Methods to generate security profile for restricting resources used by a program based on entitlements of the program

1. A computer-implemented method for dynamically compiling a security profile for a program, the method comprising:

in response to a request for launching a program, determining, by a launch module executed by a processor, a list of one or more application frameworks to be accessed by the program during execution of the program;

determining, by a helper module executed by the processor, zero or more entitlements representing one or more resources entitled by the program during the execution;

determining a set of one or more rules associated with at least one of the application frameworks based on the entitlements of the program, the set of one or more rules specifying one or more of resources associated with the at least one application framework, the at least one application framework providing an operating environment for the program; and

dynamically compiling, by a profile compiler, a security profile for the program based on the set of one or more rules associated with the at least one application framework, wherein the compiled security profile is used to restrict the program from accessing at least one resource of the at least one application frameworks during the execution of the program.

2. The method of claim 1 , further comprising:

loading the compiled security profile of the program in a kernel space of an operating system (OS) of a data processing system;

launching the program in a user space of the OS of the data processing system; and

in response to a request received from the program to access a first of the application frameworks, enforcing within the kernel space a set of one or more rules based on the loaded security profile to limit resources of the first application framework accessed by the program.

3. The method of claim 1 , wherein determining zero or more entitlements comprises communicating with a trusted source to obtain a list of the entitlements of the program, wherein the trusted source maintains entitlements of a plurality 1 of programs to be deployed in a data processing system.

4. The method of claim 3 , wherein the trusted source is associated with an authority that authorizes at least a portion of the plurality of programs to be deployed in the data processing system.

5. The method of claim 1 , wherein determining zero or more entitlements comprises extracting information representing the entitlements from the program.

6. The method of claim 5 , wherein the information representing the entitlements is stored in an attribute of the program signed by a trusted source that authorizes the program to be deployed in the data processing system.

7. The method of claim 1 , wherein obtaining a set of one or more rules based on the entitlements comprises:

identifying a bootstrap snippet associated with each of the application frameworks; and

executing the identified bootstrap snippet to generate the set of one or more rules associated with each application framework based on the entitlements of the program.

8. The method of claim 1 , wherein obtaining a set of one or more rules based on the entitlements comprises:

retrieving from each application framework a list of restrictions concerning resources associated with the application framework; and

interpreting the restrictions in view of the entitlements of the program to generate the set of one or more rules.

9. A non-transitory computer-readable storage medium having instructions stored therein, which when executed by a computer, cause the computer to perform a method for dynamically compiling a security profile for a program, the method comprising:

in response to a request for launching a program, determining by a launch module executed by a processor, a list of one or more application frameworks to be accessed by the program during execution of the program;

determining zero or more entitlements representing one or more resources entitled by the program during the execution;

determining by a helper module a set of one or more rules associated with at least one of the application frameworks based on the entitlements of the program, the set of one or more rules specifying one or more resources associated with the at least one application framework, the at least one application framework providing an operating environment for the program; and

dynamically compiling, by a profile compiler, a security profile for the program based on the set

of one or more rules associated with the at least one application framework, wherein the compiled security profile is used to restrict the program from accessing at least one resource of the at least one application frameworks during the execution of the program.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises:

loading the compiled security profile of the program in a kernel space of an operating system (OS) of a data processing system;

launching the program in a user space of the OS of the data processing system; and

in response to a request received from the program to access a first of the application frameworks, enforcing within the kernel space a set of one or more rules based on the loaded security profile to limit resources of the first application framework accessed by the program.

11. The non-transitory computer-readable storage medium of claim 9 , wherein determining zero or more entitlements comprises communicating with a trusted source to obtain a list of the entitlements of the program, wherein the trusted source maintains entitlements of a plurality of programs to be deployed in a data processing system.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the trusted source is associated with an authority that authorizes at least a portion of the plurality of programs to be deployed in the data processing system.

13. The non-transitory computer-readable storage medium of claim 9 , wherein determining zero or more entitlements comprises extracting information representing the entitlements from the program.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the information representing the entitlements is stored in an attribute of the program signed by a trusted source that authorizes the program to be deployed in the data processing system.

15. The non-transitory computer-readable storage medium of claim 9 , wherein obtaining a set of one or more rules based on the entitlements comprises:

identifying a bootstrap snippet associated with each of the application frameworks; and

executing the identified bootstrap snippet to generate the set of one or more rules associated with each application framework based on the entitlements of the program.

16. The non-transitory computer-readable storage medium of claim 9 , wherein obtaining a set of one or more rules based on the entitlements comprises:

retrieving from each application framework a list of restrictions concerning resources associated with the application framework; and

interpreting the restrictions in view of the entitlements of the program to generate the set of one or more rules.

17. An apparatus, comprising:

a processor; and

a memory coupled to the processor;

a launch service module executed in the memory by the processor, in response to a request for launching a program, to determine a list of one or more application frameworks to be accessed by the program during execution of the program;

a helper module executed in the memory by the processor and coupled to the launch service module to determine zero or more entitlements representing one or more resources entitled by the program during the execution;

one or more application frameworks executed in the memory by the processor to provide a set of one or more rules based on the entitlements of the program, the set of one or more rules specifying one or more resources associated with at least one of the application frameworks; and

a profile compiler executed in the memory by the processor to dynamically compile a security profile for the program based on the set of one or more rules associated with the at least one application framework, wherein the compiled security profile is used to restrict the program from accessing at least one resource of the at least one application framework during the execution of the program.

18. The apparatus of claim 17 , further comprising an access control module, in response to a request received from the program to access a first of the application frameworks, to enforce within a set of one or more rules based on the security profile to limit resources of the first application framework accessed by the program.