Patent ID: 8539481

Claim:
A system for restricting access to resources comprising: a computing device storing instructions that when executed cause: an operating system module to instantiate a system environment, the system environment associated with a global physical hierarchy comprising a plurality of nodes representing resources and an isolated environment within the system environment associated with a view of the global physical hierarchy, the view constraining access of an entity executing in the isolated environment to a subset of the resources and forms a virtual file system hierarchy that is different from a hierarchy in the global physical hierarchy and contains at least one node in addition to the nodes in the global hierarchy, the virtual file system hierarchy comprising a first virtual node with a link to a first physical node in the global physical hierarchy, and a second virtual node with a link to a second physical node in the global physical hierarchy, a relative arrangement of the first and second virtual nodes within the virtual file system hierarchy differing as compared to a relative arrangement of the first and second physical nodes within the global physical hierarchy, the operating system module adapted to generating the view by creation of the virtual file system hierarchy in volatile storage only, the virtual file system hierarchy not persisted to non-volatile storage and wherein the entity's sole access to the subset of the resources is via the virtual file system hierarchy, the operating system module adapted to receiving a first request to access a first node in the virtual file system hierarchy, and, in response to determining that the first node is not a leaf node, responding to the first request by returning a file handle that references the first node, the operating system module adapted to receiving a second request to access a second node in the virtual file system hierarchy, in response to determining that the second node is a leaf node, determining a name used to reference a node in the physical directory; and responding to the second request by returning a file handle that references the name used to reference the node in the physical directory.