Filesystem access for web applications and native code modules
AssigneeGoogle Inc.
InventorsEric J. Uhrhane, Matthew Papakipos
Life of this patent
Estimating the term…
Abstract
One embodiment provides a system that facilitates the execution of a web application. During operation, the system allocates a storage space on one or more storage devices for use by the web application. Next, the system creates, for the web application, a private filesystem comprising a private root directory within the storage space. Finally, the system enables access to the private filesystem for the web application through the private root directory in a manner that does not allow access to a host filesystem associated with the one or more storage devices from the web application.
Claims32
A computer-implemented method for providing filesystem services to a web application on a computing system, comprising:
- allocating a filesystem storage space on one or more storage devices for use by the web application;
- creating, for the web application, a private filesystem comprising a private root directory within the filesystem storage space;
- providing a programmatic interface on the computing system for use by code of the web application and through which the web application accesses the private filesystem;
- and
- managing filesystem access according to filesystem security criteria, wherein the filesystem security criteria include web application-specific criteria that allow the web application to access the private filesystem through the private root directory and do not allow the web application to access a host filesystem associated with the one or more storage devices, and wherein managing the filesystem access according to the filesystem security criteria includes:
- allowing access from a first module used by the web application to a file in a first region within the private filesystem and preventing access from the first module to a file in any other region within the private filesystem, and
- allowing access from a different, second module used by the web application to a file in a different, second region within the private filesystem and preventing access from the second module to a file in any other region within the private filesystem.
A system for providing filesystem services to a web application, comprising:
- a processor;
- one or more storage devices coupled to the processor;
- and
- a file system manager executed by the processor, wherein the file system manager is configured to perform a method comprising:
- allocating filesystem storage space on the one or more storage devices for use by the web application;
- creating, for the web application, a private filesystem comprising a private root directory within the filesystem storage space;
- providing a programmatic interface on the system for use by the web application and through which the web application accesses the private filesystem;
- and
- managing filesystem access according to filesystem security criteria, wherein the filesystem security criteria include web application-specific criteria that allow the web application to access the private filesystem through the private root directory and do not allow the web application to access a host file system associated with the one or more storage devices, and wherein managing the filesystem access according to the filesystem security criteria includes:
- allowing access from a first module used by the web application to a file in a first region within the private filesystem and preventing access from the first module to a file in any other region within the private filesystem, and
- allowing access from a different, second module used by the web application to a file in a different, second region with the private filesystem and preventing access from the second module to a file in any other region within the private filesystem.
A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for providing filesystem services to a web application on the computer, the method comprising:
- allocating a filesystem storage space on one or more storage devices for use by the web application;
- creating, for the web application, a private filesystem comprising a private root directory within the filesystem storage space;
- providing a programmatic interface on the computer for use by the web application and through which the web application accesses the private filesystem;
- managing filesystem access according to filesystem security criteria, wherein the filesystem security criteria include web application-specific criteria that allow the web application to access the private filesystem through the private root directory and do not allow the web application to access a host filesystem associated with the one or more storage devices, and wherein managing the filesystem access according to the filesystem security criteria includes:
- allowing access from a first module used by the web application to a file in a first region within the private filesystem and preventing access from the first module to a file in any other region within the private filesystem, and
- allowing access from a different, second module used by the web application to a file in a different, second region within the private filesystem and preventing access from the second module to a file in any other region within the private filesystem.
Dependencies are inferred from the claim text.