Filtering policies for evaluation by an embedded machine
Some embodiments provide a method for limiting data passed between an application and a process virtual machine (VM) embedded in the application that authorizes API (Application Programming Interface) calls to the application. The method receives a policy code comprising references to a group of parameters. The method modifies the policy code to remove references in the policy code to a set of the parameters that are not used during evaluation of the policy. The method generates a set of binary instructions from the modified policy code, where the process VM does not use the set of parameters while executing the binary instructions to make an authorization decision for a particular API call.
1. A method for limiting data passed between an application and a process virtual machine (VM) embedded in the application that authorizes API (Application Programming Interface) calls to the application, the method comprising:
receiving a policy code comprising references to a plurality of parameters;
modifying the policy code to remove references in the policy code to a set of the parameters that are not used during evaluation of the policy; and
generating a set of binary instructions from the modified policy code, wherein the process VM does not use the set of parameters while executing the binary instructions to make an authorization decision for a particular API call.
2. The method of claim 1 , wherein the set of parameters is a first set of parameters, wherein a second set of parameters comprises parameters in the plurality of parameters that are not in the first set of parameters, wherein the second set of parameters are provided to the process VM by the application.
3. The method of claim 2 , wherein the first set of parameters are not provided to the process VM by the application.
4. The method of claim 1 , wherein the application received at least one parameter in the plurality of parameters from the particular API call.
5. The method of claim 1 further comprising providing the set of binary instructions to the process VM inside the application.
6. The method of claim 1 further comprising, prior to modifying the policy code, evaluating a portion of the policy.
7. The method of claim 1 , wherein generating the set of binary instructions from the modified policy code comprises compiling the policy code.
8. The method of claim 7 , wherein the set of binary instructions is generated by including one or more policy extension codes in addition to the policy code, wherein a policy extension code defines an extension to the policy, wherein at least one policy extension code is in a different language than the policy code.
9. The method of claim 1 , wherein for each binary instruction in the set of binary instructions, the process VM (i) translates the binary instruction into a binary instruction that is native to the application, and (ii) executes the translated native instruction.
10. The method of claim 1 , wherein the set of binary instructions is a first set of binary instructions, wherein for each binary instruction in the first set of binary instructions, the process VM (i) translates the first set of instructions into a code, (ii) optimizes the translated code for at least one of the application and the host system, (iii) compiles the translated code into a second set of instructions that are native to the application, and (iv) executes the native set of instructions.
11. The method of claim 1 , wherein the application executes within virtualization software executing on a host computer.
12. A non-transitory machine readable medium storing a program which when executed by at least one processing unit limits data passed between an application and a process virtual machine (VM) embedded in the application that authorizes API (Application Programming Interface) calls to the application, the program comprising sets of instructions for:
receiving a policy code comprising references to a plurality of parameters;
modifying the policy code to remove references in the policy code to a set of the parameters that are not used during evaluation of the policy; and
generating a set of binary instructions from the modified policy code, wherein the process VM does not use the set of parameters while executing the binary instructions to make an authorization decision for a particular API call.
13. The non-transitory machine readable medium of claim 12 , wherein the set of parameters is a first set of parameters, wherein a second set of parameters comprises parameters in the plurality of parameters that are not in the first set of parameters, wherein (i) the first set of parameters are not provided to the process VM by the application and (ii) the second set of parameters are provided to the process VM by the application.
14. The non-transitory machine readable medium of claim 12 , wherein the application received at least one parameter in the plurality of parameters from the particular API call.
15. The non-transitory machine readable medium of claim 12 further comprising a set of instructions for providing the set of binary instructions to the process VM inside the application.
16. The non-transitory machine readable medium of claim 12 further comprising a set of instructions for, prior to modifying the policy code, evaluating a portion of the policy.
17. The non-transitory machine readable medium of claim 12 , wherein the set of instructions for generating the set of binary instructions from the modified policy code comprises a set of instructions for compiling the policy code.
18. The non-transitory machine readable medium of claim 17 , wherein the set of binary instructions is generated by including one or more policy extension codes in addition to the policy code, wherein a policy extension code defines an extension to the policy, wherein at least one policy extension code is in a different language than the policy code.
19. The non-transitory machine readable medium of claim 12 , wherein for each binary instruction in the set of binary instructions, the process VM (i) translates the binary instruction into a binary instruction that is native to the application, and (ii) executes the translated native instruction.
20. The non-transitory machine readable medium of claim 12 , wherein the set of binary instructions is a first set of binary instructions, wherein for each binary instruction in the first set of binary instructions, the process VM (i) translates the first set of instructions into a code, (ii) optimizes the translated code for at least one of the application and the host system, (iii) compiles the translated code into a second set of instructions that are native to the application, and (iv) executes the native set of instructions.