Filesystem view separation for data confidentiality and integrity using lattice-based security domains

An apparatus, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor, the computer program instructions configured to enforce view separation in a filesystem comprising one or more read-only filesystem overlays deployed on top of a writable base filesystem, the computer program instructions comprising program code configured to:
• associate a set of security domains according to a trust hierarchy, wherein each security domain has a rank representing a trust level relative to one or more other of the security domains;
• responsive to a request to the base filesystem to execute a process, apply a computation to the trust hierarchy to select a target security domain in which the process should execute;
• and
• based on the computation, launch the process in the target security domain.

A computer program product in a non-transitory computer readable medium, the computer program product holding computer program instructions to enforce view separation in a filesystem comprising one or more read-only filesystem overlays deployed on top of a writable base filesystem, the computer program instructions comprising program code configured to:

• associate a set of security domains according to a trust hierarchy, wherein each security domain has a rank representing a trust level relative to one or more other of the security domains;
• responsive to a request to the base filesystem to execute a process, apply a computation to the trust hierarchy to select a target security domain in which the process should execute;
• and
• based on the computation, launch the process in the target security domain.