Abstract: Embodiments are provided for implementing a transparent conversion of common virtual storage requests to storage with limited access. Embodiments include providing a storage manager configured to perform address translation for requests, providing a data address translation (DAT) structure configured to connect a higher-level DAT table to a lower-level DAT table, and creating the DAT structure based on a request from a process. Embodiments also include responsive to receiving a storage request, performing a DAT fault process based on validating user credentials associated with an entry of the higher-level DAT table corresponding to the storage request, and responsive to the validation, updating the higher-level DAT table entry to allow access to the restricted-use portion of the common virtual storage, and otherwise, returning a DAT fault for the higher-level DAT table entry.

Abstract: A method and apparatus for enabling a listening daemon in a client/server system to execute a specified task on behalf of a user. Upon receiving a user request, the listening daemon sets an environment variable in accordance with the user identity specified in the request and issues a system call to the operating system kernel to spawn the user task specified in the request. In response to the system call, the operating system kernel creates a new address space for the specified user task and creates a security environment for the user task in accordance with the environment variable before starting the user task in the new address space.