Method and apparatus for handling security of an application and its extension

A non-transitory computer-readable storage medium having instructions stored therein, which when executed by a computer, cause the computer to perform a method, the method comprising:

• launching, by an application manager of an operating system running within a data processing system, an application in a first sandboxed environment based on a first security profile associated with the application;
• receiving a request from the application for accessing a function of an application extension that is associated with the application;
• in response to the request, launching, by the application manager, the application extension in a second sandboxed environment based on a second security profile associated with the application extension;
• determining, by the operating system, that the application is authorized to communicate with the application extension and that the application extension is authorized to communicate with the application based on the first and second security profiles, wherein the application extension is associated with or maps to the application;
• and
• individually enforcing security and managing resources of the application and the application extension in the first and second sandboxed environments based on the first and second security profiles for communications between the application and the application extension, respectively, wherein the second security profile specifies resources that are different than the first security profile.

A data processing system, comprising:

• a processor;
• and
• a memory coupled to the processor for storing instructions, which when executed from the memory, cause the processor to
• launch an application in a first sandboxed environment based on a first security profile associated with the application,
• receive a request from the application for accessing a function of an application extension that is associated with the application,
• in response to the request, launch the application extension in a second sandboxed environment based on a second security profile associated with the application extension,
• determine, by an operating system, that the application is authorized to communicate with the application extension and that the application extension is authorized to communicate with the application based on the first and second security profiles, wherein the application extension is associated with or maps to the application, and
• individually enforce security and manage resources of the application and the application extension in the first and second sandboxed environments based on the first and second security profiles for communications between the application and the application extension, respectively, wherein the second security profile specifies resources that are different than the first security profile.

A computer-implemented method, comprising:

• launching, by an application manager of an operating system running within a data processing system, an application in a first process address space;
• in response to a request received from the application for invoking an application extension associated with the application, launching, by the application manager, the application extension in a second process address space;
• determining, by the operating system, that the application is authorized to communicate with the application extension and that the application extension is authorized to communicate with the application based on the first and second security profiles, wherein the application extension is associated with or maps to the application, and
• synchronizing, via an inter-process call (IPC) mechanism, graphical user interface (GUI) content between the application and the application extension running within the first and second process address spaces, respectively, without requiring the application extension to be executed within the first process address space.

A computer-implemented method, comprising:

• receiving a request for upgrading an application executed as a first process of an operating system of a data processing system, the application invoking a plugin that is executed as a second process of the operating system, wherein the plugin is associated with or maps to the application;
• in response to the request, determining whether the plugin is being used by a user of the data processing system and whether the plugin is deactivated by the user;
• providing an option to the user to deactivate the plugin;
• allowing upgrading of the application if the plugin is not being used by the user or if the plugin deactivated;
• deferring upgrading of the application if the plugin is being used by the user and the plugin is not deactivated;
• and
• synchronizing user interactions with graphical user interface (GUI) content between the application and the plugin executed as the first and second processes, respectively.