Operating System Context Isolation via Resource Manifest Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional operating systems lack the ability to isolate applications and control resource access effectively, leading to potential interference and security risks due to shared global namespaces, where applications may inadvertently or maliciously access and overwrite each other's resources.
Innovation Solution
The operating system employs a context construct that includes an installation service, configuration service, and activation service to manage and isolate applications by declaring required resources in a manifest, ensuring only declared resources are accessible to the executing software, thereby preventing access to unintended global resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a global namespace is used for resource access, then applications can access any resource freely, but applications cannot be isolated and may interfere with each other
Solution Approach 1:
The global namespace is segmented into application-specific namespaces, where each application receives only the resources it declares it needs. The operating system creates isolated execution contexts that partition the global resource pool, preventing applications from accessing resources outside their designated namespace while maintaining full access to declared resources.
2Ease of operation
If ACLs are used for access control, then user-level access control is provided, but the operating system cannot control access based on application identity
Solution Approach 1:
An intermediary layer is introduced between the application and the resource access mechanism. The operating system acts as a mediator that intercepts resource access requests, verifies them against the application's declared requirements in its manifest, and grants or denies access accordingly. This intermediary control mechanism enables application-level security policies without requiring changes to user-level ACLs.
3Productivity
If applications assume access to global namespace, then resource availability is maximized, but malicious programs can compromise system integrity
Solution Approach 1:
The operating system performs preliminary actions by requiring applications to declare their resource requirements in advance through manifests during installation or configuration. Based on these pre-declared requirements, the system configures isolated namespaces and access permissions before the application executes. This preliminary configuration ensures that applications can access all resources they legitimately need while preventing them from accessing undeclared resources, thereby maintaining system security.
Data Source
AI summary
The resources needed by an application to execute are declared by the application. When the application is activated, only the declared resources are made available to the application because only the declared resources are connected to the execution environment. Accessibility to resources may be controlled by the operating system by making the resource visible or invisible to the executing software by mapping a local name used by the executing software to a global resource, possibly limiting the type of access allowed. Because the executing software relies on the mapping function performed by the operating system for access to resources, and the operating system only maps names declared by the software, the operating system can isolate the software, and prevent the application from accessing undeclared global resources.