Patent ID: 8479256
Filing Date: 2013-07-02
Classification: G06F

Abstract:
1. A method comprising: identifying, by a processor, a security policy for an instance of a program executing in a path container, wherein the path container has a path container identifier and provides a confined execution environment for the instance of the program within a tree structure execution environment having a corresponding tree structure directory, and wherein the security policy is a system-wide security policy that defines permitted operations for all instances of the program within the tree structure execution environment; generating, by the processor, a modified instance of the system-wide security policy to generate a container-specific security policy for the path container; applying, by the processor, the container-specific security policy within the path container to separate security of the path container from other path containers within the tree structure execution environment; managing operation of the instance of the program within the path container based on the container-specific security policy, wherein the container-specific security policy prevents the instance of the program from having visibility into circumstances outside of the path container; and managing operation of another program outside of the path container and within the tree structure execution environment, wherein the other program has higher permissions that allow the other program to have visibility into circumstances inside the path container.