Application execution in a restricted application execution environment

1. A computer-implemented method comprising performing computer-implemented operations for:

intercepting an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource;

determining if the intercepted API call is blocked by the restricted application execution environment;

in response to determining that the intercepted API call is blocked by the restricted application execution environment, modifying the blocked API call before the blocked API call is executed within the restricted application execution environment;

creating a shadow resource within the restricted application execution environment; and

causing the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource.

2. The computer-implemented method of claim 1 , wherein the modifying the blocked API call before the blocked API is executed within the restricted application execution environment further comprises:

executing remediation code to reformat the blocked API call before it is executed within the restricted application execution environment; and

executing the reformatted API call within the restricted application execution environment.

3. The computer-implemented method of claim 1 , wherein determining if the intercepted API call is blocked by the restricted application execution environment further comprises determining whether the intercepted API call is described in a runtime remediation database.

4. The computer-implemented method of claim 3 , wherein the runtime remediation database comprises a database storing data identifying API calls that are blocked by the restricted application execution environment.

5. The computer-implemented method of claim 4 , wherein the runtime remediation database is generated by:

intercepting API calls made by the external application before the API calls are to be executed within the restricted application execution environment;

determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment; and

for each API call blocked from execution within the restricted application execution environment, storing data in the runtime remediation database that identifies the blocked API call.

6. The computer-implemented method of claim 5 , wherein determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment comprises determining whether the API calls are identified in a security rules database.

7. The computer-implemented method of claim 6 , wherein the security rules database comprises a database storing data indicating whether API calls are allowed to execute within the restricted application execution environment.

8. The computer-implemented method of claim 4 , wherein the runtime remediation database is generated by performing a static analysis on the external application to identify API calls that are blocked from execution within the restricted application execution environment.

9. The computer-implemented method of claim 1 , wherein the restricted application execution environment comprises an operating system that restricts the use of legacy APIs.

10. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

intercept an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource;

determine if the intercepted API call is blocked by the restricted application execution environment;

in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before the blocked API call is executed within the restricted application execution environment;

create a shadow resource within the restricted application execution environment; and

cause the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource.

11. The computer-readable storage medium of claim 10 , wherein modifying the blocked API call before the blocked API call is executed within the restricted application execution environment further comprises executing remediation code to reformat the blocked API call before the blocked API call is executed within the restricted application execution environment.

12. The computer-readable storage medium of claim 10 , wherein determining if the intercepted API call is blocked for execution within the restricted application execution environment further comprises determining whether the API call is described in a database that stores data identifying API calls that are blocked from execution within the restricted application execution environment.

13. The computer-readable storage medium of claim 12 , wherein the database is generated by:

intercepting API calls made by the external application before the API calls are to be executed within the restricted application execution environment;

determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment; and

for each API call blocked from execution within the restricted application execution environment, storing data in the database that identifies the blocked API call.

14. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to:

provide a learning mode of operation in which application programming interface (API) calls made by an application external to a restricted application execution environment are intercepted before the API calls are executed within the restricted application execution environment and in which data are stored in a database for each intercepted API call, wherein the API calls are directed toward a secure resource; and

at a runtime of the external application, intercept an API call made by the external application before the API call is to be executed within the restricted application execution environment, utilize the database to determine if the intercepted API call is blocked by the restricted application execution environment, in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before it is executed within the restricted application execution environment, create a shadow resource comprising a version of the secure resource that is accessible to the modified API call within the restricted application execution environment, and cause the modified API call to be executed against the shadow resource.

15. The computer-readable storage medium of claim 14 , wherein modifying the blocked API call before the blocked API call is executed within the restricted application execution environment further comprises:

executing remediation code to reformat the blocked API call for execution within the restricted application execution environment; and

executing the reformatted API call.

16. A system comprising:

a processor; and

a computer-readable storage medium in communication with the processor, the computer-readable storage medium having executable instructions stored thereupon which, when executed by the processor, cause the processor to

intercept an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource,

determine if the intercepted API call is blocked by the restricted application execution environment,

in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before the blocked API call is executed within the restricted application execution environment,

create a shadow resource within the restricted application execution environment, and

cause the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource.

17. The system of claim 16 , wherein modify the blocked API call before the blocked API is executed within the restricted application execution environment further comprises:

executing remediation code to reformat the blocked API call before it is executed within the restricted application execution environment; and

executing the reformatted API call within the restricted application execution environment.

18. The system of claim 16 , wherein determine if the intercepted API call is blocked by the restricted application execution environment further comprises determining whether the intercepted API call is described in a runtime remediation database.

19. The system of claim 18 , wherein the runtime remediation database comprises a database storing data identifying API calls that are blocked by the restricted application execution environment.

20. The system of claim 19 , wherein the runtime remediation database is generated by:

intercepting API calls made by the external application before the API calls are to be executed within the restricted application execution environment;

determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment; and

for each API call blocked from execution within the restricted application execution environment, storing data in the runtime remediation database that identifies the blocked API call.

21. The system of claim 20 , wherein determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment comprises determining whether the API calls are identified in a security rules database.

22. The system of claim 21 , wherein the security rules database comprises a database storing data indicating whether API calls are allowed to execute within the restricted application execution environment.

23. The system of claim 19 , wherein the runtime remediation database is generated by performing a static analysis on the external application to identify API calls that are blocked from execution within the restricted application execution environment.

24. The system of claim 16 , wherein the restricted application execution environment comprises an operating system that restricts the use of legacy APIs.