Patent ID: 7882227
Filing Date: 2011-02-01
Classification: G06F

Abstract:
1. A machine implemented method, comprising: registering a particular portion of a first file system of a first container as being sharable, wherein the particular portion of the first file system comprises a file, wherein the first container comprises a first isolated execution environment in a global operating system environment; mounting the particular portion of the first file system to a second file system of a second container, wherein the second container comprises a second isolated execution environment in the global operating system environment; receiving a network packet containing a request to access the file from the second container; determining that the file resides within the particular potion of the first file system, and wherein the first container serves to prevent processes executing within the first container from accessing files in the global operating system environment that are located external to the first container, wherein the global operating system environment and the first isolated execution environment are executed on a computer system; determining, after determining that the file resides within the particular portion of the first file system, that the particular portion of the first file system is sharable; in response to determining that the particular portion of the first file system is shareable, determining that the first container has a first sensitivity label associated therewith; extracting a packet sensitivity label from the network packet; determining whether the packet sensitivity label dominates the first sensitivity label; and in response to determining that the packet sensitivity label dominates the first sensitivity label, granting access to the file using the first container; wherein no sensitivity label is associated with the file, and wherein access to the file is determined without requiring any sensitivity label to be associated with the file.