Abstract: Aspects and features include maintaining at least one auxiliary disk image on a computing device. Certain code that is aligned with the base operating system of the computing device resides in and is executed from the auxiliary disk image. In one example, a computing device receives an update asset and uses it to patch the auxiliary disk image. The computing device executes the updated code from the patched disk image without rebooting or otherwise restarting the base operating system. The existing auxiliary disk image may be replaced with the patched disk image in response to a reboot or some other event, or while executing the code in the patched disk image from memory.

Abstract: Enclosed herein are techniques for securely executing an application. A method can be implemented by an operating system of a computing device, where the computing device includes a file system volume that includes a first data structure, and the method includes the steps of (1) receiving a request to launch the application, where the request references an application archive file that includes a second data structure that: (i) defines an organization of a plurality of files associated with the application, and (ii) includes cryptographic information for verifying the plurality of files and the second data structure; (2) in response to receiving the request: determining whether the second data structure, the plurality of files, or both, are valid using the cryptographic information; and (3) in response to determining that the second data structure, the plurality of files, or both, are valid: associating the second data structure with the first data structure.

Abstract: Representative embodiments set forth herein disclose techniques for implementing improved links between paths of one or more file systems. According to some embodiments, techniques are disclosed for establishing a system volume and a data volume within a container. According to other embodiments, techniques are disclosed for establishing a link from a source path of a system volume within a container to a target path of a data volume within the container. According to yet other embodiments, techniques are disclosed for determining whether to allow a file system operation on a data volume of a container based on at least determining whether a target path is associated with a reference to a source path.

Abstract: The subject disclosure provides systems and methods for application-specific network data filtering. Application-specific network data filtering may be performed by a sandboxed process prior to providing the network data to an application to which the network data is directed. Any malicious or otherwise potentially harmful data that is included in the network data may be removed by the application-specific network data filter or may be allowed to corrupt the application specific network data filtering operations within the sandbox, thereby preventing the malicious or harmful data from affecting the application or other portions of an electronic device. In one or more implementations, a first process such as an application-specific network data filtering process may request allocation of memory for the first process from second process, such as an application, that is separate from a memory manager of the electronic device.

Abstract: In an embodiment, a system supports an external trust cache. That is, the trust cache is separate from the kernel image on the non-volatile storage in the system. During boot, the boot code may read the trust cache from the storage and write it to the working memory of the system (e.g. the Random Access Memory (RAM) forming the memory system in the system). The boot code may also validate the kernel image and write it to the memory system. The boot code may program a region register in the processor to define a region in the working memory that encompasses the kernel image and the trust cache, to protect the region from modification/tampering.

Abstract: Representative embodiments set forth herein disclose techniques for implementing improved links between paths of one or more file systems. According to some embodiments, techniques are disclosed for establishing a system volume and a data volume within a container. According to other embodiments, techniques are disclosed for establishing a link from a source path of a system volume within a container to a target path of a data volume within the container. According to yet other embodiments, techniques are disclosed for determining whether to allow a file system operation on a data volume of a container based on at least determining whether a target path is associated with a reference to a source path.

Abstract: Techniques for handling security of an application and its extension are described. In one embodiment, an application manager of an operating system running within a data processing system launches an application in a first sandboxed environment based on a first security profile associated with the application. In response to receiving a request from the application for accessing a function of an application extension that is associated with the application, the application manager launches the application extension in a second sandboxed environment based on a second security profile associated with the application extension. The application manager is to individually enforce security and manage resources of the application and the application extension in the first and second sandboxed environments based on the first and second security profiles, respectively. The second security profile specifies resources fewer than the first security profile.

Abstract: In an embodiment, a system supports an external trust cache. That is, the trust cache is separate from the kernel image on the non-volatile storage in the system. During boot, the boot code may read the trust cache from the storage and write it to the working memory of the system (e.g. the Random Access Memory (RAM) forming the memory system in the system). The boot code may also validate the kernel image and write it to the memory system. The boot code may program a region register in the processor to define a region in the working memory that encompasses the kernel image and the trust cache, to protect the region from modification/tampering.

Abstract: Systems and methods are disclosed for logging encoded diagnostic information from a sequence of processing operations, the processing operations generated by an activity in a computing environment. Diagnostic information is tracked by activity, across process boundaries where the processes can be in computationally isolated, or “sandboxed”. Within each process, diagnostic information for an activity is stored in an activity-specific buffer registered with a kernel in the computing environment. For each activity in the computing system, the kernel keeps a list of all processes that have performed, or are performing, a processing task of the activity. The kernel also keeps a reference to the activity-specific log buffers for the activity for each process associated with the activity. If a processing operation for an activity fails, all activity-specific logs from all processes that are associated with the activity can be collected. A report can be generated from the collected logs for the activity.

Abstract: Systems, methods, and machine readable media are described which use code verification to verify the authenticity of installed software. The code verification can be performed in any one of a set of different paths, in one embodiment, which includes a first path using a trust cache of hashes of operating system components and one or more platform applications that are included together in a static software build that is installed on a system and a second path which evaluates code figured with one or more certificates (e.g. code signatures) for a software component (e.g. a third party software application or daemon) that is not part of the static software build. The path taken by a code verification process is audited to verify that the system has not been compromised.

Abstract: Techniques for handling security of an application and its extension are described. In one embodiment, an application manager of an operating system running within a data processing system launches an application in a first sandboxed environment based on a first security profile associated with the application. In response to receiving a request from the application for accessing a function of an application extension that is associated with the application, the application manager launches the application extension in a second sandboxed environment based on a second security profile associated with the application extension. The application manager is to individually enforce security and manage resources of the application and the application extension in the first and second sandboxed environments based on the first and second security profiles, respectively. The second security profile specifies resources fewer than the first security profile.

Abstract: Techniques for handling security of an application and its extension are described. In one embodiment, an application manager of an operating system running within a data processing system launches an application in a first sandboxed environment based on a first security profile associated with the application. In response to receiving a request from the application for accessing a function of an application extension that is associated with the application, the application manager launches the application extension in a second sandboxed environment based on a second security profile associated with the application extension. The application manager is to individually enforce security and manage resources of the application and the application extension in the first and second sandboxed environments based on the first and second security profiles, respectively. The second security profile specifies resources fewer than the first security profile.

Abstract: Systems and methods are disclosed for logging encoded diagnostic information from a sequence of processing operations, the processing operations generated by an activity in a computing environment. Diagnostic information is tracked by activity, across process boundaries where the processes can be in computationally isolated, or “sandboxed”. Within each process, diagnostic information for an activity is stored in an activity-specific buffer registered with a kernel in the computing environment. For each activity in the computing system, the kernel keeps a list of all processes that have performed, or are performing, a processing task of the activity. The kernel also keeps a reference to the activity-specific log buffers for the activity for each process associated with the activity. If a processing operation for an activity fails, all activity-specific logs from all processes that are associated with the activity can be collected. A report can be generated from the collected logs for the activity.

Abstract: A method for resource management of a data processing system is described herein. According to one embodiment, a token is periodically pushed into a memory usage queue, where the token includes a timestamp indicating time entering the memory usage queue. The memory usage queue stores a plurality of memory page identifiers (IDs) identifying a plurality of memory pages currently allocated to a plurality of programs running within the data processing system. In response to a request to reduce memory usage, a token is popped from the memory usage queue. A timestamp of the popped token is then compared with current time to determine whether a memory usage reduction action should be performed.

Abstract: Systems and methods are disclosed for logging encoded diagnostic information from a sequence of processing operations, the processing operations generated by an activity in a computing environment. Diagnostic information is tracked by activity, across process boundaries where the processes can be in computationally isolated, or “sandboxed”. Within each process, diagnostic information for an activity is stored in an activity-specific buffer registered with a kernel in the computing environment. For each activity in the computing system, the kernel keeps a list of all processes that have performed, or are performing, a processing task of the activity. The kernel also keeps a reference to the activity-specific log buffers for the activity for each process associated with the activity. If a processing operation for an activity fails, all activity-specific logs from all processes that are associated with the activity can be collected. A report can be generated from the collected logs for the activity.

Abstract: Techniques for handling security of an application and its extension are described. In one embodiment, an application manager of an operating system running within a data processing system launches an application in a first sandboxed environment based on a first security profile associated with the application. In response to receiving a request from the application for accessing a function of an application extension that is associated with the application, the application manager launches the application extension in a second sandboxed environment based on a second security profile associated with the application extension. The application manager is to individually enforce security and manage resources of the application and the application extension in the first and second sandboxed environments based on the first and second security profiles, respectively. The second security profile specifies resources fewer than the first security profile.

Abstract: Systems and methods are disclosed for logging encoded diagnostic information from a sequence of processing operations, the processing operations generated by an activity in a computing environment. Diagnostic information is tracked by activity, across process boundaries where the processes can be in computationally isolated, or “sandboxed”. Within each process, diagnostic information for an activity is stored in an activity-specific buffer registered with a kernel in the computing environment. For each activity in the computing system, the kernel keeps a list of all processes that have performed, or are performing, a processing task of the activity. The kernel also keeps a reference to the activity-specific log buffers for the activity for each process associated with the activity. If a processing operation for an activity fails, all activity-specific logs from all processes that are associated with the activity can be collected. A report can be generated from the collected logs for the activity.

Abstract: A method for resource management of a data processing system is described herein. According to one embodiment, a token is periodically pushed into a memory usage queue, where the token includes a timestamp indicating time entering the memory usage queue. The memory usage queue stores a plurality of memory page identifiers (IDs) identifying a plurality of memory pages currently allocated to a plurality of programs running within the data processing system. In response to a request to reduce memory usage, a token is popped from the memory usage queue. A timestamp of the popped token is then compared with current time to determine whether a memory usage reduction action should be performed.

Abstract: A method for resource management of a data processing system is described herein. According to one embodiment, a token is periodically pushed into a memory usage queue, where the token includes a timestamp indicating time entering the memory usage queue. The memory usage queue stores a plurality of memory page identifiers (IDs) identifying a plurality of memory pages currently allocated to a plurality of programs running within the data processing system. In response to a request to reduce memory usage, a token is popped from the memory usage queue. A timestamp of the popped token is then compared with current time to determine whether a memory usage reduction action should be performed.

Abstract: A method for resource management of a data processing system is described herein. According to one embodiment, a token is periodically pushed into a memory usage queue, where the token includes a timestamp indicating time entering the memory usage queue. The memory usage queue stores a plurality of memory page identifiers (IDs) identifying a plurality of memory pages currently allocated to a plurality of programs running within the data processing system. In response to a request to reduce memory usage, a token is popped from the memory usage queue. A timestamp of the popped token is then compared with current time to determine whether a memory usage reduction action should be performed.