Portable policy execution using embedded machines
Some embodiments provide a method for evaluating authorization policies that restrict access to API (Application Programming Interfaces) calls to an application executing on a host system. At the application, the method receives an API call to execute. The method directs a process virtual machine (VM) executing inside the application to make an authorization decision for the API call. The method executes the API call after receiving an authorization decision to allow the API call from the process VM executing inside the application.
1. A method for evaluating authorization policies that define access to APIs (Application Programming Interfaces) of an application that executes on a machine that is one of a plurality of machines operating on a host computer, the method comprising:
at a process virtual machine (VM) executing within the application that executes on the machine operating on the host computer:
receiving a request from a module of the application, within which the process VM executes, to authorize an API call that the application receives and that is to be executed by the application;
generating an authorization decision for the API call by using a binary process executing within the process VM; and
sending, to the module of the application from which the request is received, an authorization decision to allow the API call, wherein the application executes the requested API call after receiving the authorization decision to allow the API call.
2. The method of claim 1 , wherein the application comprises a native API authorization module executing within the application alongside the process VM the module from which the request is received is a different module than the native API authorization module.
3. The method of claim 1 , wherein the binary process comprises a first set of instructions that is not native to the application, wherein the binary process is executed by the process VM by interpreting each instruction in the first set of instructions as an instruction in a second set of instructions in a second language that is native to the application.
4. The method of claim 1 , wherein the binary process comprises a first set of instructions that is not native to the application, wherein the binary process is executed by the process VM by translating the first set of instructions into a code and compiling the translated code into a second set of instructions that is native to the application.
5. The method of claim 4 , wherein the translated code is optimized for the application before being compiled into the second set of instructions.
6. A method for evaluating authorization policies that define access to APIs (Application Programming Interfaces) of an application that executes on a machine that is one of a plurality of machines operating on a host computer, the method comprising:
at a process virtual machine (VM) executing within the application:
receiving a request from the application, within which the process VM executes, to authorize an API call to be executed by the application;
generating an authorization decision for the API call by (i) generating a set of binary instructions from an API authorization policy code and (ii) authorizing the API call by executing the set of binary instructions; and
sending, to the application within which the process VM executes, an authorization decision to allow the API call, wherein the application executes the requested API call after receiving the authorization decision to allow the API call.
7. The method of claim 6 further comprising:
receiving a set of contextual data associated with the API authorization policy code; and
using at least a subset of the received set of contextual data as an input to the set of binary instructions.
8. The method of claim 7 further comprising identifying at least a portion of the contextual data by using a set of parameters associated with the API call, wherein at least one of the parameters is received by the process VM along with the request from the application.
9. The method of claim 6 , wherein authorizing the API call by executing the set of binary instructions comprises, for each binary instruction in the set of binary instructions:
translating the binary instruction into a binary instruction that is native to the application, and
executing the translated native instruction.
10. The method of claim 6 , wherein the set of binary instructions is a first set of binary instructions, wherein authorizing the API call by executing the set of binary instructions comprises:
translating the first set of binary instructions into a code;
optimizing the translated code for at least one of (i) the application within which the process VM executes and (ii) the host, computer;
compiling the optimized translated code into a second set of binary instructions that are native to the application, and
executing the native second set of binary instructions.
11. The method of claim 6 , wherein generating the set of binary instructions from the API authorization policy code comprises:
evaluating a portion of the API authorization policy code; and
compiling the API authorization policy code.
12. The method of claim 6 , wherein:
generating the set of binary instructions from the API authorization code comprises using one or more policy extension codes in addition to the API authorization policy code to generate the set of binary instructions;
the policy extension codes define extensions to the API authorization policy; and
at least one of the policy extension codes is in a different language than the API authorization policy code.
13. The method of claim 1 , wherein the application comprises a native API authorization module executing within the application alongside the process VM and the request is received from the native API authorization module.
14. A method for evaluating authorization policies that define access to APIs (Application Programming Interfaces) of an application executing on a host system, the method comprising:
at a process virtual machine (VM) executing as a runtime interpreter for an instruction set inside the application:
receiving a request from the application to authorize an API call to be executed by the application;
generating an authorization decision for the API call; and
sending, to the application, an authorization decision to allow the API call, wherein the application executes the requested API call after receiving the authorization decision to allow the API call.
15. The method of claim 14 , wherein the instruction set is one of WebAssembly (WASM), Lua, or extended Berkeley Packet Filter (eBPF).
16. A non-transitory machine readable medium storing a process virtual machine (VM) executing within an application that is one of a plurality of machines executing on a host computer, the process VM for evaluating authorization policies that define access to APIs (Application Programming Interfaces) of the application within which the process VM executes, the process VM comprising sets of instructions for:
receiving a request from a module of the application, within which the process VM executes, to authorize an API call that the application receives and that is to be executed by the application;
generating an authorization decision for the API call by using a binary process executing within the process VM; and
sending, to the module of the application from which the request is received, an authorization decision to allow the API call, wherein the application executes the requested API call after receiving the authorization decision to allow the API call.
17. The non-transitory machine-readable medium of claim 16 , wherein the application comprises a native API authorization module executing within the application alongside the process VM and the module from which the request is received is a different module than the native API authorization module.
18. A non-transitory machine readable medium storing a process virtual machine (VM) executing inside an application that executes on a host computer, the process VM for evaluating authorization policies that define access to APIs (Application Programming Interfaces) of the application executing on the host computer, the process VM comprising sets of instructions for:
receiving a request from the application to authorize an API call to be executed by the application;
generating an authorization decision for the API call by (i) generating a set of binary instructions from an API authorization policy code and (ii) authorizing the API call by executing the set of binary instructions; and
sending, to the application, an authorization decision to allow the API call, wherein the application executes the requested API call after receiving the authorization decision to allow the API call.
19. The non-transitory machine readable medium of claim 18 , wherein the process VM further comprises sets of instructions for:
receiving a set of contextual data associated with the API authorization policy code; and
using at least a subset of the received set of contextual data as an input to the set of binary instructions.
20. The non-transitory machine-readable medium of claim 16 , wherein the application comprises a native API authorization module executing within the application alongside the process VM and the request is received from the native API authorization module.