Mechanism for drivers to create alternate namespaces

• US 20070136356A1
• Filed: 12/12/2005
• Published: 06/14/2007
• Est. Priority Date: 12/12/2005
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Talluri, Madhusudhan, Smith, Frederick, Khalidi, Yousef, Havens, Jeff
• Application Number:
  US11/301,072
• Publication Number:
  US 20070136356A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space

Abstract

An intra-operating system isolation mechanism called a silo provides for the grouping of processes running on a single computer using a single instance of the operating system. The operating system divides the system into multiple side-by-side and/or nested environments enabling the partitioning and controlled sharing of resources and providing an isolated application environment in which applications can run. More specifically, a system environment may be divided into an infrastructure silo and one or more server silos. Each server silo is provided with its own copy of the device driver name space. Each device is associated with a system device object accessed via a system device functional interface and with a server silo-specific device object accessed via a control device interface. The infrastructure silo populates the silo-specific device name space with the control device interface. The server silo uses the control device interface to create new device object(s) as needed.

Claims

1. A system for creating isolated application environments on a computer comprising:

an operating system kernel that is adapted to;

creating an infrastructure silo and at least one of a plurality of server silos comprising isolated application environments on the computer by creating for a device a first device object having a first device interface and by creating for the device a second device object having a second device interface;

populating a silo-specific device name space with the second device object, the second device object used for creating within the at least one server silo by the at least one server silo a silo-specific device using the second device interface.

2. The system of claim 1, wherein the operating system kernel is further adapted to creating the silo-specific device name space for the at least one server silo, the silo-specific device name space providing a view restricting resources available to each server silo, the view comprising links to a subset of a system device name space.

3. The system of claim 1, wherein the device comprises a named pipe.

4. The system of claim 1, wherein the second device interface enables a create or a delete operation to be performed on the silo-specific device.

5. The system of claim 1, wherein the operating system kernel prohibits the at least one server silo from creating a device using the first device interface.

6. The system of claim 1, wherein the server silo-specific device name space is a silo-specific system objects name space.

7. A method for creating isolated application environments on a single computer using a driver comprising:

creating a first device object associated with a first device interface for a device and creating a second device object associated with a second device interface for the device;

creating a server silo, the server silo comprising an isolated application environment for running applications; and

generating a server silo-specific name space for the server silo, the server-silo specific name space restricting access to a set of resources by providing a view of a subset of a set of system resources.

8. The method of claim 7, further comprising:

populating at least a first portion of the server silo-specific device name space with the second device object.

9. The method of claim 7, further comprising:

creating a device from within the server silo, the device stored in the server silo-specific name space.

10. The method of claim 7, wherein the device is a name pipe.

11. A computer-readable medium comprising computer-executable instructions for:

creating a first device object associated with a first device interface for a device; and

creating a second device object associated with a second device interface for the device.

12. The computer-readable medium of claim 11, comprising further computer-executable instructions for:

creating a server silo, the server silo comprising an isolated application environment for running applications on a single computer.

13. The computer-readable medium of claim 11, comprising further computer-executable instructions for:

generating a server silo-specific name space for the server silo, the server-silo specific name space restricting access to a set of resources by providing a view of a subset of a set of system resources.

14. The computer-readable medium of claim 11, comprising further computer-executable instructions for:

populating at least a first portion of the server silo-specific device name space with the second device object.

15. The computer-readable medium of claim 11, comprising further computer-executable instructions for:

creating a device from within the server silo, the device stored in the server silo-specific name space.

16. The computer-readable medium of claim 11, comprising further computer-executable instructions for:

creating a named pipe device.