Patent ID: 7818781

Claim:
A method performed by a computer having a memory and a processor for setting a self-imposed policy of a process, comprising: under control of an operating system, starting execution by the processor of the process with an initial policy; under control of the process, and before the process starts executing code that may perform a risky activity, sending from the process to the operating system a first request to set a self-imposed policy on the process, the first request including an indication of the self-imposed policy and indicating whether the self-imposed policy is revocable or irrevocable, the self-imposed policy setting access restrictions that are more restrictive than the initial policy of the process; under control of the operating system, receiving from the process the first request, storing an indication of the self-imposed policy of the process and whether the self-imposed policy is revocable or irrevocable as indicated by the first request, and sending to the process a cookie containing an identifier associated with the process and an indication of the initial policy, wherein the cookie is needed to revoke the self-imposed policy; under control of the process, receiving from the operating system the cookie, storing the received cookie, starting execution by the processor of the code that may perform a risky activity, and under control of the code that may perform a risky activity, sending to the operating system an access request to access a resource; under control of the operating system, when the self-imposed policy of the process indicates that the access of the received access request is allowed, allowing access to the resource, and when the self-imposed policy of the process indicates that the access of the received access request is not allowed, even though the initial policy would have allowed that access, denying access to the resource; under control of the process, upon completion of execution of the code that may perform the risky activity, sending to the operating system a second request to revoke the self-imposed policy, the second request including the cookie; under control of the operating system, receiving from the process the second request, and in response to receiving the second request, determining whether the self-imposed policy is revocable or irrevocable as indicated by the stored indication of whether the policy is revocable or irrevocable, upon determining that the self-imposed policy is irrevocable, denying the second request so that the process cannot remove access restrictions set by the first request; and upon determining that the self-imposed policy is revocable, retrieving an identifier associated with the process, and when the retrieved identifier matches the identifier contained by the cookie included with the second request, revoking the self-imposed policy on the process set by the first request so that the process can execute without being restricted by the access restrictions set by the self-imposed policy.