Patent ID: 8312043
Filing Date: 2012-11-13
Classification: G06F

Abstract:
1. A method, implemented by a computing system programmed to perform the following, comprising: identifying an access restriction policy for an instance of a program executing in a path container, wherein the path container comprises a path container identifier and provides a confined execution environment for the program instance within a tree structure execution environment having a corresponding tree structure directory with an absolute root directory at a base of the tree, and wherein the access restriction policy defines rules of permitted operations for instances of one or more programs executing within the tree structure execution environment, wherein the rules comprise a non-traversal rule that prevents a process executing within the path container from traversing the tree structure directory towards the absolute root further than a specified directory; generating an instance of the access restriction policy; associating the instance of the access restriction policy with the path container to generate a container-specific policy associated with the path container; and applying, by the computing system, the non-traversal rule of the access restriction policy to the path container.