Protected Virtual Networking API Using a File System Interface (NET-FS)

NetFS是操作系统的网络配置参数的文件系统接口。所有网络配置都由文件操作执行，因此继承了文件系统保护，包括受限的用户和组访问，以及对更易于支持虚拟网络的分层结构的支持。这为各个网络设置提供了细粒度的资源保护，提供了一个安全的环境，在该环境中，应用程序可以对网络配置和控制的有限子集进行受控访问，例如路由表、接口配置、IP安全关联和防火墙规则。NetFS还提供了一个接口，该接口统一了对可移植文件系统范例下操作系统的这些网络参数的访问。这种统一的受控界面还更容易支持高级虚拟网络，其中各个应用程序连接到网络基础设施的不同子集，以支持并发参与多个联盟。

NetFS is a file system interface to the network configuration parameters of an operating system. All network configuration is performed by file operations, thus inheriting file system protection, including limited user and group access, as well as support for hierarchies, which more readily support virtual networks. This results in fine-grained resource protection for individual network settings, providing in a safe environment in which applications can have controlled access to limited subsets of network configuration and control, such as routing tables, interface configurations, IP security associations, and firewall rules. NetFS also provides an interface that unifies access to these networking parameters of the operating system under a portable file system paradigm. This unified controlled interface also more readily supports advanced virtual networking, where individual applications are attached to different subsets of network infrastructure to support concurrent participation in multiple coalitions.