Domain based management of partitions and resource groups

A system, comprising:

• a processor;
• a domain based isolation monitor executable by the processor to:
• responsive to determining that an operation is being attempted on an object, determine whether the object corresponds to a software partition;
• responsive to determining that the object corresponds to a software partition, determine a partition identifier associated with the object, the partition identifier indicating one or more software partitions corresponding to the object;
• determine a domain identifier associated with a user attempting the operation;
• access domain isolation rules indicating rules for allowing or disallowing operations to proceed on the partition based on partition identifiers and domain identifiers;
• determine whether the operation can proceed on the partition based on the domain isolation rules by determining whether the domain identifier associated with the user is a permitted domain for the partition identifier corresponding to the object;
• and
• responsive to determining that the operation on the partition can proceed based on the domain isolation rules by determining that the domain identifier a permitted domain for the partition identifier, permit the operation.

A computer program product for domain based partition management, the computer program product comprising:

• a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising computer readable program code configured to:
• responsive to determining that an operation is being attempted on an object, determine whether the object corresponds to a software partition;
• responsive to determining that the object corresponds to a software partition, determine a partition identifier associated with the object, the partition identifier indicating one or more software partitions corresponding to the object;
• determine a domain identifier associated with a user attempting the operation;
• access domain isolation rules indicating rules for allowing or disallowing operations to proceed on the partition based on partition identifiers and domain identifiers;
• and
• determine whether the operation can proceed on the partition based on the domain isolation rules by determining whether the domain identifier associated with the user is a permitted domain for the partition identifier corresponding to the object;
• and
• responsive to determining that the operation on the partition can proceed based on the domain isolation rules by determining that the domain identifier a permitted domain for the partition identifier, permit the operation.

A method, comprising:

• receiving an identifier of an object on which an operation is being attempted;
• determining a domain identifier of a user attempting the operation;
• determining whether the domain identifier of the user attempting the operation is hierarchically linked to a parent domain identifier;
• responsive to determining that the domain identifier of the user attempting the operation is hierarchically linked to a parent domain identifier, determining whether the operation can proceed on the object based on the parent domain identifier and domain isolation rules;
• permitting the operation in response to determining that the operation is permitted based on the parent domain identifier;
• determining whether the operation corresponds to a resource group;
• responsive to determining that the operation corresponds to a resource group, determining a resource group identifier associated with the operation;
• and
• determining whether the operation can proceed based on the domain isolation rules, the domain isolation rules indicating rules for allowing or disallowing operations to proceed based on resource group identifiers and domain identifiers.