Systems and methods for controlling privileged operations

1. A computer-implemented method for controlling privileged operations on a client computer system having an operating system defining a kernel space, the steps comprising:

providing a kernel module having a kernel authorization subsystem for the kernel space of the client computer system, the kernel module being loadable to the client computer system and is configured to intercept one or more file operations, wherein the kernel authorization subsystem is configured to manage authorization of the one or more file operations;

registering, by the kernel module, a listener for the kernel authorization subsystem;

monitoring, by the kernel module, the one or more file operations for a file access, and calling the registered listener by the kernel authorization subsystem when the kernel authorization subsystem detects the file access;

identifying, by the kernel module, the file access and then calling a privileged daemon when the kernel module identifies the file access, the privileged daemon being configured to perform an authorization process with at least one root-user privilege;

checking a policy, by the privileged daemon, and determining, based on the policy, whether at least one applied rule is applicable;

if the at least one applied rule is applicable, initializing, by the privileged daemon, a launcher module with at least one parameter identifying a target application;

launching the target application, by the launcher module, with the at least one root-user privilege;

receiving a request, from a running application, for one or more restricted operations, wherein the one or more restricted operations are associated with one or more authorization rights that define one or more checks that must be performed in order to grant access to the one or more restricted operations; and

receiving, by an authorization subsystem and from the running application, a request to perform the one or more checks on the one or more authorization rights, wherein the one or more authorization rights comprise one or more customized mechanism rights created by the privileged daemon.

2. The computer-implemented method of claim 1 , wherein, when the kernel module identifies the file access, the registered listener obtains a file name of the file access and provides the file name to the privileged daemon, such that the privileged daemon checks the policy with the file name to determine whether the at least one applied rule is applicable.

3. The computer-implemented method of claim 1 , further comprising the steps:

requesting, by the running application, the one or more customized mechanism rights;

invoking, by the authorization subsystem, an authorization plugin; and

calling, by the authorization plugin, the privileged daemon to lookup the policy to determine whether the at least one applied rule, which allows the one or more restricted operations, should be applied.

4. The computer-implemented method of claim 3 , further comprising the steps:

providing, by the privileged daemon, a success status notification to the authorization plugin, when the privileged daemon locates the at least one applied rule for the one or restricted operations;

forwarding, by the authorization plugin, the success status notification to the authorization subsystem; and

authorizing, by the authorization subsystem, the one or more restricted operations to the running application.

5. The computer-implemented method of claim 1 , wherein the one or more customized mechanism rights are created via the following steps:

obtaining a list of one or more regular rights;

copying the one or more regular rights to create one or more copied rights;

renaming the one or more copied rights to create one or more renamed rights, the one or more renamed rights preserve a function of the one or more regular rights; and modifying the one or more regular rights by applying at least one modification to create the one or more customized mechanism rights.

6. The computer-implemented method of claim 1 , wherein the operating system further comprises a service module and a message module;

wherein the service module is configured to expose a context menu for inputting one or more shell rules; and

wherein the message module is configured to display one or more messages for the at least one applied rule.

7. The computer-implemented method of claim 1 , wherein the operating system comprises the authorization subsystem.

8. A computer-implemented method for controlling privileged operations on a client computer system having an operating system defining a kernel space, the steps comprising:

providing a kernel module having a kernel authorization subsystem for the kernel space of the client computer system, the kernel module being loadable to the client computer system and is configured to intercept one or more file operations, wherein the kernel authorization subsystem is configured to manage authorization of the one or more file operations;

registering, by the kernel module, a listener for the kernel authorization subsystem;

monitoring, by the kernel module, the one or more file operations for a file access, and calling the registered listener by the kernel authorization subsystem when the kernel authorization subsystem detects the file access;

identifying, by the kernel module, the file access and then calling a privileged daemon when the kernel module identifies the file access, the privileged daemon being configured to perform an authorization process with at least one root-user privilege;

checking a policy, by the privileged daemon, and determining, based on the policy, whether at least one applied rule is applicable;

if the at least one applied rule is applicable, initializing, by the privileged daemon, a launcher module with at least one parameter identifying a target application;

launching the target application, by the launcher module, with the at least one root-user privilege;

informing the kernel module, by the privileged daemon, of the at least one applied rule;

denying, by the kernel module, the file access via the kernel authorization subsystem,

such that executing the target application with a standard user privilege does not succeed;

requesting, by a running application, one or more restricted operations; wherein the one or more restricted operations are associated with one or more authorization rights that define one or more checks that must be performed in order to grant access to the one or more restricted operations; and

calling, by the running application, an authorization subsystem to perform the one or more checks on the one or more authorization rights, wherein the one or more authorization rights comprise one or more customized mechanism rights created by the privileged daemon.

9. The computer-implemented method of claim 8 , wherein, when the kernel module identifies the file access, the registered listener obtains a file name of the file access and provides the file name to the privileged daemon, such that the privileged daemon checks the policy with the file name to determine whether the at least one applied rule is applicable.

10. The computer-implemented method of claim 8 , further comprising the steps:

requesting, by the running application, the one or more customized mechanism rights;

invoking, by the authorization subsystem, an authorization plugin; and

calling, by the authorization plugin, the privileged daemon to lookup the policy to determine whether at least one applied rule, which allows the one or more restricted operations, should be applied.

11. The computer-implemented method of claim 10 , further comprising the steps:

providing, by the privileged daemon, a success status notification to the authorization plugin, when the privileged daemon locates the at least one applied rule for the one or restricted operations;

forwarding, by the authorization plugin, the success status notification to the authorization subsystem; and

authorizing, by the authorization subsystem, the one or more restricted operations to the running application.

12. The computer-implemented method of claim 8 , wherein the one or more customized mechanism rights are created via the following steps:

obtaining a list of one or more regular rights;

copying the one or more regular rights to create one or more copied rights;

renaming the one or more copied rights to create one or more renamed rights, the one or more renamed rights preserve a function of the one or more regular rights; and

modifying the one or more regular rights by applying at least one modification to create the one or more customized mechanism rights;

wherein the at least one modification is selected from a group of modifications comprising: a class key configuration and a mechanisms key configuration.

13. The computer-implemented method of claim 8 , wherein the operating system further comprises a service module and a message module;

wherein the service module is configured to expose a context menu for inputting one or more shell rules; and

wherein the message module is configured to display one or more messages for the at least one applied rule.

14. A system for controlling privileged operations on a client computer comprising:

at least one computing device comprising a processor and a memory;

an operating system defining a kernel space;

a kernel module comprising a kernel authorization subsystem for the kernel space and the kernel module being loadable in at least one computing device of the client computer, the kernel module, when executed by the at least one computing device, being configured to:

intercept one or more file operations;

manage, via the kernel authorization subsystem, authorization of the one or more file operations;

register a listener for the kernel authorization subsystem;

monitor the one or more file operations for a file access;

call, via the kernel authorization subsystem, the registered listener when the kernel authorization subsystem detects the file access;

identify the file access and then calling a privileged daemon;

receive a request, from a running application, for one or more restricted operations, wherein the one or more restricted operations are associated with one or more authorization rights that define one or more checks that must be performed in order to grant access to the one or more restricted operations; and

receive from the running application, a request to perform the one or more checks on the one or more authorization rights, wherein the one or more authorization rights comprise one or more customized mechanism rights created by the privileged daemon;

the privileged daemon being configured to:

perform an authorization process with at least one root-user privilege;

check a policy; and

determine, based on the policy, whether at least one applied rule is applicable;

if the at least one applied rule is applicable, initialize a launcher module with at least one parameter identifying a target application;

the launcher module being configured to launch the target application with the at least one root-user privilege; and

an authorization subsystem being configured to

receive a request from a running application for one or more restricted operations; wherein the one or more restricted operations are associated with one or more authorization rights that define one or more checks that must be performed in order to grant access to the one or more restricted operations; and

receive a call from the running application to perform the one or more checks on the one or more authorization rights, the one or more authorization rights comprise one or more customized mechanism rights created by the privileged daemon.

15. The system of claim 14 , wherein when the kernel module identifies the file access, the registered listener obtains a file name of the file access and provides the file name to the privileged daemon, such that the privileged daemon checks the policy with the file name to determine whether the at least one applied rule is applicable.

16. The system of claim 14 , wherein the kernel module is further configured to:

receive, from the running application, a request for the one or more customized mechanism rights;

invoke an authorization plugin; and

call the privileged daemon to lookup the policy to determine whether at least one applied rule, which allows the one or more restricted operations, should be applied.

17. The system of claim 16 , wherein:

the privileged daemon is further configured to:

locate the at least one applied rule for the one or restricted operations; and

in response to locating the at least one applied rule, provide a success status notification to the authorization plugin;

the authorization plugin is configured to forward the success status notification to the authorization subsystem; and

the authorization subsystem configured to authorize the one or more restricted operations to the running application.

18. The system of claim 14 , wherein the one or more customized mechanism rights are created via the following steps:

obtaining a list of one or more regular rights;

copying the one or more regular rights to create one or more copied rights;

renaming the one or more copied rights to create one or more renamed rights, the one or more renamed rights preserve a function of the one or more regular rights; and

modifying the one or more regular rights by applying at least one modification to create the one or more customized mechanism rights;

wherein the at least one modification is selected from a group of modifications comprising: a class key configuration and a mechanisms key configuration.

19. The system of claim 14 , wherein the operating system further comprises

a service module and a message module;

wherein the service module is configured to expose a context menu for inputting one or more shell rules; and

wherein the message module is configured to display one or more messages for the at least one applied rule.

20. The system of claim 14 , wherein the operating system comprises the authorization subsystem.