| 摘要 |
<p>When a process running in an isolated execution environment is started by a user, the credentials of the user are associated with a naming environment for the isolated execution environment. The isolated execution environment may be implemented via creation of a namespace representing resources available to one or more processes running within the isolated execution environment. The resources available to the isolated processes may represent some subset of global resources. When a request to access a named resource is received, the request is mediated by the operating system. Access, if provided, may be provided via the naming environment associated with the isolated execution environment. The operating system determines whether to grant or deny access to the resource by checking the credentials associated with the naming environment with the ACL of the resource.</p> |
