System and method for limiting exploitable or potentially exploitable sub-components in software components

1. A computer-implemented method of limiting exploitable applications in an operating system, the method being implemented by a computer system that includes one or more physical processors programmed with one or more computer program instructions which, when executed, perform the method, the method comprising:

obtaining, by the computer system, at least a first operating system, the first operating system including (i) a first application that provides a function that is exploitable to compromise the first operating system and (ii) a second application that is exploitable to compromise the first operating system;

disabling, by the computer system, the first application such that the function provided by the first application will not be available via the first operating system when the first operating system is executed, wherein the first application is disabled based on a determination that the first application is not necessary for functioning of the first operating system, and wherein the second application is not disabled based on a determination that the second application is necessary for the functioning of the first operating system; and

causing, by the computer system, the first operating system to be executed after the first application is disabled such that the function provided by the first application is not available for use and is not exploitable to compromise the first operating system.

2. The method of claim 1 , wherein disabling the first application comprises removing the first application from the first operating system.

3. The method of claim 1 , wherein disabling the first application comprises turning off the function provided by the first application without removing the first application from the first operating system.

4. The method of claim 1 , wherein disabling the first application comprises removing the first application from the first operating system during a boot-up of the first operating system.

5. The method of claim 1 , wherein disabling the first application comprises turning off the function provided by the first application during a boot-up of the first operating system.

6. The method of claim 1 , wherein disabling the first application comprises associating the first operating system with disabling instructions such that the disabling instructions causes availability of the function provided by the first application to be removed from the first operating system during a boot-up of the first operating system.

7. The method of claim 6 , wherein associating the first operating system with the disabling instructions comprises inserting the disabling instructions into the first operating system.

8. The method of claim 1 , wherein the first operating system further includes a third application that is exploitable, the method further comprising:

identifying, by the computer system, a code set associated with the third application that causes the third application to be exploitable; and

removing, by the computer system, the code set from the third application such that the third application no longer includes the code set, wherein the first operating system includes the third application without the code set when the first operating system is executed.

9. The method of claim 1 , further comprising:

generating, by a component authoring subsystem, the first operating system in a component creation environment;

associating, by the component authoring subsystem, first profile information with the first operating system, wherein the first profile information is used to determine whether a given application of the first operating system should be disabled; and

identifying, by a component sealing subsystem, based on the first profile information, the first application as an application to be disabled.

10. The method of claim 1 , further comprising:

generating, by a component authoring subsystem, the first operating system in a component creation environment such that the first operating system includes the first application and a second application; and

associating, by the component authoring subsystem, first profile information with the first operating system, wherein the first profile information is used to determine whether a given application of the first operating system should be disabled, and wherein the second application is not disabled based on the first profile information.

11. The method of claim 1 , further comprising:

generating, by a component exporting subsystem, integrity information for the first operating system after the first application is disabled and before the first operating system is placed in a component repository, wherein the integrity information is used to determine whether the first operating system has been modified after the integrity information is generated for the first operating system.

12. The method of claim 1 , wherein the first operating system comprises an operating system instance of a virtual machine.

13. The method of claim 1 , wherein the function provided by the first application comprises an administrative or maintenance function provided by the first application, wherein the administrative or maintenance function is used by a user having system administrator privileges to administer or maintain the first operating system but is exploitable by others to compromise the first operating system, and wherein the administrative or maintenance function provided by the first application is not available to administer or maintain the first operating system and is not exploitable to compromise the first operating system after the first application is disabled.

14. A system for limiting exploitable applications in an operating system, the system comprising:

one or more physical processors programmed with one or more computer program instructions such that the one or more physical processors are programmed to:

obtain at least a first operating system, the first operating system including (i) a first application that provides a function that is exploitable to compromise the first operating system and (ii) a second application that provides a function that is exploitable to compromise the first operating system;

disable the first application such that the function provided by the first application will not be available via the first operating system when the first operating system is executed, wherein the first application is disabled based on a determination that the first application is not necessary for functioning of the first operating system, and wherein the second application is not disabled based on a determination that the second application is necessary for the functioning of the first operating system; and

cause the first operating system to be executed after the first application is disabled such that the function provided by the first application is not available for use and is not exploitable to compromise the first operating system.

15. The system of claim 14 , wherein the one or more physical processors are further programmed to remove the first application from the first operating system, and wherein the first application is disabled based on the removal of the first application.

16. The system of claim 14 , wherein the one or more physical processors are further programmed to turn off the function provided by the first application without removing the first application from the first operating system, and wherein the first application is disabled based on the turn off of the function provided by the first application.

17. The system of claim 14 , wherein the one or more physical processors are further programmed to remove the first application from the first operating system during a boot-up of the first operating system, and wherein the first application is disabled based on the removal of the first application.

18. The system of claim 14 , wherein the one or more physical processors are further programmed to turn off the function provided by the first application during a boot-up of the first operating system, and wherein the first application is disabled based on the turn off of the function provided by the first application.

19. The system of claim 14 , wherein the one or more physical processors are further programmed to associate the first operating system with disabling instructions such that the disabling instructions causes availability of the function provided by the first application to be removed from the first operating system during a boot-up of the first operating system, and wherein the first application is disabled based on the association of the first operating system with the disabling instructions.

20. The system of claim 19 , wherein the one or more physical processors are further programmed to insert the disabling instructions into the first operating system, and wherein the first operating system is associated with the disabling instructions based on the insertion of the disabling instructions.

21. The system of claim 14 , wherein the first operating system further includes a third application that is exploitable, and wherein the one or more physical processors are programmed to:

identify a code set associated with the third application that causes the third application to be exploitable; and

remove the code set from the third application such that the third application no longer includes the code set, wherein the first operating system includes the third application without the code set when the first operating system is executed.

22. The system of claim 14 , wherein the one or more physical processors are programmed to:

generate the first operating system in a component creation environment;

associate first profile information with the first operating system, wherein the first profile information is used to determine whether a given application of the first operating system should be disabled; and

identify, based on the first profile information, the first application as an application to be disabled.

23. The system of claim 14 , wherein the one or more physical processors are programmed to:

generate the first operating system in a component creation environment such that the first operating system includes the first application and a second application; and

associate first profile information with the first operating system, wherein the first profile information is used to determine whether a given application of the first operating system should be disabled, and wherein the second application is not disabled based on the first profile information.

24. The system of claim 14 , wherein the one or more physical processors are programmed to:

generate integrity information for the first operating system after the first application is disabled and before the first operating system is placed in a component repository, wherein the integrity information is used to determine whether the first operating system has been modified after the integrity information is generated for the first operating system.

25. The system of claim 14 , wherein the first operating system comprises an operating system instance of a virtual machine.

26. The system of claim 14 , wherein the function provided by the first application comprises an administrative or maintenance function provided by the first application, Wherein the administrative or maintenance function is used by a user having system administrator privileges to administer or maintain the first operating system but is exploitable by others to compromise the first operating system, and wherein the administrative or maintenance function provided by the first application is not available to administer or maintain the first operating system and is not exploitable to compromise the first operating system after the first application is disabled.