公开(公告)号：US20180218148A1

公开(公告)日：2018-08-02

申请号：US15417955

申请日：2017-01-27

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Michela D'Errico ,  Leon Frank Ehrenhart ,  Chris I. Dalton ,  Michael John Wray ,  Siani Pearson ,  Dennis Heinze

IPC: G06F21/53 ,  G06F17/30

CPC classification number: G06F21/53 ,  G06F16/245 ,  G06F2221/033

Abstract: Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

公开(公告)号：US10650138B2

公开(公告)日：2020-05-12

申请号：US15417955

申请日：2017-01-27

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Michela D'Errico ,  Leon Frank Ehrenhart ,  Chris I. Dalton ,  Michael John Wray ,  Siani Pearson ,  Dennis Heinze

IPC: G06F21/53 ,  G06F16/245

Abstract: Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

公开(公告)号：US09628516B2

公开(公告)日：2017-04-18

申请号：US14919258

申请日：2015-10-21

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： Siani Pearson ,  Archie Reed ,  Marco Casassa Mont ,  Gina Kounga ,  Liqun Chen

IPC: H04L29/06

CPC classification number: H04L63/20 ,  H04L63/0442 ,  H04L63/045 ,  H04L63/0464 ,  H04L63/061 ,  H04L63/0876 ,  H04L63/123

Abstract: Compliance to a policy about how to treat data in a computer network environment is ensured by checking that conditions in the policy are satisfied by the entity before access to the data is provided.