Limited execution environment of a monolithic kernel

Abstract

Embodiments of the present systems and methods may provide additional security mechanisms within the operating system kernel itself by isolating portions of the kernel to protect them from attack. For example, in an embodiment, a computer-implemented method implemented in a computer, the computer including a processor, a memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method may include: creating a namespace in the operating system kernel space in the memory of the computer, creating an address space for the namespace, the address space mapping only kernel objects owned by the namespace, and providing access to only kernel objects owned by the namespace to at least one user process using a combined page table.

Description

Background Art

[0001] The present invention relates to techniques for providing additional security mechanisms within the operating system kernel itself by isolating portions of the kernel to protect them from attack.

[0002] The Linux operating system kernel is a monolithic, meaning that all code and data are linked together and there is no mandatory separation between different parts of the code or data. This means that exploitable flaws in the interface can allow an attacker to gain unrestricted access to kernel resources. Since flaws like this often occur, a mechanism is needed to limit the damage that may be caused by such exploitation. For example, suppose there is an exploitable flaw in the file system. If an attacker exploits this flaw, he can gain access to other subsystems (such as memory allocators, networking stacks, schedulers, etc.), even if those subsystems do not contain exploitable flaws. This is due to the lack of security mechanisms within the kernel itself, because the kernel is built as a single block of code.

[0003] Thus, a need has arisen for techniques to provide additional security mechanisms within the operating system kernel itself. Summary of the invention

[0004] Embodiments of the present systems and methods may provide additional security mechanisms within the operating system kernel itself by isolating portions of the kernel to protect them from attack.

[0005] For example, in an embodiment, a computer-implemented method implemented in a computer, the computer including a processor, a memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method may include: creating a namespace in an operating system kernel space in the memory of the computer, creating an address space for the namespace, the address space mapping only kernel objects owned by the namespace, and using a combined page table to provide only access to kernel objects owned by the namespace to at least one user process.

[0006] In an embodiment, creating an address space for a namespace may include: generating a namespace page table including a kernel space mapping for kernel objects owned by the namespace, and constructing a combined page table, the combined page table being accessible by at least one user process, the combined page table including a user space page table and a namespace page table of the user process. The operating system is a Linux operating system. The namespace is a namespace type selected from a mount namespace, a process ID namespace, a network namespace, an inter-process communication namespace, a UTS namespace, a user ID namespace, and a control group namespace. The method may further include destroying the namespace by destroying the combined page table, the namespace page table, and the kernel objects owned by the namespace.

[0007] In an embodiment, a system may include a processor, a memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor to: create a namespace in an operating system kernel space in the memory of the computer, create an address space for the namespace that maps only kernel objects owned by the namespace, and use a combined page table to provide at least one user process with access only to kernel objects owned by the namespace.

[0008] In an embodiment, a computer program product may include a non-volatile computer-readable storage device having program instructions embodied therewith, the program instructions being executable by a computer to cause the computer to perform a method comprising: creating a namespace in an operating system kernel space in a memory of the computer, creating an address space for the namespace that maps only kernel objects owned by the namespace, and providing access to only kernel objects owned by the namespace to at least one user process using a combined page table. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The details of the present invention, both as to its structure and operation, may be best understood by reference to the accompanying drawings, in which like reference numerals and designations refer to like elements.

[0010] Figure 1 is an exemplary block diagram of key objects in an operating system kernel (eg, the Linux kernel).

[0011] Figure 2 is an exemplary block diagram of a core structure according to an embodiment of the present system and method.

[0012] Figure 3 is an exemplary block diagram of a page table implementation that may be used by embodiments of the present systems and methods.

[0013] Figure 4 is an exemplary block diagram of a test implementation of an embodiment of the present system and method.

[0014] Figure 5 is an exemplary block diagram of a computer system in which the processes involved in the embodiments described herein may be implemented. DETAILED DESCRIPTION

[0015] Embodiments of the present systems and methods may provide additional security mechanisms within the operating system kernel itself by isolating portions of the kernel to protect them from attack.

[0016] A namespace is a domain of kernel objects that are logically grouped together to serve a group of processes. The main purpose of a namespace is to allow the same object name to be reused in a namespace while addressing different kernel objects. That is, a namespace is a construct within the kernel that can be used to avoid name conflicts in user space. For example, in a specific "user" namespace, usernames must be unique. However, the same username can be reused across different user namespaces. This is the same concept for pid namespaces (separated by process IDs), network namespaces (separated by network device names), etc. Currently, all data objects belonging to all namespaces are mapped in memory, regardless of the current namespace being used. This potentially allows access to the wrong object by exploiting a flaw in the interface.

[0017] Embodiments of the present system and method may provide a security mechanism that isolates certain parts of the kernel and protects them from attacks that attempt to access objects from different namespaces. Embodiments may provide multiple address spaces within the kernel and may isolate kernel objects at the namespace level. Each namespace may have its own address space and will only map kernel objects owned by that namespace.

[0018] In an embodiment, when an object residing outside the current namespace is needed (eg, when performing memory allocation inside a network stack), an IPC (inter-process communication) mechanism may be used.

[0019] Figure 1 An exemplary block diagram of key objects in an operating system kernel 100 (such as the Linux kernel) is shown in FIG. In this example, the kernel 100 may include a process ID 102, a task structure 104, an nsproxy 106, a network namespace 108, a sock layer 110, a network device (net_device) 112, and a socket layer 114. The process ID 102 may be a numeric value, represented by the data type pid_t, which may uniquely identify each process for the system. The task structure 104 may be a process descriptor of type task_struct (in<linux / sched.h> 104) and may be an element in a task list. Each task structure 104 may contain information about a particular process or thread that is running, such as a process identified by a process ID 102. Task structure 104 points to an associated network namespace, such as network namespace 108.

[0020] Socket 114 is a file descriptor pointing to a network connection for inter-process communication, which can be any type of communication within the kernel, between user processes, between different machines, etc. There are many different types of sockets, and different types of sockets can use different communication protocols. In this example, socket 114 is a general representation of different types of sockets, and can interact with user space directly through the system interface. Socket 114 can point to the type of intermediate interface, sleeve 110, and sleeve 110 points to an instance of network namespace 108. Network namespace 108 can divide other kernel objects (such as task structure 104, socket layer 114, sleeve 110, and network device 112) into logical groups. At any time when kernel code interacts with a specific socket (such as socket 114), the kernel code must be in the associated network namespace (such as network namespace 108) or in the default namespace.

[0021] Network device 112 represents any specific network hardware or interface. For example, user space code can access network device 112 using a device name such as "eth0". In kernel space, eth0 would refer to network device 112 that also belongs to a specific network namespace 108. This mechanism provides the ability to isolate which user processes have access to which devices. Likewise, any code running on behalf of a process associated with task structure 104 points to an associated network namespace, such as network namespace 108, and the code then runs on behalf of that network namespace.

[0022] In an embodiment, when any code running on behalf of a process associated with a task structure 104 and associated with a network namespace 108 attempts to access an object, the embodiment can ensure that the object also belongs to the same network namespace 108. This provides isolation of objects from user processes because the address space of the network namespace 108 is separate. It should be noted that the description of embodiments of the present system and method is provided with reference to a network namespace. However, this is merely an example. An operating system kernel (e.g., a Linux kernel) can utilize many different types of namespaces, and embodiments of the present system and method are equally applicable to those other types of namespaces. Examples of the types of namespaces to which the present system and method are applicable include: mount (mnt) namespace - a mount namespace controls mount points; a process ID (pid) namespace - a PID namespace provides a process with a set of process IDs (PIDs) that is independent of other namespaces; a network (net) namespace - a network namespace virtualizes a network stack; an interprocess communication (ipc) namespace - an IPC namespace isolates processes from SysV-style interprocess communication; a UTS namespace - a UTS namespace allows a single system to appear to have different hosts and domain names for different processes; a user ID (user) namespace - a user namespace provides both permission isolation and user identity isolation across multiple sets of processes; a control group (cgroup) namespace - a cgroup namespace type hides the identity of the control group of which a process is a member, etc.

[0023] Figure 2 An exemplary block diagram of a kernel structure 200 according to an embodiment of the present system and method is shown in FIG. In this example, the structure 200 may include a kernel space 202 and a user space 204. The kernel space 202 may include code and data residing in an elevated system state, and it may include a protected memory space and full access to hardware. The user space 204 may include user applications, which may be executed with reduced privileges, wherein the user application may only access a subset of a subset of the available resources of the hardware and software. Applications in the user space 204 cannot directly execute certain system functions, directly access hardware, access memory outside of the memory allocated to them by the kernel, etc. In order for an application in the user space 204 to access other system resources, the application may make a system call 206 to request the kernel to perform certain functions of the application.

[0024] like Figure 2As shown, kernel space 202 may include a general address space 208 and a restricted address space 210. General address space 208 may include general kernel resources, such as page table 216, file 214, etc. Restricted address space 210 may include multiple namespaces 212A-N. Each namespace 212A-N is an address space linked to a specific namespace, and each namespace protects multiple sub-kernel objects such as devices, network sockets, and associated buffers. In an embodiment, in order to provide an address space to each namespace 212A-N, the memory of each namespace in the kernel may be reorganized so that objects owned by different namespaces may be mapped in separate memory pages / areas. When a namespace such as namespace 212A is created, an address space (memory page directory) belonging to the specific namespace may also be created. All kernel data objects mapped in the address space of namespace 212A belong to namespace 212A. Each time a system call 206 is called that acts on a data object from a particular namespace, such as namespace 212A, the address space of that namespace must be activated. When a namespace is destroyed, the address space is also destroyed along with all mapped kernel objects.

[0025] Kernel code that acts on data objects belonging to a namespace, such as namespace 212A, must all be mapped into the address space of namespace 212A. Other kernel code, such as functions that cannot be called from within a namespace, should not be mapped because it is impossible to access unmapped data objects.

[0026] Figure 3 An example of a page table implementation that can be used by an embodiment of the present system and method is shown. For example, the current version of the Linux kernel includes a feature called kernel page table isolation (PTI) to mitigate certain security vulnerabilities and improve kernel security. PTI completely separates user space and kernel space page tables. For example, user space page table 304N includes user space address mapping and a minimum kernel space mapping set to provide system calls, interrupts, and exceptions. Kernel space page table 302N includes both kernel space 306N and user space 307N address mappings, but it is only used when the system is running in kernel mode. User space page table 304N and kernel space page table 302N form PTI pair 308N together. As shown in this example, user space page tables 302A-N can be established for each user process in user space 204, and kernel space page tables 304A-N can be established for each user process in kernel space 202.

[0027] In an embodiment, page tables may be isolated based on namespace mapping page tables using an additional page table for each namespace. Figure 3As shown, the network namespace 310 may be associated with a namespace kernel page table 312 that is isolated to the namespace. Kernel mappings for the namespace may be established in the kernel page table 312. For example, when a task runs within the namespace 310 and attempts to access an object, the task may not use the regular kernel page table 304A / 302A for the process, but instead, a new page table constructed from the user portion 304A kernel page table 304A / 302A and the kernel portion from the namespace kernel page table 312 may be used to form a kernel space page table 316 isolated to the namespace 310. The kernel space page table 316 may then provide access to all objects belonging to the namespace and all common objects, and in addition, may provide access to user objects and user code for that particular task.

[0028] In an embodiment, when namespace 310 is initially created, an address space, such as memory page table 312, may be created for namespace 310. When a userspace process or task (such as user process / task 304A) requests to perform an action on a kernel object, the address space (page table 312) of namespace 310 that owns those objects may be activated, and it may be ensured that only those kernel objects owned by namespace 310 are mapped in page table 316 available to userspace process / task 304. When namespace 310 is destroyed, page table 316 may be destroyed along with all mapped kernel objects.

[0029] An exemplary test implementation of the present system and method is performed in Figure 4404. In this example, srv 402 (a TCP / IP server program) may be listening on a specific TCP / IP port (veth0 404) that belongs to the default namespace. User space programs, progl 406 and prog2 408, may be TCP clients connected to port veth1 410. User space programs progl 406 and prog2 408 may be running within a specific network namespace 412, which means that progl 406 and prog2 408 are associated with a task structure that points to namespace 412. Port veth1 410 may be an instance of a network device that also belongs to namespace 412. Therefore, only progl 406 and prog2 408 may use port veth1 410. Port veth1 410 may be connected to veth0 404, which belongs to the default namespace and is outside namespace 412, via bridge br0 414. Thus, prog1 406 can open a TCP socket to connect to server srv 402, which is outside of namespace 412. Prog2 408 can pass the TCP socket and still use it to connect to srv 402, because the TCP socket is within namespace 412. However, if the TCP socket is passed to, for example, prog3 416, which is outside of namespace 412, prog3 416 will not be able to connect to srv 402 using either the socket or veth1 410, because prog3 416 will not have access to both the socket and veth1 410.

[0030] Figure 5 An exemplary block diagram of a computer system 500 is shown in which the processes involved in the embodiments described herein may be implemented. The computer system 500 may be implemented using one or more programmed general-purpose computer systems (e.g., embedded processors, systems on a chip, personal computers, workstations, server systems, and minicomputers or mainframe computers) or in a distributed networked computing environment. The computer system 500 may include one or more processors (CPUs) 502A-502N, input / output circuits 504, network adapters 506, and memory 508. The CPUs 502A-502N execute program instructions to perform the functions of the present communication systems and methods. Typically, the CPUs 502A-502N are one or more microprocessors, such as INTEL processor. Figure 5An embodiment in which the computer system 500 is implemented as a single multi-processor computer system is shown, in which multiple processors 502A-502N share system resources, such as memory 508, input / output circuits 504, and network adapter 506. However, the present communication systems and methods also include embodiments in which the computer system 500 is implemented as multiple networked computer systems, which may be single-processor computer systems, multi-processor computer systems, or a mixture thereof.

[0031] Input / output circuitry 504 provides the ability to input data to or output data from computer system 500. For example, input / output circuitry may include input devices such as keyboards, mice, touch pads, trackballs, scanners, analog-to-digital converters, etc., output devices such as video adapters, monitors, printers, etc., and input / output devices such as modems, etc. Network adapter 506 interfaces device 500 to a network 510. Network 510 may be any public or private LAN or WAN, including but not limited to the Internet.

[0032] The memory 508 stores program instructions executed by the CPU 502 and data used and processed by the CPU 502 to perform the functions of the computer system 500. The memory 508 may include, for example, electronic memory devices such as random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc., as well as electromechanical storage such as a disk drive, a tape drive, an optical drive, which may use an integrated drive electronics (IDE) interface or a variation or enhancement thereof, such as enhanced IDE (EIDE) or ultra direct memory access (UDMA), or an interface based on a small computer system interface (SCSI) or a variation or enhancement thereof, such as fast SCSI, wide SCSI, fast and wide SCSI, serial advanced technology attachment (SATA) or a variation or enhancement thereof, or a fiber channel arbitrated loop (FC-AL) interface.

[0033] The contents of memory 508 may vary depending on the functions that computer system 500 is programmed to perform. Figure 5 In the illustrated example, exemplary memory contents representing routines and data for embodiments of the above-described processes are shown. However, those skilled in the art will recognize that, based on well-known engineering considerations, these routines and memory contents associated with these routines may not be included in one system or device, but may be distributed among multiple systems or devices. The present communication systems and methods may include any and all such arrangements.

[0034] exist Figure 5In the example shown, memory 508 may include kernel space 512, user space 514, and other operating system routines 522. Kernel space 202 may include code and data residing in an elevated system state, and it may include protected memory space and full access to hardware. Kernel space 202 may include a general address space 516 and a restricted address space 518. General address space 516 may include general kernel resources, such as page tables, files, etc. Restricted address space 518 may include multiple namespaces 520A-N. Each namespace 520A-N is an address space linked to a specific namespace, and each namespace protects multiple sub-kernel objects such as devices, network sockets, and associated buffers. User space 514 may include user applications that can be executed with reduced privileges, where they can only access a subset of the available resources of hardware and software. Other operating system routines 522 may provide additional system functions.

[0035] like Figure 5 As shown, the communication system and method may include implementations on one or more systems that provide multi-processor, multi-tasking, multi-process and / or multi-threaded computing, as well as implementations on systems that only provide single-processor, single-threaded computing. Multi-processor computing involves using more than one processor to perform computing. Multi-tasking computing involves using more than one operating system task to perform computing. A task is an operating system concept that refers to a combination of an executing program and bookkeeping information used by the operating system. Whenever a program is executed, the operating system creates a new task for it. A task is like an envelope for a program because it identifies the program with a task number and attaches other bookkeeping information to the program. Many operating systems (including Linux, and ) are capable of running many tasks simultaneously and are known as multitasking operating systems. Multitasking is the ability of an operating system to execute more than one executable file at the same time. Each executable file runs in its own address space, which means that the executable files cannot share any of their memory. This has advantages because it is impossible for any program to damage the execution of any other program running on the system. However, there is no way for programs to exchange any information except through the operating system (or by reading files stored on the file system). Multiprocess computing is similar to multitasking computing in that the terms task and process are often used interchangeably, although some operating systems distinguish between the two.

[0036] The present invention may be a system, method and / or computer program product of any possible integrated technical detail level. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform aspects of the present invention. A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device.

[0037] The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device (such as a punch card or a raised structure in a groove with instructions recorded thereon), and any suitable combination of the foregoing. As used herein, a computer readable storage medium should not be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0038] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives computer-readable program instructions from the network and forwards these computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0039] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and procedural programming languages, such as "C" programming language or similar programming languages. The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, by using the Internet of an Internet service provider). In some embodiments, an electronic circuit (including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA)) can execute a computer-readable program instruction to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform aspects of the present invention.

[0040] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each box of the flowchart and / or block diagram and the combination of boxes in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0041] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine that is executed by a processor of a computer or other programmable data processing device to create a device for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that may direct a computer, a programmable data processing device, and / or other device to function in a particular manner, such that a computer-readable storage medium having instructions stored therein includes an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0042] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operating steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0043] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to different embodiments of the present invention.To this end, each box in the flow chart or block diagram can represent a part of a module, segment or instruction, which includes one or more executable instructions for realizing the logical function of the specification.In some alternative embodiments, the function marked in the box may not occur in the order marked in the figure.For example, depending on the function involved, the two boxes shown in succession can actually be performed substantially at the same time, or these boxes can sometimes be performed in reverse order.It will also be noted that each box in the block diagram and / or flow chart and the combination of the boxes in the block diagram and / or flow chart can be realized by a system based on special-purpose hardware, and the system based on special-purpose hardware performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

[0044] Although specific embodiments of the present invention have been described, those skilled in the art will appreciate that there are other embodiments that are equivalent to the described embodiments. Therefore, it should be understood that the present invention is not limited to the specific embodiments described, but only to the scope of the appended claims.

Claims

1. A computer-implemented method implemented in a computer, the computer comprising a processor, a memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method comprising: creating a namespace in an operating system kernel space in the memory of the computer; Creating an address space for the namespace, the address space mapping only kernel objects owned by the namespace, wherein creating an address space for the namespace comprises: generating a namespace page table, the namespace page table comprising kernel space mappings for kernel objects owned by the namespace; and constructing a combined page table accessible by at least one user process, the combined page table comprising a user space page table of the user process and the namespace page table; and Using a combined page table provides access to kernel objects owned by the namespace only to at least one user process.

2. The method of claim 1, wherein: The operating system is the Linux operating system.

3. The method of claim 2, wherein: The namespace is a namespace type selected from the following: an installation namespace, a process ID namespace, a network namespace, an inter-process communication namespace, a UTS namespace, a user ID namespace, and a control group namespace.

4. The method of claim 1 further comprises destroying the namespace by destroying the combined page table, the namespace page table, and the kernel objects owned by the namespace.

5. A system comprising a processor, a memory accessible by the processor, and computer program instructions stored in the memory and operable by the processor to: creating a namespace in an operating system kernel space in the memory of the computer; Creating an address space for the namespace, the address space mapping only kernel objects owned by the namespace, wherein creating the address space of the namespace comprises: generating a namespace page table, the namespace page table comprising kernel space mappings for kernel objects owned by the namespace; and constructing a combined page table accessible by at least one user process, the combined page table comprising a user space page table of the user process and the namespace page table; and Using a combined page table provides access to kernel objects owned by the namespace only to at least one user process.

6. The system of claim 5, wherein: The operating system is the Linux operating system.

7. The system of claim 6, wherein: The namespace is a namespace type selected from the following: an installation namespace, a process ID namespace, a network namespace, an inter-process communication namespace, a UTS namespace, a user ID namespace, and a control group namespace.

8. The system of claim 5, further comprising destroying the namespace, comprising destroying the combined page table, the namespace page table, and the kernel objects owned by the namespace.

9. A computer program product comprising a non-transitory computer-readable storage device having program instructions embodied therewith, the program instructions being executable by a computer to cause the computer to perform a method comprising: creating a namespace in an operating system kernel space in a memory of the computer; Creating an address space for the namespace, the address space mapping only kernel objects owned by the namespace, wherein creating the address space of the namespace comprises: generating a namespace page table, the namespace page table comprising kernel space mappings for kernel objects owned by the namespace; and constructing a combined page table accessible by at least one user process, the combined page table comprising a user space page table of the user process and the namespace page table; and Using a combined page table provides access to kernel objects owned by the namespace only to at least one user process.

10. The computer program product of claim 9, wherein: The operating system is the Linux operating system.

11. The computer program product of claim 10, wherein: The namespace is a namespace type selected from the following: an installation namespace, a process ID namespace, a network namespace, an inter-process communication namespace, a UTS namespace, a user ID namespace, and a control group namespace.

12. The computer program product of claim 9, further comprising destroying the namespace, including destroying the combined page table, the namespace page table, and the kernel objects owned by the namespace.

Images