Virtualizing super-user privileges for multiple virtual processes

• US 7,219,354 B1
• Filed: 12/22/2000
• Issued: 05/15/2007
• Est. Priority Date: 12/22/2000
• Status: Expired

• Current Assignee: Alto Dynamics, LLC (IP Investments Group LLC)
• Original Assignee: Ensim Corporation (Techstep ASA)
• Inventors: Keshav, Srinivasan, Huang, Xun Wilson, Estan, Cristian
• Primary Examiner(s): Thomson; William
• Assistant Examiner(s): ZHEN, LI B
• Application Number:
  US09/747,687
• Time in Patent Office: 2,335 Days
• Field of Search: 709100-108, 709/203, 709/330, 713/200, 719/328, 719/330, 718/1, 718/100, 718/102, 726/15
• US Class Current: 719/328
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services

Abstract

Super-user privileges are virtualized by designating a virtual super-user for each of a plurality of virtual processes and intercepting system calls for which actual super-user privileges are required, which are nevertheless desirable for a virtual super-user to perform in the context of his or her own virtual process. In one embodiment, a computer operating system includes multiple virtual processes, such as virtual private servers. Each virtual process can be associated with one or more virtual super-users. When an actual process makes a system call that requires actual super-user privileges, the call is intercepted by a system call wrapper.

Claims

1. A computer-implemented method for virtualizing super-user privileges in a computer operating system including multiple virtual private servers, the method comprising:

associating a user with a first virtual private server, the first virtual private server comprising a first plurality of actual processes executing within the same operating system as a second plurality of actual processes comprising a second virtual private server;

designating the user as a virtual super-user;

intercepting a call to the operating system for which actual super-user privileges are required, the call made by a process located in the operating system, the process owned by the user, wherein intercepting the call to the operating system comprises;

loading a system call wrapper;

saving a pointer to the call to the operating system, wherein the pointer to the call to the operating system comprises a system call vector; and

replacing the pointer to the call to the operating system with a pointer to the system call wrapper, such that the system call wrapper is executed when the call to the operating system is invoked; and

in response to the intercepted call to the operating system pertaining to the first virtual private server;

granting actual super-user privileges to the user; and

allowing execution of the call to the operating system.

2. A computer program product for virtualizing super-user privileges in a computer operating system including multiple virtual private servers, the computer program product comprising a computer-readable medium and computer program code encoded on the medium for:

associating a user with a first virtual private server, the first virtual private server comprising a first plurality of actual processes executing within the same operating system as a second plurality of actual processes comprising a second virtual private server;

designating the user as a virtual super-user;

intercepting a call to the operating system for which actual super-user privileges are required, the call made by a process located in the operating system, the process owned by the user, wherein intercepting the call to the operating system comprises;

loading a system call wrapper;

saving a pointer to the call to the operating system, wherein the pointer to the call to the operating system comprises a system call vector; and

replacing the pointer to the call to the operating system with a pointer to the system call wrapper, such that the system call wrapper is executed when the call to the operating system is invoked; and

granting actual super-user privileges to the user, and allowing execution of the call to the operating system, in response to the intercepted call to the operating system pertaining to the first virtual private server.