Patent ID: 8006088
Filing Date: 2011-08-23
Classification: H04L

Abstract:
1. A computer program product for modifying access to securable objects, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising: providing a rule that includes an application-criterion set including at least one criterion for modifying a token of a process during execution of the process in accordance with the rule, the rule specifying at least one group to be added to the token of the process that satisfies the application-criterion set and whose access to securable objects is controlled by an operating system in accordance with the token, at least one said specified group being a group other than the Administrators group; and before the operating system employs the process's token to determine the process's access to securable objects: if the inheritance option is set to block and the process does not satisfy any said of the rule's application-criterion set, the method further comprises determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.