Patent ID: 8635663

Claim:
A method of operating a computing device having an operating system defining kernel space and user space, comprising the acts of: causing a program to be operated by the computing device, the program having a plurality of intended functionalities, the program further having a security profile associated therewith, the security profile including a set of policies; monitoring calls attempted by the program, the monitoring performed by monitoring operations in the kernel initiated in response to the calls, the monitoring comprising intercepting a kernel operation at a point at which one or more arguments associated with the call have been resolved in the kernel for the kernel operation; determining whether at least one intercepted kernel operation initiated in response to the program is consistent with the policies associated with the program, wherein the security profile is directed to defer a permission decision to user space, and the determining comprises: identifying a user space function referenced by a callback table in the kernel and located in user space to perform the permission decision, and performing a procedure call to the user space function; and allowing execution of the intercepted kernel operation when the call to the user space function indicates that the request is permitted.