Patent ID: 7496576

Claim:
A system for isolating access to a named resource comprising: a processor, wherein the processor is configured to execute an operating system, the operating system implementing an Access Control List (“ACL”) and upon receiving a request to start a first process by a first user: initiate the first process in an isolated execution environment; create a first namespace; associate the first namespace with the first process; associate a credential of the first user with the first namespace; upon receiving a request by the first process to pass a named resource to a second process running by a second user in a second isolated execution environment: create a second namespace using the first namespace; associate the credential of the first user with the second namespace; provide a reference to the resource to the second process, wherein the reference comprises a first handle to the resource, a name and an open handle to the second namespace; upon receiving a request by the second process to open the resource, resolve the resource name using the second namespace; and when the credentials associated with the second namespace in comparison with the ACL of the requested resource are sufficient: create a second handle for the resource; associate the second handle with the second namespace; and return the second handle to the second process, wherein the operating system includes a kernel that creates the first and second namespace upon request.