System services for native code modules

A computer-implemented method comprising:

• receiving, by a computing system, a plurality of entries to be included in a service registry of the computing system, wherein each entry identifies a respective service module on the computing system and at least one system service provided by the respective service module;
• executing a first native code module in a secure runtime environment of the computing system according to a first security policy that specifies permissions for the first native code module to access services of the computing system;
• identifying a request for access to a first system service from the first native code module;
• examining entries of the service registry to identify a first service module that provides the first system service;
• examining the first security policy to determine whether the first security policy restricts access to the first system service from the first native code module;
• selecting the first service module to provide the first system service to the first native code module responsive to a determination that the first security policy does not restrict access to the first system service from the first native code module;
• and
• executing the first service module in a first instance of a limited runtime environment that executes the first service module with a first set of reduced privileges, wherein the first set of reduced privileges restricts access from the first service module to resources on the computing system.

One or more non-transitory computer-readable storage devices having instructions stored thereon that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

• receiving a plurality of entries to be included in a service registry, wherein each entry identifies a respective service module and at least one system service provided by the respective service module;
• executing a first native code module in a secure runtime environment according to a first security policy that specifies permissions for the first native code module to access services;
• identifying a request for access to a first system service from the first native code module;
• examining entries of the service registry to identify a first service module that provides the first system service;
• examining the first security policy to determine whether the first security policy restricts access to the first system service from the first native code module;
• selecting the first service module to provide the first system service to the first native code module responsive to a determination that the first security policy does not restrict access to the first system service from the first native code module;
• and
• executing the first service module in a first instance of a limited runtime environment that executes the first service module with a first set of reduced privileges, wherein the first set of reduced privileges restricts access from the first service module to system resources.