Domain-based isolation and access control on dynamic objects

A computer program product for performing domain-based access control for granular isolation on a data processing system, the computer program product comprising:

• a computer-readable storage device having computer-readable program code embodied therewith, wherein the computer-readable program code, when executed by a data processing system, causes the data processing system to:
• assign one or more first domain tags to a dynamic object that is created by a first process that is executing on the data processing system;
• assign one or more second domain tags to a second process that is executing on the data processing system;
• and
• evaluate the first and second domain tags according to one or more enforced rules to determine whether to grant or deny the second process access to data associated with the dynamic object, wherein the one or more enforced rules include a first rule that specifies that a domain set of the dynamic object is required to be a subset of a domain set of the second process, a second rule that specifies that the domain set of the dynamic object is required to share one or more common domains with the domain set of the second process, and a third rule that specifies a denial domain set that takes precedence over the first and second rules when the domain set of the second process includes a domain in the denial domain set.

A data processing system, comprising:

• a memory;
• and
• a processor core coupled to the memory, wherein the processor core is configured to:
• assign one or more first domain tags to a dynamic object that is created by a first process that is executing on the data processing system;
• assign one or more second domain tags to a second process that is executing on the data processing system;
• and
• evaluate the first and second domain tags according to one or more enforced rules to determine whether to grant or deny the second process access to data associated with the dynamic object, wherein the one or more enforced rules include a first rule that specifies that a domain set of the dynamic object is required to be a subset of a domain set of the second process, a second rule that specifies that the domain set of the dynamic object is required to share one or more common domains with the domain set of the second process, and a third rule that specifies a denial domain set that takes precedence over the first and second rules when the domain set of the second process includes a domain in the denial domain set.