Patent ID: 8677449
Filing Date: 2014-03-18
Classification: G06F

Abstract:
1. A method performed by a system of one or more computers, the method comprising: executing a virtual machine on a host operating system; mounting a synthetic file system on the virtual machine to expose the synthetic file system to a plurality of guest applications executing on the virtual machine, wherein the synthetic file system is configured to provide a plurality of system calls to the guest applications including at least a read operation or a write operation for reading from or writing to an external data repository storing data outside the virtual machine; receiving a first system call of the plurality of system calls at the synthetic file system for the read operation or the write operation from a first guest application of the plurality of guest applications; determining that the first guest application is not authorized for the first system call by a security policy associated with the synthetic file system, wherein determining that the first guest application is not authorized for the first system call by the security policy comprises: denying access to the external data repository to the first guest application.