Application execution in a restricted application execution environment

A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

• intercept an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource;
• determine if the intercepted API call is blocked by the restricted application execution environment;
• in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before the blocked API call is executed within the restricted application execution environment;
• create a shadow resource within the restricted application execution environment;
• and
• cause the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource.

A system comprising:

• a processor;
• and
• a computer-readable storage medium in communication with the processor, the computer-readable storage medium having executable instructions stored thereupon which, when executed by the processor, cause the processor to
• intercept an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource,
• determine if the intercepted API call is blocked by the restricted application execution environment,
• in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before the blocked API call is executed within the restricted application execution environment,
• create a shadow resource within the restricted application execution environment, and
• cause the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource.