CN112541182B - Kernel VFS layer system repairing method, device, equipment and storage medium - Google Patents

Abstract

The invention relates to the technical field of computers, and discloses a kernel VFS layer system repairing method, a kernel VFS layer system repairing device, kernel VFS layer system repairing equipment and a storage medium, wherein the kernel VFS layer system repairing device comprises the following steps: when a patch package is received, extracting a file list and diff files from the patch package, and carrying out diff on the files with the holes and the files without the holes by a server to obtain the patch package; loading the file list into a memory, determining a modified file according to the file list, and identifying the modified file; when an access request is received, determining a file to be accessed according to the access request; when the file to be accessed has the identifier, determining a target difference file corresponding to the file to be accessed according to the file list and the diff file; and generating a target file according to the target difference file and the file to be accessed, so that the target file can be generated according to the target difference file and the file to be accessed without depending on a bottom file system, and vulnerability repair can be completed without occupying excessive memory space.

Description

Kernel VFS layer system repair method, device, equipment and storage medium

technical field

The invention relates to the field of computer technology, in particular to a kernel VFS layer system repair method, device, equipment and storage medium.

Background technique

At present, when performing vulnerability repair on the Linux VFS layer, the main target of the repair is files. However, the existing vulnerability repair methods are relatively complicated, rely on the underlying file system, and need to occupy more memory space when performing vulnerability repair.

The above content is only used to assist in understanding the technical solution of the present invention, and does not mean that the above content is admitted as prior art.

Contents of the invention

The main purpose of the present invention is to propose a kernel VFS layer system repair method, device, equipment and storage medium, aiming at solving the technical problem in the prior art that the bug repair depends on the underlying file system and needs to occupy more memory space.

In order to achieve the above object, the invention provides a kind of kernel VFS layer system repair method, described kernel VFS layer system repair method comprises the following steps:

When the patch package is received, the file list and the diff file are extracted from the patch package, and the patch package is obtained by diffing the file with the vulnerability and the file without the vulnerability;

Loading the file list into memory, determining a modified file according to the file list, and identifying the modified file;

When receiving an access request, determine the file to be accessed according to the access request;

When the file to be accessed has an identifier, determine a target difference file corresponding to the file to be accessed according to the file list and the diff file;

A target file is generated according to the target difference file and the to-be-accessed file.

Optionally, the loading the file list into the memory, determining the modified file according to the file list, and identifying the modified file includes:

Loading the file list into the memory, and determining the modification file information according to the file list;

extracting the modified file name from the modified file information, and determining the modified file according to the modified name;

Add identification information according to the modified file to identify the modified file.

Optionally, the adding identification information according to the modified file to identify the modified file includes:

Obtain the index node corresponding to the modified file;

Add identification information to the index node to identify the modified file.

Optionally, when the access request is received, determining the file to be accessed according to the access request includes:

When an access request is detected through the hook layer, receive the access request;

extracting the information of the file to be accessed from the access request, and extracting the name of the file to be accessed from the information of the file to be accessed;

The file to be accessed is determined according to the name of the file to be accessed.

Optionally, after determining the file to be accessed according to the name of the file to be accessed, the method further includes:

Hooking is performed through the hook layer and the name of the file to be accessed to obtain the file to be accessed.

Optionally, before determining the target difference file corresponding to the file to be accessed according to the file list and the diff file when the file to be accessed has an identifier, the method further includes:

An identifier detection is performed on the file to be accessed to determine whether there is an identifier in the file to be accessed.

Optionally, the performing identification detection on the file to be accessed to determine whether there is an identification in the file to be accessed includes:

Acquiring the index node to be detected corresponding to the file to be accessed;

Detecting whether identification information exists in the index node to be detected, and obtaining a detection result;

Judging whether there is an identifier in the file to be accessed according to the detection result.

Optionally, after determining whether there is an identifier in the file to be accessed according to the detection result, the method further includes:

When the detection result is that identification information exists in the index node to be detected, it is determined that an identification exists in the file to be accessed;

When the detection result is that there is no identification information in the index node to be detected, it is determined that there is no identification information in the file to be accessed.

Optionally, after performing identification detection on the file to be accessed to determine whether there is an identification in the file to be accessed, the method further includes:

When the file to be accessed does not have an identifier, the file to be accessed is used as the target file.

Optionally, when the file to be accessed has an identifier, determining the target difference file corresponding to the file to be accessed according to the file list and the diff file includes:

When the file to be accessed has an identifier, match the target modification file information corresponding to the file to be accessed in the file list;

Determine a target difference file corresponding to the file to be accessed according to the target modification file information and the diff file.

Optionally, after determining the target difference file corresponding to the file to be accessed according to the target modification file information and the diff file, the method further includes:

extracting the target file path from the target modification file information;

The target difference file is obtained from the diff file according to the target file path.

Optionally, the generating the target file according to the target difference file and the file to be accessed includes:

extracting target difference data from the target difference file;

Data restoration is performed on the file to be accessed according to the target difference data to generate a target file.

In addition, in order to achieve the above object, the present invention also proposes a kernel VFS layer system repairing device, said kernel VFS layer system repairing device comprising:

The patch package module is used to extract the file list and the diff file from the patch package when receiving the patch package, and the patch package is obtained by diffing the files with vulnerabilities and the files without vulnerabilities by the server;

A file identification module, configured to load the file list into the memory, determine the modified file according to the file list, and identify the modified file;

A file access module, configured to determine the file to be accessed according to the access request when receiving the access request;

A difference file module, configured to determine a target difference file corresponding to the file to be accessed according to the file list and the diff file when the file to be accessed has an identifier;

A target file module, configured to generate a target file according to the target difference file and the file to be accessed.

Optionally, the file identification module is further configured to load the file list into memory, and determine the modified file information according to the file list; extract the modified file name from the modified file information, and The modification name determines the modification file; adding identification information according to the modification file to identify the modification file.

Optionally, the file identification module is further configured to obtain an index node corresponding to the modified file; and add identification information to the index node to identify the modified file.

Optionally, the file access module is further configured to receive the access request when the access request is detected through the hook layer; extract the file information to be accessed from the access request, and extract the file information from the file information to be accessed Extracting the name of the file to be accessed; determining the file to be accessed according to the name of the file to be accessed.

Optionally, the file access module is further configured to perform a hook through the hook layer and the name of the file to be accessed, so as to obtain the file to be accessed.

Optionally, the difference file module is further configured to perform identification detection on the file to be accessed, so as to determine whether there is an identification in the file to be accessed.

In addition, in order to achieve the above object, the present invention also proposes a kernel VFS layer system repair device, the kernel VFS layer system repair device includes: a memory, a processor, and a device stored on the memory and capable of running on the processor. A kernel VFS layer system repair program, when the kernel VFS layer system repair program is executed by a processor, the steps of the above-mentioned kernel VFS layer system repair method are realized.

In addition, in order to achieve the above object, the present invention also proposes a storage medium, on which a kernel VFS layer system repair program is stored, and when the kernel VFS layer system repair program is executed by a processor, the above-mentioned kernel VFS Steps of layer system repair method.

The method for repairing the kernel VFS layer system proposed by the present invention extracts a file list and a diff file from the patch package when the patch package is received, and the patch package is obtained by diffing the file with the loophole and the file without the loophole by the server; Loading the file list into memory, determining the modified file according to the file list, and identifying the modified file; when receiving an access request, determining the file to be accessed according to the access request; When the file has an identifier, determine the target difference file corresponding to the file to be accessed according to the file list and the diff file; generate a target file according to the target difference file and the file to be accessed, so as not to rely on the underlying file system The target file can be generated according to the target difference file and the file to be accessed, and the vulnerability repair can be completed without occupying too much memory space.

Description of drawings

Fig. 1 is the schematic diagram of the structure of the kernel VFS layer system repairing equipment of the hardware operation environment involved in the scheme of the embodiment of the present invention;

Fig. 2 is the schematic flow chart of the first embodiment of the kernel VFS layer system repair method of the present invention;

Fig. 3 is a schematic diagram of a leaky file and a non-leaky file diff of an embodiment of the kernel VFS layer system repair method of the present invention;

Fig. 4 is the schematic flow chart of the second embodiment of the kernel VFS layer system repair method of the present invention;

Fig. 5 is the file identification schematic diagram of an embodiment of the kernel VFS layer system repair method of the present invention;

Fig. 6 is a schematic flow chart of the third embodiment of the kernel VFS layer system repair method of the present invention;

Fig. 7 is a schematic diagram of the identification detection of the existence identification of an embodiment of the kernel VFS layer system repair method of the present invention;

Fig. 8 is a schematic diagram of the identification detection of the non-existent identification of an embodiment of the kernel VFS layer system repair method of the present invention;

9 is a schematic flow chart of the fourth embodiment of the method for repairing the kernel VFS layer system of the present invention;

FIG. 10 is a schematic diagram of the functional modules of the first embodiment of the device for repairing the kernel VFS layer system of the present invention.

The realization of the purpose of the present invention, functional characteristics and advantages will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Referring to FIG. 1 , FIG. 1 is a schematic structural diagram of a system repair device at the kernel VFS layer of the hardware operating environment involved in the solution of the embodiment of the present invention.

As shown in FIG. 1 , the kernel VFS layer system repair device may include: a processor 1001 , such as a central processing unit (Central Processing Unit, CPU), a communication bus 1002 , a user interface 1003 , a network interface 1004 , and a memory 1005 . Wherein, the communication bus 1002 is used to realize connection and communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a button, and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable memory (non-volatile memory), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the device structure shown in Figure 1 does not constitute a limitation on the kernel VFS layer system repair device, and may include more or less components than those shown in the figure, or combine certain components, or have different Part placement.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a kernel VFS layer system repair program.

In the kernel VFS layer system repair device shown in Figure 1, the network interface 1004 is mainly used to connect to the external network and perform data communication with other network devices; the user interface 1003 is mainly used to connect to user equipment and perform data communication with the user equipment The device of the present invention calls the kernel VFS layer system repair program stored in the memory 1005 through the processor 1001, and executes the kernel VFS layer system repair method provided by the embodiment of the present invention.

Based on the above hardware structure, an embodiment of the method for repairing the kernel VFS layer system of the present invention is proposed.

Referring to FIG. 2 , FIG. 2 is a schematic flowchart of a first embodiment of a method for repairing a kernel VFS layer system according to the present invention.

In the first embodiment, the method for repairing the kernel VFS layer system includes the following steps:

Step S10, when receiving the patch package, extract the file list and the diff file from the patch package, and the patch package is obtained by diffing the vulnerable file and the non-vulnerable file by the server.

It should be noted that the execution subject of this embodiment can be a kernel VFS layer system repair device, such as a terminal device, or other devices that can achieve the same or similar functions, which is not limited in this embodiment. In this embodiment , using a terminal device as an example for illustration.

It should be noted that the technical solution of this embodiment can be applied to Linux systems, and the function of VFS (virtual FileSystem) is to use standard Linux system calls to read and write different file systems located on different physical media, that is, to provide various file systems A unified user interface and application programming interface. VFS is a glue layer that allows system calls such as open(), read(), and write() to work regardless of the underlying storage medium and file system type.

It should be understood that, when the server detects a file with a vulnerability, it may acquire the file without the vulnerability corresponding to the file with the vulnerability, and perform a diff between the file with the vulnerability and the file without the vulnerability to obtain a patch package. Among them, the diff command is to compare the difference between two files in the simplest case. If "-" is used instead of the file parameter, the content to be compared comes from the standard input. The diff command compares the similarities and differences of text files line by line. If you specify a directory to compare, the diff command will compare the text files with the same name in the two directories, but will not compare the subdirectories.

In the specific implementation, as shown in Figure 3, Figure 3 is a schematic diagram of a diff between a file with vulnerabilities and a file without vulnerabilities, set1 is a file with vulnerabilities, including: 1, 2, 3, 4, 5, and set2 is a file without vulnerabilities, including: 1, 2, 3', 4, 5', after diffing set1 and set2, it can be found that there are differences between 3, 5 in set1 and 3', 5' in set2, so 3', 5' can be used as diff file, and then generate a patch package according to 3' and 5'.

It should be understood that the patch package in this embodiment is composed of a diff file and a file list. The difference file is the content of diff, and the file list is a list describing the diff file. For example, the file list can record diff File information such as the file name, file size, and file path of the file may also record other file information, which is not limited in this embodiment.

Therefore, after the server diffs the vulnerable file and the non-vulnerable file to obtain the diff file, it can obtain the diff file information corresponding to the diff file, and generate a file list according to the diff file information, and according to the diff file and the file list Generate a patch package. As shown in FIG. 3, the patch package in FIG. 3 consists of two parts: diff files: 3', 5' and a file list list.

It should be understood that after the server generates the patch package, it sends the patch package to the terminal device. After receiving the patch package, the terminal device can decompress the patch package to obtain a diff file and a file list.

Step S20, loading the file list into memory, determining the modified file according to the file list, and marking the modified file.

It can be understood that, after obtaining the file list, the terminal device may load the file list into the memory, determine the modified file according to the file list, and identify the modified file.

In a specific implementation, according to the file list, it can be determined that the modified files are files 3 and 5, and at this time, the files 3 and 5 can be identified.

Step S30, when an access request is received, determine the file to be accessed according to the access request.

It should be understood that when the VFS layer performs system calls such as open(), read(), and write(), the VFS layer will be accessed. Therefore, when an access request is received, the file to be accessed can be determined according to the access request.

Further, in order to more accurately detect the access request and determine the file to be accessed, the step S30 includes:

When the access request is detected by the hook layer, the access request is received; the file information to be accessed is extracted from the access request, and the file name to be accessed is extracted from the file information to be accessed; according to the file name to be accessed Determine the file to be accessed.

It can be understood that when an access request of an access process is detected through the hook layer, the access request can be received, and the file to be accessed can be determined according to the access request. The file information to be accessed can be extracted from the access request, and then the name of the file to be accessed can be extracted from the file information to be accessed. Since each file has its corresponding file name, for example, the name corresponding to file 3 is "file 3", file 4 The corresponding name is "file 4", etc. Therefore, after the name of the file to be accessed is determined, the file to be accessed can be determined according to the name of the file to be accessed.

Further, after determining the file to be accessed, in order to obtain the file to be accessed more accurately, after determining the file to be accessed according to the name of the file to be accessed, it also includes:

Hooking is performed through the hook layer and the name of the file to be accessed to obtain the file to be accessed.

It can be understood that after the name of the file to be accessed is determined, in order to accurately obtain the file to be accessed corresponding to the name of the file to be accessed, a hook operation can be performed through the hook layer and the name of the file to be accessed to obtain the file to be accessed.

Step S40, when the file to be accessed has an identifier, determine the target difference file corresponding to the file to be accessed according to the file list and the diff file.

It should be understood that, since the file to be modified has been marked in the above steps, whether it needs to be modified can be determined by detecting whether the file to be accessed has a mark. If there is an identifier in the file to be accessed, it means that it needs to be modified, and if there is no identifier in the file to be accessed, it means that it does not need to be modified.

It can be understood that when the file to be accessed needs to be modified, the target difference file corresponding to the file to be accessed can be determined according to the file list and the diff file, and then the file to be detected can be repaired according to the target difference file.

Step S50, generating a target file according to the target difference file and the file to be accessed.

It should be understood that after the target difference file and the file to be accessed are determined, the file to be accessed may be processed based on the target difference file to generate a target file, thereby achieving the effect of repairing the vulnerability of the file to be accessed.

It can be understood that this step can specifically be: the target difference data can be extracted from the target difference file, and then the data of the file to be accessed can be restored according to the target difference data to generate a target file, and the target file can be fed back to the accessing process.

It can be understood that this embodiment aims at the feature that everything in the Linux system is a file, through the above solution, it has the ability to repair any real file, and since the patch package is in a compressed format, the transmission load of file delivery can be reduced. Moreover, this solution does not rely on the underlying file system, supports byte random access, and supports out-of-the-box composition. It does not need to occupy too much memory space. When the file needs to be used, the vulnerability is repaired to avoid the waste of resources.

In this embodiment, when the patch package is received, the file list and the diff file are extracted from the patch package, and the patch package is obtained by diffing the files with vulnerabilities and the files without vulnerabilities by the server; the file list is loaded into In the memory, determine the modified file according to the file list, and identify the modified file; when receiving the access request, determine the file to be accessed according to the access request; The file list and the diff file determine the target difference file corresponding to the file to be accessed; the target file is generated according to the target difference file and the file to be accessed, so that the target difference file and the target difference file can be obtained without relying on the underlying file system The target file is generated by accessing the file, and the vulnerability repair can be completed without occupying too much memory space.

In one embodiment, as shown in FIG. 4 , based on the first embodiment, a second embodiment of the method for repairing the kernel VFS layer system of the present invention is proposed, and the step S20 includes:

Step S201, loading the file list into memory, and determining the modified file information according to the file list.

It should be understood that the terminal device can load the file list into the memory of the kernel, so that the operation will not increase too much memory usage, and the file list can be called from the memory in time when the file list needs to be used. Improve the efficiency of bug fixes.

It can be understood that, since the file information corresponding to the diff file is recorded in the file list, the modified file information of the files to be modified can be determined according to the file list.

Step S202, extracting the modified file name from the modified file information, and determining the modified file according to the modified name.

It can be understood that since the file information corresponding to the diff file recorded in the file list includes information such as file name, file size, and file path, after obtaining the modified file information, the modified file name can be extracted from the modified file information, and then Determine the modified file based on the modified file name.

In a specific implementation, for example, when the modified file names extracted from the modified file information are "file 3" and "file 5", it may be determined that the modified files are file 3 and file 5.

Step S203, adding identification information according to the modified file to identify the modified file.

It should be understood that, after the modified file is determined, identification information may be added according to the modified file, so as to achieve the effect of identifying the modified file. For example, when the files are modified as file 3 and file 5, identification information may be added to file 3 and file 5 to identify file 3 and file 5.

Further, since this solution is applied to the Linux system, in order to achieve a better identification effect, the step S203 includes:

Obtaining the index node corresponding to the modified file; adding identification information to the index node to identify the modified file.

It should be understood that each file has a corresponding index node inode, inode is a data structure in the Linux system, its essence is a structure, it contains some important information related to each file in the file system, in Linux When a file system is created in the system, a large number of inodes will be created at the same time. Usually, about one percent of the disk space of the file system is allocated to the inode table. Using inodes in the Linux system can save a lot of time and improve work efficiency.

Therefore, after the modified file is determined, the index node corresponding to the modified file can be obtained, and identification information can be added to the index node corresponding to the modified file, so as to achieve the effect of identifying the modified file.

In the specific implementation, as shown in Figure 5, Figure 5 is a schematic diagram of file identification, modify the files to file 3 and file 5, respectively obtain the index node inode3 corresponding to file 3 and the index node inode5 corresponding to file 5, and then inode3 and file 5 Add identification information to inode5 to identify file 3 and file 4.

In this embodiment, the file list is loaded into the memory, and the modified file information is determined according to the file list; the modified file name is extracted from the modified file information, and the modified file is determined according to the modified name; Add identification information to the modified file to identify the modified file, thereby determine the modified file name according to the file list, and then determine the modified file, identify the modified file by adding identification information, and pass the identification detection in the subsequent steps The way to judge whether the file needs to be repaired improves the efficiency and accuracy of the detection.

In one embodiment, as shown in FIG. 6, a third embodiment of the method for repairing the kernel VFS layer system of the present invention is proposed based on the first embodiment or the second embodiment. In this embodiment, the description is based on the first embodiment, Before the step S40, it also includes:

Step S01, performing identification detection on the file to be accessed to determine whether there is an identification in the file to be accessed.

It should be understood that after the file to be accessed is determined, the file to be accessed can be detected for identification to determine whether there is an identification in the file to be accessed. When there is an identification in the file to be accessed, it indicates that the file to be accessed needs to be repaired. When there is no flag, it means that the file to be accessed does not need to be repaired. In the two cases, different codes are executed and different operations are performed.

Further, in order to more accurately detect whether there is an identifier in the file to be accessed and improve the accuracy of detection, the S01 includes:

Acquiring the index node to be detected corresponding to the file to be accessed; detecting whether there is identification information in the index node to be detected, and obtaining a detection result; judging whether there is an identification in the file to be accessed according to the detection result.

It can be understood that the identification detection method may be to obtain the index node to be detected corresponding to the file to be accessed, and determine whether the file to be accessed has an identification by detecting whether identification information exists in the index node.

In the specific implementation, as shown in FIG. 7, FIG. 7 is a schematic diagram of the identification detection of the presence of the identification. Assuming that the file to be accessed is file 5, the corresponding index node inode5 to be detected of the file 5 can be obtained, and whether there is identification information in the inode5 is detected. To determine whether there is an identifier in the file 5, if there is identifier information in the inode5, it means that the identifier exists in the file 5, and then the target file is generated according to the target difference file corresponding to the file 5 and the file 5.

Further, since the index node records the file information of its corresponding file, therefore, the index node to be detected records various file information of the node to be visited, and the identification of the node to be visited can be determined through these file information, the said After judging whether there is an identifier in the file to be accessed according to the detection result, it also includes:

When the detection result is that there is identification information in the index node to be detected, it is determined that there is an identification in the file to be accessed; when the detection result is that there is no identification information in the index node to be detected, it is determined that the Identifier does not exist in the file to be accessed.

It should be understood that, when the detection result is that there is identification information in the index node to be detected, it means that there is an identification in the file to be accessed, and when the detection result is that there is no identification information in the index node to be detected, it means that there is There is no mark, and by detecting the mark information of the index node to be detected, it can be quickly determined whether the mark is present in the file to be recognized, and the detection efficiency is improved.

Further, since there is still a situation where the file to be accessed does not have an identifier, in this case it is still necessary to respond to the access request, and the identifier detection is performed on the file to be accessed to determine whether there is an identifier in the file to be accessed After identification, also include:

When the file to be accessed does not have an identifier, the file to be accessed is used as the target file.

It should be understood that when there is no identifier for the file to be accessed, it means that the file to be accessed does not need to be modified, and the file to be accessed can be directly fed back to the access process as the target file.

In the specific implementation, as shown in Figure 8, Figure 8 is a schematic diagram of identification detection without identification, assuming that the file to be accessed is file 1, then the index node inode1 to be detected corresponding to file 1 can be obtained, and whether identification information exists in inode1 can be detected , to determine whether there is an identifier in the file 1, and if there is no identifier information in the inode5, it means that the identifier exists in the file 1, and then the file 1 is taken as the target file.

In this embodiment, the identifier detection is performed on the file to be accessed to determine whether there is an identifier in the file to be accessed, and then different operation strategies are adopted according to the judgment result, thereby improving the flexibility of file access.

In one embodiment, as shown in FIG. 9, the fourth embodiment of the method for repairing the kernel VFS layer system of the present invention is proposed based on the first embodiment or the second embodiment. In this embodiment, the description is based on the first embodiment. The step S40 includes:

Step S401, when the file to be accessed has an identifier, match the target modification file information corresponding to the file to be accessed in the file list.

It should be understood that when the file to be accessed has an identifier, it means that the file to be accessed needs to be repaired, and the target modified file information corresponding to the file to be accessed can be matched in the file list.

Step S402: Determine the target difference file corresponding to the file to be accessed according to the target modification file information and the diff file.

It can be understood that the target modification file name can be extracted from the target modification file information, and then the target difference file corresponding to the file to be accessed is determined according to the target modification file name and the diff file.

In a specific implementation, for example, when the file to be accessed is file 5, the target modification file information corresponding to file 5 can be matched in the file list, and then the name of the target modification file can be determined to be file 5', and then according to the target file name and diff The file can determine the target difference file corresponding to the file to be accessed.

Further, since the file path is recorded in the file list, the file path can be obtained from the file list to obtain the difference file, and the target corresponding to the file to be accessed is determined according to the target modification file information and the diff file After the diff file, also include:

Extracting the target file path from the target modification file information; obtaining the target difference file from the diff file according to the target file path.

It should be understood that since the diff file may include multiple difference files, it is more complicated to find. In order to improve the efficiency of obtaining the difference files, after determining the target difference file according to the name of the target modification file, it can also be extracted from the information of the target modification file. The target file path, and then obtain the target difference file from the diff file according to the target file path.

In this embodiment, when the file to be accessed has an identifier, match the target modification file information corresponding to the file to be accessed in the file list, and determine the target modification file information according to the target modification file information and the diff file. The target difference file corresponding to the file to be accessed, extracting the target file path from the target modification file information; obtaining the target difference file from the diff file according to the target file path, so that the target difference file can be determined according to the file list , and obtain the target difference file from the diff file according to the file path information recorded in the file list, so that the target difference file can be accurately determined and obtained, and the efficiency of obtaining the target difference file is improved.

In addition, the embodiment of the present invention also proposes a storage medium, on which a kernel VFS layer system repair program is stored, and when the kernel VFS layer system repair program is executed by a processor, the kernel VFS layer system as described above is realized. Steps in the repair method.

Since the storage medium adopts all the technical solutions of all the above-mentioned embodiments, it at least has all the beneficial effects brought by the technical solutions of the above-mentioned embodiments, which will not be repeated here.

In addition, referring to FIG. 10 , an embodiment of the present invention also proposes a kernel VFS layer system repairing device, the kernel VFS layer system repairing device includes:

The patch package module 10 is configured to, when receiving the patch package, extract a file list and a diff file from the patch package, and the patch package is obtained by performing a diff between the vulnerable file and the non-vulnerable file by the server.

The file identification module 20 is configured to load the file list into memory, determine the modified file according to the file list, and identify the modified file.

The file access module 30 is configured to determine the file to be accessed according to the access request when receiving the access request.

The difference file module 40 is configured to determine a target difference file corresponding to the file to be accessed according to the file list and the diff file when the file to be accessed has an identifier.

The target file module 50 is configured to generate a target file according to the target difference file and the file to be accessed.

In this embodiment, when the patch package is received, the file list and the diff file are extracted from the patch package, and the patch package is obtained by diffing the files with vulnerabilities and the files without vulnerabilities by the server; the file list is loaded into In the memory, determine the modified file according to the file list, and identify the modified file; when receiving the access request, determine the file to be accessed according to the access request; The file list and the diff file determine the target difference file corresponding to the file to be accessed; the target file is generated according to the target difference file and the file to be accessed, so that the target difference file and the target difference file can be obtained without relying on the underlying file system The target file is generated by accessing the file, and the vulnerability repair can be completed without occupying too much memory space.

In one embodiment, the difference file module 40 is further configured to obtain the index node to be detected corresponding to the file to be accessed; detect whether there is identification information in the index node to be detected, and obtain the detection result; according to the detection As a result, it is judged whether there is an identifier in the file to be accessed.

In an embodiment, the difference file module 40 is further configured to determine that an identifier exists in the file to be accessed when the detection result is that there is identification information in the index node to be detected; when the detection result is When there is no identification information in the index node to be detected, it is determined that there is no identification in the file to be accessed.

In an embodiment, the difference file module 40 is further configured to use the file to be accessed as the target file when the file to be accessed does not have an identifier.

In an embodiment, the difference file module 40 is further configured to match the target modification file information corresponding to the file to be accessed in the file list when the file to be accessed has an identifier; Modify the file information and the diff file to determine the target difference file corresponding to the file to be accessed.

In an embodiment, the difference file module 40 is further configured to extract a target file path from the target modification file information; and obtain the target difference file from the diff file according to the target file path.

In an embodiment, the target file module 50 is further configured to extract target difference data from the target difference file; perform data restoration on the file to be accessed according to the target difference data to generate a target file.

For other embodiments or specific implementation methods of the device for repairing the system at the kernel VFS layer in the present invention, reference may be made to the above-mentioned method embodiments, which will not be repeated here.

It should be noted that, in this document, the term "comprising", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising that element.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a computer-readable storage medium as described above (such as ROM/RAM, magnetic disk, optical disk), including several instructions to make a smart device (which can be a mobile phone, a computer, a kernel VFS layer system repair device, or a network kernel VFS layer system repair device, etc.) execute this The methods described in the various embodiments of the invention.

Claims (20)

1. a kind of kernel VFS layer system repairing method, it is characterized in that, described kernel VFS layer system repairing method comprises the following steps: When the patch package is received, the file list and the diff file are extracted from the patch package, and the patch package is obtained by diffing the file with the vulnerability and the file without the vulnerability; Loading the file list into memory, determining a modified file according to the file list, and identifying the modified file; When receiving an access request, determine the file to be accessed according to the access request; When the file to be accessed has an identifier, determine a target difference file corresponding to the file to be accessed according to the file list and the diff file; A target file is generated according to the target difference file and the to-be-accessed file. 2. the kernel VFS layer system repairing method as claimed in claim 1, is characterized in that, described list of files is loaded in internal memory, determines modification file according to list of files, and identifies modification file, include: Loading the file list into the memory, and determining the modification file information according to the file list; extracting the modified file name from the modified file information, and determining the modified file according to the modified file name; Add identification information according to the modified file to identify the modified file. 3. kernel VFS layer system repairing method as claimed in claim 2, is characterized in that, described according to described modified file adding identification information, to mark described modified file, comprising: Obtain the index node corresponding to the modified file; Add identification information to the index node to identify the modified file. 4. The kernel VFS layer system repair method according to any one of claims 1 to 3, wherein, when the access request is received, determining the file to be accessed according to the access request includes: When an access request is detected through the hook layer, receive the access request; extracting the information of the file to be accessed from the access request, and extracting the name of the file to be accessed from the information of the file to be accessed; The file to be accessed is determined according to the name of the file to be accessed. 5. kernel VFS layer system repairing method as claimed in claim 4, is characterized in that, after described according to described to-be-visited file title, after determining to-be-accessed file, also comprising: Hooking is performed through the hook layer and the name of the file to be accessed to obtain the file to be accessed. 6. the kernel VFS layer system repairing method as described in any one in claim 1～3, it is characterized in that, when described to-be-accessed file exists mark, determine the place according to described file list and described diff file Before describing the target difference file corresponding to the file to be accessed, it also includes: An identifier detection is performed on the file to be accessed to determine whether there is an identifier in the file to be accessed. 7. the kernel VFS layer system repairing method as claimed in claim 6, is characterized in that, described file to be accessed is carried out identification detection, to judge whether there is identification in described file to be accessed, comprising: Acquiring the index node to be detected corresponding to the file to be accessed; Detecting whether identification information exists in the index node to be detected, and obtaining a detection result; Judging whether there is an identifier in the file to be accessed according to the detection result. 8. the kernel VFS layer system repair method as claimed in claim 7, is characterized in that, after described according to described detection result judges whether there is mark in described to-be-accessed file, also comprises: When the detection result is that identification information exists in the index node to be detected, it is determined that an identification exists in the file to be accessed; When the detection result is that there is no identification information in the index node to be detected, it is determined that there is no identification information in the file to be accessed. 9. The kernel VFS layer system repairing method as claimed in claim 6, is characterized in that, described file to be accessed is carried out identification detection, after judging whether there is identification in described file to be accessed, also comprises: When the file to be accessed does not have an identifier, the file to be accessed is used as the target file. 10. the kernel VFS layer system repairing method as described in any one in claim 1～3, it is characterized in that, when described to-be-visited file exists sign, determine the place according to described file list and described diff file Describe the target difference file corresponding to the file to be accessed, including: When the file to be accessed has an identifier, match the target modification file information corresponding to the file to be accessed in the file list; Determine a target difference file corresponding to the file to be accessed according to the target modification file information and the diff file. 11. the kernel VFS layer system repairing method as claimed in claim 10, is characterized in that, after described according to described target modification file information and described diff file determination described to-be-visited target difference file corresponding, also comprise: extracting the target file path from the target modification file information; The target difference file is obtained from the diff file according to the target file path. 12. The method for repairing the kernel VFS layer system according to any one of claims 1 to 3, wherein said generating target file according to said target difference file and said file to be accessed comprises: extracting target difference data from the target difference file; Data restoration is performed on the file to be accessed according to the target difference data to generate a target file. 13. A kind of kernel VFS layer system repairing device, it is characterized in that, described kernel VFS layer system repairing device comprises: The patch package module is used to extract the file list and the diff file from the patch package when receiving the patch package, and the patch package is obtained by diffing the files with vulnerabilities and the files without vulnerabilities by the server; A file identification module, configured to load the file list into the memory, determine the modified file according to the file list, and identify the modified file; A file access module, configured to determine the file to be accessed according to the access request when receiving the access request; A difference file module, configured to determine a target difference file corresponding to the file to be accessed according to the file list and the diff file when the file to be accessed has an identifier; A target file module, configured to generate a target file according to the target difference file and the file to be accessed. 14. The kernel VFS layer system repairing device as claimed in claim 13, wherein the file identification module specifically includes: loading the file list into memory, and determining the modification file information according to the file list; Extracting the modified file name from the modified file information, and determining the modified file according to the modified file name; adding identification information according to the modified file to identify the modified file. 15. The kernel VFS layer system repairing device as claimed in claim 14, wherein the file identification module specifically includes: obtaining the index node corresponding to the modified file; adding identification information in the index node to Identify the modified file. 16. The kernel VFS layer system repairing device according to any one of claims 13 to 15, wherein the file access module specifically includes: when an access request is detected by the hook layer, receiving the access request ; Extracting the information of the file to be accessed from the access request, and extracting the name of the file to be accessed from the information of the file to be accessed; determining the file to be accessed according to the name of the file to be accessed. 17. The device for repairing the kernel VFS layer system according to claim 16, wherein the file access module is further configured to hook through the hook layer and the name of the file to be accessed to obtain the file to be accessed. 18. The device for repairing the kernel VFS layer system according to any one of claims 13 to 15, wherein the difference file module is also used to carry out identification detection to the file to be accessed, so as to judge the file to be accessed. Accesses whether the id exists in the file. 19. A kind of kernel VFS layer system repair equipment, it is characterized in that, described kernel VFS layer system repair equipment comprises: memory, processor and are stored on described memory and can run on the kernel VFS layer system of described processor A repair program, the kernel VFS layer system repair program is configured with the steps of realizing the kernel VFS layer system repair method according to any one of claims 1 to 12. 20. A storage medium, characterized in that a kernel VFS layer system repair program is stored on the storage medium, and when the kernel VFS layer system repair program is executed by a processor, it is realized as described in any one of claims 1 to 12 The steps of the above-mentioned kernel VFS layer system repair method.

Images