ISOLATING PROCESSES USING ASPECTS

• US 20100218261A1
• Filed: 02/26/2009
• Published: 08/26/2010
• Est. Priority Date: 02/26/2009
• Status: Abandoned Application

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Schneider, James P.
• Application Number:
  US12/393,992
• Publication Number:
  US 20100218261A1
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs

Abstract

A system and method for receiving a request to load a computer application into a memory for execution, analyzing the computer application to identify one or more join points, injecting aspect computer code into the computer application at the one or more join points, wherein the aspect computer code to regulate the execution of restricted operations initiated by the computer application based on a restricted operations profile associated with the aspect computer code, and executing the computer application having the aspect computer code injected therein.

Claims

1. A computer-implemented method comprising:

receiving, at a computing device, a request to load a computer application into a memory of the computing device for execution;

analyzing, by the computing device, the computer application to identify one or more join points;

injecting, by the computing device, aspect computer code into the computer application at the one or more join points, the aspect computer code to regulate the execution of restricted operations initiated by the computer application based on a restricted operations profile associated with the aspect computer code; and

executing the computer application having the aspect computer code injected therein.

2. The method of claim 1, wherein receiving the request to load a computer application into the memory for execution comprises one of:

receiving the request at a process loader for an operating system, wherein the process loader loads all processes to be executed by the operating system;

receiving the request at an application programming interface (API), wherein the API to receive all load requests on behalf of the operating system and transmit corresponding process load requests to the operating system; and

receiving the request within the operating system where the operating system calls the process loader to load processes on behalf of the operating system.

3. The method of claim 1, wherein the computer application comprises an executable image of machine computer code.

4. The method of claim 3, where analyzing the computer application to identify the one or more join points comprises analyzing the executable image of machine computer code in the memory to identify one or more of:

function entry points in the executable image of machine computer code;

function exit points in the executable image of machine computer code;

block boundary entry points in the executable image of machine computer code;

block boundary exit points in the executable image of machine computer code; and

operating system calls in the executable image of machine computer code.

5. The method of claim 3, wherein the executable image of machine computer code corresponds to one of:

a compiled computer program; and

a compiled computer code interpreter.

6. The method of claim 4, wherein:

the aspect computer code comprises executable machine computer code; and

wherein injecting the aspect computer code into the computer application at the one or more join points comprises injecting the executable machine computer code into the executable image of machine computer code in the memory.

7. The method of claim 1, wherein the restricted operations profile comprises a listing of operations which are restricted by the aspect computer code when initiated by the computer application, wherein the listing of operations is selected from the group comprising:

requests to load executable code after an initial process load associated with the computer application;

requests to access memory locations which are not allocated to the computer application;

requests to make executable memory locations writable;

requests to make writable memory locations executable;

requests to commit modifications to dynamically linked libraries; and

requests to self-modify the executing computer application.

8. The method of claim 1, wherein the aspect computer code to regulate the execution of restricted operations initiated by the computer application comprises:

the aspect computer code to compare computer operations requested by the computer application at the join points against the restricted operations profile, and

perform one of the following events based on the restricted operations profile;

allow execution of a computer operation requested by the computer application without modification;

allow execution of the computer operation requested by the computer application as modified by the aspect computer code;

silently fail the computer operation requested by the computer application, wherein the aspect code prevents the execution of the computer operation requested without notifying the computer application;

silently pass the computer operation requested by the computer application, wherein the aspect code allows the execution of the computer operation requested without notifying the computer application;

terminate the computer operation requested by the computer application, wherein the aspect code prevents the execution of the computer operation requested and notifies the computer application of the termination; and

false pass the computer operation requested by the computer application, wherein the aspect code prevents the execution of the computer operation requested and returns a successful execution message to the computer application.

9. A computer-readable medium, having instructions stored thereon that, when executed by a processor, perform a method comprising:

receiving a request to load a computer application into a memory of a computing device for execution;

analyzing the computer application to identify one or more join points;

injecting aspect computer code into the computer application at the one or more join points, the aspect computer code to regulate the execution of restricted operations initiated by the computer application based on a restricted operations profile associated with the aspect computer code; and

executing the computer application having the aspect computer code injected therein.

10. The computer-readable medium of claim 9, wherein the computer application comprises an executable image of machine computer code, and wherein analyzing the computer application to identify the one or more join points comprises analyzing the executable image of machine computer code in the memory to identify one or more of:

function entry points in the executable image of machine computer code;

function exit points in the executable image of machine computer code;

block boundary entry points in the executable image of machine computer code;

block boundary exit points in the executable image of machine computer code; and

operating system calls in the executable image of machine computer code.

11. The computer-readable medium of claim 9, wherein the aspect computer code comprises executable machine computer code;

and wherein

injecting the aspect computer code into the computer application at the one or more join points comprises injecting the executable machine computer code into the executable image of machine computer code in the memory.

12. The computer-readable medium of claim 9, wherein the restricted operations profile comprises a listing of operations which are restricted by the aspect computer code when initiated by the computer application, wherein the listing of operations is selected from the group comprising:

requests to load executable code after an initial process load associated with the computer application;

requests to access memory locations which are not allocated to the computer application;

requests to make executable memory locations writable;

requests to make writable memory locations executable;

requests to commit modifications to dynamically linked libraries; and

requests to self-modify the executing computer application.

13. A computing device comprising:

a memory coupled with a processor loader to receive a request to load a computer application into the memory for execution;

a code analyzer coupled with a processor and the memory to analyze the computer application and identify one or more join points;

a code injector coupled with the processor and the memory to inject aspect computer code into the computer application at the one or more join points, the aspect computer code to regulate the execution of restricted operations initiated by the computer application based on a restricted operations profile associated with the aspect computer code; and

the processor to execute the computer application having the aspect computer code injected therein.

14. The computing device of claim 13, wherein the code analyzer to analyze the computer application and identify one or more join points comprises the code analyzer to analyze the computer application in the memory for one or more of:

a function entry point in the computer application;

a function exit points in the computer application;

a block boundary entry points in the computer application;

a block boundary exit points in the computer application; and

an operating system calls in the computer application.

15. The computing device of claim 13, wherein:

the computer application comprises an executable image of machine computer code;

the aspect computer code comprises executable machine computer code; and

wherein

the code injector to inject the aspect computer code into the computer application at the one or more join points comprises the code injector to inject the executable machine code into the executable image of machine computer code in the memory.

16. The computing device of claim 13, wherein the aspect computer code to regulate the execution of restricted operations initiated by the computer application comprises:

the aspect computer code, when executed by the processor, to compare computer operations requested by the computer application at the join points against the restricted operations profile, and perform one of the following events based on the restricted operations profile;

allow execution of a computer operation requested by the computer application without modification;

allow execution of the computer operation requested by the computer application as modified by the aspect computer code;

silently fail the computer operation requested by the computer application, wherein the aspect code prevents the execution of the computer operation requested without notifying the computer application;

silently pass the computer operation requested by the computer application, wherein the aspect code allows the execution of the computer operation requested without notifying the computer application;

terminate the computer operation requested by the computer application, wherein the aspect code prevents the execution of the computer operation requested and notifies the computer application of the termination; and

false pass the computer operation requested by the computer application, wherein the aspect code prevents the execution of the computer operation requested and returns a successful execution message to the computer application.

17. A computer-implemented method comprising:

executing, in a computing device, a computer application having aspect code injected therein at one or more join points, the aspect computer code to regulate the execution of restricted operations initiated by the computer application based on a restricted operations profile associated with the aspect computer code;

receiving, in the computing device, a request from the computer application to perform an operation;

determining, via the aspect code executing in the computing device, whether the operation requested by the computer application is a restricted operation based on the restricted operations profile; and

interrupting, via the aspect code executing in the computing device, the operation requested by the computer application when the operation is determined to be a restricted operation or permitting execution of the operation requested when the operation is determined not to be a restricted operation.

18. The computer-implemented method of claim 17, wherein interrupting, via the aspect code executing in the computing device, the operation requested by the computer application when the operation is determined to be a restricted operation comprises the computer application performing one or more of the following events:

terminating requests initiated by the computer application to load executable code after an initial process load associated with the computer application;

terminating requests initiated by the computer application to access memory locations which are not allocated to the computer application;

terminating requests initiated by the computer application to make executable memory locations writable;

terminating requests initiated by the computer application to make writable memory locations executable;

terminating requests initiated by the computer application to commit modifications to dynamically linked libraries; and

terminating requests initiated by the computer application to self-modify the executing computer application.

19. The computer-implemented method of claim 18, wherein the computer application executing in the computing device further performs one or more events selected from the group comprising:

returning an error code to the computer application indicating that the operation requested by the computer application was terminated after terminating the request initiated by the computer application; and

returning a false pass to the computer application indicating that the operation requested by the computer application was successfully performed after terminating the request initiated by the computer application.

20. The computer-implemented of claim 17, wherein the computer application having the aspect code injected therein comprises one of the following:

a computer program compiled into an executable image of machine computer code having aspect code in machine code format injected at the one or more join points; and

a computer code interpreter compiled into the executable image of machine computer code having aspect code in machine code format injected at the one or more join points.