Patent ID: 8321932

Claim:
A method, comprising: intercepting a file system action attempt, which is associated with an action by a process relating to a file in a computer system; determining a program file that attempts the file system action, wherein the determining comprises: identifying a process context of the process; and associating the process context with the program file, the associating comprising: placing hooks in a process creation code path and a process termination code path; creating an entry in a data structure when the process starts executing a code represented by the program file, wherein the entry is deleted when the process stops executing the code, wherein the entry includes associations between the process context and a file handle of the program file; and determining the program file associated with the process context from the entry in the data structure; allowing the action to proceed if it is authorized by an authorization policy; and blocking the action when it is not authorized by the authorization policy and when the computer system is operating in a first mode, wherein the computer system includes a second mode that is configured to allow the action when it is not authorized according to the authorization policy.