WO2021227971A1 - 沙箱实现方法、装置、设备和存储介质 - Google Patents

沙箱实现方法、装置、设备和存储介质 Download PDF

Info

Publication number
WO2021227971A1
WO2021227971A1 PCT/CN2021/092302 CN2021092302W WO2021227971A1 WO 2021227971 A1 WO2021227971 A1 WO 2021227971A1 CN 2021092302 W CN2021092302 W CN 2021092302W WO 2021227971 A1 WO2021227971 A1 WO 2021227971A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
sandbox
operating system
target
user mode
Prior art date
Application number
PCT/CN2021/092302
Other languages
English (en)
French (fr)
Inventor
王小哲
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2021227971A1 publication Critical patent/WO2021227971A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine

Definitions

  • This application relates to the field of computer technology, in particular to a sandbox realization method, device, equipment and storage medium.
  • the first way is to use Trusted Execution Environment (TEE, Trusted Execution Environment) technology to use a secure area on the main processor of an electronic device as a trusted execution environment. , Run the application in the trusted execution environment, so that the security of the code and data loaded into the trusted execution environment is guaranteed.
  • the second method is to use a user-mode library operating system (LibOS, library Operating System) to isolate applications. LibOS can place the system call function of the operating system in the user mode and implement it in the form of a library. After the operating system is configured, applications can be loaded through LibOS to form a private storage area operating environment. In the operating environment of a private storage area, multiple applications can be run simultaneously in the running LibOS.
  • TEE Trusted Execution Environment
  • the application code itself needs to be modified, which destroys the integrity of the application.
  • the second method there are multiple types of LibOS, and the operation of LibOS usually requires complex configuration, and the configuration method of each LibOS is not universal, resulting in a set of main operating systems that cannot be compatible with running many different types of LibOS.
  • the embodiment of the present application provides a sandbox implementation method to improve the performance of target detection on an image.
  • the embodiments of the present application also provide a sandbox implementation device, an electronic device, and a storage medium to ensure the implementation and application of the above method.
  • an embodiment of the present application discloses a sandbox implementation method, and the method includes:
  • the target dynamic library file is compiled and obtained according to the target user mode operating system, and the target dynamic file includes a general interface for calling the target user mode operating system;
  • the sandbox process configures the target user profile in the sandbox container corresponding to the sandbox process by calling the general interface operating system.
  • the embodiment of the present application discloses a sandbox implementation method, and the method includes:
  • the configuration information is received in the configuration interface;
  • the configuration information includes the target storage path of the target dynamic library file; wherein the target dynamic library file is compiled according to the target user mode operating system, and the target dynamic file includes calling the The general interface of the target user mode operating system;
  • the configuration information is sent to the server, so that when the server obtains the target dynamic library file according to the target storage path, the sandbox process calls the general interface to perform the
  • the target user mode operating system is configured in the sandbox container corresponding to the sandbox process.
  • the embodiment of the application also discloses a sandbox realization device, which includes:
  • the path obtaining module is used to obtain the target storage path of the target dynamic library file by the sandbox process; wherein the target dynamic library file is compiled and obtained according to the target user mode operating system, and the target dynamic file includes calling the target user mode operation
  • the general interface of the system
  • the configuration module is configured to configure in the sandbox container corresponding to the sandbox process by the sandbox process by calling the universal interface when the target dynamic library file is obtained according to the target storage path The target user mode operating system.
  • the embodiment of the application also discloses a sandbox realization device, which includes:
  • Display module used to display the configuration interface
  • the interface configuration receiving module is used to receive configuration information in the configuration interface;
  • the configuration information includes the target storage path of the target dynamic library file; wherein, the target dynamic library file is compiled and obtained according to the target user state operating system, the The target dynamic file includes a general interface for calling the target user mode operating system;
  • the sending module is configured to send the configuration information to the server, so that when the server obtains the target dynamic library file according to the target storage path, the sandbox process calls the universal An interface for configuring the target user mode operating system in the sandbox container corresponding to the sandbox process.
  • the embodiment of the present application also discloses an electronic device, including: a processor; and a memory on which executable code is stored.
  • the processor is made to execute as in the embodiment of the present application.
  • the embodiment of the present application also discloses one or more machine-readable storage media on which executable code is stored.
  • the processor executes one or more The method described.
  • the embodiments of the present application include the following advantages:
  • the general interface can convert a set of general calling methods to It is the native calling method corresponding to the user mode operating system, so that the user can send the target storage path of the target dynamic library file corresponding to the target user mode operating system to the sandbox process according to actual needs, and the sandbox process obtains it according to the target storage path
  • the sandbox process converts the general call method of user operations into the native call method of the target user mode operating system through the general interface therein, so as to realize the purpose of calling the target user mode operating system by the sandbox process.
  • Figure 1 is a system architecture diagram of a sandbox implementation method according to an embodiment of the present application
  • Figure 2 is a flow chart of the steps of a sandbox implementation method of the present application.
  • Figure 3 is a flow chart of specific steps of a sandbox implementation method of the present application.
  • Fig. 4 is a schematic diagram of interaction of a sandbox implementation method of the present application.
  • FIG. 5 is an interactive schematic diagram of another sandbox implementation method of the present application.
  • Fig. 6 is an interactive schematic diagram of another sandbox implementation method of the present application.
  • FIG. 7 is an interactive schematic diagram of another sandbox implementation method of the present application.
  • FIG. 8 is a flow chart of the steps of another sandbox implementation method of the present application.
  • FIG. 9 is an interactive schematic diagram of another sandbox implementation method of the present application.
  • FIG. 10 is a structural block diagram of an embodiment of a sandbox implementation device of the present application.
  • FIG. 11 is a structural block diagram of another embodiment of a sandbox implementation device of the present application.
  • FIG. 12 is a schematic structural diagram of a device provided by an embodiment of the present application.
  • the electronic device may at least include an operating system and a hardware layer.
  • the operating system is divided into a user layer and a kernel layer.
  • the user layer is constructed based on the user mode
  • the kernel layer is constructed based on the kernel mode
  • the user layer is the activity space of the upper process.
  • the execution of the upper process must rely on the kernel layer. resource.
  • the kernel layer controls the hardware resources of the computer and provides an environment for the upper process to run.
  • the processes running in the kernel layer can access the computer resources in the kernel layer through system calls.
  • the hardware layer can include hardware resources such as processors and memory.
  • the above process refers to a computer program for completing one or more specific tasks. It can run at the user level, can interact with the user, can have a visual user interface, or run in the background.
  • the sandbox (Sandboxie) is a virtual system program running at the user level, which is an execution environment that restricts application behavior in accordance with security policies.
  • the sandbox process only allows authorized users to create sandboxes in the sandbox process.
  • Other applications are running in the container, and the data in the sandbox container can be deleted after the application is run to ensure the specificity and security of the application data.
  • the sandbox process creates an independent operating environment similar to a sandbox, and applications running inside it will not have a permanent impact on the external environment.
  • a container is a modern way of packaging, sharing, and deploying applications. Its essence is a set of processes that are restricted by resources and isolated from each other.
  • the container is at the operating system level.
  • the container simulates an operating system, and the container shares the kernel and physical hardware resources of the host operating system.
  • the resources of each sandbox container such as the file system, process, and network stack, will be placed in a virtual isolation environment, and other containers cannot When accessing this isolated environment, changes produced by the outside world will not affect the sandbox container, that is, the sandbox container can be understood as an isolated environment in which the data security of the running application is not affected by the outside world.
  • the sandbox process and the sandbox container can be compatible with the Open Container Initiative (OCI, Open Container Initiative) standard to realize the standardized application of container technology.
  • OCI Open Container Initiative
  • the resource configuration information of the sandbox container in the configuration file generated according to actual needs can be used to allocate hardware resources of a corresponding size for the sandbox container.
  • the hardware resources include memory resources, processor resources, and so on.
  • the user-mode operating system is a virtualized lightweight operating system that can allow applications to run in it. It is different from the virtual machine technology based on kernel mode.
  • the user-mode operating system runs in the user layer. This makes it controllable by the user.
  • the embodiment of the present application in order to ensure the data security of the user application, there is a requirement to place the application in a sandbox container created by the sandbox process. Therefore, based on this requirement, the embodiment of the present application can be used in The sandbox container corresponding to the sandbox process runs the user-mode operating system, and runs the application program in the user-mode operating system. In addition, since the user-mode operating system can allow applications to run without modification, compared to directly putting the application program to run in the container, the embodiment of the present application runs the application program in the user-mode operating system in the sandbox container. It is possible to avoid modifying the application program itself, ensuring the integrity of the application program.
  • the user-mode operating system can be a user-mode operating system (LibOS).
  • LibOS user-mode operating system
  • the implementation of LibOS is based on the concept of unikernel.
  • the operating system is designed as a modular library, which is a kind of library that allows users to meet their needs. Configure a customized operating system.
  • a high-level programming language can provide the resource management functions originally belonging to the operating system kernel to the application in the form of libraries, so that the application can directly access the underlying hardware , So that the application can run efficiently.
  • LibOS based on the different native operating system environments of electronic devices, many different types of LibOS have been produced. Different types of LibOS have different instruction forms and formats, such as: Occlum LibOS and Graphene developed based on the Linux system based on different needs. SGXLibOS, Occlum LibOS and Graphene-SGXLibOS have different command forms and formats, that is, there are differences in system interface function names, parameter types, etc. between the two. This makes it necessary to perform complex configuration of LibOS when implementing LibOS in a native operating system environment, but the configuration methods of different types of LibOS are not universal, which leads to a higher configuration cost for a native operating system environment to use different LibOS. Can not easily achieve the compatibility of multiple LibOS.
  • the target LibOS in order to achieve compatibility of multiple types of LibOS in the native operating system environment, can be compiled into a target dynamic library file, and implemented in the target dynamic library file for calling the target user state
  • the general interface of the operating system the user can send to the sandbox process the target storage path of the target dynamic library file corresponding to the target LibOS that can meet the needs according to actual needs, and the sandbox process obtains the target dynamic library file according to the target storage path
  • the target LibOS is called by the sandbox process through the general interface, and the target LibOS is configured in the sandbox container corresponding to the sandbox process.
  • a dynamic library file is a non-executable binary program file, which allows the program to share the code and other resources necessary to perform special tasks.
  • dynamic library files can include .dll (Dynamic Link Library) format files ;
  • .so format files can be imported into the dynamic library file to be implemented in the form of a shared function library to provide the functions in other applications.
  • the sandbox process can call the general interface function in the target dynamic library file.
  • the sandbox process or other processes can also implement the Calling functions that implement other functions.
  • each LibOS can be compiled into a dynamic library file, and a function of a general interface corresponding to one or more native operating interfaces in LibOS can be created.
  • Each general interface includes a conversion rule, and the conversion rule can Convert the recognizable instructions of the sandbox process to the recognizable instructions of the native operation interface. In this way, no matter what type of LibOS the user is currently requesting, the user can send a unified and general operation instruction to the sandbox process.
  • LibOS1 uses type A instructions
  • LibOS2 uses type B instructions
  • LibOS1 is compiled to obtain dynamic library file 1
  • LibOS2 is compiled to obtain dynamic library file 2.
  • Common interface functions can be implemented in file 1, including the rules for converting common instructions C to type A instructions; in dynamic library file 2, common interface functions can be implemented, including rules for converting common instructions C to type B instructions .
  • the user can send a general command C to the sandbox process.
  • the sandbox process converts the general command C into an A-type command by calling the general interface function in the dynamic library file 1, so that LibOS1 can pass the recognizable Type A instructions complete the corresponding operations, the same is true for LibOS2.
  • the user can realize the control of LibOS1 and LibOS2 through a set of common instructions C, and realize the compatibility of the two LibOS in a native operating system.
  • the process of establishing a sandbox container in the sandbox process can include the sandbox process can determine the size of the hardware resources required by the sandbox container according to actual needs. And through the sandbox driver corresponding to the sandbox process in the kernel layer, hardware resources are allocated to the running LibOS sandbox container at the hardware layer. After the hardware resource allocation is completed, LibOS can use the corresponding library of LibOS during the process of loading applications. The system driver directly accesses the hardware resources corresponding to the sandbox container to realize the operation of the application.
  • each user-mode operating system can be compiled into a dynamic library file, and a general interface for calling the user-mode operating system can be implemented in the dynamic library file.
  • the general interface can convert a set of general calling methods into a user
  • the native invoking method corresponding to the operating system allows the user to send the target storage path of the target dynamic library file corresponding to the target user-mode operating system to the sandbox process according to actual needs.
  • the sandbox process obtains the target dynamics according to the target storage path.
  • the sandbox process converts the general call method of user operations into the native call method of the target user mode operating system through the general interface therein, so as to realize the purpose of calling the target user mode operating system by the sandbox process.
  • the target user-mode operating system is configured in the sandbox container corresponding to the sandbox process, so that the operation control of different types of user-mode operating systems in the native operating system can be realized through a set of general calling methods, thus achieving a native operating system. Compatibility of multiple types of user-mode operating systems in the operating system.
  • an embodiment of the present application provides a flow chart of the steps of a sandbox implementation method, including:
  • Step 101 The sandbox process obtains the target storage path of the target dynamic library file.
  • the target dynamic library file is compiled and obtained according to the target user mode operating system, and the target dynamic file includes a general interface for calling the target user mode operating system.
  • the target storage path may be the storage path of the target dynamic library file in the memory.
  • the user can configure the target storage path according to actual needs, and make the sandbox process receive the target storage path.
  • the user-mode operating system can be a user-mode operating system (LibOS).
  • LibOS user-mode operating system
  • the implementation of LibOS is based on the concept of unikernel.
  • the operating system is designed as a modular library, which is a way for users to configure guest
  • a certain high-level programming language can provide the resource management functions originally belonging to the operating system kernel to applications in the form of libraries according to corresponding requirements, so that the applications can directly access the underlying hardware in order to The application can run efficiently.
  • the target LibOS can be compiled into a target dynamic library file and implemented in the target dynamic library file for calling the general interface of the target user mode operating system.
  • the interface includes conversion rules that can convert recognizable instructions of the sandbox process into recognizable instructions of the native operation interface.
  • the target dynamic library file can provide a general interface to the sandbox process, and add a method declaration to convert the general method into a native method in the general interface.
  • the general interface is similar to a specification and a protocol, and is an abstract Concept, from a program point of view, simple understanding, a universal interface is a function declaration that converts a universal method into a native method.
  • Step 102 When the target dynamic library file is obtained according to the target storage path, the sandbox process configures the sandbox container corresponding to the sandbox process by calling the general interface. Target user mode operating system.
  • the container is at the operating system level, and an operating system can be simulated for each container during runtime, and the container will share the kernel and physical hardware resources of the host operating system.
  • the resources of each sandbox container will be placed in a virtual isolation environment, and other containers cannot access this isolation environment.
  • the change will not affect the sandbox container, that is, the sandbox container can be understood as an isolated environment in which the data security of the running application is not affected by the outside world.
  • the user-mode operating system can be LibOS.
  • This application can compile each LibOS into a dynamic library file, and create a function of a general interface corresponding to one or more native operating interfaces in LibOS, and each general interface includes conversion Rules, the conversion rules can convert the recognizable instructions of the sandbox process into the recognizable instructions of the native operation interface, so that no matter what type of LibOS the user is currently requesting, the user can send a unified and general operation instruction to the sandbox
  • the sandbox process calls the corresponding general interface in the dynamic library file corresponding to the LibOS requested by the user, and converts the general operation instruction into an instruction recognizable by the native operation interface corresponding to the common interface, so that the native operation interface is connected to the native operation interface.
  • the instructions that can be recognized by the operation interface and the corresponding operations are executed, so that a set of universal instructions can be used to realize the control of different types of LibOS in the native operating system, and realize the compatibility of multiple LibOS in
  • LibOS can be converted into a dynamic library file through a compiler.
  • Occlum LibOS can be converted into a dynamic library file liberpal-occlum.so.
  • this application compiles each user-mode operating system into a dynamic library file, and implements a general interface for calling the user-mode operating system in the dynamic library file.
  • the general interface can convert a set of general calling methods to It is the native calling method corresponding to the user mode operating system, so that the user can send the target storage path of the target dynamic library file corresponding to the target user mode operating system to the sandbox process according to actual needs, and the sandbox process obtains it according to the target storage path
  • the sandbox process converts the general call method of user operations into the native call method of the target user mode operating system through the general interface therein, so as to realize the purpose of calling the target user mode operating system by the sandbox process.
  • FIG. 3 a flowchart of specific steps of another embodiment of the sandbox implementation method of the present application is shown.
  • Step 201 The sandbox process receives a configuration file; the configuration file includes a target storage path of the target dynamic library file.
  • the target dynamic library file is compiled and obtained according to the target user mode operating system, and the target dynamic file includes a general interface for calling the target user mode operating system.
  • FIG. 4 an interactive schematic diagram of a sandbox implementation method of the present application is shown, in which the user can perform the target storage path of the target dynamic library file through the configuration interface 11 of the client terminal 10.
  • Configuration you can also configure the hardware resource plan of the target user mode operating system in the configuration interface 12 according to actual needs.
  • click the "generate configuration file and send" button and the client 10 can send the configuration file to the electronic device 20.
  • the device in FIG. 4 is an example, and other terminal devices may also be used for configuration.
  • the user can also directly implement the configuration and generation of the configuration file in the configuration interface of the electronic device 20.
  • the electronic device 20 may deliver the target LibOS to the client 10, that is, provide the client 10 with the permission to access the target LibOS.
  • the electronic device 20 may have an operation interface, install a sandbox process, and use the configuration interface 21 and the configuration interface 22 by itself. Generate a configuration file.
  • the electronic device 20 can configure the target LibOS in the sandbox container according to the configuration file through the sandbox process, and provide the user with the target LibOS that can be operated.
  • the configuration interface is converted to the interface of the subsequent operation target LibOS.
  • Step 202 When the target dynamic library file is obtained according to the target storage path, the sandbox process configures the sandbox container corresponding to the sandbox process by calling the general interface. Target user mode operating system.
  • step 102 For details of this step, reference may be made to step 102 above, which will not be repeated here.
  • the target user mode operating system includes a native operation interface for invoking the target user mode operating system, and the general interface is used for invoking the native operation interface corresponding to the general interface.
  • step 202 may specifically include:
  • the sandbox process receives a first type instruction.
  • the sandbox process calls the universal interface, converts the first type instruction into the second type instruction according to the conversion rule, and sends the second type instruction to the The native operation interface corresponding to the general interface.
  • the universal interface references its corresponding native operation interface in function, so that the universal interface can send data to its corresponding native operation interface.
  • the LibOS has a common initialization interface and corresponding native initialization operation interface; common loading interface and corresponding native loading operation interface; common destruction interface and corresponding native destruction Operation interface.
  • the sandbox process can call the general interface in the target dynamic library file according to the difference between the first type instruction and the second type instruction.
  • the conversion rule is to convert the first type instruction into the second type instruction recognizable by the native operation interface, and send the second type instruction to the native operation interface corresponding to the general interface.
  • the target user mode operating system is configured in the sandbox container corresponding to the sandbox process according to the second type instruction through the native operation interface.
  • the operation corresponding to the second-type instruction can be further performed according to the native operation interface and the second-type instruction, and the sandbox container corresponding to the sandbox process Configure the target user mode operating system in the.
  • the universal interface includes at least one of a universal initialization interface, a universal application loading interface, a universal application closing interface, and a universal destruction interface.
  • the general initialization interface is used to allocate resources for the target user mode operating system in the sandbox container, and initialize the target user mode operating system;
  • the universal application program loading interface is used to load at least one application program to run after the initialization of the target user mode operating system is completed;
  • the general application program closing interface is used to close the running application program
  • the universal destruction interface is used to shut down the target user mode operating system and release system resources.
  • the four basic functions implemented by the target user mode operating system include: initializing the target user mode operating system, loading application programs in the target user mode operating system, and closing applications running in the target user mode operating system. Shut down the target user mode operating system and release system resources.
  • the execution operation interface 23 of the electronic device 20 includes "initialize”, “load application”, “close application”, and “ “Destroy and release resources” four functional options, and the target dynamic library file has a common initialization interface and corresponding native initialization operation interface, common application loading interface and corresponding native loading operation interface, common application closing interface and corresponding native Close operation interface, general destruction interface and corresponding native destruction operation interface.
  • the user can select the corresponding function option according to actual needs.
  • the electronic device 20 will generate the first type command common to the function option, and use the corresponding general interface in the target dynamic library file to set the first type command.
  • the type instruction is converted into the second type instruction, and the second type instruction is sent to the native operation interface corresponding to the general interface for execution.
  • the user can select the "load application” option in the execution interface 23 of FIG. 6, and further enter the selection interface 24 of FIG.
  • the selection of the program realizes the purpose of loading the selected application program into the target user mode operating system through the universal application program loading interface.
  • the user After the user completes the initialization of the target user-mode operating system, he can select the "Destroy and release resources" option in the execution interface 23 of FIG. 6, and further delete the data stored in the hardware resources corresponding to the sandbox container through the general destruction interface. And deliver the hardware resources to the host operating system to close the target user mode operating system and release system resources.
  • the parameter attr->instance_path refers to the path where the instance of LibOS is passed;
  • the parameter attr->log_level refers to: log level
  • the parameter int(*pal_init)() refers to the initialization operation.
  • a return value of 0 means: success; a return value of ENOENT means: instance_path does not exist; a return value of other means: LibOS custom error.
  • the function definition for the universal application loading interface is:
  • the parameter path refers to: the path of the binary file (application) to be run;
  • the parameter argv refers to: a binary parameter, ending with a null element
  • the parameter exit_value refers to the exit code after the binary operation ends
  • the parameter stdio refers to: the stdio handle used by the binary;
  • the parameter int(*pal_exec)() refers to: binary application loading.
  • a return value of 0 means: success; a return value of ENOENT means: path does not exist; a return value of EACCES means: path file access error; a return value of ENOEXEC means: path is not an executable file; a return value of ENOMEM means: insufficient memory.
  • the parameter sig refers to: the value of the signal sent
  • the parameter pid means: pid is -1, sent to all processes; when it is 0, it is sent to the current process; when it is greater than 0, it is sent to the specified pid process;
  • the return value of 0 means: success; the return value of EINVAL means: sig is invalid; the return value of ESRCH means: the process number is invalid; the return value of EPERM means: the signal cannot be sent; the return value of ENOSYS means: the function is not implemented; the return value is Other: LibOS custom error.
  • the description of the function definition is: stop running the binary file.
  • the return value of 0 means: success; the return value of ENOSYS means: the function is not implemented; the return value is other: LibOS custom error.
  • the configuration file further includes system resource configuration information.
  • the general interface includes a general initialization interface
  • step 202 may specifically include:
  • the sandbox process allocates system resources corresponding to the resource configuration information in the sandbox container corresponding to the sandbox process by calling the general initialization interface, and compares all resources based on the system resources.
  • the target user mode operating system is initialized.
  • the parameters selected by the electronic device 20 in the configuration interface 22 can be used as resource configuration information of the hardware resources allocated to the sandbox container corresponding to the sandbox process, where the resource configuration information includes but is not limited to memory resources, processor resources , Network card resources, etc.
  • the process of establishing a sandbox container in the sandbox process can include: the sandbox process can determine the hardware resource size required by the sandbox container according to actual needs, and pass the sandbox driver corresponding to the sandbox process in the kernel layer
  • the program allocates hardware resources for running LibOS sandbox containers at the hardware layer. After hardware resource allocation is completed, LibOS can directly access the hardware resources corresponding to the sandbox container through the library system driver corresponding to LibOS during the process of loading applications. , To achieve the operation of the application.
  • the target user mode operating system is initialized based on system resources, specifically based on system resource parameters, the variables of the target user mode operating system are assigned values, such as assigning variables to default values, so that the target user mode operating system is in the default Status, waiting for the application to load.
  • Step 203 Convert the sandbox container configured with the target user mode operating system into an image file or a software development kit.
  • Step 204 Provide the image file or software development kit to the client.
  • the mirror file is similar to the compressed package file. It makes a specific series of files into a single file according to a certain format to facilitate users to download and use. Its most important feature is that it can be recognized by specific software and can be directly Burn to disc.
  • the image file can be expanded a bit, and more information can be contained in the image file. For example, system files, boot files, partition table information, etc., so that the image file can contain all the information of a partition or even a hard disk.
  • Software development kits are generally a collection of development tools used by software engineers to build application software for specific software packages, software frameworks, hardware platforms, and operating systems.
  • the target user mode operating system may also be configured
  • the sandbox container is converted into an image file or software development kit and then delivered to the user, so that the user can conveniently use the sandbox container configured with the target user-mode operating system through the image file or the software development kit.
  • a sandbox container configured with a target user-mode operating system is converted into an image file or software development kit and delivered to the user
  • the user can open the non-sandbox process through the client when it needs to execute other non-sandbox processes.
  • the box process is executed.
  • the corresponding image file or software development kit can be directly opened, so that the sandbox container configured with the target user-mode operating system can run directly to meet the needs of the user.
  • the configuration file further includes: the type of the target user mode operating system, and the method may further include:
  • Step A1 when it is determined that the type is a preset type, step 202 is executed.
  • the configuration file may also include the "ENCLAVE_RUNTIME_TYPE" option, in which the type of LibOS can be selected, such as occlum, graphene, etc.
  • the sandbox process can be preset with preset types of LibOS that can be supported, It also judges the type of the target user-mode operating system in the configuration file. Only when the type of the target user-mode operating system is a preset type, can it be further executed when the target dynamic library is obtained according to the target storage path. In the case of files, the sandbox process configures the target user mode operating system in the sandbox container corresponding to the sandbox process by calling the general interface.
  • the sandbox process can report an error for the user to correct.
  • the method may further include:
  • Step B1 Open the target dynamic library file corresponding to the target storage path through the preset library function tool.
  • Step B2 in a case where it is detected that the target dynamic library file includes the function identifier of the universal interface, step 202 is executed.
  • the library function tool can read and process the dynamic library file in the specified format.
  • the target storage path is received, and the target storage path is opened through the preset library function tool.
  • Corresponding target dynamic library file and traverse the code in the target dynamic library file.
  • the legality of the target dynamic library file can be judged and further executed
  • the sandbox process configures the target user mode operating system in the sandbox container corresponding to the sandbox process by calling the general interface.
  • the sandbox process can report an error for the user to correct.
  • the method may further include:
  • Step C1 Start the sandbox process.
  • Step C2 The sandbox container is created by the sandbox process.
  • the process of establishing a sandbox container in the sandbox process may include: the sandbox process can determine what the sandbox container needs according to actual needs. Hardware resource size, and through the sandbox driver corresponding to the sandbox process in the kernel layer, hardware resources are allocated to the running LibOS sandbox container at the hardware layer. After hardware resource allocation is completed, LibOS can pass The library system driver corresponding to LibOS directly accesses the hardware resources corresponding to the sandbox container to realize the operation of the application.
  • the embodiment of the application compiles each user-mode operating system into a dynamic library file, and implements a general interface for calling the user-mode operating system in the dynamic library file.
  • the general interface can incorporate a set of general calling methods. , Converted to the native call method corresponding to the user-mode operating system, so that the user can send the target storage path of the target dynamic library file corresponding to the target user-mode operating system to the sandbox process according to actual needs, and the sandbox process according to the target storage path
  • the sandbox process converts the general call method of user operation into the native call method of the target user mode operating system through the general interface therein, so that the sandbox process can call the target user mode operating system.
  • the purpose is to complete the configuration of the target user mode operating system in the sandbox container corresponding to the sandbox process, so that the operation control of different types of user mode operating systems in the native operating system can be achieved through a set of general calling methods, so as to achieve To achieve the compatibility of multiple types of user-mode operating systems in a native operating system.
  • an embodiment of the present application also provides a flow chart of the steps of a sandbox implementation method, including:
  • Step 301 Display the configuration interface.
  • Step 302 Receive configuration information in the configuration interface; the configuration information includes the target storage path of the target dynamic library file; wherein, the target dynamic library file is compiled according to the target user state operating system, and the target dynamic file includes Call the general interface of the target user mode operating system.
  • the client 10 can display the configuration interface 11 and the configuration interface 12.
  • the user can configure the target storage path of the target dynamic library file through the configuration interface 11 of the client 10. It can also be configured in the configuration interface 12 according to actual needs. Configure the hardware resource scheme of the target user-mode operating system in the process. After the user inputs a selection operation in the configuration interface 11 and the configuration interface 12, configuration information is generated correspondingly.
  • the client terminal 10 may be a mobile terminal, or a terminal device such as a tablet computer and a personal computer, which is not limited in the embodiment of the present application.
  • the configuration information may include the target storage path of the target dynamic library file, so that the server 20 can obtain the target dynamic library file according to the target storage path.
  • the configuration information may also include system resource configuration information for the server 20 to perform The sandbox container corresponding to the sandbox process allocates system resources corresponding to the resource configuration information, and initializes the target user mode operating system based on the system resources.
  • Step 303 Send the configuration information to the server, so that when the server obtains the target dynamic library file according to the target storage path, the sandbox process calls the general interface,
  • the target user mode operating system is configured in the sandbox container corresponding to the sandbox process.
  • step 302 after the configuration information is generated, the user clicks the "generate configuration file and send" button, and the client 10 can send the configuration file generated according to the configuration information to the server 20, so that the service
  • the terminal 20 obtains the target dynamic library file according to the target storage path
  • the sandbox process running in the server 20 configures the target user mode operating system in the sandbox container corresponding to the sandbox process by calling the general interface.
  • the server 20 in FIG. 4 is an example.
  • the cloud server 30 is used to receive the configuration information generated by the client 10 in the configuration interface, and according to the configuration information, In the case that the target dynamic library file is obtained according to the target storage path, the sandbox process running in the cloud server 30 configures the target user mode operating system in the sandbox container corresponding to the sandbox process by calling the general interface.
  • the embodiment of this application compiles each user-mode operating system into a dynamic library file, and implements a general interface for calling the user-mode operating system in the dynamic library file.
  • the general interface can integrate a set of general calling methods. , Converted to the native call method corresponding to the user-mode operating system, so that the user can send the target storage path of the target dynamic library file corresponding to the target user-mode operating system to the sandbox process according to actual needs, and the sandbox process according to the target storage path
  • the sandbox process converts the general call method of user operation into the native call method of the target user mode operating system through the general interface therein, so that the sandbox process can call the target user mode operating system.
  • the purpose is to complete the configuration of the target user mode operating system in the sandbox container corresponding to the sandbox process, so that the operation control of different types of user mode operating systems in the native operating system can be achieved through a set of general calling methods, so as to achieve To achieve the compatibility of multiple types of user-mode operating systems in a native operating system.
  • this embodiment also provides a sandbox implementation device, which is applied to electronic devices such as terminal devices and servers.
  • FIG. 10 a structural block diagram of an embodiment of a sandbox implementation device according to an embodiment of the present application is shown, which may specifically include the following modules:
  • the path obtaining module 401 is configured to obtain the target storage path of the target dynamic library file by the sandbox process; wherein the target dynamic library file is compiled and obtained according to the target user mode operating system, and the target dynamic file includes calling the target user mode The general interface of the operating system;
  • the path acquisition module 401 includes:
  • the configuration receiving submodule is configured to receive a configuration file by the sandbox process; the configuration file includes the target storage path of the target dynamic library file.
  • the configuration module 402 is configured to, when the target dynamic library file is obtained according to the target storage path, call the universal interface by the sandbox process in the sandbox container corresponding to the sandbox process Configure the target user mode operating system.
  • the target user mode operating system includes a native operation interface for invoking the target user mode operating system, and the general interface is used for invoking the native operation interface corresponding to the general interface.
  • a conversion rule between a first type of instruction and a second type of instruction is set in the universal interface;
  • the first type of instruction is an identifiable instruction of a sandbox process, and the second type of instruction is the Recognizable instructions of the native operating interface;
  • the configuration module 402 includes:
  • a receiving sub-module configured to receive a first type instruction by the sandbox process
  • the conversion sub-module is configured to call the universal interface by the sandbox process, convert the first type instruction into the second type instruction according to the conversion rule, and send the second type instruction to the The native operation interface corresponding to the universal interface;
  • the configuration sub-module is configured to configure the target user mode operating system in the sandbox container corresponding to the sandbox process according to the second type instruction through the native operating interface.
  • the universal interface includes at least one of a universal initialization interface, a universal application loading interface, a universal application closing interface, and a universal destruction interface; wherein, the universal initialization interface is used in the sandbox container
  • the target user mode operating system allocates resources and initializes the target user mode operating system
  • the universal application loading interface is used to load at least one application program to run after the target user mode operating system is initialized
  • the general application program closing interface is used to close the running application
  • the general destruction interface is used to close the target user mode operating system and release system resources.
  • the configuration file further includes system resource configuration information.
  • the configuration module 402 includes:
  • the allocation submodule is used for the sandbox process to allocate system resources corresponding to the resource configuration information in the sandbox container corresponding to the sandbox process by calling the general initialization interface, and based on the system resources
  • the target user mode operating system is initialized.
  • the configuration file further includes: the type of the target user mode operating system; the device further includes:
  • the first verification module executes the configuration module.
  • the configuration file further includes: the type of the target user mode operating system; the device further includes:
  • the first verification module is configured to execute the configuration module when it is determined that the type is a preset type.
  • the opening module is used to open the target dynamic library file corresponding to the target storage path through a preset library function tool
  • the second verification module is configured to execute the configuration module when it is detected that the target dynamic library file includes the function identifier of the universal interface.
  • the device further includes:
  • the startup module is used to start the sandbox process
  • the creation module is used to create the sandbox container by the sandbox process.
  • the device further includes:
  • the providing module is used to provide the image file or software development kit to the client.
  • the embodiment of this application compiles each user-mode operating system into a dynamic library file, and implements a general interface for calling the user-mode operating system in the dynamic library file.
  • the general interface can convert a set of general calling methods into a dynamic library file.
  • the sandbox process converts the general call method of user operations into the native call method of the target user mode operating system through the general interface therein, so as to realize the purpose of calling the target user mode operating system by the sandbox process.
  • FIG. 11 there is shown a structural block diagram of an embodiment of a sandbox implementation device according to an embodiment of the present application, which may specifically include the following modules:
  • the display module 501 is used to display the configuration interface
  • the interface configuration receiving module 502 is configured to receive configuration information in the configuration interface; the configuration information includes the target storage path of the target dynamic library file; wherein the target dynamic library file is compiled and obtained according to the target user mode operating system, so The target dynamic file includes a general interface for calling the target user mode operating system;
  • the sending module 503 is configured to send the configuration information to the server, so that when the server obtains the target dynamic library file according to the target storage path, the sandbox process calls the A universal interface for configuring the target user mode operating system in the sandbox container corresponding to the sandbox process.
  • the embodiment of this application compiles each user-mode operating system into a dynamic library file, and implements a general interface for calling the user-mode operating system in the dynamic library file.
  • the general interface can convert a set of general calling methods into a dynamic library file.
  • the sandbox process converts the general call method of user operations into the native call method of the target user mode operating system through the general interface therein, so as to realize the purpose of calling the target user mode operating system by the sandbox process.
  • the embodiment of the present application also provides a non-volatile readable storage medium.
  • the storage medium stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute Instructions for each method step in the embodiment of this application.
  • the embodiments of the present application provide one or more machine-readable storage media on which instructions are stored.
  • the electronic device executes the operations described in one or more of the above embodiments. method.
  • the electronic equipment includes various types of equipment such as terminal equipment and servers (clusters).
  • the embodiments of the present disclosure may be implemented as a device that uses any appropriate hardware, firmware, software, or any combination thereof to perform a desired configuration.
  • the device may include electronic devices such as terminal devices, servers (clusters), and the like.
  • Fig. 12 schematically shows an exemplary apparatus 700 that can be used to implement the various embodiments described in the embodiments of the present application.
  • FIG. 12 shows an exemplary apparatus 700 having one or more processors 702, a control module (chipset) 704 coupled to at least one of the processor(s) 702 , The memory 706 coupled to the control module 704, the non-volatile memory (NVM)/storage device 708 coupled to the control module 704, one or more input/output devices 710 coupled to the control module 704, and the The network interface 712 is coupled to the control module 704.
  • a control module (chipset) 704 coupled to at least one of the processor(s) 702
  • the memory 706 coupled to the control module 704
  • the non-volatile memory (NVM)/storage device 708 coupled to the control module 704
  • one or more input/output devices 710 coupled to the control module 704, and the
  • the network interface 712 is coupled to the control module 704.
  • the processor 702 may include one or more single-core or multi-core processors, and the processor 702 may include any combination of a general-purpose processor or a special-purpose processor (such as a graphics processor, an application processor, a baseband processor, etc.).
  • the apparatus 700 can be used as the terminal device, server (cluster) and other devices described in the embodiments of the present application.
  • the apparatus 700 may include one or more computer-readable storage media (for example, the memory 706 or the NVM/storage device 708) having instructions 714, and a storage medium related to the one or more computer-readable storage media.
  • the apparatus 700 may include one or more processors 702 configured to execute instructions 714 to implement modules to perform the actions described in this disclosure.
  • control module 704 may include any suitable interface controller to provide any suitable interface controller to at least one of the processor(s) 702 and/or any suitable device or component in communication with the control module 704 Interface.
  • the control module 704 may include a memory controller module to provide an interface to the memory 706.
  • the memory controller module may be a hardware module, a software module, and/or a firmware module.
  • the memory 706 may be used to load and store data and/or instructions 714 for the device 700, for example.
  • the memory 706 may include any suitable volatile memory, for example, a suitable DRAM.
  • the memory 706 may include a double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).
  • control module 704 may include one or more input/output controllers to provide interfaces to the NVM/storage device 708 and the input/output device(s) 710.
  • NVM/storage device 708 may be used to store data and/or instructions 714.
  • the NVM/storage device 708 may include any suitable non-volatile memory (e.g., flash memory) and/or may include any suitable non-volatile storage device(s) (e.g., one or more hard drives (HDD), one or more compact disc (CD) drives and/or one or more digital versatile disc (DVD) drives).
  • suitable non-volatile memory e.g., flash memory
  • suitable non-volatile storage device(s) e.g., one or more hard drives (HDD), one or more compact disc (CD) drives and/or one or more digital versatile disc (DVD) drives.
  • HDD hard drives
  • CD compact disc
  • DVD digital versatile disc
  • the NVM/storage device 708 may include storage resources that are physically part of the device on which the apparatus 700 is installed, or it may be accessible by the device and may not necessarily be a part of the device.
  • the NVM/storage device 708 can be accessed via the input/output device(s) 710 via the network.
  • the input/output device(s) 710 may provide an interface for the apparatus 700 to communicate with any other suitable devices.
  • the input/output device 710 may include communication components, audio components, sensor components, and the like.
  • the network interface 712 can provide an interface for the device 700 to communicate through one or more networks, and the device 700 can communicate with one or more of the wireless network standards and/or protocols according to any of the one or more wireless network standards and/or protocols.
  • the components perform wireless communication, for example, access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination of them for wireless communication.
  • At least one of the processor(s) 702 may be packaged with the logic of one or more controllers (eg, memory controller modules) of the control module 704.
  • at least one of the processor(s) 702 may be packaged with the logic of one or more controllers of the control module 704 to form a system in package (SiP).
  • at least one of the processor(s) 702 may be integrated with the logic of one or more controllers of the control module 704 on the same mold.
  • at least one of the processor(s) 702 may be integrated with the logic of one or more controllers of the control module 704 on the same mold to form a system on chip (SoC).
  • SoC system on chip
  • the apparatus 700 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (for example, a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.).
  • the device 700 may have more or fewer components and/or different architectures.
  • the device 700 includes one or more cameras, keyboards, liquid crystal display (LCD) screens (including touchscreen displays), non-volatile memory ports, multiple antennas, graphics chips, application specific integrated circuits ( ASIC) and speakers.
  • LCD liquid crystal display
  • ASIC application specific integrated circuits
  • the detection device can use the main control chip as a processor or a control module, sensor data, location information, etc. are stored in a memory or NVM/storage device, the sensor group can be used as an input/output device, and the communication interface can include a network interface.
  • the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing terminal equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the instruction device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing terminal equipment, so that a series of operation steps are executed on the computer or other programmable terminal equipment to produce computer-implemented processing, so that the computer or other programmable terminal equipment
  • the instructions executed above provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

一种沙箱实现方法、装置、设备和存储介质，包括：由沙箱进程获取目标动态库文件的目标存储路径（101）；目标动态文件包括调用目标用户态操作系统的通用接口；在根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过调用通用接口，在沙箱进程对应的沙箱容器中配置目标用户态操作系统（102）。该方法中沙箱进程通过通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。

Description

沙箱实现方法、装置、设备和存储介质
本申请要求2020年05月15日递交的申请号为202010415447.0、发明名称为“沙箱实现方法、装置、设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别是涉及一种沙箱实现方法、装置、设备和存储介质。
背景技术
随着保障数据安全的需求不断被提出，如何在用户使用应用时提高应用数据的安全性成为新的研究课题。
目前，保障应用数据的安全性，可以具有两种实现方式，方式一，采用可信执行环境(TEE，Trusted Execution Environment)技术，将电子设备的主处理器上的一个安全区域作为可信执行环境，将应用运行在可信执行环境中，使得加载到该可信执行环境内部的代码和数据的安全性得到保障。方式二，采用用户态的库操作系统(LibOS，library Operating System)实现对应用的隔离，LibOS可以将操作系统的系统调用功能放在用户态并以库的方式实现，在将LibOS与电子设备主操作系统配置完成后，可以通过LibOS加载应用，构成一个私有存储区域的运行环境。在一个私有存储区域的运行环境中，运行的LibOS中可以同时运行多个应用。
但是，方式一中为了实现应用运行在可信执行环境，需要对应用程序的代码本身进行修改，破坏了应用的完整性。方式二中，LibOS具有多种类型，LibOS的运行通常需要做复杂的配置，且每种LibOS的配置方法并不通用，导致一套主操作系统无法兼容运行多种不同类型的LibOS。
发明内容
本申请实施例提供了一种沙箱实现方法，以提高对图像进行目标检测的性能。
相应的，本申请实施例还提供了一种沙箱实现装置、一种电子设备以及一种存储介质，用以保证上述方法的实现及应用。
为了解决上述问题，本申请实施例公开了一种沙箱实现方法，所述方法包括：
由沙箱进程获取目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
本申请实施例公开了一种沙箱实现方法，所述方法包括：
显示配置界面；
在所述配置界面中接收配置信息；所述配置信息包括目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
向服务端发送所述配置信息，以供所述服务端在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
本申请实施例还公开了一种沙箱实现装置，所述装置包括：
路径获取模块，用于由沙箱进程获取目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
配置模块，用于在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
本申请实施例还公开了一种沙箱实现装置，所述装置包括：
显示模块，用于显示配置界面；
界面配置接收模块，用于在所述配置界面中接收配置信息；所述配置信息包括目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
发送模块，用于向服务端发送所述配置信息，以供所述服务端在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
本申请实施例还公开了一种电子设备，包括：处理器；和存储器，其上存储有可执行代码，当所述可执行代码被执行时，使得所述处理器执行如本申请实施例中一个或多个所述的方法。
本申请实施例还公开了一个或多个机器可读的存储介质，其上存储有可执行代码，当所述可执行代码被执行时，使得处理器执行如本申请实施例中一个或多个所述的方法。
与现有技术相比，本申请实施例包括以下优点：
在本申请实施例中，通过将每个用户态操作系统编译成动态库文件，并在动态库文件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统， 使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
附图说明
图1是本申请实施例的一种沙箱实现方法的系统架构图；
图2是本申请的一种沙箱实现方法的步骤流程图；
图3是本申请的一种沙箱实现方法的具体步骤流程图；
图4是本申请的一种沙箱实现方法的交互示意图；
图5是本申请的另一种沙箱实现方法的交互示意图；
图6是本申请的另一种沙箱实现方法的交互示意图；
图7是本申请的另一种沙箱实现方法的交互示意图；
图8是本申请的另一种沙箱实现方法的步骤流程图；
图9是本申请的另一种沙箱实现方法的交互示意图；
图10是本申请的一种沙箱实现装置实施例的结构框图；
图11是本申请的另一种沙箱实现装置实施例的结构框图；
图12是本申请一实施例提供的装置的结构示意图。
具体实施方式
为使本申请的上述目的、特征和优点能够更加明显易懂，下面结合附图和具体实施方式对本申请作进一步详细的说明。
参照图1，其示出了本申请实施例提供的一种沙箱实现方法的系统架构图，电子设备至少可以包括：操作系统和硬件层。
其中，操作系统分为用户层和内核层，用户层是基于用户态构建的，内核层是基于内核态构建的，用户层为上层进程的活动空间，上层进程的执行必须依托于内核层提供的资源。内核层控制计算机的硬件资源，并提供上层进程运行的环境，运行在内核层中的进程可以通过系统调用，访问内核层中的计算机资源。硬件层中可以包括处理器、内存等硬件资源。
需要说明的是，上述进程，指为完成某项或多项特定工作的计算机程序，它可以运行在用户层，可以和用户进行交互，可以具有可视的用户界面，也可以在后台运行。
本申请实施例中，沙箱(Sandboxie)为运行在用户层的虚拟系统程序，是一种按照安全策略限制应用程序行为的执行环境，沙箱进程仅允许授权用户在沙箱进程创建的沙箱容器中运行其他应用程序，并可以在应用程序运行完毕后，将沙箱容器中的数据删除，以保证应用数据的专用性和安全性。沙箱进程创造了一个类似沙盒的独立作业环境，在其内部运行的应用程序不会对外界环境产生永久性的影响。
具体的，容器是一种对应用程序进行打包、分享和部署的现代化方式，其本质是一组受到资源限制，彼此间相互隔离的进程，容器是操作系统级的，在运行时可以为每个 容器模拟一个操作系统，容器会共享主机操作系统的内核以及物理硬件资源。当沙箱进程在自己对应的执行环境中完成沙箱容器的部署之后，每个沙箱容器的资源，例如文件系统、进程和网络栈都会被安置在一个虚拟的隔离环境之中，其它容器无法访问这一隔离环境，外界产生的变化也不会对沙箱容器产生影响，即可以将沙箱容器理解为一个隔离环境，其中运行的应用程序的数据安全性不受外界影响。需要说明的是，沙箱进程和沙箱容器可以兼容开放容器倡议(OCI，Open Container Initiative)标准，以实现容器技术的标准化应用。另外可以由根据实际需求产生的配置文件中，对沙箱容器的资源配置信息，来为沙箱容器分配对应大小的硬件资源，硬件资源包括内存资源、处理器资源等。
进一步的，用户态操作系统是一种虚拟化的轻量级操作系统，可以允许应用程序在其中运行，区别于基于内核态实现的虚拟机技术，用户态操作系统是运行在用户层中的，这使得它可以被用户所控制。
在本申请实施例中，为了保证用户应用程序的数据安全性，具有将应用程序置于一个由沙箱进程创建的沙箱容器中运行的需求，因此，基于该需求，本申请实施例可以在沙箱进程对应的沙箱容器中运行用户态操作系统，并将应用程序运行在用户态操作系统中。另外，由于用户态操作系统可以允许应用程序不作修改即可运行，相较于直接将应用程序置于容器中运行，本申请实施例将应用程序运行在处于沙箱容器的用户态操作系统中，可以避免对应用程序本身进行修改，保证了应用程序的完整性。
需要说明的是，用户态操作系统可以为用户态的操作系统(LibOS)，LibOS的实现基于单内核(unikernel)的概念，将操作系统设计成模块化的库，是一种让用户可以按需配置客制化的操作系统，能够根据对应需求，由某一高级编程语言将原本属于操作系统内核的资源管理功能，以库(libraries)的形式提供给应用程序，使得应用程序能够直接访问底层硬件，以便应用程序能够高效地运行。
但是，基于电子设备不同的原生操作系统环境，使得产生了多种不同类型的LibOS，不同类型的LibOS各自的指令形式和格式不同，如：基于不同需求，基于linux系统开发的Occlum LibOS和Graphene-SGXLibOS，Occlum LibOS和Graphene-SGXLibOS各自的指令形式和格式不同，即二者间系统接口函数名、参数类型等存在差异。这就使得在一个原生操作系统环境中实现LibOS时，需要进行LibOS的复杂配置，但是不同类型的LibOS的配置方法不通用，这就导致一个原生操作系统环境使用不同的LibOS的配置成本较高，无法便捷的实现多种LibOS的兼容。
在本申请实施例中，为了在原生操作系统环境中实现多种类型LibOS的兼容，可以将目标LibOS编译成目标动态库文件，并在目标动态库文件中实现(implements)用于调用目标用户态操作系统的通用接口，用户可以根据实际需求，向沙箱进程发送能够满足该需求的目标LibOS所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口调用目标 LibOS，在沙箱进程对应的沙箱容器中配置该目标LibOS。
具体的，动态库文件是一种不可执行的二进制程序文件，它允许程序共享执行特殊任务所必需的代码和其他资源，在Windows环境下，动态库文件可以包括.dll(Dynamic Link Library)格式文件；在linux环境下，动态库文件可以包括.so格式文件。可以向动态库文件中导入函数，使其以一个共享函数库的形式实现，用以向其他应用程序提供其中的函数。如，在本申请实施例中，沙箱进程可以调用目标动态库文件中的通用接口函数，另外，若在目标动态库文件中增加实现其他功能的函数，沙箱进程或其他进程也可以实现对该实现其他功能的函数的调用。
在本申请实施例中，可以将每个LibOS编译为动态库文件，并创建LibOS中的一个或多个原生操作接口各自对应的通用接口的函数，每个通用接口包括转换规则，该转换规则能够将沙箱进程的可识别指令转换为原生操作接口的可识别指令，这样，无论用户当前请求的是何种类型的LibOS，用户都可以发送统一通用的操作指令至沙箱进程，沙箱进程在调用用户请求的LibOS对应的动态库文件中对应的通用接口，将该通用的操作指令转换为通用接口对应的原生操作接口可识别的指令，使得根据原生操作接和该原生操作接口可识别的指令，执行对应操作，使得可以通过一套通用的指令，实现不同类型的LibOS在原生操作系统中的控制，实现了一个原生操作系统中多种LibOS的兼容。
例如，假设存在第一类型的LibOS1和第二类型的LibOS2，LibOS1使用A类型的指令，LibOS2使用B类型的指令，且LibOS1编译得到动态库文件1，LibOS2编译得到动态库文件2，在动态库文件1中可以实现通用接口函数，其中包括将通用指令C转换为A类型的指令的规则；在动态库文件2中可以实现通用接口函数，其中包括将通用指令C转换为B类型的指令的规则。用户在使用LibOS1时，可以向沙箱进程发送通用指令C，沙箱进程通过调用动态库文件1中的通用接口函数，将将通用指令C转换为A类型的指令，使得LibOS1能够通过可识别的A类型的指令，完成对应操作，对于LibOS2同理。这样，用户就可以通过一套通用指令C，实现对LibOS1和LibOS2的控制，实现了一个原生操作系统中2种LibOS的兼容。
进一步的，LibOS需要配置在沙箱容器中运行，参照图1，沙箱进程中建立的沙箱容器的过程可以包括，沙箱进程可以根据实际需求，确定沙箱容器所需的硬件资源大小，并通过内核层中沙箱进程对应的沙箱驱动程序，在硬件层为运行LibOS沙箱容器分配硬件资源，在完成硬件资源分配后，LibOS在加载应用程序的过程中，可以通过LibOS对应的库系统驱动程序，直接访问沙箱容器对应的硬件资源，实现应用程序的运行。
本申请实施例可通过将每个用户态操作系统编译成动态库文件，并在动态库文件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储 路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统，使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
参照图2，本申请实施例提供了一种沙箱实现方法的步骤流程图，包括：
步骤101，由沙箱进程获取目标动态库文件的目标存储路径。
其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口。
在本申请实施例中，目标存储路径可以为目标动态库文件在内存中的存储路径。用户可以根据实际需求，对目标存储路径进行配置，并使得沙箱进程接收到该目标存储路径。
具体的，用户态操作系统可以为用户态的操作系统(LibOS)，LibOS的实现基于单内核(unikernel)的概念，将操作系统设计成模块化的库，是一种让用户可以按需配置客制化的操作系统，能够根据对应需求，由某一高级编程语言将原本属于操作系统内核的资源管理功能，以库(libraries)的形式提供给应用程序，使得应用程序能够直接访问底层硬件，以便应用程序能够高效地运行。为了在原生操作系统环境中实现多种类型LibOS的兼容，可以将目标LibOS编译成目标动态库文件，并在目标动态库文件中实现(implements)用于调用目标用户态操作系统的通用接口，通用接口包括转换规则，该转换规则能够将沙箱进程的可识别指令转换为原生操作接口的可识别指令。
在本申请实施例中，目标动态库文件可以向沙箱进程提供通用接口，并在通用接口中添加将通用方法转换为原生方法的方法声明，通用接口类似一个规范、一个协议，是一个抽象的概念，从程序角度，简单理解，通用接口就是将通用方法转换为原生方法的函数声明。
步骤102，在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
在本申请实施例中，容器是操作系统级的，在运行时可以为每个容器模拟一个操作系统，容器会共享主机操作系统的内核以及物理硬件资源。当沙箱进程在自己对应的执行环境中完成沙箱容器的部署之后，每个沙箱容器的资源都会被安置在一个虚拟的隔离环境之中，其它容器无法访问这一隔离环境，外界产生的变化也不会对沙箱容器产生影响，即可以将沙箱容器理解为一个隔离环境，其中运行的应用程序的数据安全性不受外界影响。
具体的，用户态操作系统可以为LibOS，本申请可以将每个LibOS编译为动态库文 件，并创建LibOS中的一个或多个原生操作接口各自对应的通用接口的函数，每个通用接口包括转换规则，该转换规则能够将沙箱进程的可识别指令转换为原生操作接口的可识别指令，这样，无论用户当前请求的是何种类型的LibOS，用户都可以发送统一通用的操作指令至沙箱进程，沙箱进程在调用用户请求的LibOS对应的动态库文件中对应的通用接口，将该通用的操作指令转换为通用接口对应的原生操作接口可识别的指令，使得根据原生操作接和该原生操作接口可识别的指令，执行对应操作，使得可以通过一套通用的指令，实现不同类型的LibOS在原生操作系统中的控制，实现了一个原生操作系统中多种LibOS的兼容。
需要说明的是，可以通过编译器，将LibOS转换为动态库文件，如，在linux环境下，可以将Occlum LibOS转换为动态库文件liberpal-occlum.so。
综上所述，本申请通过将每个用户态操作系统编译成动态库文件，并在动态库文件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统，使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
参照图3，示出了本申请的另一种沙箱实现方法实施例的具体步骤流程图。
步骤201，由所述沙箱进程接收配置文件；所述配置文件包括所述目标动态库文件的目标存储路径。
其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口。
在本申请实施例中，参照图4，示出了本申请的一种沙箱实现方法的交互示意图，其中，用户可以通过客户端10的配置界面11，进行目标动态库文件的目标存储路径的配置，还可以根据实际需求，在配置界面12中进行目标用户态操作系统的硬件资源方案配置，配置完成后，点击“生成配置文件并发送”按钮，客户端10可以将配置文件发送至电子设备20。可以理解，图4中的设备为一种示例，还可以采用其他的终端设备进行配置。
需要说明的是，若电子设备20中具有可操作界面和相应的输入接口，则用户也可以直接在电子设备20的配置界面中，实现配置文件的配置和生成。
在电子设备20的沙箱进程根据配置文件完成在沙箱容器中配置目标LibOS之后，电子设备20可以将目标LibOS交付给客户端10，即提供给客户端10访问目标LibOS 的权限。
需要说明的是，参照图5，示出了本申请的另一种沙箱实现方法的交互示意图，电子设备20可以具有操作界面，安装有沙箱进程，并通过配置界面21和配置界面22自己生成配置文件，电子设备20可以通过沙箱进程，根据配置文件在沙箱容器中配置目标LibOS，并提供可以操作的目标LibOS给用户，如点击“配置完成，点击后交付”按钮后，会由配置界面转换至后续操作目标LibOS的界面。
步骤202，在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
该步骤具体可以参照上述步骤102，此处不再赘述。
可选的，所述目标用户态操作系统包括用于调用所述目标用户态操作系统的原生操作接口，所述通用接口用于调用所述与所述通用接口对应的原生操作接口。
可选的，所述通用接口中设置有第一类型指令和第二类型指令之间的转换规则；所述第一类型指令为所述沙箱进程的可识别指令，所述第二类型指令为所述原生操作接口的可识别指令，步骤202具体可以包括：
子步骤2021，由所述沙箱进程接收第一类型指令。
子步骤2022，由所述沙箱进程调用所述通用接口，将所述第一类型指令按照所述转换规则转换为所述第二类型指令，并将所述第二类型指令发送给与所述通用接口对应的原生操作接口。
在本申请实施例中，通用接口与原生操作接口之间一一对应，且通用接口在函数上引用与其对应的原生操作接口，使得通用接口可以将数据发送至其对应的原生操作接口。例如，假设一个LibOS中具有初始化、加载、销毁三个功能，则该LibOS具有通用初始化接口与对应的原生初始化操作接口；通用加载接口与对应的原生加载操作接口；通用销毁接口与对应的原生销毁操作接口。
在该步骤中，当沙箱进程接收到沙箱进程的可识别的第一类型指令之后，沙箱进程可以通过调用目标动态库文件中的通用接口，按照第一类型指令与第二类型指令的转换规则，将第一类型指令转换为原生操作接口可识别的第二类型指令，并将第二类型指令发送给与通用接口对应的原生操作接口。
子步骤2023，通过所述原生操作接口，根据所述第二类型指令，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
在该步骤中，由于原生操作接口已经得到可识别的第二类型指令，则可以进一步根据原生操作接口和第二类型指令，执行第二类型指令对应的操作，在沙箱进程对应的沙箱容器中配置目标用户态操作系统。
可选的，所述通用接口包括通用初始化接口、通用应用程序加载接口、通用应用程 序关闭接口、通用销毁接口中的至少一种。
其中，所述通用初始化接口用于在所述沙箱容器为所述目标用户态操作系统分配资源，以及对所述目标用户态操作系统进行初始化；
所述通用应用程序加载接口用于在所述目标用户态操作系统初始化完成之后，加载至少一个应用程序进行运行；
所述通用应用程序关闭接口用于关闭运行中的应用程序；
所述通用销毁接口用于关闭所述目标用户态操作系统并释放系统资源。
在本申请实施例中，目标用户态操作系统实现的四个基础功能包括：初始化目标用户态操作系统、在目标用户态操作系统中加载应用程序，关闭目标用户态操作系统中运行的应用程序，关闭目标用户态操作系统并释放系统资源。
参照图6，示出了本申请的另一种沙箱实现方法的交互示意图，在电子设备20的执行操作界面23中，包括“初始化”、“加载应用程序”、“关闭应用程序”、“销毁并释放资源”四个功能选项，且目标动态库文件中具有通用初始化接口以及对应的原生初始化操作接口、通用应用程序加载接口以及对应的原生加载操作接口、通用应用程序关闭接口以及对应的原生关闭操作接口、通用销毁接口以及对应的原生销毁操作接口。
用户可以根据实际需求，选取对应的功能选项，选取对应的功能选项后，电子设备20会生成该功能选项通用的第一类型指令，并通过目标动态库文件中对应的通用接口，将该第一类型指令转换为第二类型指令，并将第二类型指令发送至通用接口对应的原生操作接口进行执行。
例如，用户在完成目标用户态操作系统的初始化之后，可以在图6的执行操作界面23中选取“加载应用程序”选项，进一步进入图7的选择界面24，通过对选择界面24中可选应用程序的选取，通过通用应用程序加载接口实现将选取的应用程序加载至目标用户态操作系统中运行的目的。
用户在完成目标用户态操作系统的初始化之后，可以在图6的执行操作界面23中选取“关闭应用程序”选项，进一步进入另一选择界面，通过对该另一选择界面中可选应用程序的选取，通过通用应用程序关闭接口实现将选取的应用程序停止运行。
用户在完成目标用户态操作系统的初始化之后，可以在图6的执行操作界面23中选取“销毁并释放资源”选项，进一步通过通用销毁接口，删除沙箱容器对应的硬件资源中存储的数据，并将该硬件资源交付至主机操作系统，实现关闭目标用户态操作系统并释放系统资源。
在实际的Linux应用场景下，针对通用初始化接口的函数定义为：
struct pal_attr_t{
const char*   instance_dir；
const char*   log_level；
}；
intpal_init(struct pal_attr_t*attr)；
其中，参数attr->instance_path是指：传递LibOS的实例所在路径；
参数attr->log_level是指：日志级别；
参数int(*pal_init)()；是指：初始化操作。
返回值为0表示：成功；返回值为ENOENT表示：instance_path不存在；返回值为其他表示：LibOS自定义错误。
该函数定义的描述为：传入LibOS实例的路径(如/xxx/.occlum或xxxx.manifest)和日志级别，并对LibOS做初始化。
针对通用应用程序加载接口的函数定义为：
struct stdio_fds{
     int stdin,stdout,stderr；
}；
int pal_exec(char*path,char*argv[],structstdio_fds*stdio,int*exit_value)
其中，参数path是指：待运行二进制文件(应用程序)的路径；
参数argv是指：二进制的参数，以null元素结尾；
参数exit_value是指：二进制运行结束后的退出码；
参数stdio是指：二进制使用的stdio句柄；
参数int(*pal_exec)()；是指：二进制应用程序加载。
返回值为0表示：成功；返回值为ENOENT表示：path不存在；返回值为EACCES表示：path文件访问错误；返回值为ENOEXEC表示：path非可执行文件；返回值为ENOMEM表示：内存不足。
该函数定义的描述为：传入待执行二进制文件的路径，同步等待二进制运行结束并返回结果。
针对通用应用程序关闭接口的函数定义为：
intpal_kill(intpid,int sig)；
其中，参数sig是指：发送的信号值；
参数pid是指：pid为-1，发送给所有进程；为0时发送给当前进程；大于0时发送给指定pid进程；
返回值为0表示：成功；返回值为EINVAL表示：sig无效；返回值为ESRCH表示:进程号无效；返回值为EPERM表示:无法发送信号；返回值为ENOSYS表示:功能未实现；返回值为其他：LibOS自定义错误。
该函数定义的描述为：停止运行二进制文件。
针对通用销毁接口的函数定义为：
intpal_destroy()
返回值为0表示：成功；返回值为ENOSYS表示：功能未实现；返回值为其他：LibOS自定义错误。
该函数定义的描述为：销毁LibOS实例。
可选的，所述配置文件还包括系统资源配置信息，在所述通用接口包括通用初始化接口的情况下，步骤202具体可以包括：
子步骤2024，由所述沙箱进程通过调用所述通用初始化接口，在所述沙箱进程对应的沙箱容器中分配与所述资源配置信息对应的系统资源，并基于所述系统资源对所述目标用户态操作系统进行初始化。
参照图5，电子设备20在配置界面22中选择的参数，可以作为对沙箱进程对应的沙箱容器分配的硬件资源的资源配置信息，其中资源配置信息包括但不限于内存资源、处理器资源、网卡资源等。
参照图1，沙箱进程中建立的沙箱容器的过程可以包括：沙箱进程可以根据实际需求，确定沙箱容器所需的硬件资源大小，并通过内核层中沙箱进程对应的沙箱驱动程序，在硬件层为运行LibOS沙箱容器分配硬件资源，在完成硬件资源分配后，LibOS在加载应用程序的过程中，可以通过LibOS对应的库系统驱动程序，直接访问沙箱容器对应的硬件资源，实现应用程序的运行。
进一步的，基于系统资源对目标用户态操作系统进行初始化，具体为基于系统资源的参数，对目标用户态操作系统的变量进行赋值，如将变量赋为默认值，使得目标用户态操作系统处于默认状态，等待应用的加载。
步骤203，将配置有所述目标用户态操作系统的所述沙箱容器，转换为镜像文件或软件开发工具包。
步骤204，向客户端提供所述镜像文件或软件开发工具包。
具体的，镜像文件和压缩包文件类似，它将特定的一系列文件按照一定的格式制作成单一的文件，以方便用户下载和使用，它最重要的特点是可以被特定的软件识别并可直接刻录到光盘上。镜像文件可以再扩展一下，在镜像文件中可以包含更多的信息。比如说系统文件、引导文件、分区表信息等，这样镜像文件就可以包含一个分区甚至是一块硬盘的所有信息。
软件开发工具包一般是一些被软件工程师用于为特定的软件包、软件框架、硬件平台、操作系统等建立应用软件的开发工具的集合。
在本申请实施例中，在沙箱进程对应的沙箱容器中配置完成目标用户态操作系统之后，为了提高用户使用目标用户态操作系统的便利性，还可以将配置有目标用户态操作系统的沙箱容器，转换为镜像文件或软件开发工具包后交付给用户，使得用户可以通过镜像文件或软件开发工具包，便捷的使用配置有目标用户态操作系统的沙箱容器。
例如，在将一个配置有目标用户态操作系统的沙箱容器转换为镜像文件或软件开发工具包并交付给用户后，用户可以在需要执行其他非沙箱进程时，通过客户端打开该非沙箱进程进行执行，在用户需要执行应用程序隔离时，可以直接打开对应的镜像文件或软件开发工具包，使得配置有目标用户态操作系统的沙箱容器直接运行，满足用户的需求。
可选的，配置文件还包括：目标用户态操作系统的类型，所述方法还可以包括：
步骤A1、在确定所述类型为预设类型的情况下，执行步骤202。
在本申请实施例中，配置文件中还可以包括“ENCLAVE_RUNTIME_TYPE”选项，该选项中可以选择LibOS的类型，如，occlum、graphene等，沙箱进程可以预置有可以支持的LibOS的预设类型，并对配置文件中的目标用户态操作系统的类型进行判断，仅在目标用户态操作系统的类型为预设类型的情况下，才进一步执行在根据所述目标存储路径获取到所述目标动态库文件的情况下，沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
若目标用户态操作系统的类型不为预设类型，则沙箱进程可以报错，以供用户修正。
可选的，所述方法还可以包括：
步骤B1、通过预设的库函数工具，打开所述目标存储路径对应的目标动态库文件。
步骤B2、在检测到所述目标动态库文件包括所述通用接口的函数标识的情况下，执行步骤202。
在本申请实施例中，库函数工具可以实现对指定格式的动态库文件的读取和处理，在该步骤中，接收到目标存储路径，通过预设的库函数工具，打开所述目标存储路径对应的目标动态库文件，并对目标动态库文件中的代码进行遍历，在检测到目标动态库文件包括通用接口的函数标识的情况下，可以判断目标动态库文件的合法性，并进一步执行在根据所述目标存储路径获取到所述目标动态库文件的情况下，沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
若目标动态库文件不包括通用接口的函数标识，则沙箱进程可以报错，以供用户修正。
可选的，所述方法还可以包括：
步骤C1、启动所述沙箱进程。
步骤C2、由所述沙箱进程创建所述沙箱容器。
在本申请实施例中，LibOS需要配置在沙箱容器中运行，参照图1，沙箱进程中建立的沙箱容器的过程可以包括，沙箱进程可以根据实际需求，确定沙箱容器所需的硬件资源大小，并通过内核层中沙箱进程对应的沙箱驱动程序，在硬件层为运行LibOS沙箱容器分配硬件资源，在完成硬件资源分配后，LibOS在加载应用程序的过程中，可以通过LibOS对应的库系统驱动程序，直接访问沙箱容器对应的硬件资源，实现应用程序的 运行。
综上所述，本申请实施例通过将每个用户态操作系统编译成动态库文件，并在动态库文件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统，使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
参照图8，本申请实施例还提供了一种沙箱实现方法的步骤流程图，包括：
步骤301、显示配置界面。
步骤302、在所述配置界面中接收配置信息；所述配置信息包括目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口。
参照图4，客户端10可以显示配置界面11和配置界面12，用户可以通过客户端10的配置界面11，进行目标动态库文件的目标存储路径的配置，还可以根据实际需求，在配置界面12中进行目标用户态操作系统的硬件资源方案配置。用户在配置界面11和配置界面12中输入选择操作后，会对应生成配置信息。
需要说明的是，客户端10可以是移动终端，也可以是平板电脑、个人电脑等终端设备，本申请实施例不对其加以限制。
需要说明的是，配置信息可以包括目标动态库文件的目标存储路径，以供服务端20根据目标存储路径获取得到目标动态库文件，配置信息还可以包括系统资源配置信息，以供服务端20为沙箱进程对应的沙箱容器分配与资源配置信息对应的系统资源，并基于系统资源对目标用户态操作系统进行初始化。
步骤303、向服务端发送所述配置信息，以供所述服务端在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
进一步参照步骤302中对图4的示例说出，在生成配置信息之后，用户点击“生成配置文件并发送”按钮，客户端10可以将根据配置信息生成的配置文件发送至服务端20，使得服务端20在根据目标存储路径获取到目标动态库文件的情况下，由服务端20中运行的沙箱进程通过调用通用接口，在沙箱进程对应的沙箱容器中配置目标用户态操作系统。
可以理解，图4中的服务端20为一种示例，另外，还可以参照图9，采用云服务端 30接收客户端10在配置界面中生成的配置信息，并根据配置信息，在云服务端30根据目标存储路径获取到目标动态库文件的情况下，由云服务端30中运行的沙箱进程通过调用通用接口，在沙箱进程对应的沙箱容器中配置目标用户态操作系统。
综上所述，本申请实施例通过将每个用户态操作系统编译成动态库文件，并在动态库文件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统，使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
需要说明的是，对于方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请实施例并不受所描述的动作顺序的限制，因为依据本申请实施例，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作并不一定是本申请实施例所必须的。
在上述实施例的基础上，本实施例还提供了一种沙箱实现装置，应用于终端设备、服务器等电子设备中。
参照图10，示出了本申请实施例的一种沙箱实现装置实施例的结构框图，具体可以包括如下模块：
路径获取模块401，用于由沙箱进程获取目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
可选的，所述路径获取模块401，包括：
配置接收子模块，用于由所述沙箱进程接收配置文件；所述配置文件包括所述目标动态库文件的目标存储路径。
配置模块402，用于在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
可选的，所述目标用户态操作系统包括用于调用所述目标用户态操作系统的原生操作接口，所述通用接口用于调用所述与所述通用接口对应的原生操作接口。
可选的，所述通用接口中设置有第一类型指令和第二类型指令之间的转换规则；所述第一类型指令为沙箱进程的可识别指令，所述第二类型指令为所述原生操作接口的可 识别指令；所述配置模块402，包括：
接收子模块，用于由所述沙箱进程接收第一类型指令；
转换子模块，用于由所述沙箱进程调用所述通用接口，将所述第一类型指令按照所述转换规则转换为所述第二类型指令，并将所述第二类型指令发送给与所述通用接口对应的原生操作接口；
配置子模块，用于通过所述原生操作接口，根据所述第二类型指令，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
可选的，所述通用接口包括通用初始化接口、通用应用程序加载接口、通用应用程序关闭接口、通用销毁接口中的至少一种；其中，所述通用初始化接口用于在所述沙箱容器为所述目标用户态操作系统分配资源，以及对所述目标用户态操作系统进行初始化；所述通用应用程序加载接口用于在所述目标用户态操作系统初始化完成之后，加载至少一个应用程序进行运行；所述通用应用程序关闭接口用于关闭运行中的应用程序；所述通用销毁接口用于关闭所述目标用户态操作系统并释放系统资源。
可选的，所述配置文件还包括系统资源配置信息，在所述通用接口包括通用初始化接口的情况下，所述配置模块402，包括：
分配子模块，用于由所述沙箱进程通过调用所述通用初始化接口，在所述沙箱进程对应的沙箱容器中分配与所述资源配置信息对应的系统资源，并基于所述系统资源对所述目标用户态操作系统进行初始化。
可选的，所述配置文件还包括：目标用户态操作系统的类型；所述装置还包括：
第一校验模块，执行配置模块。
可选的，所述配置文件还包括：目标用户态操作系统的类型；所述装置还包括：
第一校验模块，用于在确定所述类型为预设类型的情况下，执行配置模块。
开启模块，用于通过预设的库函数工具，打开所述目标存储路径对应的目标动态库文件；
第二校验模块，用于在检测到所述目标动态库文件包括所述通用接口的函数标识的情况下，执行配置模块。
可选的，所述装置还包括：
启动模块，用于启动所述沙箱进程；
创建模块，用于由所述沙箱进程创建所述沙箱容器。
可选的，所述装置还包括：
转换模块，用于将配置有所述目标用户态操作系统的所述沙箱容器，转换为镜像文件或软件开发工具包；
提供模块，用于向客户端提供所述镜像文件或软件开发工具包。
综上，本申请实施例通过将每个用户态操作系统编译成动态库文件，并在动态库文 件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统，使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
参照图11，示出了本申请实施例的一种沙箱实现装置实施例的结构框图，具体可以包括如下模块：
显示模块501，用于显示配置界面；
界面配置接收模块502，用于在所述配置界面中接收配置信息；所述配置信息包括目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
发送模块503，用于向服务端发送所述配置信息，以供所述服务端在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
综上，本申请实施例通过将每个用户态操作系统编译成动态库文件，并在动态库文件中实现用于调用用户态操作系统的通用接口，通用接口能够将一套通用调用方法，转换为用户态操作系统对应的原生调用方法，使得用户可以根据实际需求，向沙箱进程发送目标用户态操作系统所对应的目标动态库文件的目标存储路径，在沙箱进程根据目标存储路径获取到目标动态库文件的情况下，由沙箱进程通过其中的通用接口，将用户操作的通用调用方法转换为目标用户态操作系统的原生调用方法，实现沙箱进程调用目标用户态操作系统的目的，以在沙箱进程对应的沙箱容器中完成配置目标用户态操作系统，使得可以通过一套通用的调用方法，实现不同类型的用户态操作系统在原生操作系统中的操作控制，从而达到了在一个原生操作系统中多种类型用户态操作系统的兼容。
本申请实施例还提供了一种非易失性可读存储介质，该存储介质中存储有一个或多个模块(programs)，该一个或多个模块被应用在设备时，可以使得该设备执行本申请实施例中各方法步骤的指令(instructions)。
本申请实施例提供了一个或多个机器可读的存储介质，其上存储有指令，当由一个或多个处理器执行时，使得电子设备执行如上述实施例中一个或多个所述的方法。本申请实施例中，所述电子设备包括终端设备、服务器(集群)等各类型的设备。
本公开的实施例可被实现为使用任意适当的硬件，固件，软件，或及其任意组合进行想要的配置的装置，该装置可包括终端设备、服务器(集群)等电子设备。图12示意 性地示出了可被用于实现本申请实施例中所述的各个实施例的示例性装置700。
对于一个实施例，图12示出了示例性装置700，该装置具有一个或多个处理器702、被耦合到(一个或多个)处理器702中的至少一个的控制模块(芯片组)704、被耦合到控制模块704的存储器706、被耦合到控制模块704的非易失性存储器(NVM)/存储设备708、被耦合到控制模块704的一个或多个输入/输出设备710，以及被耦合到控制模块704的网络接口712。
处理器702可包括一个或多个单核或多核处理器，处理器702可包括通用处理器或专用处理器(例如图形处理器、应用处理器、基频处理器等)的任意组合。在一些实施例中，装置700能够作为本申请实施例中所述终端设备、服务器(集群)等设备。
在一些实施例中，装置700可包括具有指令714的一个或多个计算机可读的存储介质(例如，存储器706或NVM/存储设备708)以及与该一个或多个计算机可读的存储介质相合并被配置为执行指令714以实现模块从而执行本公开中所述的动作的一个或多个处理器702。
对于一个实施例，控制模块704可包括任意适当的接口控制器，以向(一个或多个)处理器702中的至少一个和/或与控制模块704通信的任意适当的设备或组件提供任意适当的接口。
控制模块704可包括存储器控制器模块，以向存储器706提供接口。存储器控制器模块可以是硬件模块、软件模块和/或固件模块。
存储器706可被用于例如为装置700加载和存储数据和/或指令714。对于一个实施例，存储器706可包括任意适当的易失性存储器，例如，适当的DRAM。在一些实施例中，存储器706可包括双倍数据速率类型四同步动态随机存取存储器(DDR4SDRAM)。
对于一个实施例，控制模块704可包括一个或多个输入/输出控制器，以向NVM/存储设备708及(一个或多个)输入/输出设备710提供接口。
例如，NVM/存储设备708可被用于存储数据和/或指令714。NVM/存储设备708可包括任意适当的非易失性存储器(例如，闪存)和/或可包括任意适当的(一个或多个)非易失性存储设备(例如，一个或多个硬盘驱动器(HDD)、一个或多个光盘(CD)驱动器和/或一个或多个数字通用光盘(DVD)驱动器)。
NVM/存储设备708可包括在物理上作为装置700被安装在其上的设备的一部分的存储资源，或者其可被该设备访问可不必作为该设备的一部分。例如，NVM/存储设备708可通过网络经由(一个或多个)输入/输出设备710进行访问。
(一个或多个)输入/输出设备710可为装置700提供接口以与任意其他适当的设备通信，输入/输出设备710可以包括通信组件、音频组件、传感器组件等。网络接口712可为装置700提供接口以通过一个或多个网络通信，装置700可根据一个或多个无线网络标准和/或协议中的任意标准和/或协议来与无线网络的一个或多个组件进行无线通信， 例如接入基于通信标准的无线网络，如WiFi、2G、3G、4G、5G等，或它们的组合进行无线通信。
对于一个实施例，(一个或多个)处理器702中的至少一个可与控制模块704的一个或多个控制器(例如，存储器控制器模块)的逻辑封装在一起。对于一个实施例，(一个或多个)处理器702中的至少一个可与控制模块704的一个或多个控制器的逻辑封装在一起以形成系统级封装(SiP)。对于一个实施例，(一个或多个)处理器702中的至少一个可与控制模块704的一个或多个控制器的逻辑集成在同一模具上。对于一个实施例，(一个或多个)处理器702中的至少一个可与控制模块704的一个或多个控制器的逻辑集成在同一模具上以形成片上系统(SoC)。
在各个实施例中，装置700可以但不限于是：服务器、台式计算设备或移动计算设备(例如，膝上型计算设备、手持计算设备、平板电脑、上网本等)等终端设备。在各个实施例中，装置700可具有更多或更少的组件和/或不同的架构。例如，在一些实施例中，装置700包括一个或多个摄像机、键盘、液晶显示器(LCD)屏幕(包括触屏显示器)、非易失性存储器端口、多个天线、图形芯片、专用集成电路(ASIC)和扬声器。
其中，检测装置中可采用主控芯片作为处理器或控制模块，传感器数据、位置信息等存储到存储器或NVM/存储设备中，传感器组可作为输入/输出设备，通信接口可包括网络接口。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本说明书中的各个实施例均采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似的部分互相参见即可。
本申请实施例是参照根据本申请实施例的方法、终端设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理终端设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理终端设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理终端设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理终端设备上，使得在计算机或其他可编程终端设备上执行一系列操作步骤以产生计算机实现的处理，从而在 计算机或其他可编程终端设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请实施例的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请实施例范围的所有变更和修改。
最后，还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者终端设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者终端设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者终端设备中还存在另外的相同要素。
以上对本申请所提供的一种沙箱实现方法和装置，一种电子设备和一种存储介质，进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (26)

  1. 一种沙箱实现方法，其特征在于，所述方法包括：
    由沙箱进程获取目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
    在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
  2. 根据权利要求1所述的方法，其特征在于，所述目标用户态操作系统包括用于调用所述目标用户态操作系统的原生操作接口，所述通用接口用于调用与所述通用接口对应的原生操作接口。
  3. 根据权利要求2所述的方法，其特征在于，所述通用接口中设置有第一类型指令和第二类型指令之间的转换规则；所述第一类型指令为所述沙箱进程的可识别指令，所述第二类型指令为所述原生操作接口的可识别指令；
    所述在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统，包括：
    由所述沙箱进程接收第一类型指令；
    由所述沙箱进程调用所述通用接口，将所述第一类型指令按照所述转换规则转换为所述第二类型指令，并将所述第二类型指令发送给与所述通用接口对应的原生操作接口；
    通过所述原生操作接口，根据所述第二类型指令，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
  4. 根据权利要求3所述的方法，其特征在于，所述通用接口包括通用初始化接口、通用应用程序加载接口、通用应用程序关闭接口、通用销毁接口中的至少一种；其中，所述通用初始化接口用于在所述沙箱容器为所述目标用户态操作系统分配资源，以及对所述目标用户态操作系统进行初始化；所述通用应用程序加载接口用于在所述目标用户态操作系统初始化完成之后，加载至少一个应用程序进行运行；所述通用应用程序关闭接口用于关闭运行中的应用程序；所述通用销毁接口用于关闭所述目标用户态操作系统并释放系统资源。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述由沙箱进程获取目标动态库文件的目标存储路径，包括：
    由所述沙箱进程接收配置文件；所述配置文件包括所述目标动态库文件的目标存储路径。
  6. 根据权利要求5所述的方法，其特征在于，所述配置文件还包括系统资源配置信息，在所述通用接口包括通用初始化接口的情况下，所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统，包括：
    由所述沙箱进程通过调用所述通用初始化接口，在所述沙箱进程对应的沙箱容器中分配与所述资源配置信息对应的系统资源，并基于所述系统资源对所述目标用户态操作系统进行初始化。
  7. 根据权利要求6所述的方法，其特征在于，所述配置文件还包括：目标用户态操作系统的类型；所述方法还包括：
    在确定所述类型为预设类型的情况下，执行在根据所述目标存储路径获取到所述目标动态库文件的情况下，沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统的步骤。
  8. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    通过预设的库函数工具，打开所述目标存储路径对应的目标动态库文件；
    在检测到所述目标动态库文件包括所述通用接口的函数标识的情况下，执行由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统的步骤。
  9. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    启动所述沙箱进程；
    由所述沙箱进程创建所述沙箱容器。
  10. 根据权利要求1所述的方法，其特征在于，所述方法还包括:
    将配置有所述目标用户态操作系统的所述沙箱容器，转换为镜像文件或软件开发工具包；
    向客户端提供所述镜像文件或软件开发工具包。
  11. 一种沙箱实现方法，其特征在于，所述方法包括：
    显示配置界面；
    在所述配置界面中接收配置信息；所述配置信息包括目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
    向服务端发送所述配置信息，以供所述服务端在根据所述目标存储路径获取到所述目标动态库文件的情况下，由沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
  12. 一种沙箱实现装置，其特征在于，所述装置包括：
    路径获取模块，用于由沙箱进程获取目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
    配置模块，用于在根据所述目标存储路径获取到所述目标动态库文件的情况下，由所述沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
  13. 根据权利要求12所述的装置，其特征在于，所述目标用户态操作系统包括用于调用所述目标用户态操作系统的原生操作接口，所述通用接口用于调用与所述通用接口对应的原生操作接口。
  14. 根据权利要求13所述的装置，其特征在于，所述通用接口中设置有第一类型指令和第二类型指令之间的转换规则；所述第一类型指令为沙箱进程的可识别指令，所述第二类型指令为所述原生操作接口的可识别指令；
    所述配置模块，包括：
    接收子模块，用于由所述沙箱进程接收第一类型指令；
    转换子模块，用于由所述沙箱进程调用所述通用接口，将所述第一类型指令按照所述转换规则转换为所述第二类型指令，并将所述第二类型指令发送给与所述通用接口对应的原生操作接口；
    配置子模块，用于通过所述原生操作接口，根据所述第二类型指令，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
  15. 根据权利要求14所述的装置，其特征在于，所述通用接口包括通用初始化接口、通用应用程序加载接口、通用应用程序关闭接口、通用销毁接口中的至少一种；其中，所述通用初始化接口用于在所述沙箱容器为所述目标用户态操作系统分配资源，以及对所述目标用户态操作系统进行初始化；所述通用应用程序加载接口用于在所述目标用户态操作系统初始化完成之后，加载至少一个应用程序进行运行；所述通用应用程序关闭接口用于关闭运行中的应用程序；所述通用销毁接口用于关闭所述目标用户态操作系统并释放系统资源。
  16. 根据权利要求12-15任一项所述的装置，其特征在于，所述路径获取模块，包括：
    配置接收子模块，用于由所述沙箱进程接收配置文件；所述配置文件包括所述目标动态库文件的目标存储路径。
  17. 根据权利要求16所述的装置，其特征在于，所述配置文件还包括系统资源配置信息，在所述通用接口包括通用初始化接口的情况下，所述配置模块，包括：
    分配子模块，用于由所述沙箱进程通过调用所述通用初始化接口，在所述沙箱进程对应的沙箱容器中分配与所述资源配置信息对应的系统资源，并基于所述系统资源对所述目标用户态操作系统进行初始化。
  18. 根据权利要求17所述的装置，其特征在于，所述配置文件还包括：目标用户态操作系统的类型；所述装置还包括：
    第一校验模块，用于在确定所述类型为预设类型的情况下，执行配置模块。
  19. 根据权利要求12所述的装置，其特征在于，所述装置还包括：
    开启模块，用于通过预设的库函数工具，打开所述目标存储路径对应的目标动态库文件；
    第二校验模块，用于在检测到所述目标动态库文件包括所述通用接口的函数标识的情况下，执行配置模块。
  20. 根据权利要求12所述的装置，其特征在于，所述装置还包括：
    启动模块，用于启动所述沙箱进程；
    创建模块，用于由所述沙箱进程创建所述沙箱容器。
  21. 根据权利要求12所述的装置，其特征在于，所述装置还包括:
    转换模块，用于将配置有所述目标用户态操作系统的所述沙箱容器，转换为镜像文件或软件开发工具包；
    提供模块，用于向客户端提供所述镜像文件或软件开发工具包。
  22. 一种沙箱实现装置，其特征在于，所述装置包括：
    显示模块，用于显示配置界面；
    界面配置接收模块，用于在所述配置界面中接收配置信息；所述配置信息包括目标动态库文件的目标存储路径；其中，所述目标动态库文件根据目标用户态操作系统编译获得，所述目标动态文件包括调用所述目标用户态操作系统的通用接口；
    发送模块，用于向服务端发送所述配置信息，以供所述服务端在根据所述目标存储路径获取到所述目标动态库文件的情况下，由沙箱进程通过调用所述通用接口，在所述沙箱进程对应的沙箱容器中配置所述目标用户态操作系统。
  23. 一种电子设备，其特征在于，包括：处理器；和
    存储器，其上存储有可执行代码，当所述可执行代码被执行时，使得所述处理器执行如权利要求1-10中一个或多个所述的方法。
  24. 一个或多个机器可读的存储介质，其上存储有可执行代码，当所述可执行代码被执行时，使得处理器执行如权利要求1-10中一个或多个所述的方法。
  25. 一种电子设备，其特征在于，包括：处理器；和
    存储器，其上存储有可执行代码，当所述可执行代码被执行时，使得所述处理器执行如权利要求11所述的方法。
  26. 一个或多个机器可读的存储介质，其上存储有可执行代码，当所述可执行代码被执行时，使得处理器执行如权利要求11所述的方法。
PCT/CN2021/092302 2020-05-15 2021-05-08 沙箱实现方法、装置、设备和存储介质 WO2021227971A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010415447.0 2020-05-15
CN202010415447.0A CN113297566B (zh) 2020-05-15 2020-05-15 沙箱实现方法、装置、设备和存储介质

Publications (1)

Publication Number Publication Date
WO2021227971A1 true WO2021227971A1 (zh) 2021-11-18

Family

ID=77318037

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/092302 WO2021227971A1 (zh) 2020-05-15 2021-05-08 沙箱实现方法、装置、设备和存储介质

Country Status (2)

Country Link
CN (1) CN113297566B (zh)
WO (1) WO2021227971A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114625439A (zh) * 2022-03-10 2022-06-14 腾讯音乐娱乐科技（深圳）有限公司 基于微前端架构的子应用运行方法、电子设备及存储介质
CN115994361A (zh) * 2023-03-22 2023-04-21 北京升鑫网络科技有限公司 容器漏洞的检测方法、系统、电子设备及可读存储介质
CN117609989A (zh) * 2023-12-24 2024-02-27 中国人民解放军61660部队 一种通过隐藏应用特征在互联网上保护个人信息的方法
CN117806852A (zh) * 2024-03-01 2024-04-02 傲拓科技股份有限公司 一种接口调用方法、装置、存储介质及处理器

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114253240B (zh) * 2021-12-20 2024-08-27 中国电信股份有限公司 云化工业系统设备的控制方法、装置、设备及存储介质
CN116010941B (zh) * 2023-03-28 2023-06-30 之江实验室 一种基于沙箱的多中心医学队列构建系统及方法
CN116798457B (zh) * 2023-08-29 2023-12-15 中孚安全技术有限公司 刻录行为识别与管控方法、系统、设备及介质
CN116880866A (zh) * 2023-09-07 2023-10-13 京东科技信息技术有限公司 安装操作系统的方法、设备及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103493011A (zh) * 2011-03-03 2014-01-01 微软公司 与库操作系统的应用兼容性
CN103699620A (zh) * 2013-12-19 2014-04-02 珠海世纪鼎利通信科技股份有限公司 面向对象中利用orm框架实现数据库操作的方法及系统
CN108345496A (zh) * 2017-01-23 2018-07-31 华为技术有限公司 一种运行应用程序的方法及装置
WO2019200102A1 (en) * 2018-04-11 2019-10-17 Cornell University Method and system for improving software container performance and isolation
CN107615243B (zh) * 2015-07-28 2019-12-13 华为技术有限公司 一种调用操作系统库的方法、装置及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080222659A1 (en) * 2007-03-09 2008-09-11 Microsoft Corporation Abstracting operating environment from operating system
US9389933B2 (en) * 2011-12-12 2016-07-12 Microsoft Technology Licensing, Llc Facilitating system service request interactions for hardware-protected applications

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103493011A (zh) * 2011-03-03 2014-01-01 微软公司 与库操作系统的应用兼容性
CN103699620A (zh) * 2013-12-19 2014-04-02 珠海世纪鼎利通信科技股份有限公司 面向对象中利用orm框架实现数据库操作的方法及系统
CN107615243B (zh) * 2015-07-28 2019-12-13 华为技术有限公司 一种调用操作系统库的方法、装置及系统
CN108345496A (zh) * 2017-01-23 2018-07-31 华为技术有限公司 一种运行应用程序的方法及装置
WO2019200102A1 (en) * 2018-04-11 2019-10-17 Cornell University Method and system for improving software container performance and isolation

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114625439A (zh) * 2022-03-10 2022-06-14 腾讯音乐娱乐科技（深圳）有限公司 基于微前端架构的子应用运行方法、电子设备及存储介质
CN115994361A (zh) * 2023-03-22 2023-04-21 北京升鑫网络科技有限公司 容器漏洞的检测方法、系统、电子设备及可读存储介质
CN117609989A (zh) * 2023-12-24 2024-02-27 中国人民解放军61660部队 一种通过隐藏应用特征在互联网上保护个人信息的方法
CN117806852A (zh) * 2024-03-01 2024-04-02 傲拓科技股份有限公司 一种接口调用方法、装置、存储介质及处理器
CN117806852B (zh) * 2024-03-01 2024-05-14 傲拓科技股份有限公司 一种接口调用方法、装置、存储介质及处理器

Also Published As

Publication number Publication date
CN113297566B (zh) 2024-04-02
CN113297566A (zh) 2021-08-24

Similar Documents

Publication Publication Date Title
WO2021227971A1 (zh) 沙箱实现方法、装置、设备和存储介质
US8112610B2 (en) Partition bus
US7181610B2 (en) Method and system to encapsulate a driver written for an operating system (OS) runtime environment in an OS independent environment firmware extension
RU2406113C2 (ru) Системы и способы двухрежимной виртуализации устройства реальных и идеализированных аппаратных устройств
EP2843552B1 (en) Method and system for executing callback functions delivered via a communication between a user-space application and the operating system kernel
WO2022016848A1 (zh) 一种根据服务角色的进行应用部署的方法及装置
US20100205604A1 (en) Systems and methods for efficiently running multiple instances of multiple applications
CN109032706A (zh) 智能合约执行方法、装置、设备和存储介质
CN110007980B (zh) 多业务服务端的实现方法和装置
US10445126B2 (en) Preloading enhanced application startup
JP2010521034A (ja) オペレーティングシステムからオペレーティング環境を抽象化する方法
WO2022222537A1 (zh) Ai应用部署方法及相关平台、集群、介质、程序产品
JP4000327B2 (ja) 非同期挙動変更をマネージドアプリケーションプロセスに誘導するためのシステムおよび方法
US20230409417A1 (en) Automated generation of application programming interfaces for microservices
WO2022170946A1 (zh) 一种访问控制方法及相关装置
US10389746B2 (en) Multi-tenant environment using pre-readied trust boundary components
Maaskant A robust component model for consumer electronic products
US9141352B2 (en) Dynamically building locale objects at run-time
US10120777B1 (en) Remediating serialization incompatibilities
US11249760B2 (en) Parameter management between programs
CN105550050A (zh) 硬件通信的方法及装置
Rothman et al. Harnessing the UEFI Shell: Moving the platform beyond DOS
CN112948062B (zh) 设备文件的透传方法、设备及计算机存储介质
US20190102230A1 (en) Managing split packages in a module system
Pandurov et al. Platform for extending home automation gateway's functionality with plugin mechanism

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21805136

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21805136

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 13/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21805136

Country of ref document: EP

Kind code of ref document: A1