- Number
- 20220188436
- Published
- 2022-06-16
- Filed
- 2020-12-10
- Assignee
- Disney Enterprises, Inc.
- Inventors
- MIKA; Jeremy A.
- CPC
- G06F21/31; G06F21/602; G06F21/6218; G06F21/45
- Verdict
- Set aside IT file-system security, unrelated
- Source
- Google Patents · FreePatentsOnline
Abstract
Embodiments provide techniques for managing access to files on a computing system. An example method generally includes receiving, from an application, a request by a user to access a specified file on a file system through the application. A permission record is retrieved from a permission repository based on information about the application, the user, and the specified file. A determination is made of whether the user has permission to access a directory in the file system in which the specified file is located, and a determination is made of whether the application is allowed to access the specified file. Based on determining that the user has permission to access the directory in which the specified file is located and determining that the application has permission to access the specified file, the specified file is retrieved from the directory, and the application is granted access to the specified file.
Background
BACKGROUND Field
Aspects of the present disclosure relate to file access mechanisms, and more specifically to file systems that allow applications to or disallow applications from accessing files on the file system. Description of the Related Art
File systems generally store files on a computer system and implement permission-based access to these files stored on the computer system. On many file systems, permissions may be established globally, for specific groups of users, or for a specific user. These permissions may allow a user to read a file, but not write or overwrite the file (i.e., read-only access), read from and write to the file (i.e., read/write access), and/or execute the file (i.e., execute access, where a file includes executable code, such as a Portable Executable file, a Java applet, or other code that can be executed on a computer). When an application attempts to access a file, the file system can use information about the user of the application to determine whether to allow the application to access the file (i.e., grant access to the file) or disallow the application from accessing the file (i.e., block access to the file). In this way, file systems may generally control access to files on a per-user basis so that users are able to interact with files on the file system that they have been granted access to, but are not allowed to interact with files that they should not have access to.
While file systems may be configured to contro
Claims
1. A method for managing access to files on a computer file system, comprising: receiving, from an application, a request by a user to access a specified file on a file system through the application; retrieving, from a permission repository, a permission record based on information about the application, the user, and the specified file; determining whether the user has permission to access a directory in the file system in which the specified file is located; determining whether the application is allowed to access the specified file; and based on determining that the user has permission to access the directory in which the specified file is located and determining that the application has permission to access the specified file, retrieving the specified file from the directory and granting the application access to the specified file. ||
13. A system, comprising: a processor; and a memory having instructions stored thereon which, when executed by the processor, performs an operation for managing access to files on a computer file system, the operation comprising: receiving, from an application, a request by a user to access a specified file on a file system through the application, retrieving, from a permission repository, a permission record based on information about the application, the user, and the specified file, determining whether the user has permission to access a directory in the file system in which the specified file is located, determining whether the application is allowed to access the specified file, and based on determining that the user has permission to access the directory in which the specified file is located and determining that application has permission to access the specified file, retrieving the specified file from the directory and granting the application access to the specified file. ||
20. A computer-readable medium having instructions stored thereon which, when executed by a processor, performs an operation for managing access to files on a computer file system, the operation comprising: receiving, from an application, a request by a user to access a specified file on a file system through the application; retrieving, from a permission repository, a permission record based on information about the application, the user, and the specified file; determining whether the user has permission to access a directory in the file system in which the specified file is located; determining whether the application is allowed to access the specified file; and based on determining that the user has permission to access the directory in the file system in which the specified file is located and determining that the application has permission to access files in the directory in which the specified file is located, retrieving the specified file from the directory and granting the application access to the specified file.