Patent ID: 8838644

Claim:
A computer-implemented method for governing access to one or more objects on a filesystem, the method comprising: providing a framework in an operating system environment for support of a plurality of access control list (ACL) types; accepting a plurality of ACL type definitions, each ACL type definition corresponding to at least one of the plurality of ACL types and being implemented by a corresponding kernel extension; and controlling access to a filesystem object in response to receiving a request to control access to the filesystem object, the filesystem object associated with an ACL type, the controlling access comprising: dynamically loading the kernel extension corresponding to the ACL type, the kernel extension implementing the ACL type definition associated with the ACL type; adding to a kernel namespace one or more symbols exported by the dynamically loaded kernel extension; and making the one or more symbols added to the kernel namespace available to one or more subsequently loaded kernel extensions; wherein controlling access to the filesystem object further comprises: storing an indicator of the ACL type in association with the filesystem object; and in response to receiving the request to control access to the filesystem object, retrieving the ACL type definition according to the indicator and governing access to the filesystem object according to the ACL and the retrieved ACL type definition.