Patent ID: 7996841

Claim:
A system for restricting access to resources comprising: a computer device comprising a processor; a memory in communication with the processor when the system is operational; computer instructions stored in the memory that upon execution by the computing device cause an operating system module to serve a system environment, the system environment associated with a global hierarchy comprising a plurality of nodes representing resources; the operating system creating an isolated environment within the system environment by controlling a view of the global hierarchy, the view constraining access of an entity executing in the isolated environment to a subset of the resources and; computer instruction stored in the memory that upon execution cause the operating system module to generate the view by creating a constrained-space-specific hierarchy in volatile storage only, the constrained-space-specific hierarchy not persisted to non-volatile storage and wherein the entity's sole access to the subset of the resources is via the constrained-space-specific hierarchy, the constrained-space-specific hierarchy comprising a subset of the plurality of nodes of the global hierarchy, wherein the global hierarchy represents a system object manager name space for the system environment, wherein the constrained-space-specific hierarchy represents a subset of the system object manager name space for the isolated environment, wherein at least one node in the constrained-space-specific hierarchy represents a link to a system object, wherein the view comprises a hierarchical arrangement distinct from an arrangement of the global hierarchy, such that the nodes of the distinct hierarchical arrangement have a subset nodes of the global hierarchy that are not dependant on one another.