File access management method and apparatus, and device, storage medium and program product

Abstract

Disclosed in the present disclosure are a file access management method and apparatus, and a device, a storage medium and a program product. The method comprises: during a process in which a pre-configured management program is run to acquire a file access request, if a file access request is acquired, determining whether a process corresponding to the file access request is running in a target container, wherein the target container comprises a container that has no permission to access a file system of a host machine; when the process is running in the target container, determining whether a target file accessed by the file access request is stored in the file system of the host machine where the target container is located; and if the target file is stored in the file system of the host machine, by means of the management program, sending termination information to the process corresponding to the file access request, so as to terminate the process. The present disclosure realizes the effective management of file access behaviors, thereby avoiding risks such as data loss and data corruption caused by malicious access by processes to a file system of a host machine.

Description

File access management method, device, equipment, storage medium and program product

[0001] The present disclosure claims priority to Chinese Patent Application No. 202411111628.9, filed on August 13, 2024, with the Chinese Patent Office, entitled "File access management method, device, equipment, storage medium and program product", the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of computers, and specifically relates to a file access management method, device, equipment, storage medium and program product. BACKGROUND

[0003] With the wide application of containerization technology, more and more application programs are deployed in containers to improve resource utilization and flexibility of application deployment. When the processes in the containers execute the functions of the application programs, they may access the file system of the host computer. However, once a malicious process accesses the file system of the host computer, it may cause data leakage, data corruption and other problems of the host computer. SUMMARY

[0004] The present disclosure proposes a file access management method, device, equipment, storage medium and program product to solve the problems of data leakage, data corruption and other problems caused by malicious access to the file system of the host computer in the related art.

[0005] A first aspect of the present disclosure proposes a file access management method, which comprises:

[0006] In the process of running the preconfigured management program to obtain the file access request, if the file access request is obtained, it is determined whether the process corresponding to the file access request is running in a target container, the target container including a container that has no right to access the file system of the host computer;

[0007] In the case where the process is running in the target container, it is determined whether the target file accessed by the file access request is stored in the file system of the host computer where the target container is located;

[0008] If the target file is stored in the file system of the host computer, the management program sends termination information to the process, and the termination information is used to terminate the process.

[0009] A second aspect of the present disclosure proposes a file access management device, which comprises:

[0010] The first determining module is configured to, in the process of calling the pre-configured management program to obtain the file access request, determine whether the process corresponding to the file access request is running in the target container if the file access request is obtained, the target container including a container without access right to the file system of the host computer;

[0011] The second determining module is configured to, in the case that the process is running in the target container, determine whether the target file accessed by the file access request is stored in the file system of the host computer where the target container is located.

[0012] The sending module is configured to, if the target file is stored in the file system of the host computer, send the termination information to the process through the management program, the termination information being used to terminate the process.

[0013] The third aspect of the present disclosure provides a file access management system, which comprises a management program configured in a host computer, at least one target container and at least one process, the target container including a container without access right to the file system of the host computer.

[0014] The process is configured to send a file access request to the file system of the host computer, and terminate running in the case of receiving the termination information sent by the management program.

[0015] The management program is configured to, when being run by the host computer, obtain a file access request, and determine whether the process corresponding to the file access request is running in the target container; in the case that the process corresponding to the file access request is running in the target container, determine whether the target file accessed by the file access request is stored in the file system of the host computer; and if the target file is stored in the file system of the host computer, send the termination information to the process corresponding to the file access request.

[0016] The fourth aspect of the present disclosure provides an electronic device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the method according to the first aspect.

[0017] The fifth aspect of the present disclosure provides a computer readable storage medium, which stores a computer program, the program being executable on a processor to implement the method according to the first aspect.

[0018] The sixth aspect of the present disclosure provides a computer program product, which comprises a computer program, the computer program being executable on a processor to implement the method according to the first aspect.

[0019] The file access management method according to the first aspect has at least the following advantages:

[0020] In the embodiments of the present disclosure, in the process of running the pre-configured management program to obtain a file access request, if the file access request is obtained and the process corresponding to the file access request runs in a target container, it is determined whether a target file accessed by the file access request is stored in a file system of a host computer where the target container is located; if the target file is stored in the file system of the host computer, termination information is sent to the process by the management program to terminate the process; wherein the target container includes a container that has no right to access the file system of the host computer. Thus, by pre-configuring the management program, the file access behavior of the process in the target container can be managed by the management program. When it is determined that the process in the target container accesses the file of the host computer, i.e., the process accesses the file beyond the authority, the process is terminated by sending termination information to the process, so as to block the file access behavior of the process to the host computer, thereby reducing the risk of data leakage, data damage and the like caused by malicious access to the file system of the host computer, and providing protection for the data security of the host computer.

[0021] The above description is only a summary of the technical solutions of the present disclosure. In order to more clearly understand the technical means of the present disclosure, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the specific embodiments of the present disclosure are described below. BRIEF DESCRIPTION OF DRAWINGS

[0022] The drawings described herein are used to provide further understanding of the present disclosure, and form a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure, and do not constitute an improper limitation on the present disclosure. In the drawings:

[0023] Fig. 1 is a schematic diagram of an application scenario of a file access management method provided by an embodiment of the present disclosure;

[0024] Fig. 2 is a first flowchart of a file access management method provided by an embodiment of the present disclosure;

[0025] Fig. 3 is a second flowchart of a file access management method provided by an embodiment of the present disclosure;

[0026] Fig. 4 is a flowchart of a heap memory dynamic allocation method provided by an embodiment of the present disclosure;

[0027] Fig. 5 is a third flowchart of a file access management method provided by an embodiment of the present disclosure;

[0028] Fig. 6 is a schematic diagram of a file access management method provided by an embodiment of the present disclosure;

[0029] Fig. 7 is a fifth flowchart of a file access management method provided by an embodiment of the present disclosure;

[0030] FIG. 8 is a structural schematic diagram of a file access management apparatus according to an embodiment of the present disclosure;

[0031] FIG. 9 is a structural schematic diagram of a file access management system according to an embodiment of the present disclosure;

[0032] FIG. 10 is a structural schematic diagram of an electronic device according to an embodiment of the present disclosure;

[0033] FIG. 11 is a structural schematic diagram of a storage medium according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, the same numbers are used to indicate the same or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all the implementations in accordance with the present disclosure. Instead, they simply represent exemplary devices and methods in accordance with some aspects of the present disclosure, as detailed in the appended claims.

[0035] First, some nouns or terms appearing in the description of the embodiments of the present disclosure are explained as follows:

[0036] Image: It is a read-only template that contains all the necessary content for running an application, such as code, runtime, libraries, environment variables, and configuration files, etc.

[0037] Container: It is a lightweight, portable, self-sufficient software running environment that encapsulates an application and its dependencies; a container is a running instance of an image, and a container can contain multiple processes.

[0038] Runc: It is a command-line tool for creating and running containers, and it is one of the implementations of the OCI (Open Container Initiative) container runtime specification.

[0039] OCI: It is an open industry standard that aims to define the runtime and image formats of containers to achieve interoperability of container technology.

[0040] Mount point (mnt): It is a special location in the file system that is used to mount a directory, device, or file system to another directory.

[0041] Namespace: It is a technology means to isolate resources between containers and ensure the security of containers, including limiting the access of containers to the host and limiting the communication between containers.

[0042] EBPF (Extended Berkeley Packet Filter) is an advanced kernel technology that allows users to dynamically inject a pre-compiled, secure piece of code into the kernel without changing the kernel code. It can be attached to multiple different points in the kernel and make behavioral interventions on the currently running processes according to the settings of the EBPF program.

[0043] Host machine: refers to a physical or virtual machine that has installed a container runtime environment (such as Containerd, Kubernetes, etc.) for deploying, running, and managing container instances.

[0044] Privileged container: a container with privileged permissions, which can access the host machine's files and network resources through various system calls.

[0045] SIGKILL signal: a signal used to terminate a running process.

[0046] Docker container: also known as a Docker container, a lightweight, portable software container used to run applications and their dependencies in an isolated environment.

[0047] Load and Attach: loading and attaching, meaning loading necessary code or modules first, and then attaching them to specific parts of the system or application to perform specific tasks or monitor specific events. In Linux kernel programming, "load and attach" refers to loading code or modules and attaching them to a certain function in the kernel so that custom monitoring logic can be executed when the function is called.

[0048] The terms used in the present disclosure are merely for the purpose of describing specific embodiments and are not intended to limit the present disclosure. The singular forms "a," "an," and "the" used in the present disclosure and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0049] It should be understood that although the terms first, second, third, etc. may be employed in this disclosure to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one piece of information from another of the same type. For example, without departing from the scope of the present disclosure, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining" or the like.

[0050] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0051] Runc is a widely used container runtime in container technology, and is also the default runtime carried by various mainstream container runtime engines. Runc uses the namespace technology of the Linux system to limit the resources accessible by the container, so that the network, file system, process and other resources between containers and between containers and the host are independent of each other. However, as more and more open source images are used, some vulnerabilities will inevitably exist, which provides an opportunity for some malicious applications to access the file system of the host, not only causing problems such as data leakage and data damage of the host, but also possibly causing serious attacks on the host or even the cluster where the host is located. In related technologies, in order to solve the technical problem, a container runtime with an independent kernel such as Kata Containers (secure container) is usually used to solve the isolation problem of containers and host files. Kata Containers provides an independent virtual machine for each deployment unit (Pod), and the virtual machine has its own independent kernel, thereby providing an additional isolation layer between the container and the host. However, Kata Containers needs to run a lightweight virtual machine, and the virtual machine itself requires additional resources, so compared with traditional containers such as Runc, Kata Containers requires more resources (such as memory). And because it needs to start and manage virtual machines, the startup time of Kata Containers is usually longer than that of traditional containers, and the management of Kata Containers is more complex than that of traditional containers. Furthermore, the introduction of virtual machines not only causes a certain degree of performance loss, especially in terms of network and storage performance, but also may bring new security risks due to the increase in system components and complexity.

[0052] Based on this, the embodiment of the disclosure provides a file access management method, and FIG. 1 is a schematic diagram of an application scenario of a file access management method provided by the embodiment of the disclosure. As shown in FIG. 1, the scenario includes a host, at least one target container configured in the host, a hypervisor configured in the host, and a file system of the host. The host can be a physical machine or a virtual machine. The physical machine can be a terminal device or a server. The terminal device can be a mobile phone, a tablet computer, a desktop computer, a portable notebook computer, a wearable device, etc. The server can be a physical server or a cloud server, etc. The target container includes a container that has no access right to the file system of the host. The target container runs at least one process. The target container can be an Runc container, a Docker container, or any other type of container. The hypervisor is used to manage the file access behavior of the process in the target container. The hypervisor can be an EBPF program.

[0053] In FIG. 1, the host is taken as a desktop computer for illustrative purposes. It should be understood that FIG. 1 is only a schematic representation of the application scenario of the file access management method involved in the disclosure, and does not limit the technical solutions of the disclosure. In some other embodiments, the application scenario of the file access management method involved in the disclosure can also include more or fewer components.

[0054] Specifically, the hypervisor can be pre-configured in the host. The host maintains an identification policy of a process running environment, an identification policy of a file location, a processing policy of no access right, etc. The identification policy of the process running environment is used to determine whether the process corresponding to the file access request runs in the target container when the hypervisor obtains the file access request. The identification policy of the file location is used to determine whether the target file accessed by the file access request is stored in the file system of the host when the process corresponding to the file access request runs in the target container. The processing policy of no access right is used to send termination information to the process through the hypervisor to terminate the process when the target file is stored in the file system of the host. In this way, by pre-configuring the hypervisor, the file access behavior of the process in the target container can be managed through the hypervisor. When it is determined that the process in the target container accesses the file of the host, i.e., the process accesses the file beyond the right, the process is terminated by sending termination information to the process, which can block the file access behavior of the process to the host, thereby reducing the risk of data leakage, data damage, etc. caused by malicious access to the file system of the host, and providing protection for the data security of the host. In addition, when the target container is an Runc container, since Runc itself does not have the problems of excessive resource consumption, long startup time, and complex management of Kata Containers, the problems of excessive resource consumption, long startup time, and complex management in isolating the container and the host file by using Kata Containers are solved.

[0055] The technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the foregoing technical problems will be described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0056] FIG. 2 is a flowchart of a file access management method provided by an embodiment of the present disclosure, and the method shown in FIG. 2 can be performed by the host computer in FIG. 1. As shown in FIG. 2, the method specifically includes the following steps 101-103.

[0057] Step 101, in the process of obtaining a file access request by running a pre-configured management program, if the file access request is obtained, it is determined whether the process corresponding to the file access request is running in a target container, and the target container includes a container that has no access right to the file system of the host computer.

[0058] Step 102, in the case where the process is running in the target container, it is determined whether the target file accessed by the file access request is stored in the file system of the host computer where the target container is located.

[0059] Step 103, if the target file is stored in the file system of the host computer, termination information is sent to the process through the management program, and the termination information is used to terminate the process.

[0060] Specifically, the management program can be pre-configured in the host computer, and the management program is run in the host computer to obtain a file access request in the host computer through the management program. Considering that the file access request can come from a process in the target container, can come from a process in the host computer, and can come from a process in a privileged container, in order to prevent the process in the target container from accessing the file of the host computer beyond the access right, when the file access request is obtained through the management program, it is first determined whether the process corresponding to the file access request is running in the target container. Since the process in the target container can access the file in the target container, in order to further identify whether the file access request is an access to the target file beyond the access right, after it is determined that the process corresponding to the file access request is running in the target container, it is determined whether the target file is stored in the file system of the host computer where the target container is located. When the target file is stored in the file system of the host computer, it indicates that the process is accessing the target file beyond the access right, in order to protect the safety of the target file and the safety of the file system of the host computer, termination information is sent to the process corresponding to the file access request through the management program to terminate the process corresponding to the file access request.

[0061] In some embodiments, the management program can be attached to the first function, the process can call the first function to initiate a file access request of the target file, and the first function can call back the management program when the first function is called by the process. Accordingly, when the management program obtains the callback information, it is determined that the file access request is obtained. The file access request can include the file mounting point of the target file, the identification of the process, and the like. Wherein, the first function can be a vfs_open function, which is a function defined in the kernel. This function will execute the file opening operation according to the provided parameters and the characteristics of the file system.

[0062] In some embodiments, the above termination information can be a SIGKILL signal. Unlike other signals for terminating processes, the SIGKILL signal cannot be captured or ignored by the process, and once sent to the process, the process will be terminated immediately without condition, thereby completely blocking the corresponding file access behavior, providing great protection for the safety of the target file.

[0063] The file access method provided by the embodiments of the present disclosure, in the process of running the pre-configured management program to obtain the file access request, if the file access request is obtained, and the process corresponding to the file access request runs in the target container, it is determined whether the target file accessed by the file access request is stored in the file system of the host where the target container is located; if the target file is stored in the file system of the host, the management program sends termination information to the process to terminate the process; wherein, the target container includes a container that has no right to access the file system of the host. Thus, by pre-configuring the management program, the file access behavior of the process in the target container can be managed through the management program. When it is determined that the process in the target container accesses the file of the host, i.e., the process accesses the file beyond authority, the process is terminated by sending termination information to the process, which can block the file access behavior of the process to the host, thereby reducing the risk of data leakage, data damage and the like caused by malicious access to the file system of the host, and providing protection for the data security of the host.

[0064] Considering that in the container technology, the namespace provides resource isolation capability, and the namespace where the process is located is the namespace of the container where the process is located. Based on this, in some embodiments, whether the process corresponding to the file access request runs in the target container is determined based on the namespace where the process is located and the namespace set of the target container. Specifically, as shown in FIG. 3, step 101 can include the following step 1011 and step 1012:

[0065] Step 1011, in the process of running the pre-configured management program to obtain the file access request, if the file access request is obtained, it is determined that the namespace where the process corresponding to the file access request is located.

[0066] In some embodiments, the second function can be called to obtain the namespace in which the process is located. Specifically, in the process of running the pre-configured management program to obtain the file access request, if the file access request is obtained, the second function is called to obtain the data structure of the process corresponding to the file access request, and the namespace in which the process is located is obtained from the data structure. The data structure of the process can include process identification, the namespace in which the process is located, the identification of the namespace in which the process is located, and the like. The second function can be a bpf_get_current_task function, which is a helper function defined in the kernel to obtain a pointer to the structure of the currently executing task (process), and then the pointer can be used to access the properties of the task (process).

[0067] In step 1012, if the namespace set includes the namespace in which the process is located, it is determined that the process runs in the target container, and the namespace set includes the namespace of the target container.

[0068] Specifically, each namespace in the namespace set is matched with the namespace in which the process is located. If there is a namespace in the namespace set that matches the namespace in which the process is located, it is determined that the process runs in the target container. If there is no namespace in the namespace set that matches the namespace in which the process is located, it is determined that the process does not run in the target container.

[0069] It can be understood that when the process corresponding to the file access request runs in any target container, the namespace in which the process is located is the namespace of the target container. Therefore, by matching the namespaces in the namespace set with the namespace in which the process is located, it can be accurately determined whether the process runs in the target container.

[0070] It can be understood that when the process corresponding to the file access request runs in any target container, the namespace in which the process is located is the namespace of the target container. Therefore, by matching the namespaces in the namespace set with the namespace in which the process is located, it can be accurately determined whether the process runs in the target container.

[0071] In step A, if the update information of the target container is obtained, the namespace set is updated according to the namespace of the target container corresponding to the update information.

[0072] In some embodiments, the updating of the namespace set is determined when the container creation information is obtained and the container corresponding to the container creation information is a new target container, or when the container destruction information is obtained and the container corresponding to the container destruction information is an already-created target container. The namespace set is updated according to the namespace of the new target container or the namespace of the already-created target container. That is, the step A can include: if the container creation information is obtained and the container corresponding to the container creation information is a new target container, adding the namespace of the new target container to the namespace set; or if the container destruction information is obtained and the container corresponding to the container destruction information is an already-created target container, deleting the namespace of the already-created target container from the namespace set.

[0073] Specifically, if the container creation information is obtained, the first permission information of the container to be created is obtained from the container creation information. If the first permission information indicates that the container to be created does not have the access permission of the file system of the host machine, it is determined that the container to be created corresponding to the container creation information is a new target container. The namespace of the new target container is obtained from the container creation information, and the namespace is added to the namespace set. If the container destruction information is obtained, the second permission information corresponding to the container to be destroyed is obtained according to the container identifier of the container to be destroyed included in the container destruction information. If the second permission information indicates that the container to be destroyed does not have the access permission of the file system of the host machine, it is determined that the container to be destroyed corresponding to the container destruction information is an already-created target container. The namespace of the container to be destroyed is obtained according to the container identifier, and the namespace is queried in the namespace set. The queried namespace is deleted.

[0074] Therefore, when the container creation information is obtained, by determining whether the container to be created has the access permission of the file system of the host machine, it can effectively avoid misattributing the privileged container to the target container, and ensure the accuracy of the namespace set. When the container destruction information is obtained, by determining whether the container to be destroyed is the target container, and deleting the namespace of the target container from the namespace set when the container to be destroyed is the target container, it ensures that there is no useless namespace in the namespace set, and can also release the storage resources required for storing the corresponding namespace in time. It can be seen that during the life cycle of the container, the namespace set is updated in real time based on the container creation information and the container destruction information, which ensures the accuracy of the namespace set, and further provides a favorable guarantee for accurately managing the access behavior of the file.

[0075] In some embodiments, the identifier of the namespace in which the process is located can also be obtained in the foregoing step 1011, and accordingly, the namespace set can be an identifier set of the namespaces, which includes the identifier of the namespace of the target container. In the foregoing step 1012, if the identifier set of the namespaces includes the identifier of the namespace in which the process is located, it is determined that the process runs in the target container. In the foregoing step A, the identifier set of the namespaces is updated according to the identifier of the namespace corresponding to the update information. That is, if the container creation information is obtained and the container corresponding to the container creation information is a new target container, the identifier of the namespace of the new target container is added to the identifier set of the namespaces; if the container destruction information is obtained and the container corresponding to the container destruction information is an already-created target container, the identifier of the namespace of the already-created target container is deleted from the identifier set of the namespaces.

[0076] In some embodiments, as shown in FIG. 4, the hypervisor can also initialize a first file after running, and save each namespace in the namespace set or each identifier in the identifier set of the namespaces through the first file. That is, when the namespace in which the process is located is obtained in the foregoing step 1011, each namespace in the namespace set can be saved in the first file. When the identifier of the namespace in which the process is located is obtained in the foregoing step 1011, each identifier in the identifier set of the namespaces can be saved in the first file. In addition, when the update information of the target container is obtained, the first file is updated according to the update information. That is, when the container creation information is obtained and the container corresponding to the container creation information is a new target container, the namespace or the identifier of the namespace in the container creation information is added to the first file; when the container destruction information is obtained and the container corresponding to the container destruction information is an already-created target container, the namespace or the identifier of the namespace of the target container corresponding to the container destruction information is deleted from the first file. The first file can be in any form such as a table or a document, which is not specifically limited in the present disclosure.

[0077] In order to avoid that the process accesses the file system of the host machine beyond authorization, when it is determined that the process corresponding to the file access request runs in the target container based on the namespace set or the identifier set of the namespaces, in some embodiments, it is determined whether the target file is stored in the file system of the host machine based on the file mounting point of the target file. Specifically, as shown in FIG. 5, step 102 can include the following step 1021 and step 1022:

[0078] Step 1021, obtaining the file mounting point of the target file from the file access request.

[0079] Step 1022, determining whether the target file is stored in the file system of the host machine in which the target container is located according to the relationship between the file mounting point and the mounting point set.

[0080] wherein the mount point set is at least one of a host machine mount point set and a target container mount point set. The host machine mount point set is a set of mount points contained in the namespace of the host machine, and the target container mount point set is a set of mount points contained in the namespace set, i.e., the target container mount point set is a set of mount points contained in the namespace of the target container.

[0081] In some embodiments, the mount point set is the host machine mount point set. Accordingly, step 1022 can include: if the host machine mount point set includes the file mount point, determining that the target file is stored in the file system of the host machine where the target container is located.

[0082] Specifically, when the mount point set is the host machine mount point set, the mount points in the host machine mount point set are matched with the file mount point of the target file. If there is a mount point in the host machine mount point set that matches the file mount point, it is indicated that the host machine mount point set includes the file mount point, and it is determined that the target file is stored in the file system of the host machine where the target container is located. If there is no mount point in the host machine mount point set that matches the file mount point, it is indicated that the host machine mount point set does not include the file mount point, and it is determined that the target file is not stored in the file system of the host machine where the target container is located.

[0083] In some embodiments, the mount point set is the target container mount point set. Accordingly, step 1022 can include: if the target container mount point set contains the file mount point, determining that the target file is not stored in the file system of the host machine where the target container is located.

[0084] Specifically, when the mount point set is the target container mount point set, the mount points in the target container mount point set are matched with the file mount point of the target file. If there is a mount point in the target container mount point set that matches the file mount point, it is indicated that the target container mount point set includes the file mount point, and it is determined that the target file is stored in the file system of the target container, i.e., not in the file system of the host machine where the target container is located. If there is no mount point in the target container mount point set that matches the file mount point, it is indicated that the target container mount point set does not include the file mount point, and it is determined that the target file is not stored in the file system of the target container, i.e., the process does not have access to the target file.

[0085] In some embodiments, the mount point set can also include both the host machine mount point set and the target container mount point set, and one of them is selected according to a pre-set selection strategy to determine whether the target file is stored in the file system of the host machine. The selection strategy can be set as needed in actual application, which is not specifically limited in the present disclosure.

[0086] It can be seen that by maintaining the mount point set, it can be accurately determined whether the target file is stored in the file system of the host machine based on the mount point set, so as to determine whether the process has the permission to access the target file, thereby avoiding the problem of file loss caused by unauthorized access of the process to the target file.

[0087] It is considered that in actual application, the mount point is not fixed and unchangeable, but will change with the change of the attribute of the file, the migration of the file, etc. In order to guarantee the accuracy of the mount point set, in some embodiments, the method can further include the following step B:

[0088] Step B, if the mount point update information is obtained, the mount point set is updated according to the mount point update information.

[0089] Specifically, when the mount point set is the host mount point set, if the addition information of the mount point in the namespace of the host is obtained, the added mount point corresponding to the addition information is added to the mount point set. If the deletion information of the mount point in the namespace of the host is obtained, the mount point corresponding to the deletion information is queried from the mount point set, and the queried mount point is deleted from the mount point set. When the mount point set is the target container mount point set, if the addition information of the mount point in the namespace of the target container is obtained, the added mount point corresponding to the addition information is added to the mount point set. If the deletion information of the mount point in the namespace of the target container is obtained, the mount point corresponding to the deletion information is queried from the mount point set, and the queried mount point is deleted from the mount point set.

[0090] Further, in order to quickly determine whether the target file is stored in the file system of the host machine when the file access request is obtained, in some embodiments, when the mount point set is the host mount point set, the management program can further include: obtaining the mount point in the namespace of the host by the management program according to the preset access path, and saving the obtained mount point to the created mount point set.

[0091] It can be understood that when the mount point set is the target container mount point set, the mount point addition information corresponding to the mount point can be added to the mount point set when the mount point addition information in the namespace of the target container is obtained after the target container is successfully created.

[0092] In some embodiments, the hypervisor further initializes a second file after running, and accordingly, the hypervisor can save each mount point in the obtained mount point set in the second file. Further, when obtaining the file access request initiated by the process calling the first function, the process can be determined to have access permission based on the first file and the second file in the aforementioned manner; and when obtaining the mount point update information, the second file is updated according to the mount point update information. The second file can be in any form such as a table or a document.

[0093] It should be noted that FIG. 4 is used for illustration only and is not used for limitation, and the execution order of some operations in FIG. 4 can be interchanged, for example, steps 9 and 10 can be executed at any time after the corresponding target container is created, and step 11 can be executed at any time after step 3.

[0094] Therefore, when obtaining the mount point update information, the mount point set is updated based on the update information, which guarantees the accuracy of the mount point set, and further provides an effective data basis for accurately determining whether the target file is stored in the file system of the host.

[0095] In order to effectively manage the file access behavior of the process in the target container, as shown in FIG. 4, the management program can be loaded by a preset loader and attached to the first function. That is, step 101 can further include: running the preset loader to load the management program; and running the management program to obtain the file access request after the management program is loaded.

[0096] Specifically, as shown in FIG. 6, a.C format file containing the management program is stored in the user space of the host operating system, and the.C format file can be compiled into an.O format file by a compiling tool, and the.O format file includes the bytecode of the management program. After obtaining the.O format file, the preset loader can be run in the user space, and the.O format file is loaded into the kernel space of the host operating system and attached to the first function by the preset loader through a system call, the management program is checked and accelerated in the kernel space, and after the check is passed and the loading and attachment of the management program are completed, the management program is run to determine whether the process has access permission of the target file corresponding to the file access request based on the target set when obtaining the file access request sent by the process by calling the first function. The preset loader can be a go program, and the management program can be an EBPF program. The target set includes the aforementioned namespace set and the mount point set, and the process of determining whether the process has access permission of the target file corresponding to the file access request based on the target set can be referred to the related description in the foregoing, and the repeated parts will not be described here.

[0097] By loading the management program into the kernel space of the host computer, the management program has a higher level of authority, and can manage the file access behavior of the process, thereby avoiding unauthorized access of the process to the file system of the host computer, and ensuring the data security of the file system of the host computer.

[0098] In a specific embodiment, the identification set of the namespace of the target container is maintained, and each identification in the identification set is stored in a first table, and the mount point set is a host computer mount point set, and each mount point in the host computer mount point set is stored in a second table. As shown in FIG. 7, the file access management method can include the following steps 201 to 210:

[0099] Step 201, running a preset loader to load the management program, and attaching the management program to a first function, the first function being used to execute an open file operation.

[0100] Specifically, after running the loader, the management program is loaded and attached by the loader to perform a load and attach process, so as to load the management program into the kernel space, and attach the management program to the first function, so as to trigger the file access management logic of the management program when the first function is called. The preset loader can be a go program, and the management program can be an EBPF program.

[0101] Step 202, running the management program and initializing the first table and the second table.

[0102] Step 203, obtaining the mount point in the host computer namespace according to the preset access path through the management program, and storing the obtained mount point into the second table.

[0103] Step 204, if the container creation information is obtained through the management program, determining whether the corresponding to-be-created container is a new target container according to the container creation information, the target container including a container without access right to the file system of the host computer.

[0104] Specifically, if the container creation instruction is obtained through the management program, the container creation information is obtained from the container creation instruction, the first authority information of the to-be-created container is obtained from the container creation information, and if the first authority information represents that the to-be-created container does not have the access right to the file system of the host computer, it is determined that the to-be-created container corresponding to the container creation information is a new target container. The container creation instruction can come from any one of a user, a container creation script, a container management tool, etc., which is not specifically limited in the present disclosure. The target container can include a Runc container.

[0105] In step 205, if the container to be created is a new target container, the identifier of the namespace of the new target container is obtained from the container creation information, and the obtained identifier of the namespace is added to the first table.

[0106] In step 206, if the file access request is obtained by the hypervisor, the identifier of the namespace in which the process corresponding to the file access request is determined. The file access request is initiated by the process calling the first function.

[0107] Specifically, the process can call the first function to initiate a file access request for a target file. When the first function is called, the first function can call back the hypervisor. Correspondingly, when the hypervisor obtains the callback information, it is determined that the file access request is obtained, and the second function is called to obtain the pointer of the data structure of the process corresponding to the file access request. In addition, the identifier of the namespace in which the process is located is obtained from the data structure of the process corresponding to the file access request.

[0108] In step 207, it is determined whether the first table contains the identifier of the namespace in which the process is located.

[0109] In step 208, if yes, the file mount point of the target file is obtained from the file access request.

[0110] In step 209, it is determined whether the second table contains the file mount point.

[0111] In step 210, if yes, termination information is sent to the process corresponding to the file access request, and the termination information is used to terminate the process.

[0112] In step 211, if the container destruction information is obtained, and the container corresponding to the container destruction information is the created target container, the identifier of the namespace of the container corresponding to the container destruction information is deleted from the first table.

[0113] Specifically, if the container destruction instruction is obtained by the hypervisor, the container destruction information is obtained from the container destruction instruction, and the second permission information corresponding to the container destruction information is obtained according to the container identifier of the container to be destroyed included in the container destruction information. If the second permission information indicates that the container to be destroyed does not have the access permission of the file system of the host computer, it is determined that the container corresponding to the container destruction information is the created target container. The identifier of the namespace of the container to be destroyed is obtained according to the container identifier, and the identifier of the namespace is queried in the first table, and the queried identifier of the namespace is deleted.

[0114] It should be noted that the execution sequence of steps 201 to 211 is not limited to the above, and the execution sequence of some operations can be interchanged, for example, step 204 can be executed at any time after step 202, step 211 can be executed at any time after the corresponding target container is created, etc. The specific implementation process of steps 201 to 211 can be referred to the related description in the foregoing, and the repeated parts will not be described here.

[0115] Therefore, by pre-configuring the management program, the file access behavior of the process in the target container can be managed by the management program. When it is determined that the process in the target container accesses the file of the host, i.e., the process accesses the file by force, the process can be terminated by sending termination information to the process, so as to block the file access behavior of the process to the host, thereby reducing the risk of data leakage, data damage, etc. caused by malicious access to the file system of the host, and providing protection for the data security of the host.

[0116] Corresponding to the above-mentioned embodiments of the file access management method, the present disclosure also provides embodiments of a file access management device. FIG. 8 is a structural schematic diagram of a file access management device according to an exemplary embodiment, which can be configured in the host shown in FIG. 1. The device is used to execute the file access management method provided by any of the above-mentioned embodiments. As shown in FIG. 8, the file access management device includes:

[0117] The first determination module 301 is configured to, in the process of calling the pre-configured management program to obtain the file access request, if the file access request is obtained, determine whether the process corresponding to the file access request runs in the target container, and the target container includes a container that has no right to access the file system of the host;

[0118] The second determination module 302 is configured to, in the case that the process runs in the target container, determine whether the target file accessed by the file access request is stored in the file system of the host where the target container is located.

[0119] The sending module 303 is configured to, if the target file is stored in the file system of the host, send termination information to the process through the management program, and the termination information is used to terminate the process.

[0120] The file access management apparatus provided by the embodiments of the present disclosure can determine whether the target file accessed by the file access request is stored in the file system of the host computer where the target container is located, in the process of running the preconfigured management program to obtain the file access request, if the file access request is obtained and the process corresponding to the file access request runs in the target container; if the target file is stored in the file system of the host computer, the management program is used to send termination information to the process to terminate the process; the target container includes a container that has no right to access the file system of the host computer. Thus, by preconfiguring the management program, the file access behavior of the process in the target container can be managed by the management program. When it is determined that the process in the target container accesses the file of the host computer, that is, the process accesses the file beyond the right, the process is terminated by sending termination information to the process, so that the file access behavior of the process to the host computer is blocked, thereby reducing the risk of data leakage, data damage and the like caused by malicious access to the file system of the host computer, and providing protection for the data security of the host computer.

[0121] In some embodiments, the first determining module 301 is specifically configured to:

[0122] determine the namespace where the process is located;

[0123] if the namespace set includes the namespace where the process is located, it is determined that the process runs in the target container; the target container includes a container that has no right to access the file system of the host computer, and the namespace set includes the namespace of the target container.

[0124] In some embodiments, the second determining module 302 is specifically configured to:

[0125] obtain the file mounting point of the target file from the file access request;

[0126] determine whether the target file is stored in the file system of the host computer where the target container is located according to the relationship between the file mounting point and the mounting point set; the mounting point set is at least one of the host computer mounting point set and the target container mounting point set, the host computer mounting point set is a set of mounting points contained in the namespace of the host computer, and the target container mounting point set is a set of mounting points contained in the namespace set.

[0127] In some embodiments, the mounting point set is the host computer mounting point set; correspondingly, the second determining module 302 is specifically configured to:

[0128] if the host computer mounting point set includes the file mounting point, it is determined that the target file is stored in the file system of the host computer where the target container is located.

[0129] In some embodiments, the mounting point set is the target container mounting point set; correspondingly, the second determining module 302 is specifically configured to:

[0130] If the target container mount point set contains a file mount point, it is determined that the target file is not stored in the file system of the host where the target container is located.

[0131] In some embodiments, the apparatus further comprises an updating module.

[0132] The updating module is configured to add the namespace of the new target container to the namespace set if the container creation information is obtained and the container corresponding to the container creation information is the new target container, and delete the namespace of the created target container from the namespace set if the container destruction information is obtained and the container corresponding to the container destruction information is the created target container.

[0133] In some embodiments, the apparatus further comprises a loading module and a running module.

[0134] The loading module is configured to load the hypervisor by running a preset loading program.

[0135] The running module is configured to run the hypervisor to obtain the file access request after the loading is completed.

[0136] In some embodiments, the hypervisor comprises an EBPF program, and the target container comprises a Runc container.

[0137] The file access management apparatus provided by the embodiments of the present disclosure and the file access management method provided by the embodiments of the present disclosure are based on the same inventive concept and have the same beneficial effects as the method they employ, run or implement.

[0138] The implementation process of the functions and roles of each module in the above apparatus is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0139] For the device embodiment, since it basically corresponds to the method embodiment, the related parts can be referred to the part of the method embodiment. The device embodiments described above are only illustrative, and the modules described as separate components can or can not be physically separated, and the components illustrated as modules can or can not be physical modules, that is, they can be located in one place or distributed on multiple network units. According to actual needs, some or all of the modules can be selected to achieve the purpose of the present disclosure. Those skilled in the art can understand and implement without creative labor.

[0140] Corresponding to the above-mentioned embodiments of the file access management method, the present disclosure also provides embodiments of a file access management system. FIG. 9 is a structural schematic diagram of a file access management system according to an exemplary embodiment. As shown in FIG. 9, the system comprises a management program 401, at least one target container 402 and at least one process 403 configured in a host computer, wherein the target container 402 comprises a container without access to the file system of the host computer;

[0141] The process 403 is configured to send a file access request to the file system of the host computer, and terminate running in the case of receiving the termination information sent by the management program 401;

[0142] The management program 401 is configured to acquire the file access request when being run by the host computer, and determine whether the process 403 corresponding to the file access request runs in the target container 402. In the case that the process 403 corresponding to the file access request runs in the target container 402, it is determined whether the target file accessed by the file access request is stored in the file system of the host computer. If the target file is stored in the file system of the host computer, the termination information is sent to the process 403 corresponding to the file access request.

[0143] The file access management system provided by the embodiments of the present disclosure is based on the same inventive concept as the file access management method provided by the embodiments of the present disclosure, and has the same beneficial effects as the method it adopts, runs or implements.

[0144] The implementation process of the functions and roles of each component in the above system is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0145] It can be understood that the division of each module above is only a logical functional division, and the functions of the above modules can be integrated into a hardware entity for actual implementation. For example, the functions of the first determination module 301 and the second determination module 302 can be integrated into a processor for implementation, and the function of the sending module 303 can be integrated into a transceiver for implementation, etc.

[0146] Based on this, some embodiments of the present disclosure also provide an electronic device corresponding to the file access management method provided by the above-mentioned embodiments to execute the above-mentioned file access management method.

[0147] FIG. 10 is a hardware structure diagram of an electronic device according to an exemplary embodiment, which includes a communication interface 501, a processor 502, a memory 503, and a bus 504; wherein the communication interface 501, the processor 502, and the memory 503 complete communication with each other through the bus 504. The processor 502 can execute the file access management method described above by reading and executing machine executable instructions corresponding to the control logic of the file access management method in the memory 503, and the specific content of the method can refer to the above embodiments, which will not be described here.

[0148] The memory 503 mentioned in the embodiments of the present disclosure can be any electronic, magnetic, optical, or other physical storage device, and can contain stored information such as executable instructions, data, and the like. Specifically, the memory 503 can be a RAM (Random Access Memory), a flash memory, a storage drive (such as a hard drive), any type of storage disk (such as an optical disk, a DVD, etc.), or a similar storage medium, or a combination thereof. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 501 (which can be wired or wireless), and the Internet, a wide area network, a local network, a metropolitan area network, etc. can be used.

[0149] The bus 504 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 503 is used to store programs, and the processor 602 executes the programs after receiving an execution instruction.

[0150] The processor 502 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits or instruction forms of software in the processor 502. The processor 502 described above can be a general-purpose processor, including a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a ready-to-program gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware control, etc. It can implement or execute the disclosed methods, steps, and logic block diagrams in the embodiments of the present disclosure. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware coding processor for execution, or a combination of hardware and software modules in the coding processor for execution.

[0151] The electronic device provided by the embodiments of the present disclosure and the file access management method provided by the embodiments of the present disclosure have the same beneficial effects as the method adopted, run or implemented by the electronic device.

[0152] The embodiments of the present disclosure also provide a computer readable storage medium corresponding to the file access management method provided by the foregoing embodiments. Referring to FIG. 11, the computer readable storage medium shown in the figure is an optical disc 60, and a computer program (i.e., a program product) is stored on the optical disc 60. When the computer program is run by a processor, the file access management method provided by any of the foregoing embodiments is executed.

[0153] It should be noted that examples of the computer readable storage medium can also include, but are not limited to, a phase change memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory or other optical or magnetic storage medium, which will not be described one by one here.

[0154] The computer readable storage medium provided by the foregoing embodiments of the present disclosure and the file access management method provided by the embodiments of the present disclosure have the same beneficial effects as the method adopted, run or implemented by the application program stored in the computer readable storage medium.

[0155] The embodiments of the present disclosure also provide a computer program product corresponding to the file access management method provided by the foregoing embodiments. The computer program product includes a computer program executed by a processor to implement the file access management method provided by the foregoing embodiments.

[0156] The computer program product provided by the foregoing embodiments of the present disclosure and the file access management method provided by the embodiments of the present disclosure have the same beneficial effects as the method adopted, run or implemented by the application program stored in the computer program product.

[0157] Other embodiments of the present disclosure will be readily apparent to those skilled in the art upon considering the description hereof in conjunction with the accompanying drawings and claims. The present disclosure is intended to cover any variations, uses or adaptive changes of the present disclosure that follow the general principles of the present disclosure and include known or customary technical methods not disclosed in the present disclosure. The specification and examples are only considered as exemplary, and the true scope and spirit of the present disclosure are indicated by the claims.

[0158] It is also to be noted that the terms "comprising", "including", and any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0159] The above description is merely illustrative of the application, and not restrictive. Since modifications, changes, revisions, and improvements can readily occur to those skilled in the art, it is intended: that the application encompass all such modifications, changes, revisions, and improvements as fall within the spirit and scope of the disclosure.

Claims

1. A file access management method, wherein, The method comprises: In the process of running the pre-configured management program to obtain a file access request, if the file access request is obtained, it is determined whether a process corresponding to the file access request runs in a target container, the target container comprising a container without access right to a file system of a host computer; In the case that the process runs in the target container, it is determined whether a target file accessed by the file access request is stored in the file system of the host computer; If the target file is stored in the file system of the host computer, termination information is sent to the process by the management program, the termination information being used to terminate the process.

2. The method of claim 1, wherein, The determination of whether the process corresponding to the file access request runs in the target container comprises: Determination of a namespace in which the process is located; If a namespace set comprises the namespace, it is determined that the process runs in the target container, the namespace set comprising namespaces of the target container.

3. The method of claim 2, wherein, The determination of whether the target file accessed by the file access request is stored in the file system of the host computer comprises: Obtaining a file mounting point of the target file from the file access request; According to a relationship between the file mounting point and a mounting point set, it is determined whether the target file is stored in the file system of the host computer, the mounting point set being at least one of a host computer mounting point set and a target container mounting point set, the host computer mounting point set being a set of mounting points contained in a namespace of the host computer, and the target container mounting point set being a set of mounting points contained in the namespace set.

4. The method of claim 3, wherein, The mounting point set is the host computer mounting point set. The determination of whether the target file is stored in the file system of the host computer according to the relationship between the file mounting point and the mounting point set comprises: If the host computer mounting point set comprises the file mounting point, it is determined that the target file is stored in the file system of the host computer.

5. The method of claim 3, wherein, The mounting point set is the target container mounting point set. The determination of whether the target file is stored in the file system of the host computer according to the relationship between the file mounting point and the mounting point set comprises: If the target container mounting point set contains the file mounting point, it is determined that the target file is not stored in the file system of the host computer.

6. The method of any one of claims 2-5, wherein, The method further comprises: If container creation information is obtained and a container corresponding to the container creation information is a new target container, a namespace of the new target container is added to the namespace set; If container destruction information is obtained and a container corresponding to the container destruction information is an already-created target container, a namespace of the already-created target container is deleted from the namespace set.

7. The method of any one of claims 1-6, wherein, Before the process of calling the pre-configured management program to obtain a file access request, the method further comprises: Running a pre-set loading program to load the management program; After loading is completed, the management program is run to obtain a file access request.

8. The method of any one of claims 1-7, wherein, The management program comprises an EBPF program, and the target container comprises an Runc container.

9. A file access management apparatus, wherein, The device comprises: The first determining module is configured to, in a process of calling a pre-configured management program to obtain a file access request, if the file access request is obtained, determine whether a process corresponding to the file access request runs in a target container, the target container including a container without access to a file system of a host computer; The second determining module is configured to, if the process runs in the target container, determine whether a target file accessed by the file access request is stored in the file system of the host computer; The sending module is configured to, if the target file is stored in the file system of the host computer, send termination information to the process through the management program, the termination information being used to terminate the process.

10. A file access management system wherein, The application comprises: A management program, at least one target container and at least one process configured in a host computer, the target container including a container without access to a file system of the host computer; The process is configured to send a file access request to the file system of the host computer, and terminate running in a case of receiving termination information sent by the management program; The management program is configured to, when being run by the host computer, obtain the file access request, and determine whether a process corresponding to the file access request runs in the target container; In a case that the process corresponding to the file access request runs in the target container, determine whether a target file accessed by the file access request is stored in the file system of the host computer; and if the target file is stored in the file system of the host computer, send the termination information to the process corresponding to the file access request.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, The processor executes the program to implement the method in any one of claims 1-8.

12. A computer readable storage medium having stored thereon a computer program, wherein, The program is executed by the processor to implement the method in any one of claims 1-8.

13. A computer program product comprising a computer program, wherein, The computer program is executed by the processor to implement the method in any one of claims 1-8.

Images