernel mechanism of the file system, allowing processes within each namespace to have independent root directories and file views. For example, the second namespace could be 5, meaning that the file system number of the first process is 5.

[0045] After determining the first process, the first and second namespaces corresponding to the first process can be obtained by calling a standardized interface. This standardized interface can be the Docker Application Programming Interface (Docker API).

[0046] S203. Based on the first namespace and the second namespace, determine the target rule base corresponding to the first file in the preset rule base.

[0047] A preset rule base can be a pre-configured set of rules used to control file processing permissions. A preset rule base can include multiple rules, which can be determined by importing template data or by receiving data from the network.

[0048] The target rule base can be the final rule base used to determine whether the file processing request of the first file is compliant.

[0049] In one possible implementation, the target rule base corresponding to the first file can be determined as follows: a first rule base and multiple second rule bases are determined in a preset rule base; when the first namespace is equal to a first preset value, the first rule base is determined as the target rule base corresponding to the first file; when the first namespace is not equal to the first preset value, the target rule base corresponding to the first file is determined from multiple second rule bases based on the first namespace and the second namespace.

[0050] The first rule base can be used to store general rules, and the second rule base can be used to store rules corresponding to containers.

[0051] The first preset value can be a value set by the user in advance. For example, the first preset value is PROC_INIT_INO (i.e., the initialization value). It can be understood that when the first namespace is equal to the first preset value, it can be assumed that the first process is located in the initial namespace of the host machine, that is, the first process is located in a non-container environment, and the rule corresponding to the first file needs to be determined in the general rule base (i.e., the first rule base). When the first namespace is not equal to the first preset value, it can be assumed that the first process is located in a container of the host machine, and the rule corresponding to the first file needs to be determined in the container rule (i.e., the second rule base) base.

[0052] Understandably, based on the first and second namespaces, the container corresponding to the first file can be determined. After determining the container corresponding to the first file, the rule base corresponding to the container can be determined from multiple second rule bases, thereby achieving the purpose of accurate matching and improving the efficiency of rule determination.

[0053] S204. Process the first file according to the target rule base.

[0054] Processing the first file can refer to determining, based on the target rule base, whether or not permission is granted to process the first file, and then determining whether or not to process the first file. That is, if permission is granted to process the first file, the first file can be processed according to the processing request, and if permission is not granted, an error message can be generated.

[0055] In one possible implementation, the first file can be processed as follows: based on the processing request, determine the processing type of the processing request and the user identifier corresponding to the processing request; based on the processing type and the first process, determine the target rule in the target rule base; and process the first file based on the processing type, the target rule, and the user identifier.

[0056] The processing type can refer to the specific operation type of the file processing request. For example, the processing type can be open, add, delete, modify, view, execute, etc.

[0057] A user identifier can refer to the identity of the user who initiates the file processing request, and a user identifier can uniquely identify a user.

[0058] Understandably, based on the target rules in the target rule base, different users have different permissions to process the same file. For example, according to the target rules in the target rule base, user A may have the permission to view the first file, but not the permission to modify or delete it, while user B may have the permission to view, modify, and delete the first file.

[0059] In one possible implementation, the method further includes: receiving a deletion instruction for the second container; determining the second container identifier of the second container in a first mapping table; determining the third rule base corresponding to the second container in the second mapping table based on the second container identifier, and deleting the third rule base.

[0060] The delete command refers to a user-defined command used to terminate and remove a container instance. Essentially, a delete command can be a signal that triggers the destruction of a container. The second container can be the container to be deleted.

[0061] Optionally, after deleting the third rule base corresponding to the second container, the correspondence between the second container and the second container identifier in the first mapping table can also be deleted.

[0062] Optionally, the correspondence between the second container representation and the third rule base in the second mapping table can also be deleted.

[0063] This creates a closed loop from container destruction to rule base cleanup, thus avoiding the problem of invalid files increasing in the rule base when the container is destroyed but the corresponding rules are still stored there, thereby improving the efficiency of rule lookup.

[0064] In this embodiment, when a file needs to be processed, a processing request for a first file can be received. This processing request can be used to perform processing operations on the first file. The processing request may include a first process for processing the first file, which can refer to a program instance that processes the first file. Based on the first process, a first namespace and a second namespace corresponding to the first process are determined. The first namespace can be used to indicate the number of the first process, and the second namespace can be used to indicate the file system number of the first process. The first and second namespaces can be obtained by calling a standardized interface. Based on the first and second namespaces, a target rule base corresponding to the first file is determined in a preset rule base. The preset rule base can be a pre-configured set of rules used to control file processing permissions, and the target rule base can be the rule base ultimately used to determine whether the file processing request for the first file is compliant. The preset rule base may include a first rule base and multiple second rule bases. The first rule base can be used to store general rules, and the second rule bases can be used to store rules corresponding to containers. The first file is then processed according to the target rule base. In this way, by using the above method, it is possible to determine whether the first process acts on the host machine or the container based on the first namespace and the second namespace, and then determine the corresponding target rule base in the preset rule base, thereby avoiding rule confusion and privilege escalation risks. At the same time, by separating the first rule base and multiple second rule bases, the rules of the first file can be accurately matched, reducing the amount of rule lookup and thus improving the rule lookup efficiency. Furthermore, by using the mapping between namespaces and rule bases, fast rule querying and dynamic adaptation are achieved, which not only meets the real-time synchronization requirements of policies under the dynamic changes of the container lifecycle, but also achieves efficient management of file processing requests while ensuring system stability and security through optimized data interaction between kernel space and user space.

[0065] Based on any of the above embodiments, the following, in conjunction with Figure 3 The process of determining the target rule base is explained in detail.

[0066] Figure 3 This is a schematic diagram illustrating the process of determining the target rule base provided in this embodiment of the application. Please refer to... Figure 3 The method may include:

[0067] S301. Determine the first rule base and multiple second rule bases in the preset rule base.

[0068] The first rule base can be used to store general rules. It can also store fundamental rules that all processes must follow, regardless of whether it's the host machine or a container, without distinguishing between specific container or host environments.

[0069] The second rule base can be used to store rules corresponding to containers. Understandably, different containers can correspond to different rules, and the second rule base can contain container-specific rules.

[0070] In one possible implementation, a first rule base and multiple second rule bases can be determined as follows: multiple first rules are obtained from a preset rule base; the multiple first rules are validated to obtain valid second rules among the multiple first rules; it is determined whether the multiple second rules have corresponding container identifiers; the second rules with container identifiers are identified as container rules, and the second rules without container identifiers are identified as general rules; the general rules are integrated to obtain a first rule base; multiple second rule bases are determined based on the container rules and the container identifiers corresponding to the container rules, wherein each second rule base includes at least one container rule, and the container identifiers corresponding to at least one container rule are the same.

[0071] Among them, validating multiple first rules can refer to validating the validity of multiple first rules, such as verifying whether the syntax of each first rule is correct, whether the format is standardized, and whether the specified operation and object are legal.

[0072] In this way, by processing the first rule, invalid rules in the rule base can be reduced, thereby improving the efficiency of rule lookup.

[0073] Understandably, general rules can be applicable to both the host process and the processes of each container, i.e., rules that are universal. Container rules, on the other hand, can refer to rules that are only valid for the container corresponding to that container identifier.

[0074] Below, in conjunction with Figure 4 The process of determining the first rule base and multiple second rule bases is explained through specific examples.

[0075] Figure 4 For a schematic diagram illustrating the process of determining the first rule base and multiple second rule bases provided in the embodiments of this application, please refer to [link / reference]. Figure 4 It includes a preset rule base, a first rule base, and multiple second rule bases. Rules in the preset rule base can be obtained by users through data template import or through network data reception. Rules with container identifiers can be identified as container rules, and rules without container identifiers can be identified as general rules. All general rules are integrated into the first rule base, and at least one container rule corresponding to the same container identifier is integrated into the second rule base.

[0076] By integrating scattered rules into a dedicated rule base, the need to traverse all rules when required is avoided, thus improving rule matching efficiency. Furthermore, when adding rules for a new container, only a second rule base with the identifier of that new container needs to be added, without modifying the core logic, improving overall scalability.

[0077] S302. Determine whether the first namespace is equal to the first preset value.

[0078] If so, then execute S303.

[0079] If not, then execute S304.

[0080] The first preset value can be a value set by the user.

[0081] For example, assuming the first preset value is PROC_INIT_INO (initial value), if the first namespace is 1, it means that the first namespace is not equal to the first preset value. Then, based on the first namespace and the second namespace, the target rule library corresponding to the first file is determined from multiple second rule libraries. If the first namespace is PROC_INIT_INO, it means that the first namespace is equal to the first preset value. Then, the first rule library is determined as the target rule library corresponding to the first file.

[0082] S303. Determine the first rule base as the target rule base corresponding to the first file.

[0083] Understandably, when the first namespace equals the first preset value, the current process can be considered to be in the initial space of the host machine. That is, in a non-container environment, the rule corresponding to the first file needs to be determined in the general rules of the first rule base.

[0084] S304. Based on the first namespace and the second namespace, determine the target rule base corresponding to the first file among multiple second rule bases.

[0085] Understandably, when the first namespace is not equal to the first preset value, it can be assumed that the current process is located in a container on the host machine. That is, in a container environment, it is necessary to determine the second rule base corresponding to the container from multiple second rule bases.

[0086] In one possible implementation, the target rule base can be determined as follows: based on the first namespace and the second namespace, determine the first container corresponding to the first file, and the first file is stored in the storage space of the first container; obtain the first mapping table, and determine the first container identifier corresponding to the first container in the first mapping table; based on the first container identifier, determine the target rule base corresponding to the first file among multiple second rule bases.

[0087] In one possible implementation, the first mapping table can be used to indicate the correspondence between containers and container identifiers, or to store the correspondence between the first namespace and the second namespace and container identifiers. At the same time, when a container is detected to be destroyed, the mapping relationship corresponding to the container can be removed from the first mapping table. In this way, the user space can build a whitelist of containers by maintaining the first mapping table, that is, only currently available and manageable container entities are retained in the first mapping table, thereby avoiding resource leaks and obsolete mappings.

[0088] In one possible implementation, the target rule base corresponding to the first file can be determined from multiple second rule bases based on the first container identifier as follows: obtain a second mapping table; determine the second rule base corresponding to the first container identifier in the second mapping table based on the first container identifier; and determine the second rule base as the target rule base corresponding to the first file.

[0089] In one possible implementation, the second mapping table can be used to indicate the correspondence between container identifiers and the second rule base. Understandably, the kernel program can determine the second rule base corresponding to the container based on the container identifier. In this way, the rules of the container can be directly located through the independent mapping relationship without the need for a full rule search, thereby improving the efficiency of rule determination.

[0090] Understandably, the above method achieves rapid location of the rule base by setting up a dual mapping relationship, namely the mapping relationship between the container and the container identifier (first mapping table) and the mapping relationship between the container identifier and the second rule base (second mapping table).

[0091] exist Figure 3In the illustrated embodiment, when it is necessary to determine the target rule base corresponding to the first file, a first rule base and multiple second rule bases can be determined from a preset rule base. The first rule base can be used to store general rules, and the second rule bases can be used to store rules corresponding to containers. It is determined whether the first namespace is equal to a first preset value, which can be a value preset by the user. If the first namespace is equal to the first preset value, the first rule base is determined as the target rule base corresponding to the first file. If the first namespace is not equal to the first preset value, the target rule base corresponding to the first file is determined from multiple second rule bases based on the first and second namespaces. In this way, the above method can ensure global rules based on a general rule base, and multiple second rule bases support personalized policy configuration for containers, thereby meeting the rule requirements of different scenarios. Simultaneously, based on the mapping relationship between containers and container identifiers, as well as between container identifiers and second rule bases, it avoids traversing all rules, significantly improving rule matching efficiency and adapting to high-concurrency file operation scenarios. Furthermore, the rule bases are categorized and stored uniformly, supporting independent updates or deletions of rules for a specific container without affecting other environments, reducing rule maintenance costs, and avoiding the retention of invalid rules.

[0092] Based on any of the above embodiments, the following, in conjunction with Figure 5 The process of processing the first file will be explained in detail.

[0093] Figure 5 This is a schematic diagram illustrating the process of processing the first document provided in an embodiment of this application. Please refer to... Figure 5 The method may include:

[0094] S501. Based on the processing request, determine the processing type of the processing request and the user identifier corresponding to the processing request.

[0095] The processing type can refer to the specific operation type of the file processing request, that is, the specific operation type to be performed on the first file.

[0096] A user identifier can refer to the identity of the user who initiates the file processing request. A user identifier can uniquely identify a user and can also be used to distinguish the permissions of different users.

[0097] S502. Determine the target rule in the target rule base according to the processing type and the first process.

[0098] In one possible implementation, the target rule can be determined within the target rule base in the following way: based on the first process, determine the first rule set corresponding to the first process within the target rule base; based on the processing type, determine the target rule corresponding to the processing type within the first rule set.

[0099] Understandably, the first rule set can refer to the rules in the target rule base that are related to the first process, that is, the set of permission rules for each operation that the first process can perform.

[0100] For example, suppose the target rule base may include rule 1, rule 2, rule 3, rule 4, rule 5, rule 6, rule 7, and rule 8. If rule 1, rule 2, rule 3, and rule 4 are related to the first process, then the first rule set corresponding to the first process can be considered to include rule 1, rule 2, rule 3, and rule 4. If the processing type is deletion, rule 1 corresponds to deletion, rule 2 corresponds to viewing, rule 3 corresponds to modification, and rule 4 corresponds to addition. Then rule 1 can be determined as the target rule.

[0101] In one possible implementation, the following is combined with... Figure 6 The process of determining target rules is explained through specific examples.

[0102] Figure 6 For a schematic diagram illustrating the process of determining the target rule provided in the embodiments of this application, please refer to [link / reference]. Figure 6 This includes a target rule base, which can contain external and internal rules. External rules can pre-define a mapping relationship between processing types and type numbers; that is, in any process (any set of rules), the type number corresponding to the processing type is the same. Internal rules can be divided into multiple rule sets based on process type. For example, the first rule set can be the rule set corresponding to the first process, the second rule set can be the rule set corresponding to the second process, and the third rule set can be the rule set corresponding to the third process. Thus, if the processing type is type 1, and the rule set corresponding to the first process is the first rule set, we can first locate the first rule set within the internal rules based on the first process. Then, based on the processing type being type 1, we determine that the type number corresponding to type 1 is 1. Within the first rule set, we determine the rule number corresponding to type number 1 as 'a', and then define rule 'a' as the target rule.

[0103] In this way, through dual filtering, the scope of rules can be narrowed down first by process, and then specific rules can be located by processing type, avoiding traversing the entire rule base and thus improving matching efficiency; at the same time, only rules related to the initiating process are matched to ensure the isolation of permissions between different processes and improve system security.

[0104] S503. Process the first file according to the processing type, target rule, and user identifier.

[0105] The first file can be processed as follows: Based on the user identifier, determine the target key-value pair within the target rule. The target key-value pair includes the user identifier and the value, which can be used to indicate whether the user identifier has processing permissions; based on the target key-value pair, determine the value corresponding to the user identifier; when the value indicates that the user identifier has processing permissions, process the first file; when the value indicates that the user identifier does not have processing permissions, generate an error message.

[0106] The key-value pair can be a structured data format for storing permissions in the rule, consisting of a key and a value. The key can refer to the user identifier, such as user 1, user 2, user 3, etc. The value can be used to indicate whether the user identifier has processing permission. For example, the value can be 1 or 0, where 1 can indicate that the user has processing permission and 0 can indicate that the user does not have processing permission.

[0107] exist Figure 5 In the illustrated embodiment, when the first file needs to be processed, the processing type and the corresponding user identifier of the processing request can be determined based on the processing request. The processing type can refer to the specific operation type of the file processing request, and the user identifier can refer to the identity of the user initiating the file processing request. Based on the processing type and the first process, a target rule is determined in the target rule base. The first file is then processed based on the processing type, the target rule, and the user identifier. In this way, through the above method, the query scope can be gradually narrowed down using a hierarchical filtering logic of rule base, process rule set, processing type rule, and user key-value pairs, avoiding invalid traversal and improving the response speed of file operations in high-concurrency scenarios.

[0108] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0109] Figure 7 A schematic diagram of the structure of a document processing apparatus provided in an embodiment of this application. For example... Figure 7 As shown, embodiments of this application also provide a file processing apparatus 10, including: a receiving module 11, a first determining module 12, a second determining module 13, and a processing module 14, wherein,

[0110] The receiving module 11 is used to receive a processing request for the first file, the processing request including a first process for processing the first file;

[0111] The first determining module 12 is used to determine, based on the first process, the first namespace and the second namespace corresponding to the first process, wherein the first namespace is used to indicate the number of the first process and the second namespace is used to indicate the number of the file system of the first process.

[0112] The second determining module 13 is used to determine the target rule library corresponding to the first file in the preset rule library based on the first namespace and the second namespace;

[0113] The processing module 14 is used to process the first file according to the target rule base.

[0114] The document processing apparatus provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0115] In one possible design, the second determining module 13 is specifically used for,

[0116] In the preset rule base, a first rule base and multiple second rule bases are determined. The first rule base is used to store general rules, and the second rule bases are used to store rules corresponding to containers.

[0117] When the first namespace equals the first preset value, the first rule base is determined as the target rule base corresponding to the first file;

[0118] When the first namespace is not equal to the first preset value, the target rule base corresponding to the first file is determined from multiple second rule bases based on the first namespace and the second namespace.

[0119] In one possible design, the second determining module 13 is specifically used for,

[0120] Based on the first namespace and the second namespace, determine the first container corresponding to the first file, and store the first file in the storage space of the first container;

[0121] Obtain the first mapping table, which is used to indicate the correspondence between containers and container identifiers;

[0122] In the first mapping table, determine the first container identifier corresponding to the first container;

[0123] Based on the first container identifier, the target rule base corresponding to the first file is determined from multiple second rule bases.

[0124] In one possible design, the second determining module 13 is specifically used for,

[0125] Obtain the second mapping table, which indicates the correspondence between the container identifier and the second rule base;

[0126] Based on the first container identifier, determine the second rule base corresponding to the first container identifier in the second mapping table;

[0127] The second rule base is determined as the target rule base corresponding to the first file.

[0128] In one possible design, the second determining module 13 is also used for,

[0129] Retrieve multiple first rules from the preset rule base;

[0130] Validate multiple first rules to obtain the valid second rule among them.

[0131] Determine whether multiple second rules have corresponding container identifiers;

[0132] The second rule that has a container identifier is identified as a container rule, and the second rule that does not have a container identifier is identified as a general rule.

[0133] The general rules are integrated to obtain the first rule base;

[0134] Based on the container rules and the container identifiers corresponding to the container rules, multiple second rule bases are determined. Each second rule base includes at least one container rule, and at least one container rule has the same container identifier.

[0135] In one possible design, the processing module 14 is also used for,

[0136] Receive a delete command for the second container;

[0137] In the first mapping table, determine the identifier of the second container for the second container;

[0138] Based on the second container identifier, determine the third rule base corresponding to the second container in the second mapping table;

[0139] The third-party rule base was deleted.

[0140] In one possible design, processing module 14 is specifically used for,

[0141] Based on the processing request, determine the processing type of the processing request and the user identifier corresponding to the processing request;

[0142] Based on the processing type and the first process, determine the target rule within the target rule base;

[0143] The first file is processed according to the processing type, target rule, and user identifier.

[0144] In one possible design, processing module 14 is specifically used for,

[0145] Based on the first process, determine the first rule set corresponding to the first process within the target rule base;

[0146] Based on the processing type, determine the target rule corresponding to the processing type within the first rule set.

[0147] In one possible design, processing module 14 is specifically used for,

[0148] Based on the user identifier, determine the target key-value pair within the target rule. The target key-value pair includes the user identifier and the value, and the value is used to indicate whether the user identifier has processing authority.

[0149] Based on the target key-value pair, determine the value corresponding to the user identifier;

[0150] The first file is processed when the value indicates that the user identifier has processing permissions;

[0151] An error message is generated when the value indicates that the user ID does not have the necessary permissions.

[0152] The document processing apparatus provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0153] Figure 8 A schematic diagram of the structure of the electronic device provided in this application. Figure 8 As shown, the electronic device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the electronic device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus.

[0154] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to execute the above-described file processing method embodiment.

[0155] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0156] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0157] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0158] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0159] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described file processing method embodiments when it is run.

[0160] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0161] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described file processing method embodiments.

[0162] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described file processing method embodiments.

[0163] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0164] The foregoing has provided a detailed description of a document processing method, electronic device, storage medium, and program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for processing files, characterized in that, include: Receive a processing request for a first file, the processing request including a first process for processing the first file; Based on the first process, determine the first namespace and the second namespace corresponding to the first process. The first namespace is used to indicate the number of the first process, and the second namespace is used to indicate the number of the file system of the first process. Based on the first namespace and the second namespace, determine the target rule base corresponding to the first file in the preset rule base; The first file is processed according to the target rule base.

2. The method according to claim 1, characterized in that, Based on the first namespace and the second namespace, determine the target rule base corresponding to the first file in the preset rule base, including: A first rule base and multiple second rule bases are determined in the preset rule base. The first rule base is used to store general rules, and the second rule bases are used to store rules corresponding to containers. When the first namespace is equal to the first preset value, the first rule base is determined as the target rule base corresponding to the first file; When the first namespace is not equal to the first preset value, the target rule base corresponding to the first file is determined from the plurality of second rule bases based on the first namespace and the second namespace.

3. The method according to claim 2, characterized in that, Based on the first namespace and the second namespace, the target rule base corresponding to the first file is determined from the plurality of second rule bases, including: Based on the first namespace and the second namespace, the first container corresponding to the first file is determined, and the first file is stored in the storage space of the first container; Obtain the first mapping table, which is used to indicate the correspondence between containers and container identifiers; In the first mapping table, determine the first container identifier corresponding to the first container; Based on the first container identifier, the target rule base corresponding to the first file is determined from the plurality of second rule bases.

4. The method according to claim 3, characterized in that, Based on the first container identifier, the target rule base corresponding to the first file is determined from the plurality of second rule bases, including: Obtain the second mapping table, which is used to indicate the correspondence between the container identifier and the second rule base; Based on the first container identifier, determine the second rule base corresponding to the first container identifier in the second mapping table; The second rule base is determined as the target rule base corresponding to the first file.

5. The method according to claim 4, characterized in that, Before determining the first rule base and multiple second rule bases in the preset rule base, the method further includes: Obtain multiple first rules from the preset rule base; The plurality of first rules are validated to obtain the valid second rule among the plurality of first rules; Determine whether the plurality of second rules have corresponding container identifiers; The second rule that has a container identifier is identified as a container rule, and the second rule that does not have a container identifier is identified as a general rule. The general rules are integrated to obtain the first rule base; Based on the container rule and the container identifier corresponding to the container rule, multiple second rule bases are determined. Each second rule base includes at least one container rule, and the container identifier corresponding to the at least one container rule is the same.

6. The method according to claim 5, characterized in that, The method further includes: Receive a delete command for the second container; In the first mapping table, the second container identifier of the second container is determined; Based on the second container identifier, determine the third rule base corresponding to the second container in the second mapping table; The third rule base is deleted.

7. The method according to any one of claims 1-6, characterized in that, The first file is processed according to the target rule base, including: Based on the processing request, determine the processing type of the processing request and the user identifier corresponding to the processing request; Based on the processing type and the first process, a target rule is determined within the target rule base; The first file is processed according to the target rule and the user identifier.

8. The method according to claim 7, characterized in that, Based on the processing type and the first process, target rules are determined within the target rule base, including: Based on the first process, determine the first rule set corresponding to the first process within the target rule base; Based on the processing type, the target rule corresponding to the processing type is determined within the first rule set.

9. The method according to claim 8, characterized in that, The first file is processed according to the target rule and the user identifier, including: Based on the user identifier, a target key-value pair is determined within the target rule. The target key-value pair includes the user identifier and a value, where the value is used to indicate whether the user identifier has processing authority. Based on the target key-value pair, determine the value corresponding to the user identifier; When the value indicates that the user identifier has processing permissions, the first file is processed; An error message is generated when the value indicates that the user identifier does not have processing permissions.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the file processing method as described in any one of claims 1 to 9 when executing the computer program.

Images