Operating system integrated application isolation

Patent metadata

Field	Value
Publication number	US-10417142-B2
Application number	US-201615185684-A
Country	US
Kind code	B2
Filing date	Jun 17, 2016
Priority date	Jun 17, 2016
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

A system, method, and apparatus for operating system integrated application isolation. A snapshot manager creates a snapshot table including one or more pointers to a file system storage. Then an application is installed on an operating system and mapped to a snapshot table. The snapshot manager receives a request by the application to access a memory block. The snapshot manager determines whether the application has permission to access the memory block. Responsive to a determination that the application has permission to access the memory block, the snapshot manager permits access to the memory block.

First claim

The invention is claimed as follows:

1. A system comprising:
a memory, including a file system storage;
a processor, in communication with the memory;
an operating system, executing on the processor, including a file system; and
a snapshot manager, executing on the processor, wherein the processor:
creates, by the snapshot manager, a first snapshot table, wherein the first snapshot table includes a copy of the file system, the copy of the file system including pointers to the file system storage;
subsequent to the creation of the first snapshot table, installs a first application on the operating system, the first application including a first file and a second file, wherein the first application is mapped, by the snapshot manager, to the first snapshot table;
receives, by the snapshot manager, a first request, by the first application, to access a first memory block of the memory;
determines, by the snapshot manager, whether the first application has permission to access the first memory block;
responsive to a determination that the first application has permission to access the first memory block, permits, by the snapshot manager, access to the first memory block;
installs a different version of the first application on the operating system such that a plurality of versions of the first application are installed, the different version of the first application including different respective versions of the first file and the second file, wherein the different version of the first application is mapped, by the snapshot manager, to a second snapshot table; and
uninstalls all files included in the first application, including deleting, by the snapshot manager, the first snapshot table and the second snapshot table, such that each of the different respective versions of the first file and the second file for each of the different versions of the first application are uninstalled.

2. The system of claim 1 , wherein the file system is stored in a first area of the memory and data of the first application is stored in a second area of the memory separate from the first area.

3. The system of claim 1 , wherein mapping, by the snapshot manager, the first application to the first snapshot table includes updating the first snapshot table to include a first pointer to the storage location of the first application in the memory.

4. The system of claim 1 , wherein determining, by the snapshot manager, whether the first application has permission to access the first memory block includes determining whether the first memory block has been allocated to the first application.

5. The system of claim 1 , wherein the snapshot manager further determines whether the first application's access to the first memory block requires a write operation.

6. The system of claim 1 , wherein responsive to a determination that the first application does not have permission to access the first memory block because the first memory block has been allocated to a second application, the processor further determines, whether the first memory block allocated to the second application should be shared with the first application.

7. The system of claim 6 , wherein responsive to determining that the first memory block should be shared with the first application, the processor further permits, by the snapshot manager, access to the first memory block via an application program interface of the snapshot manager.

8. A method comprising:
creating, by a snapshot manager executing on a processor, a first snapshot table, wherein the first snapshot table includes a copy of the file system, the copy of the file system including one or more pointers to the file system storage;
subsequent to the creation of the first snapshot table, installing a first application on an operating system executing on the processor, the first application including a first file and a second file, wherein the first application is mapped, by the snapshot manager, to the first snapshot table;
receiving, by the snapshot manager, a first request, by the first application, to access a first memory block of the memory;
determining, by the snapshot manager, whether the first application has permission to access the first memory block;
responsive to a determination that the first application has permission to access the first memory block, permitting, by the snapshot manager, access to the first memory blocks;
installing a different version of the first application on the operating system such that a plurality of versions of the first application are installed, the different version of the first application including different respective versions of the first file and the second file, wherein the different version of the first application is mapped, by the snapshot manager, to a second snapshot table; and
uninstalling all files included in the first application, including deleting, by the snapshot manager, the first snapshot table and the second snapshot table, such that each of the different respective versions of the first file and the second file for each of the different versions of the first application are uninstalled.

9. The method of claim 8 , wherein the file system is stored in a first area of the memory and data of the first application is stored in a second area of the memory separate from the first area.

10. The method of claim 8 , wherein mapping the first application to the first snapshot table includes updating the first snapshot table to include a first pointer to the storage location of the first application in the memory.

11. The method of claim 8 , wherein determining whether the first application has permission to access the first memory block includes determining whether the first memory block has been allocated to the first application.

12. The method of claim 8 , further comprising determining, by the snapshot manager, whether the first application's access to the first memory block requires a write operation.

13. The method of claim 8 , further comprising responsive to a determination that the first application does not have permission to access the first memory block because the first memory block has been allocated to a second application, determining, whether the first memory block allocated to the second application should be shared with the first application.

14. The method of claim 13 , further comprising responsive to determining that the first memory block should be shared with the first application, permitting, by the snapshot manager, access to the first memory block via an application program interface of the snapshot manager.

15. A computer-readable non-transitory storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to:
create, by a snapshot manager executing on the computer system, a first snapshot table, wherein the first snapshot table includes a copy of the file system, the copy of the file system including one or more pointers to the file system storage;
subsequent to the creation of the first snapshot table, installing a first application on an operating system executing on the computer system, the first application including a first file and a second file, wherein the first application is mapped, by the snapshot manager, to the first snapshot table;
receiving, by the snapshot manager, a first request, by the first application, to access a first memory block of the memory;
determining, by the snapshot manager, whether the first application has permission to access the first memory block;
responsive to a determination that the first application has permission to access the first

Assignees

• Red Hat Israel Ltd

Inventors

• Zacks Simcha
• Ramraz Oded

Classifications

• G06F3/0673

  Single storage device · CPC title

• G06F3/0637

  Permissions · CPC title

• G06F3/0622

  in relation to access · CPC title

• G06F3/065

  Replication mechanisms · CPC title

• G06F3/0683

  Plurality of storage devices · CPC title