Operating system integrated application isolation
AssigneeRed Hat Israel, Ltd.
InventorsSimcha Zacks, Oded Ramraz
Life of this patent
Estimating the term…
Abstract
A system, method, and apparatus for operating system integrated application isolation. A snapshot manager creates a snapshot table including one or more pointers to a file system storage. Then an application is installed on an operating system and mapped to a snapshot table. The snapshot manager receives a request by the application to access a memory block. The snapshot manager determines whether the application has permission to access the memory block. Responsive to a determination that the application has permission to access the memory block, the snapshot manager permits access to the memory block.
Claims20
A system comprising:
- a memory, including a file system storage;
- a processor, in communication with the memory;
- an operating system, executing on the processor, including a file system;
- and
- a snapshot manager, executing on the processor,
- wherein the processor:
- creates, by the snapshot manager, a first snapshot table, wherein the first snapshot table includes one or more pointers to the file system storage;
- subsequent to the creation of the first snapshot table, installs a first application on the operating system, wherein the first application is mapped, by the snapshot manager, to the first snapshot table;
- receives, by the snapshot manager, a first request, by the first application, to access a first memory block of the memory;
- determines, by the snapshot manager, whether the first application has permission to access the first memory block;
- responsive to a determination that the first application has permission to access the first memory block, permits, by the snapshot manager, access to the first memory block.
A method comprising:
- creating, by a snapshot manager executing on a processor, a first snapshot table, wherein the first snapshot table includes one or more pointers to the file system storage;
- subsequent to the creation of the first snapshot table, installing a first application on an operating system executing on the processor, wherein the first application is mapped, by the snapshot manager, to the first snapshot table;
- receiving, by the snapshot manager, a first request, by the first application, to access a first memory block of the memory;
- determining, by the snapshot manager, whether the first application has permission to access the first memory block;
- responsive to a determination that the first application has permission to access the first memory block, permitting, by the snapshot manager, access to the first memory block.
A computer-readable non-transitory storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to:
- create, by a snapshot manager executing on the computer system, a first snapshot table, wherein the first snapshot table includes one or more pointers to the file system storage;
- subsequent to the creation of the first snapshot table, installing a first application on an operating system executing on the computer system, wherein the first application is mapped, by the snapshot manager, to the first snapshot table;
- receiving, by the snapshot manager, a first request, by the first application, to access a first memory block of the memory;
- determining, by the snapshot manager, whether the first application has permission to access the first memory block;
- responsive to a determination that the first application has permission to access the first memory block, permitting, by the snapshot manager, access to the first memory block.
Dependencies are inferred from the claim text.