PATENT DOCUMENT

Publication Number: US-8352733-B2
Application Number: US-46260006-A
Country: US
Kind Code: B2

Title: Resource restriction systems and methods

Abstract:
Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.

Claims:
1. A method, comprising:
 receiving, by a computer, an execution call to an operating system for launching an application, the execution call being associated with a user; 
 intercepting, by the computer, the execution call using a resource restriction service associated with an operating system kernel; 
 determining, by the computer, and using the resource restriction service and a resource agent, if one or more launch restrictions for the user restrict the launching of the application, including:
 providing, by the resource restriction service, at least one of a user identifier or a system call identifier to the resource agent, the user identifier being usable to identify the user, the system call identifier being usable to identify the execution call; 
 when one of the user identifier or the system call identifier is not provided by the resource restriction service, determining, by the resource agent, the identifier that is not provided; and 
 determining, by the resource agent, whether the one or more launch restrictions for the user restrict the launching of the application based on the user identifier, and the system call identifier, and pre-specified launch restrictions stored in a data store, wherein:
 the resource agent executes outside of the operating system kernel and is configured to communicate with the resource restriction service through a kernel control socket, the kernel control socket being a root-owned socket configured to prevent insertion of a user process, the kernel control socket being registered to the resource restriction service upon loading of the resource restriction service; and 
 
 
 upon determining that the launch restrictions for the user restrict the launching of the application, cancelling the execution call. 
 
     
     
       2. The method of  claim 1  further comprising
 defining the launch restrictions according to a path of the application. 
 
     
     
       3. The method of  claim 1  further comprising
 defining the launch restrictions according to a hash of the application. 
 
     
     
       4. The method of  claim 1  further comprising
 determining if the application is an allowed application; and 
 if whether the application is an allowed application cannot be determined, determining, using the resource restriction service associated with the operating system kernel and the resource agent, if one or more launch restrictions for the user restrict the launching of the application, otherwise granting the execution call if the application is an allowed application. 
 
     
     
       5. The method of  claim 1 , wherein
 the launch restrictions are defined at a user level. 
 
     
     
       6. A system, comprising:
 one or more processors; and 
 computer program instructions tangibly stored in the system, the computer program instructions operable to cause the one or more processor to perform operations comprising:
 receiving an execution call to an operating system for launching an application, the execution call being associated with a user; 
 intercepting the execution call using a resource restriction service associated with an operating system kernel; and 
 determining, using the resource restriction service and a resource agent, if one or more launch restrictions for the user restrict the launching of the application, including:
 providing, by the resource restriction service, at least one of a user identifier or a system call identifier to the resource agent, the user identifier being usable to identify the user, the system call identifier being usable to identify the execution call; 
 when one of the user identifier or the system call identifier is not provided by the resource restriction service, determining, by the resource agent, the identifier that is not provided; and 
 determining, by the resource agent, whether the one or more launch restrictions for the user restrict the launching of the application based on the user identifier, and the system call identifier, and pre-specified launch restrictions stored in a data store, 
 
 
 wherein: 
 the resource agent is configured to execute in a user space outside of the operating system kernel and is configured to communicate with the resource restriction service through a kernel control socket, the kernel control socket being a root-owned socket configured to prevent insertion of a user process, the kernel control socket being registered to the resource restriction service upon loading of the resource restriction service; and
 upon determining that the launch restrictions for the user restrict the launching of the application, cancelling the execution call. 
 
 
     
     
       7. The system of  claim 6 , wherein
 the resource agent is configured to provide one or more user identifiers having associated resource restrictions to the resource restriction service. 
 
     
     
       8. The system of  claim 6 , wherein
 the resource restriction service is a system extension, a boot program, or a library that is linked to a profile of a user. 
 
     
     
       9. The system of  claim 6 , wherein
 the execution call is for launching an application. 
 
     
     
       10. The system of  claim 9 , wherein
 the execution call is for sharing a file. 
 
     
     
       11. The system of  claim 6 , wherein
 the resource restrictions are defined by an application path. 
 
     
     
       12. The method of  claim 1 , wherein the execution call is associated with a user session. 
     
     
       13. The method of  claim 1 , wherein determining using the resource restriction service and the resource agent comprises:
 sending a request from the kernel of the operating system to the resource agent; and 
 receiving a reply from the resource agent executing on the computer through the kernel control socket, the reply including a determination whether the application can be launched, the determination being based on the launch restrictions, and the launch restrictions specifying whether the application can be launched by a user session. 
 
     
     
       14. The method of  claim 1 , wherein the intercepting, determining and canceling are performed at a root level, the root level being a level above a user level at which user-level processes are restricted. 
     
     
       15. The system of  claim 6 , wherein the resource restriction service and the resource agent execute at a root level, the root level being a level above a user level at which user-level processes are restricted. 
     
     
       16. Program instructions tangibly stored on a computer processing system, the program instructions, when executed by the computer processing system, operable to cause the computer processing system to perform operations comprising:
 receiving, by a computer, an execution call to an operating system for launching an application, the execution call being associated with a user; 
 intercepting, by the computer, the execution call using a resource restriction service associated with an operating system kernel; 
 determining, by the computer, and using the resource restriction service associated with the operating system kernel and a resource agent, if one or more launch restrictions for the user restrict the launching of the application, including:
 providing, by the resource restriction service, at least one of a user identifier or a system call identifier to the resource agent, the user identifier being usable to identify the user, the system call identifier being usable to identify the execution call; 
 when one of the user identifier or the system call identifier is not provided by the resource restriction service, determining, by the resource agent, the identifier that is not provided; 
 determining, by the resource agent, whether the one or more launch restrictions for the user restrict the launching of the application based on the user identifier, and the system call identifier, and pre-specified launch restrictions stored in a data store, wherein:
 the resource agent executes outside of the operating system kernel and is configured to communicate with the service associated with the operating system kernel through a kernel control socket, the kernel control socket being a root-owned socket configured to prevent insertion of a user process, the kernel control socket being registered to the service associated with the operating system kernel upon loading of the service associated with the operating system kernel; and 
 
 
 upon determining that the launch restrictions for the user restrict the launching of the application, cancelling the execution call. 
 
     
     
       17. The program instructions of  claim 16 , the operations comprise defining the launch restrictions according to a path or a hash of the application. 
     
     
       18. The program instructions of  claim 16 , wherein the launch restrictions are defined at a user level. 
     
     
       19. The program instructions of  claim 17 , wherein the resource restriction service is a system extension, a boot program, or a library that is linked to a profile of a user.

Description:
BACKGROUND 
     This disclosure relates to enforcing resource restrictions in an environment. 
     Users may often have associated resource restrictions on a computer device, such as a personal computer or other computing device. Typically these resource restrictions are associated with a user identifier. For example, a parent may limit the availability of applications, such as an e-mail client and web browser, on a home computer for a child by associating resource restrictions with the child&#39;s user identifier. When the child logs onto the computer with his or her user identifier, the web browser and e-mail client is not available. Likewise, a workgroup administrator may limit the availability of resources on a business computer for certain employees. For example, a software development company may limit file sharing and/or access to particular development tools for employees according to the employees&#39; user profiles. 
     Restrictions may be circumvented if the restriction is predicated on preventing the generation of a system call for the resource. Thus, if a user determines how to generate the system call for a restricted resource, the user can have access to the resource. For example, a browser application can be restricted for a user by a restriction program that inhibits the generation of menu items, desktop icons and dock ions for launching the browser application. However, if the user clicks on a web address in an HTML enabled document in a word processing program, the word processing program can generate a system call to launch the browser application, thus circumventing the restriction. 
     SUMMARY 
     Disclosed herein are systems and methods for enforcing resource restrictions. 
     In one implementation, an execution call to an operating system for an application launch is received above a user level, and a determination is likewise made above a user level as to whether launch restrictions for a user restrict the application launch. The execution call is cancelled if the launch restrictions for the user restrict the application launch. 
     In another implementation, a system includes a data store, a resource restriction service, and a resource agent. The data store stores data that associates resource restrictions with a user identifier. The resource restriction service is configured to receive system calls related to resources and directed to an operating system, determine resource request data associated with the system call, and provide the resource request data to a resource agent. The resource agent is configured to access the data store and determine whether the resource is restricted based on the resource request data provided by the resource restriction agent and generate access data based on the determination. The access data are provided to the resource restriction service, which in turn grants or denies the system call based on the access data. 
     These and the additional implementations described below facilitate enforcement of resource restrictions on a computer system. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of a system for enforcing resource restrictions. 
         FIG. 2  is a block diagram of an example network environment in which the system of  FIG. 1  can be implemented. 
         FIG. 3  is a flow diagram of an example process for enforcing resource restrictions. 
         FIG. 4  is a flow diagram of an example kernel selection process for enforcing resource restrictions. 
         FIG. 5  is a flow diagram of an example process for enforcing resource restrictions with a user-specific agent. 
         FIG. 6  is a flow diagram of an example process for enforcing resource restrictions with a user-independent agent. 
         FIG. 7  is a flow diagram of an example time-out process for enforcing resource restrictions. 
         FIG. 8  is a flow diagram of an example process for enforcing resource restrictions. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  is a block diagram of a system  100  for enforcing resource restrictions. The system  100  can be implemented in a computer or in a computer network. A data store  102  stores data defining resource restrictions for one or more users. In one implementation, the resource restrictions are associated with users by user identifiers, such as user login names, user profiles, or other user identifiers. The resource restrictions may relate to particular resources, such as an application launch, listening to a socket connection, file sharing, or some other resource initiated by a system call. 
     An operating system  104  includes a resource restriction service  106 . The resource restriction service  106  may comprise code that provides a system-level service for receiving system calls and processing the system call to determine whether the corresponding resources are restricted. In one implementation, the resource restriction service  106  may comprise code that loads during a system startup, such as a system extension or boot program. In another implementation, the resource restriction service  106  may comprise code that loads only as required, such as a library that is linked to a profile of a user having associated restrictions, and which is executed only when that user is logged onto the computer. 
     The resource restriction service  106  is configured to receive system calls and determine the user identifier of a user  120  associated with the system call. In one implementation, the user identifier is determined according to the current user session  122 . Thus, the system call for a resource is associated with the user  120  by the user session  122  regardless of whether the user  120  requests the resource or if a separate process  124  requests the resource. An example separate process  124  may include a program that requests a restricted resource, e.g., a word processing program that includes an HTML link for a restricted browser, or an agent or process launched either intentionally or inadvertently by the user  120 . 
     In one implementation, the resource restriction service  106  is cooperatively associated with a resource agent  108  that determines whether to grant or deny the system call. Alternatively, both these functions can be implemented in the resource restriction service  106 . The resource restriction service  106  provides resource request data, such as the user identifier and/or a system call identifier, to the resource agent  108 . The resource agent  108  is configured to access the data store  102  and determine whether the requested resource is restricted for the user  120  based on the resource request data. In one implementation, the resource agent  108  is configured to determine one or both of the user identifier and system call identifier as necessary to make the restriction determination. For example, if the resource request data includes only a user identifier, then the resource agent  108  can be configured to determine a system call identifier. Likewise, if the resource request data includes only a system call identifier, then the resource agent  108  can be configured to determine the user identifier. In another implementation, the resource request data may only indicate that a system call has been received, and the resource agent  108  can be configured to determine both the user identifier and the system call identifier. 
     The resource agent  108  can be instantiated on a per-user basis. In another implementation, the resource agent  108  can be a background process that operates independent of any user. 
     The resource agent  108  generates access data (e.g., a value) based on the determination and provides the access data to the resource restriction service  106 , which, in turn, grants or denies the system call accordingly. In one implementation, the access data may be a logical value, e.g., a logic 0 to deny the system call and a logic 1 to grant the system call. 
     Communication between the resource restriction service  106  and the resource agent  108  may be through a privileged socket, such as a root-owned socket. For example, upon loading the resource restriction service  106 , the resource restriction service  106  may register a root-owned socket. The privileged socket ensures that user-level processes cannot be inserted into the authorization process. 
     In one implementation, the resource agent  108  informs the resource restriction service  106  that system calls should be monitored for specific user identifiers. The user identifiers are registered with the resource restriction service  106 , and thereafter any system calls for the registered user identifiers cause the resource restriction service  106  to send a request for access data to the resource agent  108 . 
     In another implementations, the resource restriction service  106  comprises a launch restriction extension and the resource agent  108  comprises a user agent. The launch restriction extension is configured to intercept execution calls to a kernel for an application launch and determine resource request data associated with the execution call, and to provide the resource request data to a user agent. The user agent is configured to determine whether an application launch is restricted based on the resource request data provided by the launch restriction agent and generate the launch data based on the determination. The launch restriction extension, in turn, grants or denies the execution call based on the launch data. 
     In another implementation, the resource agent  108  and the resource restriction service  106  are privileged processes. For example, the resource agent  108  and the resource restriction service  106  can be root-owned processes to limit user access. 
     An authorization program  110  is configured to define resource restrictions for users and store the defined resource restrictions in the data store  102 . The authorization program  110  may be associated with a particular user  130 , such as a parent or a workgroup administrator, so that it may only be executed during the user session  130 , or may be password protected by a password known only by the user  130 . The authorization program  110  can thus operate at the user level. 
       FIG. 2  is a block diagram of an example network environment  200  in which the system of  FIG. 1  can be implemented. The network environment  200  includes a computer  202  having a processor  204 , a random access memory  206 , and a data store  208 . 
     In one implementation, the computer  202  can be a client computer, such as a computer connected to a network in a home or an office. The system  100  of  FIG. 1  can be implemented on the computer  202  and enforces resource restrictions on the computer  202 . For example, if the network  210  is the Internet, the system  100  can preclude access to e-mail client software and web browsers for particular users of the computer  202 . 
     In one implementation, the computer  202  can be a server computer, such as a server connected to a local area network. A system wide process, such as a network daemon, can be used to implement a resource agent  108  and communicate with resource restriction services  106  on devices  212 ,  222 , and  232 . The devices  212 ,  222 , and  232  may include client computers or other computer devices, such as personal digital assistants, wireless communication devices, or other devices that can have associated user restrictions. The system of  FIG. 1  can also be implemented in the network environment by other schemes, such as instantiating a resource agent  108  on each client computer  212 ,  222 , and  232 , and centrally locating the user restrictions in the data store  208 . 
       FIG. 3  is a flow digram of an example process  300  for enforcing resource restrictions. Stage  302  defines resource restrictions for a user. In one implementation, resource restrictions can be associated with a user identifier. 
     Stage  304  receives a system call to an operating system for a resource request. In one implementation, the resource restrictions can be application launch restrictions, and the system calls can be execution calls for an application launch. 
     Stage  306  determines if the resource restrictions for the user restrict the resource request. This determination is based on the resource restrictions defined in stage  302 . 
     Stage  308  cancels the system call if the resource restrictions for the user restrict the resource request. 
       FIG. 4  is a flow diagram of an example kernel selection process  320  for enforcing resource restrictions. The kernel selection process  320  is implemented in response to a resource request. Stage  322  determines a user identifier associated with the resource request. The user identifier can be determined, for example, based on the current user session of a user logged onto a computer. 
     Stage  324  determines if there are restrictions associated with the user identifier. If there are no restrictions associated with the user identifier, then stage  326  grants the system call. 
     If there are restrictions associated with the user identifier, however, then stage  328  determines if a kernel process is to determine if the system call is for a resource that is restricted for the user. An example of such a kernel process is a process to determine a restriction based on a bundle identifier of a software program, and which can be implemented in the resource restriction service  108 . If a kernel process is to make such a determination, then stage  330  grants or cancels the system call based on the kernel determination. 
     If, however, a kernel process is not to make such a determination, then stage  332  sends the resource request data to a resource agent (e.g., the resource agent  108 ). The resource agent may implement added functionality not readily available in the kernel or through an extension, such determining a hash, for example. 
     Stage  334  determines the access data based on the resource request data. For example, the resource agent  108  can access the resource restrictions stored in the data store  102  and generate access data, such as a 1 or a 0, based on the resource request data. 
     Stage  336  sends the access data (e.g., a data value) to the kernel process, and thereafter stage  330  grants or cancels the system call accordingly. 
       FIG. 5  is a flow diagram of an example process  350  for enforcing resource restrictions with a user-specific agent. In this implementation, an agent is instantiated for each user. Stage  352  registers a root-owned socket for communicating with a kernel process, such as a socket for the resource restriction service  106 . 
     Stage  354  obtains or determines a user identifier at the user&#39;s login, and stage  356  determines if restrictions are associated with the user identifier. If restrictions are not associated with the user identifier, then stage  358  grants all system calls. 
     If, however, restrictions are associated with the user identifier, then stage  360  launches a resource agent (e.g., the resource agent  108 ) and establishes communication with the kernel process using the root-owned socket. Thereafter, system calls are monitored in stage  362  and granted or canceled by the kernel process and resource agent depending on the resource restrictions associated with the user identifier. 
       FIG. 6  is a flow diagram of an example process  380  for enforcing resource restrictions with a user-independent agent. In this implementation, one agent is instantiated for all users. 
     Stage  382  registers a root-owned socket for communication with a kernel process, such as a socket for the resource restriction service  106 . 
     Stage  384  launches a resource agent (e.g., the resource agent  108 ) and establishes communication between the resource agent and a kernel process using the root-owned socket. The resource agent may be launched during a boot process or in response to a first user login. 
     Stage  386  provides the user identifiers having associated resource restrictions to the kernel process. Thereafter, stage  388  receives a system call, and stage  390  determines if restrictions are associated with the user identifier for the system call. If restrictions are not associated with the user identifier, then stage  392  grants the system call. 
     If, however, restrictions are associated with the user identifier, stage  394  provides resource request data to the resource agent  108 . Process stages similar to stages  334  and  336  of  FIG. 4  are thereafter implemented to grant or deny the system call. 
       FIG. 7  is a flow diagram of an example time-out process  400  for enforcing resource restrictions. The time-out process  400  is an error process that facilitates the processing of allowed system calls in the event that communication between the operating system process and the resource agent (e.g., the resource agent  108 ) is terminated or in the event that the resource agent crashes or is terminated by a user attempting to circumvent the resource restrictions. 
     Stage  402  sends the resource request data to the resource agent. Thereafter, stage  404  determines if access data are received from the resource agent before a time-out period. If the access data are received from the resource agent before a time-out period, then stage  406  grants or cancels the system call according to resource restrictions associated with the user. 
     If the access data are not received from the resource agent before a time-out period, however, then stage  408  determines if the requested resource is an allowed resource. Allowed resource can include resources pre-selected by another user, such as a parent or a workgroup manager. Alternatively, allowed resources can include resources associated with particular system functions. 
     If the resource is not an allowed resource, then the system call is cancelled in stage  410 ; otherwise, the system call is granted in stage  412 . 
       FIG. 8  is a flow diagram of an example process  430  for enforcing resource restrictions. The example process  430  can be implemented in a resource agent (e.g., the resource agent  108 ). The restrictions can be identifier-based, path-based, or hash-based, or based on some other identification scheme. Identifier-based restrictions limit access to a resource based on a resource identifier, such as a non-unique or unique number. Path-based restrictions limit access to a resource based on a path. Hash-based restrictions limit access to a resource based on a hash of a file associated with the resource. 
     Stage  432  receives the resource request data from a resource restriction service (e.g., the resource restriction service  106 ). Stage  434  determines if the resource is subject to a resource identifier-based restriction. If so, the system call is cancelled in stage  436 . 
     If the resource is not subject to a resource identifier-based restriction, then stage  438  determines if the resource is subject to a path-based restriction. If so, the system call is cancelled in stage  436 . 
     If the resource is not subject to a path-based restriction, then stage  440  determines if the resource is subject to a hash-based restriction. If so, the system call is cancelled in stage  436 ; otherwise, the system call is granted in stage  442 . 
     The apparatus, methods, for diagrams, and structure block diagrams described in this patent document may be implemented in computer processing systems including program code comprising program instructions that are executable by the computer processing system. Other implementations may also be used. Additionally, the flow diagrams and structure block diagrams described in this patent document, which describe particular methods and/or corresponding acts in support of steps and corresponding functions in support of disclosed structural means, may also be utilized to implement corresponding software structures and algorithms, and equivalents thereof. 
     This written description sets forth the best mode of the invention and provides examples to describe the invention and to enable a person of ordinary skill in the art to make and use the invention. This written description does not limit the invention to the precise terms set forth. Thus, while the invention has been described in detail with reference to the examples set forth above, those of ordinary skill in the art may effect alternations, modification and variations to the examples without departing from the scope of the invention.

Metadata:
Filing Date: 20060804
Publication Date: 20130108
Grant Date: 20130108
Priority Date: 20060804
Inventors: MANTERE JUSSI-PEKKA
MALUTA ALEXANDER TONY
SCALO JOHN WILLIAM
TYACKE EUGENE RAY
GAYA BRUCE
SMITH MICHAEL JOHN
KIEHTREIBER PETER
COOPER SIMON P.
Assignee: APPLE INC
CPC Classifications: [{"code": "H04L63/104", "inventive": true, "first": true, "tree": "[]"}, {"code": "G06F21/602", "inventive": true, "first": false, "tree": "[]"}, {"code": "G06F21/44", "inventive": true, "first": false, "tree": "[]"}, {"code": "H04L63/104", "inventive": true, "first": false, "tree": "[]"}, {"code": "G06F9/54", "inventive": true, "first": false, "tree": "[]"}, {"code": "G06F9/5005", "inventive": true, "first": true, "tree": "[]"}]
Family ID: 39030655