Managing privilege delegation on a computer device
A computer device for managing privilege delegation to control creation of processes thereon is described. Creation of a process, in a user account on a computer device, is requested according to first privileges. An agent, cooperating with an operating system of the computer device, intercepts the request. The agent determines whether to create the process according to second privileges, different from the first privileges and if permitted, cause the process to be created accordingly. The agent hooks a query provided by the operating system to identify whether a user account control service is enabled. The agent enquires of the operating system whether to create the process according to the second privileges whereupon the hooked query is invoked. The agent confirms to the operating system that the user account control service is enabled, such that checks by the operating system are performed as if the operating system were enabled.
1. A computer device for managing privilege delegation to control creation of processes thereon, the computer device comprising:
a processing circuit;
a memory;
an operating system;
a user account control service cooperating with the operating system; and
an agent cooperating with the operating system; wherein the agent is arranged to:
intercept a request from a user account of a logged-in user on the computer device to create a process according to first privileges in the user account on the computer device and to obtain information related to the request;
determine whether to create the process in the user account on the computer device according to second privileges different from the first privileges, based at least in part on the obtained information, by:
hooking a query provided by the operating system, wherein the hooked query is configured to identify whether the user account control service cooperating the operating system is enabled,
enquiring of the operating system whether to create the process in the user account on the computer device according to the second privileges, and
confirming, by invoking the hooked query and in response to the enquiring of the operating system, that the user account control service is enabled; and
cause the process to be created according to the second privileges in the user account by the operating system on the computer device, if it is determined to create the process in the user account on the computer device according to the second privileges.
2. The computer device according to claim 1 , wherein the agent is arranged to intercept the request by hooking the request in a user space, an application space and/or a kernel provided by the operating system.
3. The computer device according to claim 1 , wherein the agent is arranged to determine whether to create the process in the user account on the computer device according to the second privileges different from the first privileges by examining the information and referencing a policy file.
4. The computer device according to claim 1 , wherein the agent is arranged to determine whether to create the process in the user account on the computer device according to the second privileges different from the first privileges by prompting the logged-in user via the user account for authorisation and receiving the authorisation therefrom.
5. The computer device according to claim 1 , wherein the agent is arranged to cause the process to be created according to the first privileges in the user account by the operating system on the computer device, if it is determined to not create the process in the user account on the computer device according to the second privileges.
6. The computer device according to claim 1 , wherein the agent is arranged to cause the process to be created according to the second privileges in the user account by the operating system on the computer device by delegating the second privileges to the process by providing a token, having the second privileges assigned thereto, to the process.
7. The computer device according to claim 1 , wherein the user account control service cooperating the operating system is disabled.
8. The computer device according to claim 1 , wherein the first privileges are associated with a standard user account and wherein the second privileges are associated with an administrator account.
9. The computer device according to claim 1 , wherein the user account is an administrator account.
10. The computer device according to claim 1 , wherein the agent is arranged to unhook the hooked query in response to the hooked query being invoked.
11. A method of managing privilege delegation to control creation of processes on a computer device, the method being implemented by hardware of the computer device including at least a processor and a memory, the method comprising:
intercepting, by an agent cooperating with an operating system of the computer device, a request from a user account of a logged-in user on the computer device to create a process according to first privileges in the user account on the computer device and obtaining information related to the request;
determining, by the agent, whether to create the process in the user account on the computer device according to second privileges different from the first privileges, based at least in part on the obtained information, comprising:
hooking a query provided by the operating system, the hooked query configured to identify whether a user account control service cooperating the operating system is enabled,
enquiring of the operating system whether to create the process in the user account on the computer device according to the second privileges, and
confirming, by invoking the hooked query and in response to the enquiring of the operating system, that the user account control service is enabled; and
causing, by the agent, the process to be created according to the second privileges in the user account by the operating system on the computer device, if it is determined to create the process in the user account on the computer device according to the second privileges.
12. The method according to claim 11 , wherein intercepting the request comprises hooking the request in a user space, an application space and/or a kernel provided by the operating system.
13. The method according to claim 11 , wherein determining, by the agent, whether to create the process in the user account on the computer device according to the second privileges different from the first privileges comprises examining, by the agent, the information and referencing, by the agent, a policy file.
14. The method according to claim 11 , wherein determining, by the agent, whether to create the process in the user account on the computer device according to the second privileges different from the first privileges comprises prompting the logged-in user via the user account for authorisation and receiving the authorisation therefrom.
15. The method according to claim 11 , comprising causing, by the agent, the process to be created according to the first privileges in the user account by the operating system on the computer device, if it is determined to not create the process in the user account on the computer device according to the second privileges.
16. The method according to claim 11 , wherein causing, by the agent, the process to be created according to the second privileges in the user account by the operating system on the computer device comprises delegating the second privileges to the process by providing a token, having the second privileges assigned thereto, to the process.
17. The method according to claim 11 , wherein the user account control service cooperating the operating system is disabled.
18. The method according to claim 11 , wherein the first privileges are associated with a standard user account and wherein the second privileges are associated with an administrator account.
19. The method according to claim 11 , comprising unhooking, by the agent, the hooked query in response to the hooked query being invoked.
20. A tangible non-transitory computer-readable storage medium having recorded thereon instructions which, when implemented by hardware of a computer device including at least a processor and a memory, cause the computer device to:
intercept, by an agent cooperating with an operating system of the computer device, a request from a user account of a logged-in user on the computer device to create a process according to first privileges in the user account on the computer device and obtaining information related to the request;
determine, by the agent, whether to create the process in the user account on the computer device according to second privileges different from the first privileges, based at least in part on the obtained information, comprising:
hooking a query provided by the operating system, wherein the hooked query is configured to identify whether a user account control service cooperating the operating system is enabled,
enquiring of the operating system whether to create the process in the user account on the computer device according to the second privileges, and
confirming, by invoking the hooked query and in response to the enquiring of the operating system, that the user account control service is enabled; and
cause, by the agent, the process to be created according to the second privileges in the user account by the operating system on the computer device, if it is determined to create the process in the user account on the computer device according to the second privileges.