Robustly regulating access to executable class registry entries

1. A computer implemented method for robustly regulating access to executable path registry entities, the method comprising the steps of:

a registry access manager intercepting system calls that access a registry;

the registry access manager detecting an attempt by a process to access an executable path entity in the registry;

the registry access manager determining whether a security policy permits the access, the determining comprising examining contents of a file pointed to by the executable path entity; and

the registry access manager performing a step from a group of steps consisting of:

responsive to determining that the security policy permits the access, allowing the attempt to proceed; and

responsive to determining that the security policy does not permit the access, blocking the attempt.

2. The method of claim 1 wherein:

the registry access manager is instantiated as at least one system call wrapper.

3. The method of claim 1 wherein the attempt by the process to access an executable path entity in the registry comprises an attempt to perform an access of a type from a group of access types consisting of:

adding a new executable path entity;

reading an executable path entity;

modifying an executable path entity;

deleting an executable path entity;

overwriting an executable path entity;

setting object information concerning an executable path entity; and

querying object information concerning an executable path entity.

4. The method of claim 1 , wherein the registry access manager determining whether the security policy permits the access further comprises evaluating a condition from a group of conditions consisting of:

the executable path entity;

the executable path entity's type;

the executable path entity's name;

the executable path entity's contents;

a new name the access is attempting to give the executable path entity;

new content the access is attempting to write to the executable path entity;

a current time;

a current date;

the process;

the process type;

a user who owns the process;

a group with which the user who owns the process is associated; and

a computer from which the access attempt originated.

5. The method of claim 1 wherein the registry access manager blocks the attempt, the method further comprising the step of:

the registry access manager logging the blocked attempt.

6. The method of claim 1 wherein the registry access manager allows the attempt to proceed, the method further comprising the step of:

the registry access manager logging the allowed access operation.

7. The method of claim 1 wherein the security policy is host based.

8. The method of claim 1 wherein the security policy is network based.

9. The method of claim 1 , further comprising the registry access manager determining, based on the contents of the pointed-to file, whether the pointed-to file matches a type specified in the security policy.

10. A computer implemented method for robustly regulating access to entries in .INI files concerning executable entities, the method comprising the steps of:

an .INI file access manager detecting an attempt by a process to access an entry in an .INI file concerning an executable entity;

the .INI file access manager determining whether a security policy permits the access, the determining comprising examining contents of a file pointed to by the entry concerning the executable entity; and

the .INI file access manager performing a step from a group of steps consisting of:

responsive to determining that the security policy permits the access, allowing the attempt to proceed; and

responsive to determining that the security policy does not permit the access, blocking the attempt.

11. The method of claim 10 wherein:

the .INI file access manager is instantiated as at least one system call wrapper.

12. The method of claim 10 wherein:

a portion of the .INI file access manager is instantiated as a file system filter driver and a portion of the .INI file access manager is instantiated as at least one system call wrapper.

13. The method of claim 10 wherein the attempt by the process to access an entry in the .INI file concerning an executable entity comprises an attempt to perform an access of a type from a group of access types consisting of:

adding a new entry concerning an executable entity;

reading an entry concerning an executable entity;

modifying an entry concerning an executable entity;

deleting an entry concerning an executable entity; and

overwriting an entry concerning an executable entity.

14. The method of claim 10 , wherein the .INI file access manager determining whether the security policy permits the access further comprises evaluating a condition from a group of conditions consisting of:

the entry concerning an executable entity;

the entry concerning an executable entity's type;

the entry concerning an executable entity's name;

the entry concerning an executable entity's contents;

a new name the access is attempting to give the entry concerning an executable entity;

new content the access is attempting to write to the entry concerning an executable entity;

a current time;

a current date;

the process;

the process type;

a user who owns the process;

a group with which the user who owns the process is associated; and

a computer from which the access attempt originated.

15. The method of claim 10 wherein the security policy is host based.

16. The method of claim 10 wherein the security policy is network based.

17. The method of claim 10 , further comprising the .INI file access manager determining, based on the contents of the pointed-to file, whether the pointed-to file matches a type specified in the security policy.

18. A non-transitory computer readable medium containing a computer program product for robustly regulating access to executable path registry entities, the computer program product comprising:

program code for intercepting system calls that access a registry;

program code for detecting an attempt by a process to access an executable path entity in the registry;

program code for determining whether a security policy permits the access, the determining comprising examining contents of a file pointed to by the executable path entity; and

program code for performing a step from a group of steps consisting of:

responsive to determining that the security policy permits the access, allowing the attempt to proceed; and

responsive to determining that the security policy does not permit the access, blocking the attempt.

19. A non-transitory computer readable medium containing a computer program product for robustly regulating access to entries in .INI files concerning executable entities, the computer program product comprising:

program code for detecting an attempt by a process to access an entry in an .INI file concerning an executable entity;

program code for determining whether a security policy permits the access, the determining comprising examining contents of a file pointed to by the entry concerning the executable path entity; and

program code for performing a step from a group of steps consisting of:

responsive to determining that the security policy permits the access, allowing the attempt to proceed; and

responsive to determining that the security policy does not permit the access, blocking the attempt.

20. A computer system for robustly regulating access to executable path registry entities, the computer system having a memory and comprising:

a software portion stored in the memory and configured to intercept system calls that access a registry;

a software portion stored in the memory and configured to detect an attempt by a process to access an executable path entity in the registry;

a software portion stored in the memory and configured to determine whether a security policy permits the access, the determining comprising examining contents of a file pointed to by the executable path entity; and

a software portion stored in the memory and configured to perform a step from a group of steps consisting of:

responsive to determining that the security policy permits the access, allowing the attempt to proceed; and

responsive to determining that the security policy does not permit the access, blocking the attempt.