US 8,479,256 B2Granted

Merging mandatory access control (MAC) policies in a system with multiple execution containers

AssigneeRed Hat, Inc.

InventorsHenri H. van Riel, Daniel J. Walsh, Warren I. Togami, Jr.

Life of this patent

Estimating the term…

Loading patent…

Abstract

Application of a local instance of a general security policy is described. In a system with an instance of a program executing in a path container, a security policy applicable the the instance of the program is managed locally for the path container. The path container provides a confined execution environment for the program instance, and the security policy defines permitted operations for the program an all its instances. The instance of the security policy is associated with the path container, which allows the program instance to “see” management within the path container as though with the security policy, while entities having permissions outside the path container “see” the program instance limited to the path container and its associated security policy instance.

Claims21

Dependent claims

A method comprising:

identifying, by a processor, a security policy for an instance of a program executing in a path container, wherein the path container has a path container identifier and provides a confined execution environment for the instance of the program within a tree structure execution environment having a corresponding tree structure directory, and wherein the security policy is a system-wide security policy that defines permitted operations for all instances of the program within the tree structure execution environment;
generating, by the processor, a modified instance of the system-wide security policy to generate a container-specific security policy for the path container;
applying, by the processor, the container-specific security policy within the path container to separate security of the path container from other path containers within the tree structure execution environment;
managing operation of the instance of the program within the path container based on the container-specific security policy, wherein the container-specific security policy prevents the instance of the program from having visibility into circumstances outside of the path container;
and
managing operation of another program outside of the path container and within the tree structure execution environment, wherein the other program has higher permissions that allow the other program to have visibility into circumstances inside the path container.

3 more elements

A non-transitory machine-readable storage medium having content stored thereon to provide instructions to cause a machine to perform operations including:

identifying a security policy for an instance of a program executing in a path container, wherein the path container has a path container identifier and provides a confined execution environment for the instance of the program within a tree structure execution environment having a corresponding tree structure directory, and wherein the security policy is a system-wide security policy that defines permitted operations for all instances of the program within the tree structure execution environment;
generating a modified instance of the system-wide security policy to generate a container-specific security policy for the path container;
applying the container-specific security policy within the path container to separate security of the path container from other path containers within the tree structure execution environment;
managing operation of the instance of the program within the path container based on the container-specific security policy, wherein the container-specific security policy prevents the instance of the program from having visibility into circumstances outside of the path container;
and
managing operation of another program outside of the path container and within the tree structure execution environment, wherein the other program has higher permissions that allow the other program to have visibility into circumstances inside the path container.

3 more elements

A computer system comprising:

a data storage device to store a security policy for an instance of a program that executes in a path container, wherein the security policy is a system-wide security policy that defines permitted operations for all instances of the program executing within the computer system, and wherein the path container has a path container identifier and provides a confined execution environment for the instance of the program within a tree structure execution environment having a corresponding tree structure directory;
and
a processor, coupled to the data storage device, to execute a policy manager to identify the security policy as corresponding to the instance of the program, generate a modified instance of the system-wide security policy to generate a container-specific security policy for the path container, apply the container-specific security policy within the path container to separate security of the path container from other path containers within the tree structure execution environment, store the instance of the associated instance of the security policy in the data storage device, and manage operation of the instance of the program within the path container based on the container-specific security policy, wherein the container-specific security policy is to prevent the instance of the program from having visibility into circumstances outside of the path container, wherein the policy manager is to manage operation of another program outside of the path container and within the tree structure execution environment, wherein the other program has higher permissions that allow the other program to have visibility into circumstances inside the path container.

Dependencies are inferred from the claim text.