Trusted execution of binaries and modules
AssigneeVMware, Inc.
InventorsMukund Gunti, Christoph Klee
Life of this patent
Estimating the term…
Abstract
A computer system mechanism is provided that restricts execution of binaries, such as applications, kernel modules, shared libraries, on the computing system to only those that have been installed by an approved mechanism. The approved mechanism acts as a single entry point on the computing for installing new binaries. Any change in file content or metadata taints an executable file and prevents execution by the kernel. Files copied over and not installed via, the approved mechanism will not be executed.
Claims20
A method for trusted execution of an application on a computing system having an operating system, the method comprising:
- receiving an indication to install a package comprising a plurality of executable files;
- mounting the package at a pre-determined location in a filesystem of the computing system;
- installing the plurality of executable files contained within the package in locations of an in-memory filesystem;
- and
- modifying, by execution of a kernel of the operating system, a trusted execution bit associated with each of the executable files.
The method of claim I, further comprising:
- responsive to receiving an indication to execute a target file, determining whether the target file has an associated trusted execution bit that is valid;
- and
- executing the target file having the associated trusted execution bit that is valid.
A non-transitory computer-readable storage medium comprising instructions that, when executed in a computing device, provide trusted execution of an application on a computing system having an operating system, by performing the steps of:
- receiving an indication to install a package comprising a plurality of executable files;
- mounting the package at a pre-determined location in a filesystem of the computing system;
- installing the plurality of executable files contained within the package in locations of an in-memory filesystem;
- and
- modifying, by execution of a kernel of the operating system, a trusted execution bit associated with each of the executable files.
A computer system for trusted execution of an application, the computer system comprising:
- a system memory comprising an in-memory filesystem;
- a storage device comprising a persistent filesystem;
- a processor programmed to carry out the steps of:
- receiving an indication to install a package comprising a plurality of executable files;
- mounting the package at a pre-determined location in the persistent filesystem of the storage device;
- installing the plurality of executable files contained within the package in locations of the in-memory filesystem;
- and
- modifying, by execution of a kernel of an operating system, a trusted execution bit associated with each of the executable files.
Dependencies are inferred from the claim text.