US20150012538A1 - Flexible namespace prioritization - Google Patents

Abstract

Access to resources on a computer may be provided by using a first namespace of resources and a second namespace of resources, where one or more names are common to both namespaces and those names refer to different respective instances of resources. A request is received for a first resource name from an application, where the first resource name exists in the first resource namespace and in the second resource namespace. In response to the request, whether to obtain a resource from the first namespace or from the second namespace is determined by applying one or more resource policies to the first resource namespace and to the second resource namespace.

Description

CROSS REFERENCE TO RELATED APPLICATIONS
• This application is a divisional of U.S. patent application Ser. No. 11/771,964, filed Jun. 29, 2007, now U.S. Pat. No. 8,862,590, issued Oct. 14, 2014, the entire contents of which are incorporated herein by reference.
BACKGROUND
• Computer applications typically access computer or system resources through an operating system. Resources might be files, libraries, system services (e.g. cut & paste, printers), registry or configuration information, and others. A virtualization environment or component virtualizes an application's access to system resources, transparently handling the application's access to system resources as though the application were dealing directly with the operating system.
• A virtualization environment can manage access to multiple sets of system resources, some of which may overlap or conflict. A native operating system might have a set of file resources including a file with a filename such as “/somepath/someFileName”. An application virtualization package (or a set of shadow resources) might have a different file instance that uses the same filename; for example, “/path/someFileName”. The virtualization environment will manage an application's access to “/path/someFileName” in a manner that is transparent to the application. The application might write to “/path/someFileName”, and the virtualization environment will determine which instance of the file “/path/someFileName” will be the written to; the native operating system file or the virtualization package file.
• Techniques related to managing access to resources are discussed below.
SUMMARY
• The following summary is included only to introduce some concepts discussed in the Detailed Description below. This summary is not comprehensive and is not intended to delineate the scope of the claimed subject matter, which is set forth by the claims presented at the end.
• Access to resources on a computer may be provided by using a first namespace of resources and a second namespace of resources, where one or more names are common to both namespaces and those names refer to different respective instances of resources. A request is received for a first resource name from an application, where the first resource name exists in the first resource namespace and in the second resource namespace. In response to the request, whether to obtain a resource from the first namespace or from the second namespace is determined by applying one or more resource policies to the first resource namespace and to the second resource namespace.
• Many of the attendant features will be explained below with reference to the following detailed description considered in connection with the accompanying drawings.
BRIEF DESCRIPTION OF THE DRAWINGS
• The present description will be better understood from the following detailed description read in light of the accompanying drawings, wherein like reference numerals are used to designate like parts in the accompanying description.
• FIG. 1 shows a virtualization environment on a computer.
• FIG. 2 shows a virtualization layer managing access to multiple sets of overlapping resources.
• FIG. 3 shows an arrangement for flexibly prioritizing resource namespaces.
• FIG. 4 shows a general process for prioritizing resource namespaces.
• FIG. 5 shows a process for using policies to prioritize resource namespaces.
• FIG. 6 shows a process for applying different policies to different resource namespaces.
• FIG. 7 shows example policies associated with resource namespaces.
• FIG. 8 shows policies ofFIG. 7 applied in different sequences.
DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTSOverview
• Embodiments discussed below relate to managing virtual access to resources on a computing system. A virtual environment is discussed first. A general technique for flexibly prioritizing namespaces used in a virtual environment is then explained. Detailed features and embodiments for prioritizing namespaces are then described.
Virtual Environment
• FIG. 1 shows avirtualization environment100 on acomputer102. Anapplication104 running on thecomputer102 accessesvarious system resources106,108, and110 through thevirtualization environment100. Thevirtualization environment100 manages the application's104 access to thesystem resources106,108,110. Thesystem resources106,108, and110 can be any type of resource available on a computer. For example,system resources106 could be system files, registry or database entries, initialization or configuration files, dynamically loaded libraries, etc.System resources108 could be system services such as an object communication service, printing services, cut & paste services, etc.System resources110 could be profile data, TCP/IP addresses and/or ports, mutexes, semaphores, named pipes, COM objects, object brokers, fonts, etc.
• Thesystem resources106,108, and110 may have different scope of visibility on thecomputer102. Someresources106,108,110 may be global native resources visible to all applications on thecomputer102. Somesystem resources106,108, and110 might be local resources visible or accessible only to theapplication104. For example, an application virtualization package might include instances of files, registry entries, configuration settings, or other resources that only theapplication104 uses. There might also be other semi-local resources that are available only to a certain user or to applications that are using thevirtualization environment100. Notably, any of these local or semi-local resources might have corresponding native resource instances (i.e., global resources on computer102) having the same name. That is, as alluded to in the Background, given a resource name, there might be: an instance of a global resource with that name, an instance of a local resource with that name, and/or an instance of a semi-local resource with that same name. Techniques for flexibly controlling how such namespace conflicts are handled are discussed in detail later.
• Thevirtualization environment100 may cause theresources106,108, and110 to appear as one set ofvirtual resources112. While theapplication104 may execute read and/or write operations as though directly accessingsystem resources106,108, and110, thevirtualization environment100 intermediates those operations. Generally theapplication104 will not operate any differently than it would if thevirtualization environment100 were not present on thecomputer102. However, embodiments discussed below for managing namespaces of resources (such assystem resources106,108, and110) will be applicable regardless of whether an application changes its behavior in the presence of a virtualization environment.
• FIG. 2 shows avirtualization layer150 managing access to multiple overlapping sets ofresources152,154, and156. Anapplication158 transparently accesses theresources152,154, and156 through thevirtualization layer150. Under different circumstances the sets ofresources152,154, and156 can have different precedence and purpose. The user set152 is scoped only to theapplication158, thepackage set154 is scoped to applications being run by a same user under thevirtualization layer150, and theglobal set156 has global scope; any application or user identity on the host computer can potentially access theresource set156. Other types of resources may be used. In another embodiment,set152 could be for all applications running in the virtual environment and set154 could be for all virtual environments across all users that are running an application. Although the sets ofresources152,154, and156 are shown divided intocategories160,162, and164 by type, this may not be necessary, depending on how resources are accessed on a particular computing platform. In one embodiment, a set ofresources152,154, or156 will be a container containing all types of resources with the same scope, e.g., global files, registry entries, network connections, or local files and system services, etc.
• The sets ofresources152,154, and156 can overlap in that, as discussed above, one set of resources may have a resource instance with a same name as another resource instance in another set. In the example ofFIG. 2, an instance of resource “c:\dir\file1” is in each of the sets of resources. The instances have different content, different size, etc. Another resource, such as “c:\dir1\file4”, is only in theglobal resource set156. Thevirtualization layer150 handles the application's158 request to open the file named “c:\dir1\file2”.
• It is possible for thevirtualization layer150 to fix priorities of the sets ofuser resources152,154, and156. For example, thevirtualization layer150 may perhaps give priority to the set ofuser resources152 and open the instance of “c:\dir1\file2” in the set ofresources152 and return a corresponding file handle or file object to theapplication158, thus causing theapplication158 to use the instance in the user set ofresources152. When the application accesses the file named “c:\dir1\file4”, the resource is obtained fromresource set154, the only set that has the resource. Although this approach of static prioritization can be useful, it has limitations. As will be discussed presently, thevirtualization environment150 can be enhanced to allow resource namespaces to take on priorities that change under different conditions or contexts.
Flexible Namespace Prioritization
• FIG. 3 shows an arrangement for flexibly prioritizing resource namespaces. In this arrangement, thevirtualization layer150 is provided with apolicy engine192. Thepolicy engine192 may be a software component that flexibly prioritizesresource namespaces190. Although thepolicy engine192 andvirtualization layer150 are shown as separate components, this division of function is for convenience and other structural arrangements are possible. Nonetheless, in most cases thepolicy engine192 will not be visible toapplication194, which operates without regard for the existence of thevirtualization layer150.
• Also seen inFIG. 3 are differentvirtual environments196,198. Thevirtualization layer150 is capable of running applications in different virtual environments that operate in isolation to avoid or minimize resource conflicts, to prevent interference between applications, to allow execution of different instances of a same application, etc. For example, thevirtual environment196 might be for Adobe software and thevirtual environment198 might be for Microsoft Office applications. Accordingly,virtual environments196,198 may have theirown resource namespaces200,202, andpolicies204,206, respectively, for prioritizing theresource namespaces200,202.
• As discussed later, thepolicies204,206 comprise information that can be used by thepolicy engine192 to prioritize arbitrary sets of resource namespaces (e.g.,resource namespaces200,202) in different orders for different resources that are needed byapplication194. As indicated by arrows fromnamespaces200,202, theresource namespaces200,202 may be references to actual resource namespaces stored in a pool orcache208 of resource namespaces managed by thevirtualization layer150, thus allowing some resource namespaces (e.g.,resource namespaces200,202) to be conveniently passed topolicy engine192 and also, when necessary, shared between virtual environments (e.g.,virtual environments196,198), etc. Throughout this description, “namespace” will be used to refer to both containers containing instances of actual resources as well as references to such namespaces (e.g., pointers, globally unique identifiers, object references, etc.) by which a namespace may be accessed, passed between components, shared, and so on.
• FIG. 4 shows a general process for prioritizing resource namespaces. It should be appreciated that the general idea of dynamically and flexibly prioritizing namespaces (e.g., reprioritizing namespaces for different resources needed by an application) can be accomplished in numerous ways and the embodiments discussed herein are only several of those ways. Initially, as mentioned earlier, an application has a name for a resource that it needs to access. Therefore, the name is provided220 to (or intercepted by) the virtualization layer150 (this will be transparent to the application). Next, either thevirtualization layer150 and/or apolicy engine190 determine222 which policies (e.g., policies204) and namespaces are potentially relevant to the requested resource. Such namespaces could be all of the policies and namespaces known to a virtual environment, as any of the namespaces may potentially supply the needed resource. Namespaces and policies can also be pre-associated so that it is known which namespace(s) a given policy is relevant to. For example, user configuration settings for the virtualization layer or environment might specify which namespaces are to be used and their default priorities. Finally, the policies are applied224 to the determined222 namespaces to prioritize the namespaces. As will become apparent later, if a first resource is needed by the application and it is obtained using the process ofFIG. 4, and a second resource is then needed and is obtained using the process ofFIG. 4, the namespaces may have different priorities for each needed resource, even if the same determined222 policies and namespaces are used to prioritize the namespaces. Furthermore, which namespace a resource is obtained from can be flexibly changed (without having to modify the application or the virtualization layer) by modifying the relevant policies, adding new policies, or removing policies, etc.
• FIG. 5 shows a process for using policies to prioritize resource namespaces. It should be understood that it is possible to implement policies in different ways, and the process ofFIG. 5 is just one of those ways. Initially, an application has a name of a resource (e.g., a name of a file) and requires250 access to a corresponding resource (e.g., a file). In response perhaps to a system call (e.g., a request to open the file by its name, or some other means of requesting system resources), the virtual environment communicates252 to the policy engine: the fully qualified name of the needed resource; a list of resource namespaces that the application's virtual environment has access to; and a list of policies defined for the virtual environment. Again, other techniques may be used. For example, a static pre-defined set of policies and namespaces may be used for each requested resource, the list of namespaces to be prioritized might be determined before a request for a resource, etc.
• The policy engine creates254 a list of candidate namespace structures (a structures that represents a namespace) for the respective namespaces communicated252 to the policy engine. Each structure has a unique identifier (ID) that identifies the namespace that the structure represents. The structure will also have a priority score, which is initially set to zero. Examples are shown inFIG. 7, which is discussed later. The policy engine determines256 scores for the namespaces, respectively, using the list of structures, by applying the communicated252 policies to the communicated252 namespaces and storing resulting priority scores in the structures. Per the priority scores in the structures, candidate namespaces that turn out not to be candidates for providing the required250 resource may be removed258 from the list of structures (e.g., a namespace passed to the policy engine because it is associated with a first policy but is not associated with another policy). The remaining namespaces are ordered260 by their priority scores and returned262 to the virtualization layer which can then obtain from the remaining namespaces the required250 resource, which can in turn be provided to the application in response to its initial request.
• FIG. 6 shows a process for applying different policies to different resource namespaces. Generally, each policy communicated252 to the policy engine can potentially bear on the priority of each namespace communicated252 to the policy engine. Thus, to begin280 applying policies to namespaces, a policy that has not yet been applied is chosen282. As will be seen, the order of applying policies should not affect the priorities calculated for the namespaces. If the policy is applicable284 to the requested resource then for each286 namespace in the candidate namespace list (list of namespace structures) the following steps are performed (if the policy is not applicable and there is292 an unapplied policy, that policy is chosen282 and processed). First, if288 another more specific policy has already been applied to the namespace (e.g., if the absolute value of the namespace's current score is greater than current policy's desired score) then another namespace is selected286. If not, then the current policy is applied290 to the current namespace by, for example, assigning the policy's score to the namespace. If there are292 unapplied policies then another policy is chosen282 and applied accordingly. If there are not292 unapplied policies then the ranked/prioritized namespaces are returned.
• Note that whether a policy is applicable284 to a requested namespace can be determined in many ways. For example, a policy may have some context criteria or set definition such as: it applies to all filenames ending in “doc”, it applies to files in directory “\directory1\directory2”, it applies to entries in a registry location, etc. Note also that although inFIG. 6 policies are iterated over in an outer loop and namespaces are iterated for each policy, because the result is not affected by the order that policies are applied, the reverse may be used; namespaces may be iterated in an outer loop, and in an inner loop policies are iterated over a current namespace.
• In one embodiment, whenapplication194 requests a resource for a resource name (e.g., by issuing a system call such as “open(filename)”), the resource name, a set of policies, and a set of namespaces (actually, references to namespaces or globally unique identifiers of namespaces) may be passed, via thevirtualization layer150, to thepolicy engine192. Thepolicy engine192 uses this information to prioritize the namespaces and the resource is obtained from the highest priority namespace that contains a resource for the resource name.
• FIG. 7 showsexample policies320,322,324 associated with resource namespaces. Three hypothetical resource namespaces, called U, P, and N are available sources of resources.Policies320 and324 are each associated with namespaces U, P, and N. Note that the order of association (U, then P, then N) reflects the default priorities of these namespaces, U having the highest priority.Policy322 is associated with namespace N but not P and U. Theexample policies320,322,324 are registry locations, although they could as well be file directories or other definitions of sets of resources. For example, a policy could specify that local registry changes should go into a user's personal settings registry namespace. Another policy could be that changes to a user's profile should be made in a local filesystem namespace. Yet another example, files with names that match “*.doc” should always be accessed from a local filesystem namespace. Or, changes to network shares are to be performed using a given resource namespace. Consider some other examples.
• Policies such aspolicies320,322, and324 can either inherently specify which namespaces they apply to (as with some of the examples in the preceding paragraph), or namespaces can be freely associated with any policies. It can be assumed that when a policy is not associated with a namespace (at least when being used to prioritize particular namespaces) then that policy might directly prioritize that particular namespace. A policy can be associated with multiple namespaces, in which case those namespaces should have a default priority among themselves. A policy may also have some information that can be used to prioritize a namespace to which it applies. For example, some weighting constant can be used. A priority might also be assigned based on a degree to which a policy is applicable to a requested name, allowing policies to be applied in a way that, when two policies match a resource name, the policy with more specific context (e.g., a more specific filesystem directory, an explicit filename rather than a wildcard-specified filename, a longer registry path, a path name with a particular substring in it, etc.).
• FIG. 8 shows thepolicies320,322,324 ofFIG. 7 applied in different sequences according to embodiments ofFIGS. 5 and 6. A list ofdata structures340 will be now be discussed in detail, and later,similar lists342 and344 will be discussed briefly. For this example, the weight or priority score for each policy will be determined by the length of the path that it specifies,16,25, and31 for U, P, and N respectively. Other weights could as well have been used, path length happens to be a convenient measure of specificity. Weight could also be driven by factors such as the presence of a wildcard, some pre-defined criteria, etc.
• Suppose that an application requires250 a resource corresponding to the fully qualified resource name “HKLM\Software\Adobe\JobQueue\Config” (for brevity, to be referred to as “HKLM . . . Config”).Policies320,322, and324 correspond to the virtual environment in which the request is made, and so those policies as well as their associated namespaces are communicated252 to the policy engine (or some virtualization component of similar functionality). The policy engine creates254 a candidate namespace structure for each namespace, with priority set to 0; the “namespace” and “initial” columns inlist340. Thepolicies320,322,324 are applied280 as follows.
• Policy320 is chosen282 first.Policy320 is284 applicable as the requested name “HKLM . . . Config” falls under the path (context) specified bypolicy320. In other words, the requested resource name “HKLM . . . Config” matches the context of thepolicy320. Therefore, for each namespace U, P, and N in thecandidate list340, the following occurs. Namespace U is applied290 because the absolute value of the current score (0) for U is less than thepolicy320's intended score (16.3). Note that the “.3” is added to represent the fact that, forpolicy320, U has the default highest priority among the namespaces U, P, and N. Similarly, “.2” and “.1” are to be added to the weights of P and N, respectively.Policy320 is then applied to P and N, and they are given scores of 16.2 and 16.1, respectively. There are292 unapplied policies,322,324.Policy322 is chosen282. It has a greater priority weight than the scores inlist340 and therefore it scores the namespaces with −25, −25 and 25. The negative scores for namespaces U and P are given becausepolicy322 is not associated with those namespaces. Finally, thelast policy324 is applied290 to each namespace because its weight or score, 31, is greater than the absolute values of the preceding scores. The final scores for the namespaces are 31.3, 31.2, and 31.1, which indicates that, when a resource for “HKLM . . . Config” is obtained from the namespaces, namespaces U, P and N will be used in that order until a resource corresponding to “HKLM . . . Config” is found in one of the namespaces.
• Namespace lists342 and344 show how scores will be assigned whenpolicies320,322,324 are applied in different orders.List342 would result if the order were:policy322,320, then324.List344 would result if the order were:policy324,322, then320. In each case the final scores for the namespaces are the same.
• In accordance with some of the embodiments discussed above, resources can be obtained from multiple overlapping namespaces and conflicts can be resolved in a flexible and predictable manner by specifying general (or even specific) circumstances under which different namespaces take precedence (e.g., by using policies). A same policy engine can cooperate with a same virtualization layer to prioritize different namespaces with different policies for different virtual environments being handled by the virtualization layer. Furthermore, in some embodiments policies can be applied to namespaces in any order with deterministic results.
Conclusion
• Embodiments and features discussed above can be realized in the form of information stored in volatile or non-volatile computer or device readable media. This is deemed to include at least media such as optical storage (e.g., CD-ROM), magnetic media, flash ROM, or any current or future means of storing digital information. The stored information can be in the form of machine executable instructions (e.g., compiled executable binary code), source code, bytecode, or any other information that can be used to enable or configure computing devices to perform the various embodiments discussed above. This is also deemed to include at least volatile memory such as RAM and/or virtual memory storing information such as CPU instructions during execution of a program carrying out an embodiment, as well as non-volatile media storing information that allows a program or executable to be loaded and executed. The embodiments and featured can be performed on any type of computing device, including portable devices, workstations, servers, mobile wireless devices, and so on.

Claims (20)

What is claimed:

1. A computer implemented method comprising:

storing a plurality of policies for prioritizing namespaces;

receiving, by the computer, a request for a first resource name, the computer having a virtualization component that virtualizes access to system resources on the computer and having a first namespace of resources on the computer and a second namespace of resources on the computer, one or more resource names being common to both namespaces and those same resource names corresponding to differing resources in their respective namespaces;

in response to the request, determining relative priorities of the first namespace and the second resource namespace by using the policies to prioritize the first resource namespace and the second resource namespace; and

in accordance with the determining, obtaining from the first resource namespace or the second namespace a resource corresponding to the first resource name.

2. The method according toclaim 1, further comprising:

receiving a request for a second resource name, and in response to the request again determining relative priorities of the first namespace and the second resource namespace by using the selected policies to prioritize the first resource namespace and the second resource namespace; and

in accordance with the again determining, obtaining from the first resource namespace or the second namespace a resource corresponding to the second resource name.

3. The method according toclaim 1, further comprising selecting from among the resource policies those policies that are applicable to the first resource name and using those policies for the determining the relative priorities of the first and second namespaces.

4. The method according toclaim 3, wherein the policies are selected based on whether they match the first resource name.

5. The method according toclaim 1, wherein the policies describe conditions under which they should be used to prioritize a resource namespace, and when such conditions are met the resource namespaces are prioritized based on the policies.

6. The method according toclaim 5, wherein a namespace is prioritized by two different policies.

7. The method according toclaim 6, wherein a policy's contribution in prioritizing a namespace is proportional to how specific the policy is to the first resource name.

8. A system, comprising one or more computing devices collectively configured to perform a process for flexibly prioritizing two or more overlapping resource namespaces, the process comprising:

before a resource is requested by a resource name, storing policy information defining a plurality of resource contexts;

when the resource is requested by the resource name, prioritizing two or more of the overlapping resource namespaces relative to each other based on the policy information, each of the overlapping resource namespaces comprising a plurality of resources and corresponding names thereof, each of the overlapping resource namespaces overlapping such that a same name in two or more overlapping resource namespaces refers to different instances of resources in the respective overlapping resource namespaces; and

obtaining the resource by accessing the prioritized resource namespaces in order of their priority until the resource is found in one of the overlapping resource namespaces.

9. The system according toclaim 8, wherein the process is performed such that the overlapping resource namespaces are prioritized relative to each other with a same order of priority independent of an order in which the overlapping resource namespaces are prioritized.

10. The system according toclaim 8, wherein the prioritizing is further based on the resource name.

11. The system according toclaim 10, the process further comprising passing the resource name, the overlapping resource namespaces, and/or the policy information to a policy engine that performs the prioritizing.

12. The system according toclaim 8, wherein the namespaces are prioritized based on which of the resource contexts are most relevant to the requested resource name.

13. The system according toclaim 8, wherein a resource context is compared against a context of the request.

14. The system according toclaim 8, the process further comprising receiving a request for a second resource name and prioritizing the two or more of the overlapping resource namespaces relative to each other based on the policy information, where the resource namespaces are prioritized in a different order than when they were prioritized for the first resource name.

15. A computer readable storage medium comprising computer readable instructions that, when executed on a computing device, cause:

storing a plurality of policies for prioritizing namespaces;

receiving, by the computer, a request for a first resource name, the computer having a virtualization component that virtualizes access to system resources on the computer and having a first namespace of resources on the computer and a second namespace of resources on the computer, one or more resource names being common to both namespaces and those same resource names corresponding to differing resources in their respective namespaces;

in response to the request, determining relative priorities of the first namespace and the second resource namespace by using the policies to prioritize the first resource namespace and the second resource namespace; and

in accordance with the determining, obtaining from the first resource namespace or the second namespace a resource corresponding to the first resource name.

16. The computer readable storage medium according toclaim 15, further comprising:

receiving a request for a second resource name, and in response to the request again determining relative priorities of the first namespace and the second resource namespace by using the selected policies to prioritize the first resource namespace and the second resource namespace; and

in accordance with the again determining, obtaining from the first resource namespace or the second namespace a resource corresponding to the second resource name.

17. The computer readable storage medium according toclaim 15, further comprising selecting from among the resource policies those policies that are applicable to the first resource name and using those policies for the determining the relative priorities of the first and second namespaces.

18. The computer readable storage medium according toclaim 17, wherein the policies are selected based on whether they match the first resource name.

19. The computer readable storage medium according toclaim 15, wherein the policies describe conditions under which they should be used to prioritize a resource namespace, and when such conditions are met the resource namespaces are prioritized based on the policies.

20. The computer readable storage medium according toclaim 19, wherein a namespace is prioritized by two different policies.

Images