Use of rules engine to build namespaces
First Claim
1. A system for restricting access to resources comprising:
- a computing device comprising a processor;
a memory in communication with the processor when the system is operational, said memory having stored therein;
computer-readable instructions that upon execution by the processor cause an operating system module to serve a system environment and an isolated environment within the system environment, the system environment associated with a set of resources represented by a plurality of nodes of a global hierarchy, the isolated environment associated with a view of the set of resources wherein the view comprises a hierarchical arrangement distinct from an arrangement of the global hierarchy such that the view may comprise nodes from the global hierarchy in a dependency relationship that is different from the dependency relationship of the global hierarchy, the hierarchical arrangement of the view comprising a node not found in the global hierarchy;
upon execution by the processor, the operating system module causing the generation of the view by creating a constrained-space-specific hierarchy comprising a subset of the plurality of nodes of the global hierarchy, the subset representing resources accessible to the isolated environment; and
computer-readable instructions that upon execution cause a rules engine to receive and evaluate a set of declarative rules that when applied change the access capabilities for the resources accessible to the isolated environment represented by the view creating the constrained-space-specific hierarchy, wherein the rules engine evaluates the set of rules during construction of the constrained-space-specific hierarchy and associates directives representing the set of rules with nodes in the constrained-space-specific hierarchy, and wherein the constrained-space-specific hierarchy generated by application of the set of rules during construction of the constrained-space-specific hierarchy restricts a set of resources available to at least one process executing in the isolated environment by evaluating the directives during processing and enabling or denying access to a node in the constrained-space-specific hierarchy.
2 Assignments
0 Petitions
Accused Products
Abstract
A containment mechanism provides for the grouping and isolation of multiple processes running on a single computer using a single instance of the operating system. A system environment is divided into one or more side-by-side and/or nested spaces enabling the partitioning and controlled sharing of resources by creating different views of hierarchical name spaces via virtual hierarchies. A set of declarative rules specifying access capabilities may specify a set of filter drivers to be used to limit access to nodes in the hierarchical name space. The rules may be applied in sequence to construct a new name space from an existing one, or to add to an existing hierarchy. Filter drivers are used to limit access to nodes in the new name space or new portion of the name space. Access to nodes can be limited (read-only access instead of read/write) or nodes can be hidden altogether. Rules may be specified in a declarative language such as XML.
-
Citations
16 Claims
-
1. A system for restricting access to resources comprising:
-
a computing device comprising a processor; a memory in communication with the processor when the system is operational, said memory having stored therein; computer-readable instructions that upon execution by the processor cause an operating system module to serve a system environment and an isolated environment within the system environment, the system environment associated with a set of resources represented by a plurality of nodes of a global hierarchy, the isolated environment associated with a view of the set of resources wherein the view comprises a hierarchical arrangement distinct from an arrangement of the global hierarchy such that the view may comprise nodes from the global hierarchy in a dependency relationship that is different from the dependency relationship of the global hierarchy, the hierarchical arrangement of the view comprising a node not found in the global hierarchy; upon execution by the processor, the operating system module causing the generation of the view by creating a constrained-space-specific hierarchy comprising a subset of the plurality of nodes of the global hierarchy, the subset representing resources accessible to the isolated environment; and computer-readable instructions that upon execution cause a rules engine to receive and evaluate a set of declarative rules that when applied change the access capabilities for the resources accessible to the isolated environment represented by the view creating the constrained-space-specific hierarchy, wherein the rules engine evaluates the set of rules during construction of the constrained-space-specific hierarchy and associates directives representing the set of rules with nodes in the constrained-space-specific hierarchy, and wherein the constrained-space-specific hierarchy generated by application of the set of rules during construction of the constrained-space-specific hierarchy restricts a set of resources available to at least one process executing in the isolated environment by evaluating the directives during processing and enabling or denying access to a node in the constrained-space-specific hierarchy. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A method for restricting access to resources, comprising:
-
serving, by an operating system module, a system environment and an isolated environment within the system environment, the system environment associated with a set of resources represented by a plurality of nodes of a global hierarchy, the isolated environment associated with a view of the set of resources wherein the view comprises a hierarchical arrangement distinct from an arrangement of the global hierarchy such that the view may comprise nodes from the global hierarchy in a dependency relationship that is different from the dependency relationship of the global hierarchy, the hierarchical arrangement of the view comprising a node not found in the global hierarchy; causing, by the operating system module, the generation of the view by creating a constrained-space-specific hierarchy comprising a subset of the plurality of nodes of the global hierarchy, the subset representing resources accessible to the isolated environment; and receiving and evaluating, by a rules engine, a set of declarative rules that when applied change the access capabilities for the resources accessible to the isolated environment represented by the view creating the constrained-space-specific hierarchy, wherein the rules engine evaluates the set of rules during construction of the constrained-space-specific hierarchy and associates directives representing the set of rules with nodes in the constrained-space-specific hierarchy, and wherein the constrained-space-specific hierarchy generated by application of the set of rules during construction of the constrained-space-specific hierarchy restricts a set of resources available to at least one process executing in the isolated environment by evaluating the directives during processing and enabling or denying access to a node in the constrained-space-specific hierarchy. - View Dependent Claims (9, 10, 11, 12, 13)
-
-
14. A computer-readable storage medium comprising computer-executable instructions that upon execution by a computing device cause operations comprising:
-
serving, by an operating system module, a system environment and an isolated environment within the system environment, the system environment associated with a set of resources represented by a plurality of nodes of a global hierarchy, the isolated environment associated with a view of the set of resources wherein the view comprises a hierarchical arrangement distinct from an arrangement of the global hierarchy such that the view may comprise nodes from the global hierarchy in a dependency relationship that is different from the dependency relationship of the global hierarchy, the hierarchical arrangement of the view comprising a node not found in the global hierarchy; causing, by the operating system module, the generation of the view by creating a constrained-space-specific hierarchy comprising a subset of the plurality of nodes of the global hierarchy, the subset representing resources accessible to the isolated environment; and receiving and evaluating, by a rules engine, a set of declarative rules that when applied change the access capabilities for the resources accessible to the isolated environment represented by the view creating the constrained-space-specific hierarchy, wherein the rules engine evaluates the set of rules during construction of the constrained-space-specific hierarchy and associates directives representing the set of rules with nodes in the constrained-space-specific hierarchy, and wherein the global hierarchy represents a global object manager name space for the system environment or a global registry for the system environment or a global file system for the system environment and wherein the constrained-space-specific hierarchy represents a view representing a subset of the system object manager name space, or a subset of the global registry name space or a subset of the global file system name space for the isolated environment. - View Dependent Claims (15, 16)
-
Specification