Providing selective system privileges on an information handling device
View Patent ↗Devices, methods and products are described that provide for selective system or root level access for applications on an information handling device. One aspect provides a method comprising determining whether an application has system privileges on an information handling device; and executing privileged code from the application on said information handling device responsive to determining that the application has system privileges through one or more native services operating on said information handling device. Other aspects and embodiments are also described herein.
1. An information handling device comprising:
one or more processors;
a mobile operating system designating user and system privileges;
a permission vector, wherein the permission vector performs a system level permission check during installation of an application;
a memory in operative connection with the one or more processors, the memory storing instructions executable by the one or more processors to:
retrieve an application from a remote device, wherein the application requires system privileges to the information handling device for full installation;
begin installation of the application on the information handling device;
during the installation of the application, determine using the permission vector operating on said information handling device, whether the application has system privileges via determining whether the application contains one or more certificates that match one or more device keys, wherein the one or more device keys comprise a platform key used to sign an image of said information handling device;
during the installation of the application, execute non-privileged code from the application responsive to determining that the application has user privileges and not system privileges; and
during the installation of the application, execute privileged code from the application responsive to determining that the application has system privileges.
2. The information handling device of claim 1 , wherein the privileged code interacts with one or more privileged device elements.
3. The information handling device of claim 2 , wherein the one or more privileged device elements comprise firmware, system files, networking configurations, device node access, and kernel input/output control.
4. The information handling device of claim 1 , wherein determining whether the application has system privileges further comprises determining whether the privileged code has operating system granted root privileges.
5. The information handling device of claim 1 , wherein the one or more device keys comprise a public key stored on said information handling device.
6. The information handling device of claim 1 , wherein said information handling device is one of a cell phone, a tablet computing device, a notebook computing device, a television streaming device, a point-of-sale device, and in car entertainment (ICE).
7. The information handling device of claim 1 , wherein the application comprises a virtual private network (VPN) application.
8. The information handling device of claim 1 , wherein the application comprises a socks level proxy client application.
9. The information handling device of claim 1 , wherein the application is a downloaded, on-device application.
10. A method comprising:
retrieving, at an information handling device, an application from a remote device, wherein the application requires system privileges to the information handling device for full installation;
begin installing the application on the information handling device;
during the installation of the application, determining, using a permission vector operating on the information handling device, whether the application has system privileges via determining whether the application contains one or more certificates that match one or more device keys, wherein the one or more device keys comprise a platform key used to sign an image of said information handling device and wherein the permission vector performs a system level permission check during installation of an application;
during the installation of the application, executing non-privileged code from the application responsive to determining that the application has user privileges and not system privileges; and
during the installation of the application, executing privileged code from the application on said information handling device responsive to determining that the application has system privileges.
11. The method of claim 10 , wherein the privileged code interacts with one or more privileged device elements.
12. The method of claim 11 , wherein the one or more privileged device elements comprise firmware, system files, networking configurations, device node access, and kernel input/output control.
13. The method of claim 10 , wherein the determining whether the application has system privileges further comprises determining whether the privileged code has operating system granted root privileges.
14. The method of claim 10 , wherein the one or more device keys comprise a public application key stored on said information handling device.
15. The method of claim 10 , wherein said information handling device is one of a cell phone, a tablet computing device, a notebook computing device, a television streaming device, a point-of-sale device, and in car entertainment (ICE).
16. The method of claim 10 , wherein the application comprises a virtual private network (VPN) application.
17. A program product comprising:
a storage device having program code embodied therewith, the program code being executable by a processor and comprising:
program code that provides a mobile operating system designating user and system privileges;
program code that retrieves an application from a remote device, wherein the application requires system privileges to the information handling device for full installation;
program code that begin installation of the application on the information handling device;
program code that during the installation of the application, determines, using a permission vector operating on an information handling device, whether the application has system privileges on the information handling device via determining whether the application contains one or more certificates that match one or more device keys, wherein the one or more device keys comprise a platform key used to sign an image of said information handling device and wherein the permission vector performs a system level permission check during installation of the application;
program code that during the installation of the application, executes non-privileged code from the application responsive to determining that the application has user privileges and not system privileges; and
program code that during the installation of the application, executes privileged code from the application on said information handling device responsive to determining that the application has system privileges.