公开(公告)号：US20180218148A1

公开(公告)日：2018-08-02

申请号：US15417955

申请日：2017-01-27

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Michela D'Errico ,  Leon Frank Ehrenhart ,  Chris I. Dalton ,  Michael John Wray ,  Siani Pearson ,  Dennis Heinze

IPC: G06F21/53 ,  G06F17/30

CPC classification number: G06F21/53 ,  G06F16/245 ,  G06F2221/033

Abstract: Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

公开(公告)号：US10650138B2

公开(公告)日：2020-05-12

申请号：US15417955

申请日：2017-01-27

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Michela D'Errico ,  Leon Frank Ehrenhart ,  Chris I. Dalton ,  Michael John Wray ,  Siani Pearson ,  Dennis Heinze

IPC: G06F21/53 ,  G06F16/245

Abstract: Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.