A method, system, device, medium and product for write protection of a page cache page

Abstract

The present disclosure relates to a method, system, device, medium and product for write protection of a page cache page. The method comprises: in response to detecting that a downstream kernel component performs a write operation on a physical page corresponding to a target page cache page through a first kernel data structure corresponding to the target page cache page, detecting whether the first kernel data structure includes a first source marker, the first source marker being used to indicate that the target page cache page is a read-only page cache page; in response to the first kernel data structure including the first source marker, determining a processing mode for the read-only page cache page, wherein the processing mode indicates whether to allow the write operation on the read-only page cache page or to reject the write operation on the read-only page cache page; and processing the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode.

Description

Technical Field

[0001] This disclosure relates to the field of computers, and more particularly to a method, system, device, medium, and product for write protection of page cache pages. Background Technology

[0002] In modern operating systems, to improve file I / O performance, the kernel commonly employs a page cache mechanism to cache disk file data in physical memory. When multiple processes read the same file, they can share the same page cache pages, significantly reducing memory usage and disk read operations. To further improve data transfer efficiency, the Linux kernel provides a zero-copy mechanism. For example, using the `splice` system call, applications can directly "concatenate" file data into a pipe without copying the data from kernel space to user space buffers. Subsequently, the data in the pipe can be further passed to network sockets, encryption subsystems, or other kernel consumers via a zero-copy path. This mechanism is widely used in high-performance network transmission, streaming media processing, and data encryption / decryption scenarios.

[0003] However, while zero-copy improves performance, it also introduces a potential security risk: when a page cache page of a read-only file is "borrowed" to other kernel subsystems via a zero-copy path, its "read-only source" semantics may be lost during propagation. Some downstream subsystems (i.e., kernel components that receive data via hash tables or direct page references and have write capabilities) may mistakenly identify these borrowed page cache pages as writable private buffers, thereby performing write operations and contaminating the original page cache pages. This contamination can lead to data integrity corruption, privilege escalation vulnerabilities, and even be exploited as an attack path for security vulnerabilities in certain scenarios. Summary of the Invention

[0004] This disclosure provides a method, system, device, medium, and product for write protection of page cache pages, to at least solve the problem that related technologies cannot perform targeted write interception at the downstream consumption point of the zero-copy propagation chain.

[0005] According to a first aspect of the present disclosure, a write protection method for page cache pages is provided, comprising: in response to detecting that a downstream kernel component performs a write operation on a physical page corresponding to a target page cache page through a first kernel data structure corresponding to the target page cache page, detecting whether the first kernel data structure includes a first source marker, the first source marker being used to indicate that the target page cache page is a read-only page cache page; in response to the first kernel data structure including the first source marker, determining a processing mode for the read-only page cache page, wherein the processing mode indicates whether write operations are allowed or denied to be performed on the read-only page cache page; and processing the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode.

[0006] Optionally, the first kernel data structure corresponding to the target page cache page is obtained as follows: at the beginning of the zero-copy data path, in response to the target page cache page being a read-only page cache page, a second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, wherein the second source flag is used to indicate that the target page cache page is a read-only page cache page; at the downstream conversion point of the zero-copy data path, based on the second kernel data structure, the target page cache page is mapped to the second kernel component to obtain a first kernel data structure containing the first source flag.

[0007] Optionally, before setting the second source flag in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, the method further includes: detecting the identifier of the processing mode, wherein the processing mode includes a disabled mode, a forced interception mode, and an allowed mode; in response to the identifier of the processing mode indicating a disabled mode, the second source flag is not set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, and in response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, it is not detected whether the first kernel data structure includes the first source flag; in response to the identifier of the processing mode indicating a forced interception mode or an allowed mode, the second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component.

[0008] Optionally, the allowed modes include audit mode and automatic replication mode. Determining the processing mode of the target page cache includes: determining the processing mode of the target page cache through the policy inspection interface of the policy layer, and returning indication information corresponding to the determined processing mode. The policy layer is implemented as a loadable kernel module, and the indication information includes any of the following: in response to the policy inspection interface determining that the processing mode is audit mode, the indication information is that write operations are allowed; in response to the policy inspection interface determining that the processing mode is forced interception mode, the indication information is a rejection error code; in response to the policy inspection interface determining that the processing mode is automatic replication mode, the indication information is a signal indicating replication.

[0009] Optionally, according to the processing mode, the write operation of the downstream kernel component on the physical page corresponding to the target page cache page is processed, including: in response to the indication information that the write operation is allowed, performing the write operation; in response to the indication information that the copy is indicated, allocating a new physical page and copying the contents of the physical page corresponding to the target page cache page to the new physical page; updating the first kernel data structure to point to the new physical page and clearing the first source mark; and performing the write operation on the new physical page.

[0010] Optionally, depending on the processing mode, the write operation of the downstream kernel component to the physical page corresponding to the target page cache page is processed, including: in response to the indication information being a rejection error code and the write operation being rejected by terminating the process, the policy layer directly terminates the write operation process through the kernel task management interface; in response to the indication information being a rejection error code and the write operation being rejected by halting the system, the policy layer directly triggers the kernel panic mechanism to force the operating system into a safe state.

[0011] Optionally, the strategy layer records the number of unauthorized write operation events, and the strategy layer exposes the recorded number of unauthorized write operation events to the user space through a diagnostic interface.

[0012] Optionally, when the first kernel data structure is split or cloned to obtain the third kernel data structure, the third kernel data structure inherits the first source tag included in the first kernel data structure.

[0013] According to a second aspect of the present disclosure, a write protection system for page cache pages is provided, comprising: a detection unit configured to, in response to detecting that a downstream kernel component performs a write operation on a physical page corresponding to a target page cache page through a first kernel data structure corresponding to the target page cache page, detect whether the first kernel data structure includes a first source marker, the first source marker being used to indicate that the target page cache page is a read-only page cache page; a determination unit configured to, in response to the first kernel data structure including the first source marker, determine a processing mode for the target page cache page, wherein the processing mode indicates whether a write operation is allowed or denied to be performed on the target page cache page; and a processing unit configured to process the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode.

[0014] Optionally, the write protection system further includes an acquisition unit configured to acquire the first kernel data structure corresponding to the target page cache page in the following manner: at the beginning of the zero-copy data path, in response to the target page cache page being a read-only page cache page, a second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, wherein the second source flag is used to indicate that the target page cache page is a read-only page cache page; at the downstream conversion point of the zero-copy data path, based on the second kernel data structure, the target page cache page is mapped to the second kernel component to obtain a first kernel data structure containing the first source flag.

[0015] Optionally, the acquisition unit is further configured to detect the identifier of the processing mode before setting the second source flag in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, wherein the processing mode includes a disabled mode, a forced interception mode, and an allowed mode; in response to the identifier of the processing mode indicating a disabled mode, the second source flag is not set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, and in response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, the unit does not detect whether the first kernel data structure includes the first source flag; in response to the identifier of the processing mode indicating a forced interception mode or an allowed mode, the second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component.

[0016] Optionally, the permitted modes include audit mode and automatic replication mode. The determining unit is further configured to determine the processing mode of the target page cache page through the policy inspection interface of the policy layer, and return indication information corresponding to the determined processing mode. The policy layer is implemented as a loadable kernel module, and the indication information includes any of the following: in response to the policy inspection interface determining that the processing mode is audit mode, the indication information indicates that write operations are allowed; in response to the policy inspection interface determining that the processing mode is forced interception mode, the indication information is a rejection error code; in response to the policy inspection interface determining that the processing mode is automatic replication mode, the indication information is a signal indicating replication.

[0017] Optionally, the processing unit is further configured to perform a write operation in response to an indication message that a write operation is allowed; allocate a new physical page in response to an indication message that a copy is allowed; copy the contents of the physical page corresponding to the target page cache page to the new physical page; update the first kernel data structure to point to the new physical page and clear the first source mark; and perform a write operation on the new physical page.

[0018] Optionally, the processing unit is also configured to, in response to an indication message of a rejection error code and a rejection of the write operation, terminate the process performing the write operation directly through the kernel task management interface; or in response to an indication message of a rejection error code and a rejection of the write operation, halt the system directly by triggering the kernel panic mechanism to force the operating system into a safe state.

[0019] Optionally, the write protection system further includes a recording unit, configured to record the number of unauthorized write operation events through the policy layer, and the policy layer exposes the recorded number of unauthorized write operation events to the user space through a diagnostic interface.

[0020] Optionally, the write protection system further includes an inheritance unit configured to, when splitting or cloning the first kernel data structure to obtain a third kernel data structure, inherit the first source tag included in the first kernel data structure.

[0021] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement a write protection method for page cache pages according to the present disclosure.

[0022] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided that, when instructions in the computer-readable storage medium are executed by at least one processor, causes at least one processor to perform the write protection method for page cache pages as described above according to the present disclosure.

[0023] According to a fifth aspect of the present disclosure, a computer program product is provided, including computer instructions that, when executed by a processor, implement a write protection method for page cache pages according to the present disclosure.

[0024] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects: According to the write protection method, system, device, medium, and product for page cache pages disclosed herein, a source flag indicating the read-only page cache page is set in the kernel data structure corresponding to the read-only page cache page. Simultaneously, before a downstream kernel component performs a write operation on the read-only page cache page through the kernel data structure, it checks whether the kernel data structure carries the source flag of the read-only page cache page. When the source flag of the read-only page cache page is detected, the write operation can be flexibly rejected or allowed based on the processing mode for the read-only page cache page. This prevents erroneous writes to the read-only page cache by downstream kernel components when the user has set a condition prohibiting write operations on the read-only page cache page, thereby effectively preventing page cache pollution. Therefore, this disclosure solves the problem that related technologies cannot perform targeted write interception at the downstream consumption point of the zero-copy propagation chain.

[0025] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0027] Figure 1 This is a flowchart illustrating a write protection method for page cache pages according to an exemplary embodiment; Figure 2 This is a system architecture diagram illustrating a zero-copy write protection method according to an exemplary embodiment; Figure 3 This is a schematic diagram illustrating a workflow in a zero-copy data path according to an exemplary embodiment; Figure 4 This is a block diagram illustrating a write protection system for page cache pages according to an exemplary embodiment; Figure 5 This is a block diagram of an electronic device 500 according to an embodiment of the present disclosure. Detailed Implementation

[0028] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0029] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following examples do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0030] It should be noted that the phrase "at least one of several items" in this disclosure refers to three parallel cases: "any one of the several items", "a combination of any number of the several items", and "all of the several items". For example, "including at least one of A and B" includes the following three parallel cases: (1) including A; (2) including B; (3) including A and B. Another example is "performing at least one of step one and step two", which means the following three parallel cases: (1) performing step one; (2) performing step two; (3) performing both step one and step two.

[0031] Currently, the basic workflow of the zero-copy data path in the existing Linux kernel is as follows (taking the splice zero-copy mechanism as an example): When a user process transfers file data to a pipe via the `splice` system call, the kernel's `splice_folio_into_pipe()` function directly maps the physical pages in the file page cache to the `pipe_buffer` structure of the pipe buffer. At this point, the pipe does not own the physical page; it only holds a borrowed reference.

[0032] Subsequently, when data in the pipe needs to be sent to the network or passed to the encryption subsystem, the kernel uses functions such as `splice_to_socket()` to convert the `pipe_buffer` into a `bio_vec` (block I / O vector), and then further converts it into a `scatterlist` (hash table) using functions such as `extract_iter_to_sg()`. In the encryption subsystem (such as `AF_ALG`), the `scatterlist` is passed to the encryption algorithm as a data source or destination buffer.

[0033] In the above path, page cache pages originate from the file system, undergo transformations through multiple kernel data structures such as pipe_buffer, bio_vec / iov_iter, and scatterlist, and finally reach downstream consumers. In existing kernel implementations, these kernel data structures (especially bio_vec and scatterlist in earlier versions) do not carry the semantic information that "this page comes from the read-only page cache".

[0034] Therefore, the existing zero-copy mechanism has the following drawbacks: 1) Source semantics are lost during propagation via zero-copy paths. When a page cache page enters a zero-copy path, its "from read-only file" attribute exists only in the file system metadata (such as inode permission bits). As data passes through layers of pipe_buffer, bio_vec, and scatterlist, this source attribute cannot be propagated along with the physical page reference. When the data reaches downstream subsystems (i.e., downstream kernel components), consumers cannot determine whether the page cache page is a read-only page cache page, thus losing the fundamental information for access control decisions.

[0035] 2) Downstream subsystems lack a pre-write check mechanism for borrowed references. Current kernel write helper functions (such as scatterwalk_map_and_copy()) do not check whether the target page cache is a read-only page cache when performing a write operation. This means that any kernel subsystem that obtains a reference to the scatterlist can perform arbitrary writes to the page cache pages it contains, even if the page logically belongs to a read-only file.

[0036] 3) Existing memory protection mechanisms do not cover zero-copy borrowing reference scenarios. Although the kernel contains various memory protection mechanisms (such as page table-level read-only protection, MPK memory protection key, KASAN memory error detection, etc.), these mechanisms typically operate on the process's virtual address space or the kernel's own code / data segments. For page cache page references borrowed through zero-copy paths, existing protection mechanisms cannot effectively recognize their special "borrowing" semantics, nor can they perform targeted write interception at the downstream consumption point of the zero-copy propagation chain.

[0037] 4) Attempting to reclaim a borrowed page may compromise page cache integrity. The existing `pipe_buf_try_steal()` mechanism in the kernel allows pipes to attempt to "steal" page cache pages and convert them into anonymous writable pages. If the page actually comes from a read-only file, this stealing operation can cause anomalies in the original page cache's reference count and mapping, further exacerbating the risk of page cache pollution.

[0038] To address the aforementioned issues, this disclosure provides a write protection method for page cache pages. Specifically, a source flag indicating the source of the read-only page cache page is set in the kernel data structure corresponding to the read-only page cache page. Simultaneously, before a downstream kernel component performs a write operation on the read-only page cache page through the kernel data structure, it checks the kernel data structure for the source flag of the read-only page cache page. If the kernel data structure is found to carry the source flag of the read-only page cache page, the system can flexibly choose to refuse or allow the write operation based on the processing mode for the read-only page cache page. This prevents erroneous writes to the read-only page cache by downstream kernel components when the user has set a condition prohibiting write operations on the read-only page cache page, thereby effectively preventing page cache pollution.

[0039] Furthermore, this disclosure marks the source of page cache pages from read-only files at the beginning of the zero-copy data path and ensures that the mark can propagate across kernel data structures with physical page references, thus avoiding loss of read-only semantics.

[0040] Furthermore, this disclosure provides a two-tiered architecture separating the core layer and the policy layer. The core layer only provides the basic capabilities for defining and propagating source tags, without embedding any policy logic; all policy decisions are made by the policy layer at runtime. The policy layer provides flexible policy control through system control interfaces and loadable modules, focusing on policy judgment and handling without directly modifying core data structures. This separation architecture allows policy updates to be completed through module loading / unloading without modifying the kernel's core code, reducing maintenance costs and upgrade risks.

[0041] Furthermore, this disclosure can expand to a null operation or return zero inline when the compilation configuration is off (i.e., off mode). The entire mechanism does not generate additional memory access, branch judgment or function call overhead and has no impact on system performance.

[0042] The write protection method, system, device, medium, and product for page cache pages according to exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings.

[0043] Figure 1 This is a flowchart illustrating a write protection method for page cache pages according to an exemplary embodiment, such as... Figure 1 As shown, the write protection method for page cache pages includes the following steps: In step 101, in response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, it is detected whether the first kernel data structure includes a first source tag, which is used to indicate that the target page cache page is a read-only page cache page.

[0044] In step 102, in response to the first kernel data structure including a first source tag, a processing mode for the read-only page cache page is determined, wherein the processing mode indicates whether write operations are allowed or denied to the read-only page cache page.

[0045] In step 103, the write operations of the downstream kernel components on the physical pages corresponding to the target page cache pages are processed according to the processing mode.

[0046] As an example, a core layer can be deployed in the kernel's core code path to execute the write protection methods for page cache pages mentioned above. That is, the core layer is responsible for defining, setting, propagating, and providing pre-write checkpoints for source tags.

[0047] As an example, the aforementioned downstream kernel component can be a cryptographic subsystem, and the corresponding first kernel data structure can be a hash table. It should be noted that the downstream kernel component can also be a network socket or other kernel consumer, and the first kernel data structure can be the corresponding data interface; this disclosure does not impose any limitations on this.

[0048] As an example, a flag bit for storing the source flag can be defined in the unused / reserved bits of an existing kernel data structure to avoid modifying the data structure layout (KABI compatible).

[0049] For example, taking a hash table as the primary kernel data structure, the low-order bits of the `page_link` field in the hash table can be reused. Leveraging the page pointer alignment characteristic (physical pages are aligned by page size, and the low-order bits are always zero), 2 reserved bits can be used as read-only page cache flag bits to store the first source flag. To check if a hash table entry includes the first source flag, the hash table entry pointer can be used to traverse the hash table entries and check for its existence.

[0050] As an example, the above-mentioned processing mode for read-only cached pages can be pre-set, that is, according to user needs, write operations on read-only cached pages can be allowed or denied in advance, and this disclosure does not limit this.

[0051] As an example, taking the encryption subsystem, when the encryption algorithm attempts to write the authentication tag to the original page cache page, which should be read-only, the core layer performs a pre-write check and intercepts the write operation in a timely manner, thereby preventing the original page cache page from being contaminated. Specifically, after detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, it checks whether the hash table entry includes the first source tag. If it does, the processing mode for the read-only page cache page is determined. After determining the processing mode for the read-only page cache page, the write operation of the downstream kernel component on the physical page corresponding to the target page cache page can be processed according to this processing mode. For example, if the processing mode indicates that a write operation on the read-only page cache page is allowed, the write operation of the downstream kernel component on the physical page corresponding to the target page cache page can be executed; as another example, if the processing mode indicates that a write operation on the read-only page cache page is denied, the write operation of the downstream kernel component on the physical page corresponding to the target page cache page is not executed.

[0052] As an example, this disclosure can also employ a hardware-assisted scheme based on memory protection keys (MPK / PKU). Specifically, on processors that support memory protection keys, a specific protection key can be assigned to read-only page cache pages, and the protection key permissions can be checked via a hardware mechanism before downstream write operations. It should be noted that this scheme can completely avoid software-level mark propagation, but it is limited by hardware support and cannot cover all kernel execution paths.

[0053] According to an exemplary embodiment of this disclosure, the first kernel data structure corresponding to the target page cache page in step 101 above can be obtained as follows: at the beginning of the zero-copy data path, in response to the target page cache page being a read-only page cache page, a second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, wherein the second source flag is used to indicate that the target page cache page is a read-only page cache page; at the downstream conversion point of the zero-copy data path, based on the second kernel data structure, the target page cache page is mapped to the second kernel component to obtain a first kernel data structure containing the first source flag.

[0054] In this embodiment, source tags are applied to page cache pages from read-only files at the beginning of the zero-copy data path, and this tag is ensured to propagate across kernel data structures along with physical page references, thus avoiding loss of read-only semantics.

[0055] As an example, the aforementioned second kernel data structure can be a pipe data structure, and this disclosure does not limit it in this regard.

[0056] For example, taking the pipe buffer data structure as the second kernel data structure, at the beginning of the zero-copy data path, a page cache page from a read-only file is identified, and a source flag (such as page cache source, read-only source, borrowed reference, etc.) is set in the flags field of the pipe buffer. This flag can accurately describe the security semantics of the physical page reference corresponding to the page cache page.

[0057] For example, in the `flags` field of the pipe buffer structure (`pipe_buffer`), two flag bits can be defined using unused bits (i.e., reserved bits), namely the second source flag mentioned above: Page cache source tag: Indicates that this page cache page comes from the file page cache; Read-only source tag: Indicates that the cached page comes from a read-only file and should only be used as a data source.

[0058] It should be noted that the second source marker in this disclosure is not limited to the two markers mentioned above. For example, the second source marker may also include a borrowing reference marker, which is not limited in this disclosure. The borrowing reference marker is used to identify that the reference is a borrowing relationship and does not own the property, thus clearly distinguishing between "borrowing a reference" and "legal ownership." In this way, normal write-back paths of the file system, VFS write paths, and legitimate modifications made by applications through mmap are not subject to the methods of this disclosure. Only page cache references borrowed from read-only sources and propagated through zero-copy paths are checked, thereby avoiding interference with normal business logic.

[0059] For example, at the beginning of a zero-copy data path (such as in the `splice_folio_into_pipe()` function), when the kernel maps a file page cache page to the pipe buffer, it can check whether the page cache page belongs to a file mapping and whether the corresponding file does not have write permissions (i.e., determine whether the page cache page belongs to a read-only page cache page). If the result is that it belongs to a read-only page cache page, then the aforementioned second source flag is set when constructing `pipe_buffer`.

[0060] It should be noted that for pages not originating from the page cache (such as anonymous pages or kernel-private allocated pages), no source flag is set to avoid false positives.

[0061] For example, the second source flag in `pipe_buffer` can be passed to downstream kernel components. Assuming the downstream kernel component is a cryptographic subsystem, at the conversion point from pipe to block I / O vectors (such as `splice_to_socket()`), a local auxiliary array can be used to record the source state of each vector to complete the propagation of the source flag from the pipe to the block I / O vector. This achieves more accurate flag propagation when converting to hash table entries, avoiding reliance on page mapping backtracking. Specifically, a `bv_flags` field can be added to `struct bio_vec`, directly carrying the source flag. This allows the second source flag in `pipe_buffer` to be accurately copied to `bio_vec` and then to the scatterlist during `splice_to_socket()` conversion, achieving more precise propagation. It should be noted that this solution requires modifying the `bio_vec` structure definition, extending the fields only when the configuration is enabled, to ensure compatibility with the kernel application binary interface (KABI).

[0062] Then, in the extract_bvec_to_sg() function, when converting the block I / O vector into a hash table entry, it can determine whether the page cache page belongs to the read-only page cache page based on the source status of each vector; if it belongs to the read-only page cache page, the first source flag mentioned above can be set in the corresponding hash table entry.

[0063] It should be noted that in the `extract_bvec_to_sg()` function, when converting the I / O vector into a hash table entry, it is also possible to directly determine whether the page cache page belongs to the read-only page cache page based on the physical page mapping information. If it belongs to the read-only page cache page, the aforementioned first source flag can be set in the corresponding hash table entry.

[0064] This embodiment utilizes the security reserved bits of the existing kernel data structure to define the marker, and implements the propagation of the source marker by modifying the key conversion function. Thus, without changing the original memory layout of the data structure, it ensures the complete transmission of the source semantics of the "read-only page cache page" from pipe_buffer to scatterlist. This propagation mechanism covers the complete zero-copy link of splice→pipe→socket→scatterlist.

[0065] As an example, this disclosure can also employ a marking scheme based on physical page extended attributes. Specifically, it can utilize the extended attributes or flags field provided by the kernel for physical pages (struct page) to directly mark the physical page when it is borrowed from the page cache. Downstream checkpoints determine the source attribute by querying the physical page's flags field. It should be noted that the advantage of this scheme is that it does not require modification of the pipe_buffer and scatterlist markings, but the disadvantage is that physical page markings need to be cleaned up when the page is reclaimed and reused, increasing the complexity of page lifecycle management.

[0066] As an example, this disclosure can also restrict borrowed page stealing, that is, the try_steal callback of page_cache_pipe_buf_ops can be modified so that when the pipe buffer carries a read-only source flag, it can directly return failure, and prevent the conversion of read-only page cache page borrow references into anonymous writable pages.

[0067] According to an exemplary embodiment of this disclosure, before setting the second source flag in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, the identifier of the processing mode can also be detected, wherein the processing mode includes a disabled mode, a forced interception mode, and an allowed mode; in response to the identifier of the processing mode indicating that it is a disabled mode, the second source flag is not set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, and in response to detecting that the downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, it is not detected whether the first kernel data structure includes the first source flag; in response to the identifier of the processing mode indicating that it is a forced interception mode or an allowed mode, the second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component.

[0068] In this embodiment, when the processing mode is set to the off mode, no source identifier is set or the source mark is propagated. At the same time, there is no need to implement the detection step for the source mark. In other words, when the compilation configuration is off, it can be expanded into an empty operation or returned as zero inline. The whole mechanism does not generate additional memory access, branch judgment or function call overhead, and has no impact on system performance.

[0069] As an example, a set of global policy variables can be maintained, i.e., a flag indicating the processing mode can be set, allowing for dynamic adjustments during operating system runtime, thereby controlling the activation of overall functions and specific behavior modes. The processing mode can be identified in advance using this flag before setting the source flag.

[0070] This identifier can represent the following processing mode: Off mode: In this mode, source marking is not performed, source marking is not propagated, and source marking checks are not performed, resulting in zero runtime overhead; Forced interception mode: The source mark is marked and propagated, and subsequent source mark checks are also performed. When a read-only cache page is found to be written, the write operation is rejected. Allowed mode: Performs source tagging and propagation of source tags, as well as subsequent source tag checks, and allows write operations to continue when a violation is detected; It should be noted that the permitted modes can further include audit mode and automatic replication mode: Audit mode: Perform source tagging and propagate the source tagging, and conduct subsequent source tagging checks. When an illegal write operation is detected, record the violation log and allow the write operation to continue. Automatic copy mode: It performs source marking and propagates the source mark, as well as subsequent source mark checks. When it finds that a read-only cache page has been written, it can automatically copy it to a private anonymous page, perform the write operation on the private anonymous page, and only reject the write operation if the copy fails.

[0071] According to an exemplary embodiment of this disclosure, the permitted modes include an audit mode and an automatic replication mode. The step 102, determining the processing mode of the target page cache, may include: determining the processing mode of the target page cache through a policy check interface of the policy layer, and returning indication information corresponding to the determined processing mode. The policy layer is implemented as a loadable kernel module, and the indication information includes any of the following: in response to the policy check interface determining that the processing mode is an audit mode, the indication information indicates that write operations are allowed; in response to the policy check interface determining that the processing mode is a forced interception mode, the indication information is a rejection error code; in response to the policy check interface determining that the processing mode is an automatic replication mode, the indication information is a signal indicating replication.

[0072] This embodiment enables pattern judgment to be implemented at the strategy layer. The strategy layer focuses on strategy judgment and handling without directly modifying the core data structure, while the core layer only provides the basic capabilities for defining and propagating source tags without embedding any strategy logic. All strategy judgments can be determined by the strategy layer at runtime, thus realizing a two-layer separation architecture between the core layer and the strategy layer. This separation architecture allows strategy updates to be completed through module loading / unloading without modifying the core kernel code, reducing maintenance costs and upgrade risks.

[0073] As an example, the aforementioned policy layer can be implemented as a loadable kernel module and work in conjunction with the core layer through dynamic probe mechanisms such as kretprobe to provide runtime policy judgment and other processing. It should be noted that kretprobe (Kernel Return Probe) is a dynamic probe mechanism in the Linux kernel that can intercept the execution flow when a function returns.

[0074] For example, the strategy layer can set up a strategy inspection interface. The core layer can call this interface to determine the processing mode of the target page cache and return the corresponding indication information. This strategy inspection interface can receive a caller identifier. Then, the interface knows that it needs to determine the specific processing mode based on the identifier and returns the corresponding decision based on the determined processing mode: when the processing mode is determined to be audit mode, it returns "allow write operation"; when the processing mode is determined to be forced interception mode, it returns a rejection error code; when the processing mode is determined to be automatic replication mode, it returns information indicating replication.

[0075] As an example, the global policy variables that indicate the processing mode mentioned above can also be maintained in the policy layer and exposed to user space through the system control interface (sysctl), which is not limited in this disclosure. It should be noted that Sysctl (System Control, Linux) is a runtime parameter tuning interface provided by the kernel and exposed through the / proc / sys / file system.

[0076] At this point, the policy layer provides dynamically adjustable policy modes through the system control interface. This allows system administrators to enable audit mode to collect information on illegal paths during the debugging phase, enable forced interception mode to block attacks in the production environment, and enable automatic replication mode in compatibility-sensitive scenarios to balance security and business continuity. Moreover, adjustments to the processing mode for write operations do not require restarting the system or recompiling the kernel.

[0077] This embodiment implements a two-layer separation architecture between the core layer and the policy layer. The core layer provides zero-overhead marking / propagation / checkpointing capabilities, independent of any specific policy; the policy layer provides flexible policy control through system control interfaces and loadable modules. The two layers can be decoupled through function symbolic interfaces, supporting independent upgrades of the policy layer and hot replacement of different policy implementations.

[0078] According to an exemplary embodiment of this disclosure, step 103 above, which processes the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode, may include: performing the write operation in response to an indication message that the write operation is allowed; allocating a new physical page in response to an indication message that the copy is indicated, and copying the content of the physical page corresponding to the target page cache page to the new physical page; updating the first kernel data structure to point to the new physical page and clearing the first source mark; and performing the write operation on the new physical page.

[0079] This embodiment demonstrates corresponding processing operations based on several specific processing modes for write operations.

[0080] As an example, checkpoints can be provided on the critical path where write operations are performed in downstream subsystems (i.e., downstream kernel components), such as adding checkpoints on the critical path of kernel write helper functions.

[0081] For example, a new function, such as a controlled hash write helper function (scatterwalk_map_and_copy_checked()), can be added to handle write operations in forced interception mode and audit mode, replacing the traditional scatterwalk_map_and_copy(). When the input parameter (out parameter) indicates that the write direction is to write to the target page cache and the amount of data to be written is non-zero, the function calls the policy check interface to query the policy layer's decision. If the policy check interface returns a rejection error code, the query result indicates forced interception mode, and the write operation is rejected. If the policy check interface returns permission to execute the write operation, the query result indicates audit mode, and the original write logic continues, while a violation log is recorded in the policy layer.

[0082] For example, a new function could be added to the core layer, such as a writability guarantee auxiliary function (sg_ensure_writable()), to handle write operations in automatic replication mode. This function is called by consumers who need to ensure that the page is writable before writing. This function also calls the policy check interface to query the policy layer's decision. If the policy check interface returns a signal indicating replication, the query result indicates automatic replication mode. If the hash table entry carries a first-source marker, a new anonymous physical page is allocated, the content of the physical page corresponding to the target page cache page is copied to the new physical page, the hash table entry is updated to point to the new physical page, the first-source marker is cleared, and then success is returned.

[0083] It should be noted that this disclosure can also employ a dynamic inspection scheme based on eBPF. Specifically, an eBPF program can be mounted at the entry point of functions such as scatterwalk_map_and_copy() to dynamically inspect the attributes of the target page cache and execute the policy. This scheme does not require modification of the kernel source code, but the eBPF program may not be able to execute safely in certain kernel contexts (such as hard interrupts, locked paths), and the inspection granularity is limited by the eBPF verifier. According to an exemplary embodiment of this disclosure, in step 103 above, processing the write operation of the downstream kernel component on the physical page corresponding to the target page cache, according to the processing mode, may include: in response to the indication information being a rejection error code and the write operation being rejected by terminating the process, the policy layer directly terminates the write operation process through the kernel task management interface; in response to the indication information being a rejection error code and the write operation being rejected by system shutdown, the policy layer directly triggers the kernel panic mechanism to force the operating system into a safe state.

[0084] In this embodiment, in the forced interception mode, specific actions can be defined when an illegal write operation is detected. These actions can include logging only, terminating the illegal process, or triggering a system shutdown.

[0085] As an example, in forced interception mode, if the specific action is configured to terminate the process, the policy layer can directly terminate the process currently performing the illegal write operation through the kernel task management interface; if the specific action is configured to shut down the system, the policy layer can trigger the kernel panic mechanism to force the system into a safe state.

[0086] According to an exemplary embodiment of this disclosure, the policy layer records the number of unauthorized write operation events, and exposes the recorded number of unauthorized write operation events to user space through a diagnostic interface. Through this embodiment, the policy layer can record the number of violations, allowing security operations personnel to analyze and handle the corresponding violations.

[0087] As an example, the policy layer can maintain atomic counters to count the number of violations (such as unauthorized write operations) and expose the statistics to user space through a diagnostic interface (sysfs). Each time an unauthorized write operation is detected, a structured log containing information such as process identifier, process name, caller function name, and current processing mode is recorded for analysis by security operations personnel. It should be noted that sysfs is a virtual file system provided by the Linux kernel, used to expose kernel objects and driver information to user space.

[0088] According to an exemplary embodiment of this disclosure, when a third kernel data structure is obtained by splitting or cloning a first kernel data structure, the third kernel data structure inherits the first source tag included in the first kernel data structure. Through this embodiment, the inheritance of the source tag can be maintained during the splitting and jumping of the first kernel data.

[0089] As an example, taking the first kernel data as a hash table entry, we can modify the hash table page allocation helper function, such as in hash table transformation functions like `scatterwalk_ffwd()`, to inherit the first source tag of the original hash table entry when generating a new hash table entry, thus maintaining the inheritance of the source tag. For example, new hash table entries generated by hash table splitting, cloning, or jumping operations can contain the same source tag as the original hash table entry.

[0090] To better understand this disclosure, the following is in conjunction with... Figure 2 and Figure 3 Provide a systematic explanation.

[0091] Figure 2 A system architecture diagram of a zero-copy write protection method is shown. Figure 3 This demonstrates a workflow in a zero-copy path. Figure 2 Taking a system where the first kernel data structure is a hash table (scatterlist) and the second kernel data structure is a pipe buffer (pipe_buffer) as an example.

[0092] like Figure 2 As shown, the system architecture adopts a two-layer separation architecture, including a core layer and a strategy layer. The core layer includes a source tag definition module, a producer tag module, a tag propagation module, and a pre-write check module; the strategy layer includes a strategy variable management module, a statistical counter, an audit and log module, and a process handling module.

[0093] The source tag definition module defines tag bits used to store source tags in the unused / reserved bits of existing kernel data structures to avoid modifying the data structure layout.

[0094] At the beginning of the zero-copy data path, the producer marking module identifies page cache pages from read-only files and sets a second source flag (such as page cache source, read-only source, borrow reference, etc.) in the flags field of the pipeline buffer.

[0095] The mark propagation module is responsible for passing the second-source mark from the upstream data structure to the downstream data structure, such as from the pipe buffer structure (pipe_buffer) to the hash list entry. Specifically, based on the pipe buffer structure, the target page cache page is mapped to the downstream kernel component (such as the cryptographic subsystem) to obtain the hash list entry containing the first-source mark. It should be noted that during the propagation from the pipe buffer structure (pipe_buffer) to the hash list entry, the source state of each vector can be recorded through a local auxiliary array at the conversion point from the pipe to the block I / O vector (bio_vec / iov_iter) to complete the propagation of the source mark from the pipe to the block I / O vector. This achieves more accurate mark propagation when converting to hash list entries, avoiding reliance on page mapping backtracking inference.

[0096] The pre-write check module provides checkpoints on the critical path where downstream kernel components perform write operations. Specifically, the pre-write check module calls the policy check interface of the policy layer to determine the processing mode of the target page cache page. The policy check interface determines the specific processing mode through the global policy variables of the policy variable management module and returns the corresponding indication information. Then, the pre-write check module performs specific processing on the write operation according to the returned indication information.

[0097] The policy variable management module maintains global policy variables (i.e., the identifier of the processing mode) that indicate the processing mode, and exposes them to user space through the system control interface (sysctl); system administrators can set this global policy variable through the system control interface.

[0098] The statistics counter is used to record the number of unauthorized write operation events and exposes statistical information to user space through the diagnostic interface (sysfs).

[0099] Once the auditing and logging module detects an unauthorized write operation, it will increment the statistics counter by 1 and record a structured log containing information such as process identifier, process name, caller function name, and current processing mode for security operations personnel to analyze.

[0100] The process handling module is used in forced interception mode to define specific actions to take when an illegal write operation is detected, such as terminating the illegal process or triggering a system shutdown. Specifically, in forced interception mode, if the specific action is configured to terminate the process, the policy layer can directly terminate the process currently performing the illegal write operation through the kernel task management interface; if the specific action is configured to shut down the system, the policy layer can trigger the kernel panic mechanism to force the system into a safe state.

[0101] In summary, this embodiment provides a kernel zero-copy write protection system based on memory page source tracing. The core layer is deployed in the core code path of the operating system kernel. It sets source markers for page cache pages from read-only files at the start of the zero-copy read path; propagates these source markers to downstream kernel data structures at critical transition points in the zero-copy propagation path; and provides checkpoints and calls policy check interfaces before downstream write operations. The policy layer is implemented as a loadable kernel module, receiving runtime policy configurations through the system control interface; when a checkpoint is triggered, it returns a decision to allow, deny, audit, or automatically copy based on the policy configuration; and executes audit logging or process handling when an unauthorized write is detected.

[0102] Figure 3 This demonstrates a workflow in a zero-copy data path. Figure 3 Taking the example where the first kernel data structure is a hash table, the second kernel data structure is a pipe buffer, and the downstream kernel component is a cryptographic subsystem.

[0103] When a user opens a Virtual File System (VFS) using the splice(fd_in, pipe_fd) function, it needs to read the corresponding read-only page cache page of the file system and transfer the file data to the pipe subsystem. At this time, the kernel layer recognizes that the file data comes from the read-only page cache page, so it sets the above-mentioned second source flag (such as page cache source, read-only source, borrow reference, etc.) when constructing pipe_buffer.

[0104] Subsequently, when the user forwards the file data through the splice(pipe_fd, socket_fd) function, the pipe subsystem needs to pass the file data to the encryption subsystem for encryption. At this time, the core layer propagates the aforementioned second source marker to the hash table through extract_bvec_to_sg(), that is, sets the aforementioned first source marker in the corresponding hash table entry.

[0105] Then, when the encryption subsystem attempts to write the authentication tag to the original page cache page, which should be read-only, it notifies the core layer of the write operation, such as by setting the `out` parameter to 1. The core layer uses the following two helper functions, `scatterwalk_map_and_copy_checked()` and `sg_ensure_writable()`, to call the policy check interface to query the policy layer's decision, i.e., the verification processing mode. If the policy check interface returns a rejection error code, the query result is a forced interception mode, in which case the write operation is rejected; if the policy check interface returns an allow write operation, the query result is an audit mode, in which case the original write logic continues to be executed and a violation log is recorded in the policy layer; if the policy check interface returns a signal indicating replication, the query result is an automatic replication mode, and the hash table entry carries a first-source marker, a new anonymous physical page is allocated, the content of the physical page corresponding to the target page cache page is copied to the new physical page, the hash table entry is updated to point to the new physical page and the first-source marker is cleared, and then a success is returned.

[0106] Figure 4 This is a block diagram illustrating a write protection system for page cache pages according to an exemplary embodiment. (Refer to...) Figure 4 The system includes a detection unit 40, a determination unit 42, and a processing unit 44.

[0107] The detection unit 40 is configured to, in response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through a first kernel data structure corresponding to the target page cache page, detect whether the first kernel data structure includes a first source flag, the first source flag being used to indicate that the target page cache page is a read-only page cache page; the determination unit 42 is configured to, in response to the first kernel data structure including the first source flag, determine the processing mode of the target page cache page, wherein the processing mode indicates whether a write operation is allowed or denied to be performed on the target page cache page; the processing unit 44 is configured to process the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode.

[0108] In this embodiment, a source flag indicating the read-only page cache page is set in the kernel data structure corresponding to the read-only page cache page. Simultaneously, before a downstream kernel component performs a write operation on the read-only page cache page through the kernel data structure, it checks whether the kernel data structure carries the source flag of the read-only page cache page. Based on the processing mode for the read-only page cache page, it can flexibly choose to refuse or allow the write operation. This prevents erroneous writes to the read-only page cache by downstream kernel components when the user has set a condition to refuse write operations on the read-only page cache page, thus effectively preventing page cache pollution.

[0109] According to embodiments of this disclosure, the write protection system further includes an acquisition unit configured to acquire a first kernel data structure corresponding to a target page cache page in the following manner: at the beginning of a zero-copy data path, in response to the target page cache page being a read-only page cache page, a second source flag is set in a second kernel data structure obtained by mapping the target page cache page to a first kernel component, wherein the second source flag is used to indicate that the target page cache page is a read-only page cache page; at a downstream conversion point of the zero-copy data path, based on the second kernel data structure, the target page cache page is mapped to a second kernel component to obtain a first kernel data structure containing the first source flag.

[0110] In this embodiment, source tags are applied to page cache pages from read-only files at the beginning of the zero-copy data path, and this tag is ensured to propagate across kernel data structures along with physical page references, thus avoiding loss of read-only semantics.

[0111] According to embodiments of this disclosure, the acquisition unit is further configured to detect an identifier of a processing mode before setting a second source flag in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, wherein the processing mode includes a disabled mode, a forced interception mode, and an allowed mode; in response to the identifier of the processing mode indicating a disabled mode, the second source flag is not set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, and in response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, the first kernel data structure is not detected to include a first source flag; in response to the identifier of the processing mode indicating a forced interception mode or an allowed mode, the second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component.

[0112] In this embodiment, when the processing mode is set to the off mode, no source identifier is set or the source mark is propagated. At the same time, there is no need to implement the detection step for the source mark. In other words, when the compilation configuration is off, it can be expanded into an empty operation or returned as zero inline. The whole mechanism does not generate additional memory access, branch judgment or function call overhead, and has no impact on system performance.

[0113] According to embodiments of this disclosure, the permitted modes include an audit mode and an automatic replication mode. The determining unit 42 is further configured to determine the processing mode of the target page cache page through a policy inspection interface of the policy layer, and return indication information corresponding to the determined processing mode. The policy layer is implemented as a loadable kernel module, and the indication information includes any of the following: in response to the policy inspection interface determining that the processing mode is an audit mode, the indication information indicates that write operations are permitted; in response to the policy inspection interface determining that the processing mode is a forced interception mode, the indication information is a rejection error code; in response to the policy inspection interface determining that the processing mode is an automatic replication mode, the indication information is a signal indicating replication.

[0114] This embodiment enables pattern judgment to be implemented at the strategy layer. The strategy layer focuses on strategy judgment and handling without directly modifying the core data structure, while the core layer only provides the basic capabilities for defining and propagating source tags without embedding any strategy logic. All strategy judgments can be determined by the strategy layer at runtime, thus realizing a two-layer separation architecture between the core layer and the strategy layer. This separation architecture allows strategy updates to be completed through module loading / unloading without modifying the core kernel code, reducing maintenance costs and upgrade risks.

[0115] According to an embodiment of this disclosure, the processing unit 44 is further configured to: perform a write operation in response to an indication message indicating that a write operation is allowed; allocate a new physical page in response to an indication message indicating a copy; copy the contents of the physical page corresponding to the target page cache page to the new physical page; update the first kernel data structure to point to the new physical page and clear the first source mark; and perform a write operation on the new physical page.

[0116] This embodiment demonstrates corresponding processing operations based on several specific processing modes for write operations.

[0117] According to embodiments of this disclosure, processing unit 44 is further configured to, in response to an indication message being a rejection error code and the write operation being rejected in a manner that terminates the write operation, the policy layer directly terminates the write operation process through the kernel task management interface; in response to an indication message being a rejection error code and the write operation being rejected in a manner that halts the system, the policy layer directly triggers the kernel panic mechanism to force the operating system into a safe state.

[0118] In this embodiment, in the forced interception mode, specific actions can be defined when an illegal write operation is detected. These actions can include logging only, terminating the illegal process, or triggering a system shutdown.

[0119] According to embodiments of this disclosure, the write protection system further includes a recording unit configured to record the number of unauthorized write operation events through a policy layer, and the policy layer exposes the recorded number of unauthorized write operation events to the user space through a diagnostic interface.

[0120] In this embodiment, the policy layer can record the number of violations, which can be used by security operations personnel to analyze and handle the corresponding violations.

[0121] According to embodiments of this disclosure, the write protection system further includes an inheritance unit configured to, when a third kernel data structure is obtained by splitting or cloning a first kernel data structure, inherit the first source tag included in the first kernel data structure.

[0122] This embodiment ensures that the inheritance of source tags is maintained during the splitting and jumping of the first kernel data.

[0123] According to embodiments of this disclosure, an electronic device may be provided. Figure 5 This is a block diagram of an electronic device 500 according to an embodiment of the present disclosure. The electronic device includes at least one memory 501 and at least one processor 502. The at least one memory stores a set of computer-executable instructions. When the set of computer-executable instructions is executed by the at least one processor, a write protection method for page cache pages according to an embodiment of the present disclosure is executed.

[0124] As an example, electronic device 500 may be a PC, tablet, personal digital assistant, smartphone, or other device capable of executing the aforementioned set of instructions. Here, electronic device 500 is not necessarily a single electronic device, but may be a collection of any devices or circuits capable of executing the aforementioned instructions (or instruction sets) individually or in combination. Electronic device 500 may also be part of an integrated control system or system manager, or may be configured to interconnect with a portable electronic device locally or remotely (e.g., via wireless transmission) through an interface.

[0125] In electronic device 500, processor 502 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, processor 502 may also include analog processors, digital processors, microprocessors, multi-core processors, processor arrays, network processors, etc.

[0126] The processor 502 can execute instructions or code stored in memory, and the memory 501 can also store data. Instructions and data can also be sent and received over a network via a network interface device, wherein the network interface device can employ any known transmission protocol.

[0127] The memory 501 may be integrated with the processor 502, for example, by placing RAM or flash memory within an integrated circuit microprocessor. Alternatively, the memory 501 may include a separate device, such as an external disk drive, a storage array, or other storage device usable by any database system. The memory 501 and the processor 502 may be operatively coupled, or may communicate with each other, for example, via I / O ports, network connections, etc., enabling the processor 502 to read files stored in the memory 501.

[0128] In addition, the electronic device 500 may also include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, mouse, touch input device, etc.). All components of the electronic device can be interconnected via a bus and / or network.

[0129] According to embodiments of this disclosure, a computer-readable storage medium may also be provided, wherein when instructions in the computer-readable storage medium are executed by at least one processor, the at least one processor causes the processor to perform the write protection method for page cache pages according to embodiments of this disclosure. Examples of computer-readable storage media include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disc storage, hard disk drive (HDD), solid-state drive (SSD), card storage (such as multimedia cards, secure digital (SD) cards, or ultra-fast digital (XD) cards), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid-state drive, and any other device configured to store a computer program and any associated data, data files, and data structures in a non-transitory manner and to provide the computer program and any associated data, data files, and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the aforementioned computer-readable storage medium can run in an environment deployed in computer devices such as clients, hosts, agent devices, servers, etc. Furthermore, in one example, the computer program and any associated data, data files, and data structures are distributed across a networked computer system, such that the computer program and any associated data, data files, and data structures are stored, accessed, and executed in a distributed manner through one or more processors or computers.

[0130] According to embodiments of this disclosure, a computer program product is provided, including computer instructions that, when executed by a processor, implement the write protection method for page cache pages according to embodiments of this disclosure.

[0131] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

[0132] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A write protection method for page cache pages, characterized in that, include: In response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through a first kernel data structure corresponding to the target page cache page, it is detected whether the first kernel data structure includes a first source tag, wherein the first source tag is used to indicate that the target page cache page is a read-only page cache page; In response to the first kernel data structure including the first source tag, a processing mode for the read-only page cache page is determined, wherein the processing mode indicates whether write operations are allowed or denied to the read-only page cache page; According to the processing mode, the write operation of the downstream kernel component on the physical page corresponding to the target page cache page is processed.

2. The write protection method as described in claim 1, characterized in that, The first kernel data structure corresponding to the target page cache page is obtained in the following way: At the beginning of the zero-copy data path, in response to the target page cache page being a read-only page cache page, a second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component, wherein the second source flag is used to indicate that the target page cache page is a read-only page cache page; At the downstream conversion point of the zero-copy data path, based on the second kernel data structure, the target page cache page is mapped to the second kernel component to obtain a first kernel data structure containing a first source tag.

3. The write protection method as described in claim 2, characterized in that, Before mapping the target page cache page to the second kernel data structure obtained from the first kernel component and setting the second source tag, the process also includes: The identifier of the processing mode is detected, wherein the processing mode includes a shutdown mode, a forced blocking mode, and an allow mode; In response to the indicator indicating that the processing mode is off, the second source flag is not set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component. Furthermore, in response to detecting that the downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through the first kernel data structure corresponding to the target page cache page, it is not detected whether the first kernel data structure includes the first source flag. In response to the identification indication of the processing mode being either a forced interception mode or an allow mode, a second source flag is set in the second kernel data structure obtained by mapping the target page cache page to the first kernel component.

4. The write protection method as described in claim 3, characterized in that, The allowed modes include audit mode and automatic replication mode, wherein determining the processing mode of the target page cache page includes: The processing mode of the target page cache page is determined through the policy inspection interface of the policy layer, and indication information corresponding to the determined processing mode is returned. The policy layer is implemented as a loadable kernel module, and the indication information includes any of the following: In response to the policy inspection interface determining that the processing mode is an audit mode, the indication information indicates that write operations are allowed; In response to the policy inspection interface determining that the processing mode is an identifier indicating a forced interception mode, the indication information is a rejection error code; In response to the policy inspection interface determining that the processing mode is identified as an automatic copy mode, the indication information is a signal indicating copying.

5. The write protection method as described in claim 4, characterized in that, The process of handling the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode includes: In response to the indication that a write operation is permitted, the write operation is performed; In response to the indication information being a signal indicating replication, a new physical page is allocated, and the contents of the physical page corresponding to the target page cache page are copied to the new physical page; the first kernel data structure is updated to point to the new physical page and the first source tag is cleared; the write operation is performed on the new physical page.

6. The write protection method as described in claim 4, characterized in that, The process of handling the write operation of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode includes: In response to the indication information being a rejection error code and the method of rejecting the write operation being to terminate the process of the write operation, the policy layer directly terminates the process of the write operation through the kernel task management interface; In response to the indication message being a rejection error code and the write operation being rejected in the manner of system shutdown, the policy layer directly triggers the kernel panic mechanism, forcing the operating system into a safe state.

7. The write protection method as described in claim 4, characterized in that, The strategy layer records the number of unauthorized write operation events, and the strategy layer exposes the recorded number of unauthorized write operation events to the user space through a diagnostic interface.

8. The write protection method as described in claim 1, characterized in that, Also includes: When the first kernel data structure is split or cloned to obtain a third kernel data structure, the third kernel data structure inherits the first source tag included in the first kernel data structure.

9. A write protection system for page cache pages, characterized in that, include: The detection unit is configured to, in response to detecting that a downstream kernel component performs a write operation on the physical page corresponding to the target page cache page through a first kernel data structure corresponding to the target page cache page, detect whether the first kernel data structure includes a first source flag, wherein the first source flag is used to indicate that the target page cache page is a read-only page cache page; The determining unit is configured to determine the processing mode of the target page cache page in response to the first kernel data structure including the first source tag, wherein the processing mode indicates whether a write operation is allowed or denied to the target page cache page; The processing unit is configured to process the write operations of the downstream kernel component on the physical page corresponding to the target page cache page according to the processing mode.

10. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the write protection method for page cache pages as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by at least one processor, the at least one processor is caused to perform the write protection method for page cache pages as described in any one of claims 1 to 8.

12. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the write protection method for page cache pages as described in any one of claims 1 to 8.

Images