Methods and systems for controlling access to resources and privileges per process
To control privileges and access to resources on a per-process basis, an administrator creates a rule that may be applied to modify a token of a process. The rule may include an application-criterion set and changes to be made to the groups and/or privileges of the token. The rule may be set as a policy within a group policy object (GPO), where a GPO is associated with one or more groups of computers or users. When a GPO containing a rule is applied to a computer, a driver installed on the computer may access the rule(s) anytime a logged-on user executes a process. If the executed process satisfies the criterion set of a rule, the changes contained within the rule are made to the process token, and the user has expanded and/or contracted access and/or privileges for only that process.
1. A method comprising:
detecting an event related to a process before execution of the process by a processor of a digital device;
identifying one or more applicable rules that apply to the process;
receiving from a user justification text describing a reason for the user to have access rights to the process on the digital device, the reason being provided by the user;
configuring a token for the process, wherein the token relates to a level of access of the user of the digital device to the process in accordance with the one or more applicable rules, the configuring of the token occurring in response to the receiving the justification text;
before executing the process, accessing the token of the process to determine at least one of a permission, a privilege, or an integrity level with which to execute the process; and
allowing the user to access the process based, at least in part, on the determination.
2. The method of claim 1 , wherein the one or more applications rules is at least one of a hash rule, a path rule, a folder rule, an MSI Path rule, an MSI folder rule, an ActiveX rule, a certificate rule, a shell rule, and a CD/DVD rule.
3. The method of claim 1 , wherein the method further comprises authenticating the user and wherein the configuration of the token only occurs if the user is authenticated.
4. The method of claim 1 , wherein the configuration of the token only occurs if the process is owned by an Administrators Group.
5. The method of claim 1 , wherein the configuration of the token occurs for all processes launched by a specified application.
6. The method of claim 1 , wherein the method further comprises applying the one or more applicable rules to all programs in all subfolders of a specified folder.
7. The method of claim 1 , wherein the justification text is logged to a system event log.
8. A computer readable non-transitory medium comprising executable instructions, the instructions being executable by a processor to perform a method, the method comprising:
detecting an event related to a process before execution of the process by a processor of a digital device;
identifying one or more applicable rules that apply to the process;
receiving from a user justification text describing a reason for the user to have access rights to the process on the digital device, the reason being provided by the user;
configuring a token for the process, wherein the token relates to a level of access of the user of the digital device to the process in accordance with the one or more applicable rules, the configuring of the token occurring in response to the receiving the justification text;
before executing the process, accessing the token of the process to determine at least one of a permission, a privilege, or an integrity level with which to execute the process; and
allowing the user to access the process based, at least in part, on the determination.
9. The computer readable non-transitory medium of claim 8 , wherein the one or more applicable rules is at least one of a hash rule, a path rule, a folder rule, an MSI Path rule, an MSI folder rule, an ActiveX rule, a certificate rule, a shell rule, and a CD/DVD rule.
10. The computer readable non-transitory medium of claim 8 , wherein the method further comprises authenticating the user and wherein the configuration of the token only occurs if the user is authenticated.
11. The computer readable non-transitory medium of claim 8 , wherein the configuration of the token only occurs if the process is owned by an Administrators Group.
12. The computer readable non-transitory medium of claim 8 , wherein the configuration of the token occurs for all processes launched by a specified application.
13. The computer readable non-transitory medium of claim 8 , wherein the method further comprises applying the one or more applicable rules to all programs in all subfolders of a specified folder.
14. The computer readable non-transitory medium of claim 8 , wherein the configuration of the token only occurs if the user enters a justification.
15. The computer readable non-transitory medium of claim 8 , wherein the justification text is logged to a system event log.
16. A method comprising:
prior to setting an integrity level for an indicated process executed by a processor of a digital device, requesting justification text for setting the integrity level from a user of the digital device, the justification text requesting that the integrity level be set, the justification text describing a reason, by the user, for setting the integrity level, the integrity level corresponding to access rights of the user to the indicated process;
receiving from the user the justification text;
setting, in response to the receiving the justification text, the integrity level for the indicated process by the processor, wherein setting the integrity level of the indicated process does not modify an integrity level of any non-indicated process;
before execution of the indicated process, accessing an integrity level indication to determine under what integrity level to execute the indicated process; and
evaluating whether a non-indicated process is allowed to interact with the indicated process based on the determination.
17. The method of claim 16 , further comprising, prior to setting the integrity level, verifying an identity of the user requesting that the integrity level be set.
18. The method of claim 16 , wherein setting the integrity level is done in accordance with at least one rule.
19. The method of claim 18 , wherein the at least one rule is a shell rule, and wherein the integrity level is set for the indicated process upon receiving an on-demand request.
20. The method of claim 18 , wherein the at least one rule is a certificate rule, and wherein the integrity level is set if at least one criterion of a certificate of the indicated process is met.
21. The method of claim 18 , wherein the at least one rule is an administrator-defined rule, and wherein the integrity level is set upon providing a user credential.
22. The method of claim 16 , wherein the justification text is logged to a system event log.
23. A computer readable non-transitory medium comprising executable instructions, the instructions being executable by a processor to perform a method, the method comprising:
prior to setting an integrity level for an indicated process executed by a processor of a digital device, requesting justification text for setting the integrity level from a user of the digital device, the justification text requesting that the integrity level be set, the justification text describing a reason, by the user, for setting the integrity level, the integrity level corresponding to access rights to the indicated process;
receiving from the user the justification text;
setting, in response to the receiving the justification text, the integrity level for the indicated process by the processor, wherein setting the integrity level of the indicated process does not modify an integrity level of any non-indicated process;
before execution of the indicated process, accessing an integrity level indication to determine under what integrity level to execute the indicated process; and
evaluating whether a non-indicated process is allowed to interact with the indicated process based on the determination.
24. The computer readable non-transitory medium of claim 23 , wherein the justification text is logged to a system event log.