Patent ID: 7895664

Claim:
A computer implemented method for access control in a mixed discretionary access control and role based access control environment, the computer implemented method comprising: determining an execution access for a command using a set of role based authorizations for a user invoking the command; responsive to a determination that the user invoking the command is authorized based on the set of role based authorizations, raising a privilege in a set of privileges associated with the command, wherein raising the privilege in the set of privileges bypasses discretionary access control checks; responsive to a determination that a role associated with the set of role based authorizations authorizing execution access for the command is not assigned to the user invoking the command, determining whether a special authorization is associated with the command, wherein the special authorization is an authorization authorizing execution access for the command based on the user's identity in a role based access control environment; and responsive to a determination that the special authorization does not authorize execution access for the user based on the user's identity, authorizing execution access for the command if a discretionary access control mode bit indicates that the user invoking the command has execution access based on the user's identity.