Computer device and method for managing privilege delegation
A computer device that manages privilege delegation is disclosed. The computing device can insert a custom verb command into a plurality of verb commands corresponding to a file. The computing device can intercept a request to execute the custom verb command on the file by intercepting a request to create a context menu. The computer device can obtain information related to the request to execute the custom verb command by obtaining a file identifier of the file from the request to create the context menu. The computer device can determine whether to execute the custom verb command on the file according to second privileges different from the first privileges based on the information related to the request to execute the custom verb command. The computer device can cause the custom verb command to be executed on the file according to the second privileges.
1 . A system, comprising:
a memory; and
at least one computing device in communication with the memory, the at least one computing device being configured to:
replace an entry in a virtual method table with a pointer to a hook function;
intercept, via an agent, a request generated by a user selection and directed to an operating system to execute a verb command on a file according to first privileges assigned to a user account;
capture an identity associated with the request;
determine whether to execute the verb command based at least in part on at least one rule in a policy and the identity; and
launch an agent proxy process having second privileges different than the first privileges, wherein the agent proxy process is configured to cause the verb command to be executed according to the second privileges.
2 . The system of claim 1 , wherein the at least one computing device is further configured to:
provide a policy request comprising the identity to a policy server; and
receive a policy result comprising the at least one rule from the policy server.
3 . The system of claim 1 , wherein the at least one computing device is further configured to:
request an authorization from the user account to execute the verb command on the file; and
establish the authorization for the user account.
4 . The system of claim 1 , wherein the at least one computing device is further configured to:
obtain information related to the request; and
forward the information to an agent service.
5 . The system of claim 4 , wherein the information comprises a file identifier, a command identifier, a user identifier, or an identifier for the at least one computing device.
6 . The system of claim 1 , wherein the agent proxy process is configured to cause the verb command to be executed according to the second privileges.
7 . The system of claim 1 , wherein the first privileges comprise default user privileges and the second privileges comprise administrator privileges.
8 . The system of claim 1 , wherein the policy is a file which is not accessible to the user account.
9 . The system of claim 1 , wherein the user selection is of a menu entry from a context menu.
10 . A method comprising:
replacing an entry in a virtual method table with a pointer to a hook function;
intercepting, via an agent executed by one of one or more computing devices, a request generated by a user selection and directed to an operating system to execute a command on a file according to first privileges assigned to a user account;
capturing, via one of the one or more computing devices, an identity associated with the request;
determining, via one of the one or more computing devices, to execute the command based at least in part on at least one rule in a policy and the identity; and
launching, via one of the one or more computing devices, an agent proxy process having second privileges different than the first privileges, wherein the agent proxy process is configured to cause the command to be executed according to the second privileges.
11 . The method of claim 10 , further comprising inserting, via one of the one or more computing devices, a custom verb command into a plurality of verb commands corresponding to the file.
12 . The method of claim 11 , wherein the request to execute the command comprises a request to create a context menu for the file, wherein the context menu includes the plurality of verb commands.
13 . The method of claim 11 , wherein inserting the custom verb command comprises replacing one of a plurality of verb commands with the custom verb command.
14 . The method of claim 10 , wherein intercepting the request comprises intercepting a creation request for a COM object.
15 . The method of claim 14 , further comprising wrapping the COM object with a wrapper object, wherein the wrapper object comprises a same interface as the COM object.
16 . The method of claim 14 , wherein intercepting the creation request comprises modifying the virtual method table for the COM object.
17 . A non-transitory computer-readable medium embodying a program that, when executed by one of at least one computing devices, causes the at least one computing devices to:
replace an entry in a virtual method table with a pointer to a hook function;
intercept, via an agent, a request generated by a user selection and directed to an operating system to execute a verb command on a file according to first privileges assigned to a user account;
capture an identity associated with the request;
determine whether to execute the verb command based at least in part on at least one rule in a policy and the identity; and
launch an agent proxy process having second privileges different than the first privileges, wherein the agent proxy process is configured to cause the verb command to be executed according to the second privileges.
18 . The non-transitory computer-readable medium of claim 17 , wherein the program further causes the at least one computing devices to terminate the agent proxy process.
19 . The non-transitory computer-readable medium of claim 17 , wherein the program further causes the at least one computing devices to obtain a file identifier for the file.