NATIVE EXECUTION BY A GUEST OPERATING ENVIRONMENT
The present disclosure elates generally to a computer architecture and infrastructure for guest operating systems executing on a host operating system. More particularly, it relates to methods and systems for allowing a guest operating system to control the resources of a commodity server system. A method of allowing a guest operating system to control and manage computer resources includes receiving, by a host operating system, a call from a guest operating system to control and manage computer resources; creating, by the host operating system, a secure sandbox executing on the host operating system; and creating, by the host operating system, a secure tunnel between the secure sandbox and the guest operating system, the secure tunnel having loopback networking. The secure sandbox is controlled and managed by the guest operating system but executing on the host operating system.
1 . A method of allowing a guest operating system to control and manage computer resources, the method comprising:
receiving, by a host operating system, a call from a guest operating system to control and manage computer resources;
creating, by the host operating system, a secure sandbox executing on the host operating system; and
creating, by the host operating system, a secure tunnel between the secure sandbox and the guest operating system, the secure tunnel having loopback networking;
wherein the secure sandbox is controlled and managed by the guest operating system but executing on the host operating system.
2 . The method of claim 1 , wherein creating a secure tunnel includes creating a secure tunnel to create an encrypted communication path between the guest operating system and the host operating system.
3 . The method of claim 2 , wherein creating a secure tunnel includes creating a self-signed certificate and storing the certificate in the loopback networking.
4 . The method of claim 1 , wherein creating a secure sandbox includes creating a secure sandbox having a defined maximum size and a specific placement in memory of the host operating system.
5 . The method of claim 1 , wherein creating a secure sandbox includes connecting the secure sandbox to a storage through the guest operating system.
6 . The method of claim 5 , wherein creating a secure sandbox includes preventing the secure sandbox from accessing local or virtualized storage in the host operating system.
7 . The method of claim 1 , wherein creating a secure sandbox includes connecting the secure sandbox to networking through specific ports in the host operating system but preventing general access to networking in the host operating system.
8 . The method of claim 1 , further comprising receiving a request by a user operating on the guest operating system and having user credentials to invoke a process in the secure sandbox.
9 . The method of claim 8 , further comprising searching a pool of credentials for the user credentials in the host operating system.
10 . The method of claim 9 , further comprising associating the user credentials with the process such that all services running on the guest operating system having the same credentials as the host operating system.
11 . A computer program product for allowing a guest operating system to control and manage computer resources, comprising:
a non-transitory computer-readable medium comprising a set of instructions that when executed by a programmable computing device causes the computing device to implement a method for configuring a set of network devices, the method comprising:
receiving, by a host operating system, a call from a guest operating system to control and manage computer resources;
creating, by the host operating system, a secure sandbox executing on the host operating system; and
creating, by the host operating system, a secure tunnel between the secure sandbox and the guest operating system, the secure tunnel having loopback networking;
wherein the secure sandbox is controlled and managed by the guest operating system but executing on the host operating system.
12 . The computer program product of claim 11 , wherein creating a secure tunnel includes creating a secure tunnel to create an encrypted communication path between the guest operating system and the host operating system.
13 . The computer program product of claim 12 , wherein creating a secure tunnel includes creating a self-signed certificate and storing the certificate in the loopback networking.
14 . The computer program product of claim 11 , wherein creating a secure sandbox includes creating a secure sandbox having a defined maximum size and a specific placement in memory of the host operating system.
15 . The computer program product of claim 11 , wherein creating a secure sandbox includes connecting the secure sandbox to a storage through the guest operating system.
16 . The computer program product of claim 15 , wherein creating a secure sandbox includes preventing the secure sandbox from accessing local or virtualized storage in the host operating system.
17 . The computer program product of claim 11 , wherein creating a secure sandbox includes connecting the secure sandbox to networking through specific ports in the host operating system but preventing general access to networking in the host operating system.
18 . The computer program product of claim 11 , further comprising receiving a request by a user operating on the guest operating system and having user credentials to invoke a process in the secure sandbox.
19 . The computer program product of claim 18 , further comprising searching a pool of credentials for the user credentials in the host operating system.
20 . The computer program product of claim 19 , further comprising associating the user credentials with the process such that all services running on the guest operating system having the same credentials as the host operating system.