JPH08335191A - OS management resource access device - Google Patents

Abstract

(57) [Summary] [Purpose] It is possible to save the trouble of changing the access right after the access to the resource is completed, and it is possible to access the resource that the operator could not directly access in the past.
An S management resource access device is provided. The access right assignment execution unit 8 assigns an access execution right to access a resource based on the access right for each resource, the access right for each operator, and the access right assigned to the operator for each resource. Then, the access processing unit 9 performs a resource access process based on the determined access execution authority.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an operating system (hereinafter referred to as "OS") for accessing resources managed by a hierarchical structure called a directory.
The present invention relates to an S management resource access device.

[0002]

2. Description of the Related Art A conventional OS-managed resource access device of this type determines whether a resource (file, device, directory, etc.) managed by the OS can be accessed, and the access right to the resource under the directory held by the directory. And the access right possessed by the operator who accesses the resource.

[0003]

Therefore, the conventional device has the following problems. (1) When an operator tries to create a resource such as a file in a directory, the access right to the resource held by the directory is compared with the access right held by the operator, and the access right held by the directory allows the operator to create. However, the resource is created with the access right of the operator who created the resource.

This is because when creating a shared resource or creating another person's resource on behalf of another person, it is necessary to change the access right to the created resource after creating the resource. It was troublesome twice.

For example, in UNIX systems, rou
When you register a user with t and prepare the environment, the file created in the user's home directory is once roo
It will be created as a file owned by t. root creates the files, and then creates the files
It is necessary to issue a command, chgrp command, etc., and reset the file to the file owned by the user. (2) When an existing resource is shared by a plurality of operators, access to the resource is determined by the access right of the operator and the access right held by the directory, so the access right of the operator is shared. To do this, a special operator is prepared and access is performed with the authority of that operator.

This is because when a shared resource is accessed, it cannot be directly accessed, and it is necessary to change to a special operator before accessing the resource when accessing the resource. Also, if you accidentally try to update a resource without becoming a special operator, you will not be able to write to the resource, or even if you can write, the resource will be updated with the access right that the operator has. was there.

For example, in the UNIX system, when a certain shared user is set to share a file, each user issues a su command or the like to change to the shared user before accessing the shared file. There was a need. Also, if you try to access a shared file without changing it to the shared user, the user may not be able to access the shared file depending on the access rights of the shared file itself, or even if you can write to the shared file, Shared files may be updated by the access rights of the user.

Therefore, the present invention has been made in view of the above circumstances, and it is possible to save the trouble of changing the access right after the access to the resource is completed, and to the resource that the operator could not directly access in the past. An object is to provide an OS management resource access device that enables access.

[0009]

An OS managed resource access device of the present invention for solving the above-mentioned problems is an OS managed resource access device for accessing a resource managed by an operating system under a directory. A directory access right storage means for storing access rights for each operator, an operator access right storage means for storing access rights for each operator, and a transfer access right storage means for storing access rights to be transferred to an operator for each resource, Access right transfer execution means for determining an access execution right for executing access to the resource based on the access right stored in each storage means, and access processing for the resource based on the determined access execution right It has an access processing means.

[0010]

According to the OS managed resource access device of the present invention having the above-mentioned configuration, the access execution means is based on the access right for each resource, the access right for each operator, and the access right assigned to the operator for each resource. , Access execution authority is determined, and the access processing means performs access processing to the resource based on the determined access execution authority.

[0011]

Embodiments of the present invention will now be described in detail with reference to the drawings.

FIG. 1 is a block diagram showing a first embodiment of an OS managed resource access device of the present invention.

As shown in FIG. 1, the device 1 of the present embodiment has an input / output device 2 having a data input unit such as a keyboard and a data output unit such as a CRT, and an access input unit for access to resources by an operator. 3, a resource storage unit 4 that stores resources such as files, devices, and directories managed by the OS under a directory, and access rights for each resource managed by the OS (hereinafter referred to as “under-directory access rights”), for example. An access right storage unit 5 under the directory that stores the user name owned by the directory, and an access right that an operator who uses the OS to access resources managed by the OS (hereinafter referred to as "operator access right")
Say. ) As an operator access right storage unit 6 for storing an operator name, and a transfer access right for storing an operator name as an access right transferred to an operator for each resource managed by the OS (hereinafter referred to as “transfer access right”) The storage unit 7 and the access right transfer execution unit that determines the access execution right to access the resource based on the directory access right, the operator access right, and the transfer access right stored in each of the storage units 5, 6, and 7. 8
And an access processing unit 9 that performs access processing to the resource based on the determined access execution authority.

The input / output device 2 allows a user to input, edit and confirm data.

The access input unit 3 and the access processing unit 9
Each unit of the access right transfer execution unit 8 has a computer (as a matter of course, an arithmetic processing unit, a processing memory, a control memory for storing a processing procedure represented by a flowchart described later, an interface for transferring information, etc.). ).

Next, the directory access right, operator access right, transfer access right and access execution right will be described.

The access right under the directory is an access right to resources (files, devices, directories, etc.) held by the directory. For example, the owner user, owning group, permission, etc., which are attributes of the resource in the UNIX system, are given. It includes. Any combination of the access rights under the directory can be considered. For example, in the UNIX system, the directory name, the user name of the directory owner, the group name of the directory, the directory permission, (ro
Lead right to ot or principal / group / others /
(Write right / execution right) and other attributes related to resources are included.

The operator access right includes authority such as a user name and a belonging group name which are attributes of the user. This operator access right can be in any combination, and in the UNIX system, for example, includes a user name, a group name to which the user belongs, and other attributes related to the user.

The transfer access right does not exist in the UNIX system and is provided by the present invention, and includes attributes such as attributes, users, groups, and permissions for transferring access to a resource to a user ( Details will be described in the explanation of specific examples). This transfer access right means whether or not to transfer the resource access execution right to all operators, or whether or not to transfer the resource access execution right to individual operators. It is a thing. This transfer access right may be any combination. For example, in the UNIX system, the transfer right to the user, the transfer right to the group, the read right / write right / execution right to the resource, and some other It includes attributes related to access rights. Further, although it is effective for all the resources under the directory, the transfer access right can be set for each resource (one file or the like). Further, the transfer access right can be stored in the directory as a part of the access right to the directory, can be stored as a file, or can be stored as a mechanism of an OS or a file system. Is.

The access execution authority may not be included in the access transfer execution unit 8 but may be separately provided as a storage unit. The access execution authority may be any combination as follows. For example, in the UNIX system, a user name to access the resource, a group name of a user to access the resource, a read right / write to the resource. Rights / execution rights and other attributes for accessing resources are included. Further, the access execution authority can have a plurality of the same attributes. For example, the UNIX shown above
In the example of the system, it is possible to have a plurality of user names that access the resource, and have a plurality of group names to which the user who accesses the resource belongs.

Further, each part of the directory access right, the operator access right, the transfer access right, and the resource is supported by a storage area (having files, memory, etc.) on the OS.

Next, the operation of this embodiment will be described with reference to the flowchart of FIG. 11 for the specific example shown in FIGS.

2 to 7 are diagrams showing examples of information managed by this embodiment. FIG. 2 shows a list of operators who use the OS. FIG. 3 shows the under-directory access right stored in the under-directory access right storage unit 5. In this example, the directory name and the owning user name are stored. Further, FIG. 4 shows the operator access right stored in the operator access right storage unit 6, and in this example, the operator name is stored. 5 and 6 show the access rights to be transferred (transfer access right-1, transfer access right-2) stored in the transfer access right storage unit 7. In the example of FIG. 5, the access right is transferred. Information about (value 1) and whether or not (value 0) is stored. In the example of FIG. 6, information about whether or not to transfer the access right to the resource to each operator is stored. . FIG. 7 shows the authority (access execution authority) set by the access right transfer execution unit 8 or set without transfer. In the following description, U is used unless otherwise specified.
An example of a UNIX system will be described. Also, ro
ot is a UNIX system superuser, User
Is a general user.

First, the operator operates the input / output device 2 to issue an access request to the resource storage unit 4 (S1). The access request shown here means a request for creating a resource, reading a resource, updating a resource, executing a resource, or the like.

Next, the access right transfer execution unit 8 receives the directory access right, the operator access right and the transfer access right from the directory access right storage unit 5, the operator access right storage unit 6 and the transfer access right storage unit 7, respectively. Take out (S2).

Subsequently, the access right transfer execution unit 8 determines the access execution right that is the transfer right based on the information retrieved in step S2 (S3).

That is, the access right transfer execution unit 8 determines whether or not to transfer the transfer access right based on the information extracted in step S2 (S31). When not transferring, the access execution authority to the resource is set to the logged-in user (S32). As a result, the transfer access right is not transferred, and the user's authority remains unchanged and the step S4 is performed.
Will be processed. In the case of transfer, the access execution right to the resource is set to the owned user name of the directory which is the access right under the directory extracted in step S2 (S33). As a result, the transfer access right is transferred, and step S is performed with the authority of the user who owns the directory.
The process of 4 can be performed.

Next, the access processing section 9 performs access processing to the resource stored in the resource storage section 4 based on the access execution authority determined in step S3 (S4).

Next, the operation of this embodiment will be described more specifically with reference to FIGS.

8 and 9 are explanatory views when the transfer access right is FIG. 8 and 9, E1 to E4 are users who have logged in based on the operator access right. E1 'to E4' are access execution authorities to the resources obtained by the present invention. P1 and P2 are the directory name / owned user name which is the access right under the directory. Depending on the access rights under the directory, writing to these directories may not be possible, but for the sake of explanation, these directories are writable by all users. R1 and R2 are transfer access rights. A value of 1 means transfer, and a value of 0 means not transfer.
When transferring, transfer the owner of the directory as the access execution authority.

First, as shown in FIG. 8, the root of P1
Own directory DIR1 and this DIR1 is R
The case where the user has the transfer access right of 1 (value 0) will be described. In this case, E1 root and E2 Us
When er1 accesses the resource under this DIR1, it goes through the steps S31 and S32, and E1 'and E1.
You will have 2'access execution authority. In this case, the value of the transfer access right of R1 is "0", so E
The access execution authority of 1'and E2 'becomes the same as the users of E1 and E2. That is, when root creates a resource under DIR1, it is created as a resource owned by root, and when User1 creates a resource under DIR1, it is created as a resource owned by User1.

Next, as shown in FIG. 9, User of P2
There will be described a case where there is a directory DIR2 owned by one and this DIR2 has the transfer access right (value 1) of R2. In this case, E3 root and E4 U
When the ser1 accesses the resource under the DIR2, the ser1 goes through the steps S31 and S32, and the E3 ',
You will have the access execution authority of E4 '. In this case, the value of the transfer access right of R2 is "1", so E
The access execution authority of 3'and E4 'is transferred to the user (User1) who owns the directory. That is, roo
When t and User1 create a resource under DIR2, both are created as resources owned by User1.

Note that the access execution authority to be transferred can have a plurality of the same attributes. For example, roo of E3
t can have access execution authority of two users, root and User1, as E3 '. At this time, access to the resource can be considered in various ways depending on the OS, the mechanism of the file system and the access right under the directory, the operator access right, the transfer access right, the resource access right, and the like. For example, if there is a resource owned by root under DIR2 and Root writes to that resource, it will be written as Root, and if Root creates a new resource, it will be created as User1 owned resource. It

FIG. 10 is an explanatory diagram when the transfer access right is shown in FIG. In the figure, E5 to E7 are users who have logged in based on the operator access right. E5 'to E7' are access execution authorities to the resources obtained by the present invention. P3 is a directory name / owned user name which is an access right under the directory. Depending on the access rights under the directory, writing to these directories may not be possible, but for the sake of explanation, these directories are writable by all users. R3 is a transfer access right, which is transferred to the specified user and is not transferred to the unspecified user. When transferring, transfer the owner of the directory as the access execution authority.

As shown in the figure, it is assumed that there is a directory DIR3 owned by Root of P3, and this DIR3 has the transfer access right (User2, User4) of R3. In this case, E5 root and E7 Use
When r3 accesses the resource under this DIR3, it goes through the steps S31, S32, and E5 ', E.
You will have the access execution authority of 7 '.

That is, since the root of E5 is not specified in the transfer access right of R3, the step S3 is executed.
1 and S32, the resource is accessed under the authority of root under DIR3. Also,
User2, a general user of E6, is specified in the transfer access right of R3, so steps S31 and S33.
You will have the access execution authority of E6 ',
The user who owns the directory will be transferred and will be accessed with the root access execution authority. Also, E7
User3, who is a general user, does not transfer the transfer access right, but accesses with the access execution authority of User3 who is a general user.

According to the above embodiment, in addition to the access right held by the directory and the access right held by the operator, the access right transferred to the operator is stored for each resource, and the access right is transferred to the operator. Therefore, it is possible to save the trouble of changing the access right after the access to the resource is completed, and it is possible to obtain the effect that it is possible to access the resource that the operator could not directly access conventionally.

FIG. 12 is a block diagram showing a second embodiment of the OS management resource access device of the present invention.

The device 10 of the present embodiment, as shown in FIG.
Similar to the first embodiment, it has an input / output device 2, an access input unit 3, a resource storage unit 4, and an access processing unit 9. In addition, for example, an owned user name and an access right for each resource managed by the OS. An under-directory access right storage unit 15 that stores the owned group name, and an operator access right storage unit that stores, for example, an operator name and a group name as an access right of an operator who uses the OS to access resources managed by the OS 16, a transfer access right storage unit 17 that stores, for example, an operator name and a group name as an access right transferred to each operator managed by the OS, and a directory access right stored in each of the storage units 15, 16 and 17. Based on the operator access right and the transfer access right, the access execution right to execute access to the resource is set. And a permission assignment execution unit 18 to a constant.

Next, the operation of this embodiment will be described with reference to FIGS.
A specific example shown in FIG. 7 will be described according to the flowchart of FIG.

13 to 17 are diagrams showing examples of information managed by this embodiment. FIG. 13 shows a list of groups that belong to operators who use the OS. 14
Indicates the under-directory access right stored in the under-directory access right storage unit 15. In this example, the directory name, the owned user name, and the owned group name are stored. FIG. 15 shows the operator access right stored in the operator access right storage unit 16. In this example,
The operator name and the group name to which the operator belongs are stored. However, when a user belongs to a plurality of groups, only the current group is shown in this example, but information of other groups (see FIG. 13) is also stored. FIG. 16 shows the transfer access right stored in the transfer access right storage unit 17, and in this example, roo
t or whether to transfer the access execution authority of the user / group to the person (root / person), a user (group) belonging to the same group, or another user (other) (value 1) or not (value 0) Stores the information of. 17 shows the authority (access execution authority) set by the access right transfer execution unit 18 or not transferred, and in this example, the operator name and the group name are stored as the access execution authority. are doing.

First, as in the first embodiment, the operator operates the input / output device 2 to issue an access request to the resource storage unit 4 (S1), and then the access right assignment execution unit 18
Retrieves the directory access right, the operator access right, and the transfer access right from the directory access right storage unit 15, the operator access right storage unit 16, and the transfer access right storage unit 17, respectively (S2).

Subsequently, the access right transfer execution unit 18 determines the access execution right that is the transfer right based on the information retrieved in step S2 (S3 ').

That is, the access right transfer execution unit 18
Based on the information extracted in step S2, it is determined whether or not to transfer the access right of the user having the transfer access right (S34). When not transferring, the access execution right to the resource is set to the logged-in user (S35). As a result, the access right of the transfer access right of the user is not transferred, and the process of step S4 is performed with the user's right. In the case of transfer, the access execution right to the resource is set to the user who owns the directory which is the access right under the directory extracted in step S2 (S36). As a result, the access right of the transfer access right user is transferred, and the process of S4 can be performed with the authority of the user who owns the directory.

Next, the access right transfer execution unit 18 determines whether or not to transfer the access right of the transfer access right group based on the information retrieved in step S2 (S).
37). If not transferred, the access execution authority to the resource is set to the current group name of the logged-in user (S38). As a result, the access right of the transfer access right group is not transferred, and the processing of step S4 is performed with the right of the group. When transferring, the resource access execution right is set to the directory owning group which is the access right under the directory extracted in S2 (S39). As a result, the access right of the transfer access right group is transferred, and the processing of step S4 can be performed by the authority of the directory owning group.

Next, the operation of this embodiment will be described more specifically with reference to FIG.

E8 to E10 are a user who has logged in based on the operator access right and a belonging group. P
Reference numeral 4 is a directory name which is an access right under the directory, an owning user and an owning group name. R4 is a transfer access right. A value of 1 means transfer, and a value of 0 means not transfer. When transferring, the user / group owned by the directory is transferred as access execution authority. E8 'to E10' show access execution authority (user / group) to the resource.

As shown in the figure, User. b2
/ Gr. A case will be described in which there is a directory DIR4 owned by AB, and this DIR4 has the transfer access right of R4.

In this case, the E.8 User. a1 / G
r. If A wants to access a resource under this DIR4, this user will be GR. Since it also belongs to AB (see FIG. 13), the access execution right is determined by the transfer access right (center of R4) to the group of R4. This transfer access right does not transfer the access right to the user (value 0) and transfers the access right to the group (value 1). Therefore, in step S3
After passing S4, S35, S37, and S39, the user has the access execution authority of E8 '. As a result, User. a
1 / Gr. If A creates a resource under DIR4, User. a1 / Gr. It can be created as an AB owned resource.

In addition, the E. User. b1 / Gr. B
However, if the user wants to access a resource under this DIR4, this user can access the GR. Not belonging to AB (Fig. 13
Therefore, the access execution right is determined by the transfer access right (right of R4) to the other of R4. This transfer access right does not transfer the access right to the user (value 0) and does not transfer the access right to the group (value 0). Therefore, in step S3
After passing through S4, S35, S37 and S38, the user has the access execution authority of E9 '. As a result, User. b
1 / Gr. If B creates a resource under DIR4,
User. b1 / Gr. It is created as a resource owned by B.

Next, the root / daemon of E10
However, when accessing a resource under this DIR4, the transfer access right (R
The left side of 4) will determine the access execution authority. As for the transfer access right, the access right to the user is transferred (value 1), and the access right to the group is transferred (value 1). Therefore, in steps S34 and S3,
After passing through S6, S37 and S39, the user has the access execution authority of E10 '. This allows root / dam
Use if on creates the resource under DIR4
r. b2 / Gr. It can be created as an AB owned resource.

According to the above embodiment, the same effect as that of the first embodiment can be obtained, and the access right can be transferred not only to the user but also to the group.

The present invention is not limited to the above-mentioned embodiments, but can be modified in various ways. For example, although FIG. 5 is shown in FIGS. 8 and 9, FIG. 6 is shown in FIG. 10, and FIG. 16 is shown in FIG. 18, examples of individual transfer access rights are shown. It is also possible to use any combination of the above.

Consider, for example, the case where the transfer access right is used as a means having both FIG. 16 and FIG. The storage content of FIG. 6 is a storage means that clearly indicates the users who belong to the group to which the transfer is permitted. As an example of using such means, when a user of a certain shared user is set to share a file, the shared user's access to a certain user among the users who belong to the group to which the shared user belongs It is possible to make detailed settings such as transferring the right and not transferring it to a certain user. With such a setting, even users belonging to the same group can distinguish a user who can write the shared file from a user who can only read the shared file.

As an example of the processing flow in this case, it is assumed that the transfer access right of FIG. 16 allows the user belonging to the directory owning group to transfer the access right to the shared file. Next, by the transfer access right of FIG. 6, among the users who have the possibility of being transferred the access right in the above process, the user who finally transfers the access right and the user who does not transfer the access right are sorted and the access execution right is determined. .

As described above, it is also possible to have a plurality of transfer access right storage means and determine the detailed access execution right by an arbitrary combination of the storages.

[0057]

As described above in detail, according to the present invention, the access right transferred to the operator is stored for each resource separately from the access right held by the directory and the access right held by the operator, and the access right is assigned to the operator. Since the access right is transferred, it is possible to save the trouble of changing the access right after the access to the resource is completed, and the OS management resource access device that enables the access to the resource that the operator could not directly access is conventionally provided. Can be provided.

[Brief description of drawings]

FIG. 1 is a block diagram showing a first embodiment.

FIG. 2 is a diagram showing an example of information stored in the first embodiment.

FIG. 3 is a diagram showing an example of information stored in the first embodiment.

FIG. 4 is a diagram showing an example of information stored in the first embodiment.

FIG. 5 is a diagram showing an example of information stored in the first embodiment.

FIG. 6 is a diagram showing an example of information stored in the first embodiment.

FIG. 7 is a diagram showing an example of information stored in the first embodiment.

FIG. 8 is a diagram for explaining the operation of the first embodiment.

FIG. 9 is a diagram for explaining the operation of the first embodiment.

FIG. 10 is a diagram for explaining the operation of the first embodiment.

FIG. 11 is a flowchart showing the operation of the first embodiment.

FIG. 12 is a block diagram showing a second embodiment.

FIG. 13 is a diagram showing an example of information stored in the second embodiment.

FIG. 14 is a diagram showing an example of information stored in the second embodiment.

FIG. 15 is a diagram showing an example of information stored in the second embodiment.

FIG. 16 is a diagram showing an example of information stored in the second embodiment.

FIG. 17 is a diagram showing an example of information stored in the second embodiment.

FIG. 18 is a diagram for explaining the operation of the second embodiment.

FIG. 19 is a flowchart showing the operation of the second embodiment.

[Explanation of symbols]

 1, 10 OS management resource access device 2 Input / output device 3 Access input unit 4 Resource storage unit 5, 15 Directory access right storage unit 6, 16 Operator access right storage unit 7, 17 Transfer access right storage unit 8, 18 Access right Transfer execution unit 9 Access processing unit

Claims (1)

[Claims] 1. An OS-managed resource access device for accessing resources managed by a operating system under a directory, and an under-directory access right storage means for storing access right for each resource and an access right for each operator. Operator access right storage means for storing, transfer access right storage means for storing access right to be transferred to the operator for each resource, and access for executing access to the resource based on the access right stored in each storage means An OS management resource access device comprising: an access right transfer execution means for determining execution authority; and an access processing means for performing access processing to the resource based on the determined access execution authority.