Method for realizing use of high-right command by low-right user based on command sandbox
By building a command whitelist and command execution agent, low-privilege users are allowed to execute high-privilege query commands, which solves the problems of low security and low efficiency caused by OpenStack commands requiring root user execution. This achieves a secure and efficient operation and maintenance process and compliance, and is suitable for different business scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA CITIC BANK CO LTD
- Filing Date
- 2025-11-28
- Publication Date
- 2026-05-01
AI Technical Summary
In existing technologies, OpenStack commands require high-privilege root users to execute, leading to a high risk of misoperation, inconsistent operation procedures, and low efficiency. Query operations cannot be performed by low-privilege users, resulting in problems such as low security, complex processes, and low efficiency.
By building a command whitelist, a high-privilege command sandbox toolkit is generated, providing an interactive command execution interface. It utilizes a command execution agent to temporarily escalate privileges to root, allowing only low-privilege users to execute non-destructive query commands, and recording the execution process to support auditing and security analysis.
It enables low-privilege users to securely execute high-privilege query commands, improving system security and operational efficiency, simplifying operation processes, meeting compliance requirements, adapting to different business scenarios, and enhancing system flexibility and scalability.
Smart Images
Figure CN121959549A_ABST
Abstract
Description
Implementation method for low-privilege users to use high-privilege commands based on command sandbox Technical Field
[0001] This application relates to the field of computer technology, specifically to a method for enabling low-privilege users to use high-privilege commands based on a command sandbox. Background Technology
[0002] Most full-stack cloud platforms in the industry provide virtualization services based on OpenStack. Daily operation and maintenance of full-stack cloud platforms requires the use of OpenStack query commands. Currently, OpenStack commands, including CRUD commands, all require root privileges to execute.
[0003] In current daily operations and maintenance, there are many drawbacks: manual operation is risky: as the foundation of the cloud platform, OpenStack query commands are also commonly used in daily operations and maintenance, but they require root privileges to execute. After a user requests root privileges, it is easy to cause misoperation and execute other destructive commands that are not intended for the purpose, thus causing risks.
[0004] Inconsistent internal operating procedures: The internal definition of a change is an update or modification of the production environment configuration. Query operations, which are currently only performed by users with low privileges due to OpenStack's permission design, cannot be performed by users with low privileges and must be performed through a change. This is inconsistent with the internal process definition and poses an audit risk.
[0005] Low operational efficiency: Applying for higher privileges requires going through a change process or a special user process, but the commands executed are still routine query commands, which seriously affects work efficiency. Summary of the Invention
[0006] This application provides a method for enabling low-privilege users to use high-privilege commands based on a command sandbox, in order to overcome or at least partially overcome the shortcomings of the prior art.
[0007] Firstly, this application provides a method for enabling low-privilege users to use high-privilege commands based on a command sandbox. This method is implemented through a command sandbox-based business system, which includes a user terminal and a business server. The method includes: constructing a command whitelist and generating a high-privilege command sandbox toolkit based on the command whitelist, and deploying it to the business server; providing an interactive command execution interface displayed on the user terminal, and running the high-privilege command sandbox toolkit after a low-privilege user logs into the business server, allowing the low-privilege user to input or select a high-privilege command to be executed through the interactive command execution interface; and deploying a command execution agent program on the business server, temporarily escalating the low-privilege user's privileges to root, and then calling the command execution agent program to receive, verify, and execute the high-privilege command to be executed and return the result.
[0008] Optionally, the above method further includes: the business server recording all command execution processes and results to support subsequent auditing and security analysis, wherein the command execution processes and results include: the executing user, execution time, executed command, and whether the executed command passes the whitelist verification.
[0009] Optionally, in the above method, the command whitelist contains only non-destructive query commands.
[0010] Optionally, in the above method, the high-privilege command sandbox toolkit is deployed as follows: the high-privilege command sandbox toolkit is functionally and securityally verified in a test environment; after verification, the toolkit is submitted to the production environment through an artifact upgrade process; in the production environment, the toolkit is installed on the target business server through automated deployment; according to the type of the target server, an adapted high-privilege command sandbox toolkit is selected and installed, wherein the adapted high-privilege command sandbox toolkit contains whitelist commands corresponding to the type of the target server.
[0011] Optionally, in the above method, the command execution agent receives, verifies, and executes the high-privilege command to be executed and returns the result in the following manner: the command execution agent receives the following input parameters: the high-privilege command to be executed, the command type, the root user identifier, and the database name; parses the input parameters and performs pre-execution preparation according to the command type; performs whitelist verification on the high-privilege command to be executed, and if the verification passes, executes the high-privilege command to be executed and returns the result.
[0012] Optionally, in the above method, the pre-execution preparation based on the command type includes: for OpenStack commands, importing necessary environment variables; for database query commands, obtaining the corresponding database connection information.
[0013] Secondly, this application also provides a command sandbox-based business system, which includes: a user terminal, a business server, a high-privilege command sandbox toolkit, and a command execution agent. The high-privilege command sandbox toolkit is constructed based on a command whitelist and deployed on the business server. The user terminal displays an interactive command execution interface. Low-privilege users can log in to the business server through the bastion host and input or select a high-privilege command to be executed through the interactive command execution interface to run the high-privilege command sandbox toolkit. The command execution agent is deployed on the business server so that it can be invoked when the business server temporarily escalates the low-privilege user's privileges to root, receiving, verifying, and executing the high-privilege command to be executed and returning the result.
[0014] Optionally, in a command sandbox-based business system, the business server further includes a log recording and auditing module, used to record all command execution processes and results to support subsequent auditing and security analysis. The command execution processes and results include: the executing user, execution time, executed command, and whether the executed command passed the whitelist verification.
[0015] Thirdly, this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the above-described methods for enabling low-privilege users to use high-privilege commands based on a command sandbox.
[0016] Fourthly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements any of the above-described methods for enabling low-privilege users to use high-privilege commands based on a command sandbox.
[0017] This application achieves at least the following beneficial effects: Its core innovation lies in providing a high-privilege command sandbox implementation method, effectively solving the problems mentioned in the background technology and achieving the following significant functions and effects: This application effectively solves the problems of low security, complex processes, and low efficiency caused by improper access control in traditional operations and maintenance. By constructing a command whitelist mechanism, only low-privilege users are allowed to execute non-destructive query commands, preventing accidental operations and illegal command execution from the source, significantly improving system security.
[0018] This application uses a bastion host to centrally control user access paths. Combined with a command execution proxy and privilege escalation mechanism, it enables low-privilege users to securely execute high-privilege query commands without requesting root privileges, significantly simplifying the operation process and improving operational efficiency, while ensuring access control. Simultaneously, all command execution processes can be recorded and used for auditing, meeting internal compliance requirements and reducing audit risks.
[0019] The high-privilege command sandbox toolkit supports differentiated deployment based on server type, adapting to different business scenarios and improving system flexibility and scalability. Through experiments, this application has been successfully applied in a large-scale production environment, demonstrating good practicality and promotional value. Attached Figure Description
[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0021] Figure 1 shows a flowchart illustrating a method for implementing high-privilege commands by low-privilege users based on a command sandbox according to an embodiment of this application; Figure 2 shows a structural diagram of a business system based on a command sandbox according to an embodiment of this application; Figure 3 shows a screenshot of an interactive command execution interface according to an embodiment of this application; Figure 4 shows a screenshot of an interactive command execution interface according to another embodiment of this application; Figure 5 shows the output result of executing commands in an OpenStack environment according to an embodiment of this application; Figure 6 shows a structural diagram of a computer device according to an embodiment of this application. Detailed Implementation
[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0023] The overall concept of this application is to provide a completely new set of high-privilege commands (mainly query commands) that, through a whitelist, allow low-privilege users to execute methods, effectively solving the problems mentioned in the background technology: Problem 1: Commonly used query commands in daily operations and maintenance can be executed by low-privilege users at their workstations via a bastion host. Problem 2: Improve the operations and maintenance system, allowing low-privilege users to perform query operations, avoiding compliance and audit issues. Problem 3: Greatly improve the efficiency of daily operations and maintenance work.
[0024] Figure 1 shows a flowchart illustrating a method for implementing high-privilege commands by low-privilege users based on a command sandbox according to an embodiment of this application. The method mainly involves modifying an existing business system. The modified business system is referred to as a command sandbox-based business system. The traditional business system includes a user terminal and a business server. The user terminal is communicatively connected to the business server. The traditional business system is modified through steps S110-S130 of this embodiment, specifically including: step S110, constructing a command whitelist, generating a high-privilege command sandbox toolkit based on the command whitelist, and deploying it to the business server.
[0025] The modified business system is shown in Figure 2. Referring to Figure 2, in the command sandbox-based business system 200, there are user terminals 210 and business servers 220. It should be noted that there can be multiple user terminals 210 and business servers 220. Here, only one is used as an example for explanation.
[0026] Create a command whitelist that contains only non-destructive query commands that require root privileges to execute and are typically inaccessible to ordinary users.
[0027] In this application, ordinary users without root privileges are referred to as low-privilege users, and users with root privileges are referred to as high-privilege users.
[0028] Non-destructive query commands include, but are not limited to: CPS query commands, Nova query commands, Cinder query commands, Neutron query commands, and GaussDB query commands. The command whitelist is configurable; non-destructive query commands can be added as needed based on business requirements.
[0029] Commands for adding, deleting, and modifying data are not allowed to be added to the command whitelist, and low-privilege users are strictly prohibited from executing these commands. A high-privilege command sandbox toolkit 230 is generated based on the configured command whitelist, and then deployed to the business server 220.
[0030] In some embodiments of this application, the high-privilege command sandbox toolkit is deployed as follows: the high-privilege command sandbox toolkit is functionally and securityally verified in a test environment; after verification, the toolkit is submitted to the production environment through an artifact upgrade process; in the production environment, the toolkit is installed on the target business server through automated deployment; according to the type of the target server, an adapted high-privilege command sandbox toolkit is selected and installed, wherein the adapted high-privilege command sandbox toolkit contains whitelist commands corresponding to the type of the target server.
[0031] In this application, the high-privilege command sandbox toolkit is deployed automatically: the high-privilege command sandbox toolkit is approved through an internal testing process and installed on the target business server in the production environment through automated changes.
[0032] After thorough validation in the testing environment, the high-privilege command sandbox toolkit is advanced to production through an artifact-level process and deployed to target business servers automatically. Simultaneously, different high-privilege command sandbox toolkits are installed based on different server types to ensure that different types of nodes can execute different commands. For example, CCE management nodes can execute Kubernetes-related query commands, while GaussDB nodes can execute relevant SQL query statements.
[0033] Step S120: Provide an interactive command execution interface and display it on the user terminal. After a low-privilege user logs into the business server, run the high-privilege command sandbox toolkit so that the low-privilege user can input or select high-privilege commands to be executed through the interactive command execution interface.
[0034] This application provides an interactive command execution interface 240, which can be displayed on a user terminal 210. Users with lower privileges can input or select commands to be executed by users with higher privileges through the interactive command execution interface 240 on the user terminal 210.
[0035] After a user with low privileges logs into the business server 220 through the user terminal 210, the business server 220 can run the high-privilege command sandbox toolkit 230 and display an interactive command execution interface 240 in the user terminal 210. The user with low privileges can input or select the high-privilege command to be executed through the interactive command execution interface 240 in the user terminal 210.
[0036] After the user inputs or selects a high-priority command to be executed, a command execution request is generated. This command execution request for the high-priority command is sent to the business server 220, which processes it.
[0037] Step S130: Deploy a command execution agent on the business server. After temporarily elevating the low-privilege user's privileges to root on the business server, call the command execution agent to receive, verify, and execute the high-privilege command to be executed and return the result.
[0038] This application also provides a command execution agent 250, which is also deployed in the business server 220. After receiving a command execution request, the business server 220 temporarily elevates the privileges of the low-privilege user to root, and then processes the command execution request for the high-privilege command through the command execution agent 250.
[0039] Specifically, in some embodiments of this application, the command execution agent receives, verifies, and executes the high-privilege command to be executed and returns the result in the following manner: the command execution agent receives the following input parameters: the high-privilege command to be executed, the command type, the root user identifier, and the database name; parses the input parameters and performs pre-execution preparation according to the command type; performs whitelist verification on the high-privilege command to be executed, and if the verification passes, executes the high-privilege command to be executed and returns the result.
[0040] The command to be executed with high privileges is passed to the command execution agent as input parameters. The input parameters also include, but are not limited to: command type, root user identifier, and database name (required for database query commands), etc.
[0041] The command execution agent receives and parses the input parameters, determines the type of high-privilege command to be executed, and performs preparatory work before command execution. For example, the OpenStack command requires importing environment variables; a database query command requires obtaining the password for the corresponding database, etc.
[0042] Verify the command by checking if the high-privilege command to be executed is in the whitelist. Only commands in the whitelist are allowed to execute. After execution, return the command execution result.
[0043] It should be noted that if you are the root user, you can use the original method to execute the command. If you use the method described in this application, there is no need to perform command whitelist verification. The command will be executed directly and the execution result will be returned.
[0044] Optionally, in some embodiments of this application, the business server also records all command execution processes and results to support subsequent auditing and security analysis. The command execution processes and results include: the executing user, the execution time, the executed command, and whether the executed command passed the whitelist verification.
[0045] Optionally, in some embodiments of this application, it is recommended to set up a bastion host between the user terminal and the business server as a unified entry point for users to access the business server, used for user authentication and access control. In a command sandbox-based business system, a bastion host is set up between the user terminal and the business server. The bastion host serves as a unified entry point for users to access the server, used for user authentication and access control. When a request originates from the user terminal and aims to reach the business server, it will be intercepted by the bastion host for user authentication and access control. As a unified access point, the bastion host achieves centralized authentication of user identities and fine-grained control of operational permissions, effectively preventing unauthorized access and unauthorized operations. Furthermore, the bastion host can be integrated with an access control system to standardize and comply with operational processes, significantly improving system security and operational efficiency.
[0046] Figure 3 shows a screenshot of an interactive command execution interface according to an embodiment of this application, which is mainly used to execute query commands related to OpenStack.
[0047] Figure 4 shows a screenshot of an interactive command execution interface according to another embodiment of this application. In the interface shown in Figures 3 and 4, ordinary users can select to execute query commands related to OpenStack.
[0048] Figure 5 shows the output of a command executed in an OpenStack environment according to an embodiment of this application. It is primarily used for the deployment and management of the Neutron service in the OpenStack environment, allowing users to view the instance status and configuration parameters of the neutron-server using the tool (cps). The first paragraph displays the running status and version information of the service instance, while the second paragraph displays the core configuration of the Neutron service (such as authentication, network, and database connections), reflecting the overall deployment architecture and key configuration details of the Neutron service.
[0049] The following is a typical implementation scenario example of this application: In the prior art, if a user wants to query all virtual machines, he / she needs to submit changes, apply for root access, and execute nova list --all-t --limit -1 on the target business server.
[0050] In this application, the user logs into the target machine through the bastion host at the workstation using the appmon user, and executes opscmdtool to execute nova list --all-t --limit -1.
[0051] In a real-world production environment, this application has been implemented in the technology operations center of a bank, where the tool has been deployed on over 13,000 servers for auxiliary operations and maintenance. The whitelist command group covers OpenStack query commands, database query commands, container query commands, and commonly used compressed logs. Using this application has significantly improved daily operations and maintenance efficiency, greatly enhanced the bank's cloud platform's daily operations and maintenance capabilities, and effectively mitigated compliance and auditing issues.
[0052] In summary, this application effectively solves the problems of low security, complex processes, and low efficiency caused by improper access control in traditional operations and maintenance. By constructing a command whitelist mechanism, only users with low privileges are allowed to execute non-destructive query commands, preventing accidental operations and illegal command execution from the source, thus significantly improving system security.
[0053] This application, through the use of a whitelist, combined with a command execution proxy and privilege escalation mechanism, enables low-privilege users to securely execute high-privilege query commands without requesting root privileges, while ensuring access control. This significantly simplifies the operation process and improves operational efficiency. Furthermore, all command execution processes can be recorded and used for auditing, meeting internal compliance requirements and reducing audit risks.
[0054] The high-privilege command sandbox toolkit supports differentiated deployment based on server type, adapting to different business scenarios and improving system flexibility and scalability. Through experiments, this application has been successfully applied in a large-scale production environment, demonstrating good practicality and promotional value.
[0055] In one embodiment, a computer device is provided, the internal structure of which can be shown in Figure 6. The computer device includes a processor, memory, a network interface, and a database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a command sandbox-based method for low-privilege users to use high-privilege commands.
[0056] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement the steps of the method for implementing a low-privilege user to use high-privilege commands based on a command sandbox, as described in this application.
[0057] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.
[0058] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0059] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.
[0060] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.
Claims
1. A method for enabling low-privilege users to use high-privilege commands based on a command sandbox, the method being implemented through a command sandbox-based business system, the command sandbox-based business system comprising user terminals and a business server, characterized in that, The method includes: constructing a command whitelist, generating a high-privilege command sandbox toolkit based on the command whitelist, and deploying it to the business server; providing an interactive command execution interface and displaying it on the user terminal, and running the high-privilege command sandbox toolkit after a low-privilege user logs into the business server, allowing the low-privilege user to input or select a high-privilege command to be executed through the interactive command execution interface; deploying a command execution agent program on the business server, temporarily escalating the low-privilege user's privileges to root on the business server, and then calling the command execution agent program to receive, verify, and execute the high-privilege command to be executed and return the result.
2. The method for implementing high-privilege commands by low-privilege users based on a command sandbox according to claim 1, characterized in that, The method further includes: the business server, which records all command execution processes and results to support subsequent auditing and security analysis, wherein the command execution process and results include: the executing user, the execution time, the executed command, and whether the executed command passes the whitelist verification.
3. The method for implementing low-privilege users to use high-privilege commands based on a command sandbox according to claim 1, characterized in that, The command whitelist contains only non-destructive query commands.
4. The method for implementing high-privilege commands by low-privilege users based on a command sandbox according to claim 1, characterized in that, The high-authority command sandbox toolkit is deployed by performing functional and security verification of the high-authority command sandbox toolkit in a test environment. After verification, the toolkit is submitted to the production environment through the product upgrade process; in the production environment, the toolkit is installed on the target business server through automated deployment; according to the type of the target server, an appropriate high-privilege command sandbox toolkit is selected and installed, which contains whitelist commands corresponding to the type of the target server.
5. The method for implementing high-privilege commands by low-privilege users based on a command sandbox according to claim 1, characterized in that, The command execution agent receives, verifies, and executes the high-privilege command to be executed and returns the result in the following manner: The command execution agent receives the following input parameters: the high-privilege command to be executed, the command type, the root user identifier, and the database name; it parses the input parameters and performs pre-execution preparation according to the command type; it performs whitelist verification on the high-privilege command to be executed, and if the verification passes, it executes the high-privilege command to be executed and returns the result.
6. The method for implementing low-privilege users to use high-privilege commands based on a command sandbox according to claim 5, characterized in that, The pre-execution preparation based on command type includes: for OpenStack commands, importing necessary environment variables; for database query commands, obtaining the corresponding database connection information.
7. A business system based on a command sandbox, characterized in that, The command sandbox-based business system includes: a user terminal, a business server, a high-privilege command sandbox toolkit, and a command execution agent. The high-privilege command sandbox toolkit is built based on a command whitelist and deployed on the business server. The user terminal displays an interactive command execution interface. Low-privilege users can log in to the business server through the bastion host and input or select a high-privilege command to be executed through the interactive command execution interface to run the high-privilege command sandbox toolkit. The command execution agent is deployed on the business server to be invoked when the business server temporarily escalates the low-privilege user's privileges to root, receiving, verifying, and executing the high-privilege command to be executed and returning the result.
8. The business system based on a command sandbox according to claim 7, characterized in that, The business server also includes a log recording and auditing module, which records all command execution processes and results to support subsequent auditing and security analysis. The command execution processes and results include: the executing user, execution time, executed command, and whether the executed command passed the whitelist verification.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes a computer program, it implements the method for a low-privilege user to use high-privilege commands based on a command sandbox, as described in any one of claims 1-6.
10. A computer-readable storage medium storing a computer program, characterized in that, When a computer program is executed by a processor, it implements the method for a low-privilege user to use high-privilege commands based on a command sandbox, as described in any one of claims 1-6.