Back to results
US 11,886,605 B2Granted
Differentiated file permissions for container users
AssigneeRed Hat, Inc.
InventorGiuseppe Scrivano
Life of this patent
Estimating the term…
Abstract
Systems, methods, and machine-readable instructions stored on machine-readable media are disclosed for copying a first permission of a file to a second permission of the file, wherein the file is stored on a host file system. The first permission is changed to a third permission. A request is received to access the file from a container file system. In response to the request and before providing the container file system with access to the file, changing the third permission to the second permission. The file is provided to the container file system based on the second permission.
Claims19
A method comprising:
- copying a first restrictive permission of a file to a second restrictive permission of the file, wherein the file is stored on a host file system;
- changing, using a converter, the first restrictive permission to a third less-restrictive permission;
- receiving, from the host file system, a first request to access the file;
- accessing the file through the host file system, the host file system's access being based on the third less-restrictive permission;
- receiving, from a container file system, a second request to access the file;
- in response to the second request and before providing the container file system with access to the file, changing, using the converter, a permission that is used to access the file from the third less-restrictive permission to the second restrictive permission;
- and
- accessing the file through the container file system, the container file system's access being based on the second restrictive permission, wherein the container file system is executing in an operating environment that is isolated from an operating environment of the host file system.
5 more elements
A system comprising:
- a non-transitory memory;
- and
- one or more hardware processors coupled to the non-transitory memory to execute instructions from the non-transitory memory to perform operations comprising:
- storing a file with a first restrictive permission in a host file system;
- creating an extended attribute corresponding to the file and storing a second restrictive permission in the extended attribute, wherein the second restrictive permission is equivalent to the first restrictive permission;
- changing, using a converter, the first restrictive permission to a third less-restrictive permission, wherein the first restrictive permission and the third less-restrictive permission are different;
- receiving a first request from a first requester using the host file system to access the file;
- in response to the first request, accessing the file, by the first requester, through the host file system, the host file system's access being based on the third less-restrictive permission;
- receiving a second request from a second requester using a container file system to access the file;
- before providing the file to the second requester, changing, using a converter, a permission that is used to access the file from the third less-restrictive permission to the stored second restrictive permission;
- and
- in response to the second request, accessing the file, by the second requester, through the container file system, the container file system's access being based on the second restrictive permission, wherein the container file system is executing in an operating environment that is isolated from an operating environment of the host file system.
9 more elements
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause at least one machine to perform operations comprising:
- creating an extended attribute of a file stored in a host file system and storing a second restrictive permission in the extended attribute, wherein the second restrictive permission is copied from a first restrictive permission associated with the file;
- changing, using a converter, the first restrictive permission to a third less-restrictive permission;
- in response to receiving a request from a user of the host file system to access the file, accessing the file through the host file system, the host file system's access being based on the third less-restrictive permission;
- and
- in response to receiving a request from a user of a container file system to access the file, changing, using the converter, a permission that is used to access the file from the third less-restrictive permission to the second restrictive permission without writing to the third less-restrictive permission, such that the user of the container file system accesses the file through the container file system, the container file system's access being based on the second restrictive permission, wherein the container file system is executing in an operating environment that is isolated from an operating environment of the host file system.
2 more elements
Dependencies are inferred from the claim text.