Abstract: A method for executing a target program that includes opening, in response to a request, a door between the source container and the global container, where the source container is controlled by the global container and the request specifies a target program. The method further includes sending the request to an access module located in the global container using the door, verifying that the request can be executed in a target container using a policy definition, where the target program is in the target container and the target container is controlled by the global container, logging in to the target container after the request has been verified, initiating a gateway within the target container in response to the login, setting an execution context of the gateway based on the policy definition, and executing the target program by the gateway, using the execution context, to generate a response to the request.

Abstract: Several methods are provided for applying minimization to computer systems. A unified security profile is created and applied to a computer system. This provides a listing of software packages required to be installed on the computer system. Extraneous files not associated with a required software package are identified. In one method, a software module interposes between calls to filesystem operations and the filesystem. This module allows or denies access to files based on a configuration information source (which is itself based on the unified security profile), the zone from which the access request originates, and the privileges of the user making the request. Reference to each file minimized is removed from the computer system's package manifest. Files thus minimized are neither visible nor accessible to unauthorized entities on the computer system. If the unified security profile of the system is required to change, minimization actions can therefore be reversed.

Abstract: A method for executing a target program that includes opening, in response to a request, a door between the source container and the global container, where the source container is controlled by the global container and the request specifies a target program. The method further includes sending the request to an access module located in the global container using the door, verifying that the request can be executed in a target container using a policy definition, where the target program is in the target container and the target container is controlled by the global container, logging in to the target container after the request has been verified, initiating a gateway within the target container in response to the login, setting an execution context of the gateway based on the policy definition, and executing the target program by the gateway, using the execution context, to generate a response to the request.