Physical isolation system file method and apparatus for linux systems

Abstract

The application discloses a physical isolation system file method and device for a Linux system, and relates to the technical field of Linux systems, and can guarantee that system files are not damaged by user misoperation. The method comprises the following steps: creating a system file partition and a user file partition, mounting the system file partition and the user file partition to different directories of a root file system partition respectively, and creating a standard directory in the system file partition and the user file partition; modifying the default installation path of a compiling tool and an installation tool to point to the standard directory of the user file partition, and adding the installation path of the user file partition in the environment variable of the system; when a process accesses a file, judging an access path, if the access path is an original system file path, redirecting the access path to the system file partition, and returning a target file from the standard directory of the system file partition according to the redirected access path.

Description

Technical Field

[0001] This invention relates to computer software technology, and more specifically to a method and apparatus for physically isolating system files in a Linux system. Background Technology

[0002] In traditional Linux operating systems (such as Kylin OS, Ubuntu, CentOS, etc.), executable program files, shared library files, and user-installed applications are typically stored together in the same directory structure. Specifically, pre-installed executable programs are stored in directories such as / usr / bin, / bin, and / sbin, while shared libraries are stored in directories such as / usr / lib and / lib. User-installed programs, either through package managers (such as apt and dpkg) or by compiling from source (make install), are also installed in the same paths by default.

[0003] Due to historical reasons, many open-source software programs (including the Linux base library glibc, ELF loader, etc.) hardcode absolute paths (such as / usr / bin, / usr / lib, etc.) in their code to locate executable programs or shared libraries. Figure 1 As shown, when the Linux kernel loads an ELF format executable program, it first loads the dynamic linker via the absolute path / lib64 / ld-linux-x86-64.so.2. The linker then searches for the shared libraries that the executable program depends on in the following fixed order: RPATH settings within the elf file; Environment variable LD_LIBRARY_PATH; RUNPATH in the elf file; The system sets the location in / etc / ld.so.conf.d; Default path ( / usr / lib...).

[0004] This deep binding of absolute path dependency has the following technical drawbacks: First, users often accidentally tamper with the file system, leading to system file corruption and system crashes. Since user-installed programs may have the same name as pre-installed system programs (such as a user-compiled glibc library), the installation process may overwrite critical system files, causing system dependency corruption and, in severe cases, preventing the system from booting.

[0005] Secondly, since system files and user files are physically mixed in the same partition and the same directory tree, it is difficult to distinguish which files belong to the core system components and which belong to user data when upgrading the system or restoring factory settings. This makes the upgrade logic complicated and easy to accidentally delete user data.

[0006] While the Android operating system achieves isolation between the root file system and the user file system, it is a relatively closed ecosystem. Its design from the outset specifies particular application installation paths and library loading mechanisms, making it unsuitable for the open-source ecosystem of general-purpose Linux distributions. Furthermore, other mainstream Linux distributions (such as Kylin OS, Ubuntu, CentOS, Arch Linux, and SUSE) do not provide effective physical isolation solutions for system files, leaving users still at risk of accidentally damaging system files. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to provide a method and apparatus for physically isolating system files in a Linux system, thereby achieving physical isolation between system files and user files and ensuring that system files are not damaged by user misoperation.

[0008] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A method for physically isolating system files in a Linux system includes the following steps: Create a system file partition and a user file partition, and mount the system file partition and the user file partition to different directories of the root file system partition. Create standard directories in both the system file partition and the user file partition. The system file partition is used to store the system's executable program files and shared library files, and the user file partition is used to store the executable files and shared libraries compiled and installed by the user. Change the default installation path of the compilation and installation tools to point to the standard directory of the user file partition, and add the installation path of the user file partition to the system environment variables; When a process accesses a file, it determines the access path. If the access path is the original system file path, it redirects the access path to the system file partition and returns the target file from the standard directory of the system file partition according to the redirected access path.

[0009] Furthermore, when mounting the system file partition and user file partition to different directories on the root file system partition, the specific steps include: After the kernel boots, it mounts the memory file system. The init process of the memory file system then mounts the root file system partition to the root directory mount point, the system file partition to the specified system file directory of the root file system, and the user file partition to the specified user file directory of the root file system. When mounting the system file partition to the specified system file directory of the root file system, it is mounted in read-only mode.

[0010] Furthermore, before mounting the system file partition and user file partition to different directories on the root file system partition, the process includes: adding a member `sysroot` to the kernel structure `fs_struct` to point to the system file partition; after mounting the system file partition and user file partition to different directories on the root file system partition, the process includes: The init process of the memory file system calls the chroot command to transfer the root directory from the memory file system to the root file system partition; The init process of the memory file system calls the set_fs_root command to set the root field fs.root in the fs_struct structure of this process to the root file system partition; The init process of the memory file system calls the set_fs_pwd command to set the pwd field fs.pwd in the fs_struct structure of this process to the root file system partition; The init process of the memory file system calls the set_fs_sysroot command to set the sysroot field fs.sysroot in the fs_struct structure of this process to the system file partition.

[0011] Furthermore, determining the access path specifically includes: The path_openat function is used to parse the access path and obtain the first character characteristic of the access path; If the first character feature is an absolute path addressing feature and the access path is the original system file path, then the steps of redirecting the access path to the system file partition and returning the target file from the standard directory of the system file partition according to the redirected access path are executed. If the first character characteristic is a relative path addressing characteristic, and the current directory entry pointed to by the pwd field in the fs_struct structure of this process is outside the specified system file directory, then the steps of redirecting the access path to the system file partition and returning the target file from the standard directory of the system file partition according to the redirected access path are executed. If the first character characteristic is a relative path addressing characteristic, and the access path passes through the original system file path, then the steps of redirecting the access path to the system file partition and returning the target file from the standard directory of the system file partition according to the redirected access path are executed.

[0012] Furthermore, when redirecting the access path to the system file partition, the initial location of the access path is set to the specified system file directory pointed to by the sysroot field.

[0013] Furthermore, when returning the target file from the standard directory of the system file partition based on the redirected access path, the walk_component command is specifically called to find the target file starting from the initial position of the access path and return the inode of the target file to the caller.

[0014] Furthermore, when adding the installation path of the user file partition to the system environment variables, this includes: adding the executable file directory path of the user file partition to the system environment variable PATH; and adding the shared library directory path of the user file partition to the system environment variable LD_LIBRARY_PATH.

[0015] The present invention also proposes a physical isolation system file device for a Linux system, comprising a processor and a computer-readable storage medium storing a computer program, which is executed by the processor to implement the steps of the physical isolation system file method for a Linux system.

[0016] The present invention also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method for physically isolating system files for a Linux system.

[0017] The present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the steps of the method for physically isolating system files for a Linux system.

[0018] Compared with the prior art, the advantages of the present invention are as follows: This invention creates independent system file partitions and user file partitions, and mounts the system file partition in read-only mode. This fundamentally prevents user error or malicious software from tampering with core system files, solving the problem of system corruption caused by mixed storage of user programs and system files in traditional Linux systems. Furthermore, physical isolation eliminates the need to process user data during system upgrades and factory resets, significantly reducing system maintenance complexity.

[0019] This invention modifies the default installation path of the compilation and installation tool and configures environment variables to guide user programs to be deployed to the user partition by default without changing user operating habits, thus avoiding unintentional pollution of the system directory. This design maintains compatibility with the existing open-source software ecosystem and does not require mandatory modifications to the installation logic of third-party software.

[0020] This invention redirects original system file paths to system file partitions, enabling many traditional applications with hard-coded paths such as / usr / bin and / lib to run normally in an isolated architecture without modifying their source code. This mechanism is completely transparent to the application layer, achieving both physical protection of system files and avoiding compatibility risks caused by modifying basic libraries such as glibc, thus ensuring the reliability of system startup and program loading. Attached Figure Description

[0021] Figure 1 The process of loading executable programs for an existing Linux system.

[0022] Figure 2 This is the architecture design for an embodiment of the present invention.

[0023] Figure 3 This is a flowchart of a method according to an embodiment of the present invention.

[0024] Figure 4 This is a flowchart of the kernel initialization process after startup in an embodiment of the present invention.

[0025] Figure 5 This describes the workflow for file path redirection in this embodiment of the invention. Detailed Implementation

[0026] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0027] This embodiment proposes a method for physically isolating system files in Linux systems. The aim is to protect system files by placing them in a separate partition, which is then set to read-only, preventing modification except during upgrades. User-installed executable files and shared libraries are also placed in a separate partition. This ensures that system files are not corrupted by users; theoretically, the system can boot normally unless there is disk hardware failure. Simultaneously, placing user programs and data in a separate partition makes the system storage layout clearer and easier to manage.

[0028] The method in this embodiment adopts the following... Figure 2 The architecture shown is divided into three layers from top to bottom: user space, Linux kernel, and disk. Among them: (1) At the disk level, the physical storage medium is divided into three logical partitions: root file system partition, system file partition and user file partition.

[0029] The root file system partition is mounted in the root directory " / ", and contains non-critical system directories such as proc, sys, dev, boot, and var, as well as the kylinos and home directories, which serve as mount placeholders.

[0030] The system file partition is mounted read-only in the ` / kylinos` directory. It contains a standard directory structure including `usr`, `bin`, `sbin`, `lib`, and `etc`, and is used to store system executable files and shared library files. Specifically, the `-kylinos` partition moves system files, including executable files and shared library files, from the original ` / usr`, ` / bin`, ` / sbin`, and ` / lib` to the system file partition. Simultaneously, it creates a `kylinos` directory in the root file system and mounts the system file partition to `kylinos`.

[0031] The user file partition is mounted to the / home directory, and internally it also creates a standard directory structure such as usr, bin, sbin, and lib to store executable files and shared libraries compiled and installed by the user. Specifically, the user file system partition -home also creates directories such as / usr, / bin, / sbin, and / lib within this partition, and the executable files and shared libraries compiled and installed by the user are placed in these directories. This partition is mounted to the home directory line of the root file system.

[0032] (2) A file path redirection system is embedded between the Linux kernel layer, the Virtual File System (VFS) layer, and the disk layer. This system achieves transparent interception and redirection of system file access requests by extending kernel data structures and implanting redirection logic in key path resolution functions. Specifically, the process of finding a file in the Linux kernel starts from the dentry in the process's root directory, resolving and searching the path and function name level by level until the file's dentry is found. The file path redirection system first determines whether the process is currently opening a system file; if so, it starts searching from the dentry pointing to / kylinos. In many open-source software applications, access to system executables or shared libraries is done through absolute paths, such as glibc. Instead of updating so much open-source code, it's more efficient to redirect the dentry in this critical path within the Linux kernel. The file path redirection system is the most fundamental innovation of this embodiment.

[0033] (3) In the user space layer, applications (Apps) initiate file access requests through file operation interfaces (such as open) provided by glibc, which are then passed to the kernel via VFS. The compilation and installation system (including tools such as make, apt, and dpkg) is configured to install the compiled products to the user file partition by default. In Kylin OS, user software can be installed using tools such as apt and dpkg, or source code can be compiled and installed directly using make install. These commands can specify the installation path of the software, but if not specified, the software will be installed to directories such as / usr, / bin, and / lib by default. This solution requires changing the default installation paths of these tools to / home / usr, / home / bin, and / home / lib to physically isolate them from system files. At the same time, the system environment variables $PATH and $LD_LIBRARY_PATH need to be modified to ensure that the software installed by the user can be found by the system.

[0034] Based on the above architecture, such as Figure 3 As shown, the method in this embodiment specifically includes the following steps: S1) Create a system file partition and a user file partition, mount the system file partition and the user file partition to different directories of the root file system partition, and create standard directories in both the system file partition and the user file partition. The system file partition is used to place the system's executable program files and shared library files, and the user file partition is used to place the executable files and shared libraries compiled and installed by the user. S2) Modify the default installation path of the compilation tools and installation tools to point to the standard directory of the user file partition, and add the installation path of the user file partition to the system environment variables; S3) When a process accesses a file, the file path redirection system determines the access path. If the access path is the original system file path, the access path is redirected to the system file partition, and the target file is returned from the standard directory of the system file partition according to the redirected access path.

[0035] In step S1 of this embodiment, the system installation image needs to construct at least three partitions, including a root file system partition, a system file partition, and a user file partition. The root file system is mounted to the directory " / ", the system file partition is mounted to "kylinos" in read-only mode, and the user file partition is mounted to "home". System files, including executable programs, scripts, and shared libraries, are placed in the system file partition, while executable programs and scripts compiled and installed by the user are placed in the user file partition.

[0036] Therefore, in step S1, before mounting the system file partition and user file partition to different directories of the root file system partition, to achieve transparent redirection of hard-coded absolute paths, the key data structures are first extended at the Linux kernel level. A new member `sysroot` (struct path sysroot) is added to the kernel structure `fs_struct` (a data structure in the kernel used to describe the file system context of a process) to point to the system file partition, distinguishing it from the existing `root` member (pointing to the root file system partition) and `pwd` member (pointing to the current working directory). A code example is as follows: struct fs_struct { int users; seqlock_t seq; int umask; int in_exec; struct path root, pwd, sysroot; } __randomize_layout; In step S1, when mounting the system file partition and user file partition to different directories of the root file system partition, such as... Figure 4 As shown, during the system startup phase, the first file system mounted after the kernel starts is the in-memory file system initrd (or initramfs). Then, a boot process is created and the init process runs from initrd. The init process of the in-memory file system calls the modprobe command to load necessary drivers (including network card drivers and disk drivers). The init process of the in-memory file system sequentially mounts the root file system partition to the root directory mount point / , mounts the system file partition to the specified system file directory / kylinos of the root file system (mounted in read-only mode), and mounts the user file partition to the specified user file directory / home of the root file system.

[0037] After mounting the system file partition and user file partition to different directories on the root file system partition, i.e., after mounting is complete, the init process of the memory file system calls the chroot command to transfer the root directory from the memory file system to the root file system partition. Subsequently, the init process of the memory file system calls the set_fs_root command to set the root field (i.e., current->fs.root) in its fs_struct structure to the root file system partition; it calls the set_fs_pwd command to set the pwd field (i.e., current->fs.pwd) in its fs_struct structure to the root file system partition; and it calls the set_fs_sysroot command to set the sysroot field (i.e., current->fs.sysroot) in its fs_struct structure to the system file partition ( / kylinos). Subsequent processes in the system are all child processes derived from the init process, and all child processes inherit the above sysroot settings. sysroot->dentry will also point to " / kylinos", ensuring that the file system context of all processes in the entire system contains a sysroot member pointing to the system file partition.

[0038] In step S2 of this embodiment, when adding the installation path of the user file partition to the system environment variables, specifically after the system starts, the executable file directory path of the user file partition (such as / home / bin, / home / sbin) is added to the environment variable $PATH, and the shared library directory path of the user file partition (such as / home / lib) is added to the environment variable $LD_LIBRARY_PATH, to ensure that the kernel and glibc can find the correct path when loading the executable program and the shared libraries it depends on. Meanwhile, in step S2, when modifying the default installation paths of the compilation and installation tools to point to the standard directories of the user file partition, the compilation and installation system, including apt, dpkg, make install, etc., is modified to " / home / bin" and " / home / lib". Specifically, the installation prefix configuration of the package management tools (such as apt and dpkg) can be modified so that they will by default deploy executable files and shared libraries to the standard directories of the user file partition (such as / home / usr, / home / bin, and / home / lib). At the same time, the default installation prefix parameters of the source code compilation and installation tools (such as make) are modified (usually by modifying the default prefix value of the Makefile or configuration script) so that they will by default install the compiled products to the standard directories of the user file partition.

[0039] Through the collaborative configuration in step S2, user programs are guided to be deployed to the user partition by default without changing user operating habits, thus avoiding unintentional pollution of the system directory and maintaining compatibility with the existing open source software ecosystem.

[0040] like Figure 5 As shown, in step S3 of this embodiment, when a process (including a user-space application or a system component that initiates a request via glibc) accesses a file, the request is intercepted by the file path redirection system embedded in the Linux kernel layer. In the Linux kernel, the function `path_openat` handles whether the file is opened by user space or the kernel, and the process of finding the file based on the path. Specifically, determining the access path includes: The access path is resolved using the path_openat function (a well-known path resolution entry function in the VFS layer); Addressing patterns are identified based on the first character feature of the access path: if the first character is an absolute path addressing feature (starting with " / "), it is determined to be an absolute path addressing pattern; if the first character is a relative path addressing feature (starting with "."), it is determined to be a relative path addressing pattern.

[0041] In this embodiment, for absolute path addressing, the file path redirection system embedded in the kernel first determines whether the absolute path is the original system file path, including but not limited to " / bin", " / lib", " / usr / bin", " / usr / lib". If it is, the addressing start position is set to " / kylinos" pointed to by sysroot. If not, no redirection is required.

[0042] In this embodiment, for relative path addressing, the file path redirection system first determines whether the location of pwd is within " / kylinos". If so, it means that the system file partition has been entered, and no redirection is needed. It then determines whether the relative path passes through the original system file path, including but not limited to " / bin", " / lib", " / usr / bin", and " / usr / lib". If so, the addressing start position is set to " / kylinos" pointed to by sysroot; otherwise, no redirection is needed.

[0043] Therefore, if the access path is determined to be in absolute path addressing mode, it is further determined whether the access path is the original system file path (including but not limited to / bin, / sbin, / lib, / usr / bin, / usr / lib and their subdirectories that conform to the File System Hierarchy Standard (FHS)). If so, redirection is performed: the initial location of the access path is set to the specified system file directory pointed to by the sysroot field (i.e., current->fs.sysroot), instead of the default current->fs.root, thereby switching the path resolution starting point from the root file system partition to the system file partition; if not, no redirection is needed, and the path resolution starting point remains current->fs.root.

[0044] If the relative path addressing mode is determined, the process first queries the current working directory (which is common knowledge) pointed to by the pwd field in the fs_struct structure of the current process. If the current working directory is located within the specified system file directory ( / kylinos) (i.e., the current working path is prefixed with / kylinos), it means the process is already within the system file partition, no redirection is needed, and the path resolution starting point remains current->fs.pwd. If the current working directory is outside the specified system file directory, it further determines whether the resolved access path will pass through the original system file path, i.e., whether the resolved endpoint is the original system file path. If yes (e.g., executing .. / usr / bin / ls from / home), the initial position of the access path is redirected to the specified system file directory pointed to by the sysroot field; if no (e.g., executing .. / usr / bin / myapp from / home, the resolved endpoint is / home / bin / myapp, which contains bin but does not belong to the original system file path / bin, so no redirection is performed), the path resolution starting point remains current->fs.pwd.

[0045] In step S3, when returning the target file from the standard directory of the system file partition according to the redirected access path, the walk_component command is called to find the target file starting from the initial position of the access path and return the inode of the target file to the caller.

[0046] It's important to note that regardless of whether redirection occurs, the `walk_component` function is ultimately called. Starting from a predetermined initial position (which could be `fs.root`, `fs.sysroot`, or `fs.pwd`), the function traverses the directory entries (dentry, a kernel data structure representing directory structure) level by level according to the access path until it finds the inode (inode, a kernel data structure representing file metadata) of the target file. The inode is then returned to the caller, completing the file access. Through this mechanism, applications can correctly access system files located in the system file partition under a physically isolated architecture without modifying the hard-coded absolute paths in the source code (such as ` / usr / bin / xxx` or ` / lib / xxx.so`). This achieves complete transparent compatibility with the existing Linux software ecosystem, protecting system files and avoiding compatibility risks associated with modifying basic libraries such as glibc, thus ensuring the reliability of system startup and program loading.

[0047] Furthermore, this embodiment also proposes a physical isolation system file device for a Linux system, including a processor and a computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and the computer program is executed by the processor to implement the steps of the physical isolation system file method for a Linux system described in this embodiment.

[0048] Furthermore, this embodiment also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method for physically isolating system files for a Linux system as described in this embodiment.

[0049] Furthermore, this embodiment also proposes a computer program product, including a computer program that, when executed by a processor, implements the steps of the method for physically isolating system files for a Linux system as described in this embodiment.

[0050] In summary, this invention proposes a method and apparatus for physically isolating system files in a Linux system, which can achieve physical isolation between system files and user files while maintaining compatibility with existing Linux applications. The key points are as follows: 1) File path redirection system: This system redirects system file paths commonly accessed by open-source software to protected system file partitions in the kernel, which can avoid a large amount of code modification.

[0051] 2) Physically isolating system files and user files can protect system files and facilitate the management of user files.

[0052] 3) Modify the default path of the compiled installation system to make the installation of user programs more like Windows or Android, which is also part of physically isolating system files and user files.

[0053] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for physically isolating system files in a Linux system, characterized in that, Includes the following steps: Create a system file partition and a user file partition, and mount the system file partition and the user file partition to different directories of the root file system partition. Create standard directories in both the system file partition and the user file partition. The system file partition is used to store the system's executable program files and shared library files, and the user file partition is used to store the executable files and shared libraries compiled and installed by the user. Change the default installation path of the compilation and installation tools to point to the standard directory of the user file partition, and add the installation path of the user file partition to the system environment variables; When a process accesses a file, it determines the access path. If the access path is the original system file path, it redirects the access path to the system file partition and returns the target file from the standard directory of the system file partition according to the redirected access path.

2. The method for physically isolating system files in a Linux system according to claim 1, characterized in that, When mounting the system file partition and user file partition to different directories on the root file system partition, the specific steps include: After the kernel boots, it mounts the memory file system. The init process of the memory file system then mounts the root file system partition to the root directory mount point, the system file partition to the specified system file directory of the root file system, and the user file partition to the specified user file directory of the root file system. When mounting the system file partition to the specified system file directory of the root file system, it is mounted in read-only mode.

3. The method for physically isolating system files in a Linux system according to claim 2, characterized in that, Before mounting the system file partition and user file partition to different directories on the root file system partition, the process includes: adding a member `sysroot` to the kernel structure `fs_struct` to point to the system file partition; after mounting the system file partition and user file partition to different directories on the root file system partition, the process includes: The init process of the memory file system calls the chroot command to transfer the root directory from the memory file system to the root file system partition; The init process of the memory file system calls the set_fs_root command to set the root field fs.root in the fs_struct structure of this process to the root file system partition; The init process of the memory file system calls the set_fs_pwd command to set the pwd field fs.pwd in the fs_struct structure of this process to the root file system partition; The init process of the memory file system calls the set_fs_sysroot command to set the sysroot field fs.sysroot in the fs_struct structure of this process to the system file partition.

4. The method for physically isolating system files in a Linux system according to claim 3, characterized in that, When determining the access path, the specific steps include: The path_openat function is used to parse the access path and obtain the first character characteristic of the access path; If the first character feature is an absolute path addressing feature and the access path is the original system file path, then the steps of redirecting the access path to the system file partition and returning the target file from the standard directory of the system file partition according to the redirected access path are executed. If the first character characteristic is a relative path addressing characteristic, and the current directory entry pointed to by the pwd field in the fs_struct structure of this process is outside the specified system file directory, then the steps of redirecting the access path to the system file partition and returning the target file from the standard directory of the system file partition according to the redirected access path are executed. If the first character characteristic is a relative path addressing characteristic, and the access path passes through the original system file path, then the steps of redirecting the access path to the system file partition and returning the target file from the standard directory of the system file partition according to the redirected access path are executed.

5. The method for physically isolating system files in a Linux system according to claim 3, characterized in that, When redirecting the access path to the system file partition, the initial location of the access path is set to the specified system file directory pointed to by the sysroot field.

6. The method for physically isolating system files in a Linux system according to claim 5, characterized in that, When returning the target file from the standard directory of the system file partition based on the redirected access path, the walk_component command is called to find the target file starting from the initial position of the access path and return the inode of the target file to the caller.

7. The method for physically isolating system files in a Linux system according to claim 1, characterized in that, When adding the installation path of the user file partition to the system environment variables, this includes: adding the executable file directory path of the user file partition to the system environment variable PATH; and adding the shared library directory path of the user file partition to the system environment variable LD_LIBRARY_PATH.

8. A physically isolated system file device for a Linux system, characterized in that, The method includes a processor and a computer-readable storage medium storing a computer program, which is executed by the processor to implement the steps of the method for physically isolating system files for a Linux system as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for physically isolating system files for a Linux system as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method for physically isolating system files for a Linux system as described in any one of claims 1 to 7.

Images