Data protection for computing device

An apparatus comprising:

• at least one processor;
• and
• a non-transitory computer readable medium storing executable instructions that when executed by the at least one processor cause the at least one processor to:
• store data loss prevention (DLP) restriction data in a memory device associated with an operating system of a computing device, the DLP restriction data including a DLP control identifying at least one content attribute of restricted content and a restriction to a computer function when the restricted content is rendered on a display of the computing device, the operating system including a first software container executing a native application and a second software container executing a virtual application;
• detect, by a window manager of the operating system, a first display event generated by the first software container, the first display event including a content attribute of content to be rendered on the display;
• detect, by the window manager, a second display event generated by the second software container, the second display event including a content attribute of content to be rendered on the display;
• detect, by the window manager, that the content attribute from the first display event or the content attribute from the second display event corresponds to the at least one content attribute in the DLP control;
• and
• restrict the computer function during a period of time in which the restricted content is rendered on the display.

A non-transitory computer-readable medium storing executable instructions that, when executed by at least one processor, cause the at least one processor to execute operations, the operations comprising:

• receiving data loss prevention (DLP) restriction data, the DLP restriction data including a DLP control identifying at least one content attribute of restricted content and a restriction to a computer function when the restricted content is rendered on a display of a computing device;
• storing the DLP restriction data in a memory device associated with an operating system of the computing device, the operating system including a first software container executing a native application and a second software container executing a virtual application;
• detecting, by a window manager of the operating system, a first display event generated by the first software container, the first display event including a content attribute of content to be rendered on the display;
• detecting, by the window manager, a second display event generated by the second software container, the second display event including a content attribute of content to be rendered on the display;
• detecting, by the window manager, that the content attribute from the first display event or the content attribute from the second display event corresponds to at least one content attribute of the DLP control;
• and
• restricting the computer function during a period of time in which the restricted content is rendered on the display.