Fine grained access control for linux services
View Patent ↗A user requests to execute an application. The system authenticates the user and determines whether the user is authorized to execute the application. If the user is both authenticated and authorized to execute the application, the system grants the user permission to execute the application. Otherwise, the system denies the user permission to execute the application.
1. An apparatus, comprising:
an application including an application name;
a receiver to receive a request from a user to execute the application;
a plurality of authentication modules to authenticate the user responsive to the request from the user to execute the application, each of the plurality of authentication modules capable of authenticating the user by themselves;
an authentication module selector to select an authentication module using the application name, the authentication module separate from each of the plurality of authentication modules;
an object set, including at least a first object representing the user and a second object including an indication as to whether the user is authorized to execute the application, the indication as to whether the user is authorized to execute the application includes a blacklist of IDs to be denied permission to execute the application and the first object includes a user ID (UID), wherein the UID is a unique ID assigned to the user by the system different from any ID assigned to other users; and
an authorization module to determine whether the UID is included in the blacklist of IDs.
2. An apparatus according to claim 1 , further comprising an access grantor to grant the user permission to execute the application if the user is authenticated by the selected authentication module and is authorized by the authorization module.
3. An apparatus according to claim 2 , wherein the access grantor is to deny the user permission to execute the application if the user is not authenticated by the selected authentication module and authorized by the authorization module.
4. An apparatus according to claim 1 , wherein:
the first object further includes a group ID (GID); and
the authorization module is further to determine whether the GID is included in the blacklist of IDs.
5. An apparatus according to claim 1 , wherein:
the object set further includes a group object, the group object identifying a grouping of users and including a group name, the grouping of users including the user; and
the authorization module is further to determine whether the group name is included is in the blacklist of IDs.
6. An apparatus according to claim 1 , wherein the application is designed to run on an operating system from LINUX.
7. A method, comprising:
receiving a request from a user to execute an application;
authenticating the user responsive to the request from the user to execute the application, including:
selecting an authentication module from a plurality of authentication modules using a name of the application, each of the plurality of authentication modules capable of authenticating the user by themselves; and
using the selected authentication module to authenticate the user; and
verifying that the user is authorized to execute the application using an authorization module, the authentication module separate from each of the plurality of authentication modules, including:
accessing an object set, the object set including at least a first object representing the user and a second object including an indication as to whether the user is authorized to execute the application, the indication as to whether the user is authorized to execute the application including a blacklist for the application;
determining a user ID (UID) for the user from the first object in the object set, wherein the UID is a unique ID assigned to the user by the system different from any ID assigned to other users;
determining if the UID is on the blacklist; and
if the UID is not on the blacklist for the application, indicating that the user is authorized to execute the application.
8. A method according to claim 7 , further comprising, if the user is authorized to execute the application and is authenticated, granting the user permission to execute the application.
9. A method according to claim 7 , further comprising, if the user is not authorized to execute the application or is not authenticated using the selected authentication module, denying the user permission to execute the application.
10. A method according to claim 7 , wherein determining whether the user is on a blacklist further includes:
determining a group ID (GID) for the user from the first object in the object set; and
determining if the GID is on the blacklist.
11. A method according to claim 7 , wherein determining whether the user is on a blacklist includes:
determining a group to which the user belongs, the group represented by a group object in the object set; and
determining if the group is on the blacklist.
12. An article, comprising:
a non-transitory storage medium, said non-transitory storage medium having stored thereon instructions, that, when executed by a machine, result in:
receiving a request from a user to execute an application;
authenticating the user responsive to the request from the user to execute the application, including:
selecting an authentication module from a plurality of authentication modules using a name of the application, each of the plurality of authentication modules capable of authenticating the user by themselves; and
using the selected authentication module to authenticate the user; and
verifying that the user is authorized to execute the application using an authorization module, the authentication module separate from each of the plurality of authentication modules, including:
accessing an object set, the object set including at least a first object representing the user and a second object including an indication as to whether the user is authorized to execute the application, the indication as to whether the user is authorized to execute the application including a blacklist for the application;
determining a user ID (UID) for the user from the first object in the object set, wherein the UID is a unique ID assigned to the user by the system different from any ID assigned to other users;
determining if the UID is on the blacklist; and
if the UID is not on the blacklist for the application, indicating that the user is authorized to execute the application.
13. An article according to claim 12 , wherein the non-transitory storage medium has further instructions stored thereon that, when executed by the machine result in, if the user is authorized to execute the application and is authenticated, granting the user permission to execute the application.
14. An article according to claim 12 , wherein the non-transitory storage medium has further instructions stored thereon that, when executed by the machine result in, if the user is not authorized to execute the application or is not authenticated using the selected authentication module, denying the user permission to execute the application.
15. An article according to claim 12 , wherein determining whether the user is on a blacklist further includes:
determining a group ID (GID) for the user from the first object in the object set; and
determining if the GID is on the blacklist.
16. An article according to claim 12 , wherein determining whether the user is on a blacklist includes:
determining a group to which the user belongs, the group represented by a group object in the object set; and
determining if the group is on the blacklist.
17. An apparatus according to claim 1 , the object set further includes a third object including a second indication as to whether the user is authorized to execute a second application, wherein a first of the indication and the second indication can grant the user access to a first of the application and the second application as though the user were an administrative user, and a second of the indication and the second indication can grant the user access to a second of the application and the second application as though the user were a limited user.
18. A method according to claim 7 , wherein accessing an object set includes accessing the object set, the object set further including a third object including a second indication as to whether the user is authorized to execute a second application, a first of the indication and the second indication indicating that the user can access a first of the application and the second application as though the user were an administrative user, and a second of the indication and the second indication indicating that the user can access a second of the application and the second application as though the user were a limited user.
19. An article according to claim 12 , wherein accessing an object set includes accessing the object set, the object set further including a third object including a second indication as to whether the user is authorized to execute a second application, a first of the indication and the second indication indicating that the user can access a first of the application and the second application as though the user were an administrative user, and a second of the indication and the second indication indicating that the user can access a second of the application and the second application as though the user were a limited user.