Controlling applications by an application control system in a computer device

1. A method, comprising:

intercepting, via a computing device, a request to launch a requested application on the computing device by a calling process, wherein the request includes information identifying the requested application;

determining, via the computing device, that a user interaction is required before launching the requested application by consulting a set of application policies based on the information identifying the requested application;

in response to determining that the user interaction is required, establishing, via the computing device, whether or not the calling process is associated with a controlling terminal provided by an operating system of the computer device, wherein a process session group containing processes launched within a user session is selectively associated with the controlling terminal by the operating system; and

in response to establishing that the calling process is associated with the controlling terminal, performing, via the computing device, the user interaction using a pair of input and output channels of the controlling terminal, wherein the user interaction comprises receiving user input via the at least one computing device.

2. The method of claim 1 , wherein the set of application policies define a set of outcomes responsive to the user interaction.

3. The method of claim 1 , further comprising launching, via the computing device, the requested application based on the user interaction.

4. The method of claim 1 , further comprising denying, via the computing device, the requested application from launching based on the user interaction.

5. The method of claim 1 , wherein the request to launch the requested application comprises calling a program execution function and the method further comprises providing, via the computing device, an extra implementation of the program execution function in a system library.

6. The method of claim 1 , wherein the set of application policies are pre-configured and immutable.

7. The method of claim 1 , further comprising:

in response to establishing that the calling process is not associated with the controlling terminal, determining, via the computing device, that the request to launch was initiated from a graphical user interface;

starting, via the computing device, a message process in the graphical user interface; and

in response to determining that the request was initiated from the graphical user interface, performing, via the computing device, the user interaction by communicating with the message process in the graphical user interface.

8. The method of claim 1 , wherein the user interaction comprises receiving a typed command into a textual command line interface of the controlling terminal.

9. A system, comprising:

a memory device; and

at least one computing device in communication with the memory device, the at least one computing device being configured to:

intercept a request to launch a requested application on the at least one computing device by a calling process executed by the at least one computing device, wherein the request includes information identifying the requested application;

determine that a user interaction is required before launching the requested application by consulting a set of application policies based on the information identifying the requested application;

in response to determining that the user interaction is required, establish that the calling process is associated with a controlling terminal provided by an operating system of the at least one computing device, wherein a process session group containing processes launched within a user session is selectively associated with the controlling terminal by the operating system; and

in response to establishing that the calling process is associated with the controlling terminal, perform the user interaction via a pair of input and output channels of the controlling terminal, wherein the user interaction comprises receiving user input via the at least one computing device.

10. The system of claim 9 , wherein the at least one computing device is further configured to determine an outcome for the requested application based on the user interaction.

11. The system of claim 10 , wherein the outcome comprises one of: permitting a launch of the requested application and denying the launch of the requested application.

12. The system of claim 9 , wherein the at least one computing device is further configured to provide a higher privilege level than a privilege level of a current user to execute the requested application.

13. The system of claim 9 , wherein the at least one computing device is further configured to:

receive a cancel to the user interaction; and

perform a default outcome defined by the set of application policies.

14. A non-transitory computer-readable medium embodying a program that, when executed by at least one computing device, causes the at least one computing device to:

intercept a request to launch a requested application on the at least one computing device by a calling process, wherein the request includes information identifying the requested application;

determine that a user interaction is required before launching the requested application by consulting a set of application policies based on the information identifying the requested application;

in response to determining that the user interaction is required, establish that the calling process is associated with a controlling terminal provided by an operating system of the at least one computing device, wherein a process session group containing processes launched within a user session is selectively associated with the controlling terminal by the operating system; and

in response to establishing that the calling process is associated with the controlling terminal, perform an authentication action including the user interaction using the controlling terminal by receiving user input operatively connected to the at least one computing device, wherein the authentication action is performed via a pair of input and output channels of the controlling terminal, wherein

the authentication action comprises receiving user input via an input device connected to the at least one computing device.

15. The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:

in response to intercepting the request, iterate over a system directory containing a plurality of file names match individual ones of a plurality of open file descriptors with a respective one of the plurality of file names;

obtain a respective set of flags associated with the individual ones of the plurality of open file descriptors; and

close at least one file descriptor from the plurality of open file descriptors based on a close-on-execute flag being set in the respective set of flags associated with the at least one file descriptor.

16. The non-transitory computer-readable medium of claim 14 , wherein the program comprises an application control system that operates in addition to a native security mechanism of an operating system of the at least one computing device.

17. The non-transitory computer-readable medium of claim 14 , wherein the set of application policies define conditions under which the requested application may be launched in relation to the at least one computing device.

18. The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:

transmit, to a policy service, a policy request message defining the request to launch the requested application on the at least one computing device by the calling process; and

receive a policy result defining that the user interaction is required from a policy service based on the policy request message and the set of application policies.

19. The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:

gather at least a process identity of the calling process;

traverse a process tree containing the calling process based on at least the process identity of the calling process; and

discover whether or not the controlling terminal is associated with a process within the process tree.

20. The non-transitory computer-readable medium of claim 14 , wherein the authentication action comprises at least one of: challenge-response, credential entry, or biometric scan.