Techniques for minimum permissions detection and verification

• US 20070174899A1
• Filed: 01/23/2006
• Published: 07/26/2007
• Est. Priority Date: 01/23/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Jeffries, Matthew, Cohen, Matthew, Broberg, Eric
• Granted Patent: US 8,321,837 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Techniques are provided for determining a minimum set of permissions for a software component. A first set of minimum permissions is determined for proper execution of the software component. The first set designates one or more permissions. Determining the first set includes performing iterative testing to determine whether one or more user permissions are included in the first set by only disabling one of the user permissions on an iteration. Verification processing may be performed in which a second set of minimum permissions is determined and the first set may be compared to the second set to determine whether the first set is equivalent to the second set.

Claims

1. A method for determining a minimum set of permissions for a software component comprising:

determining a first set of minimum permissions for proper execution of said software component, wherein said first set designates one or more permissions, said determining including performing iterative testing to determine whether one or more user permissions are included in said first set by only disabling one of said user permissions on an iteration.

2. The method of claim 1, further comprising:

performing verification processing and determining a second set of minimum permissions; and

comparing said first set to said second set to determine whether said first set is equivalent to said second set, and

wherein said determining, said performing and said comparing are performed using a test harness.

3. The method of claim 2, wherein said test harness executes in an auto-detection mode to perform said determining step, and a verification mode to perform said performing and said comparing steps.

4. The method of claim 2, wherein said first set is determined to be said minimum set if said first set is equivalent to said second set.

5. The method of claim 3, wherein if said first set includes one or more user permissions, said verification processing further comprises:

determining whether said software component successfully executes using said first set of permissions.

6. The method of claim 5, further comprising:

if said software component does not successfully execute using said first set of permissions, reperforming processing associated with said auto-detection mode.

7. The method of claim 6, further comprising:

performing iterative testing by disabling only one of said user permissions included in said first set on an iteration.

8. The method of claim 7, further comprising:

if said software component does not execute properly when only said one user permission is disabled, determining that said one user permission is included in said second set.

9. The method of claim 1, wherein said iterative testing includes testing one or more administrative permissions, said one or more administrative permissions forming a hierarchy in which only one administrative permission can be designated for a user account.

10. The method of claim 2, wherein said test harness automatically creates a user account and automatically sets permissions for said user account in accordance with processing performed by said test harness.

11. The method of claim 3, wherein a mode for executing said test harness is indicated by an indicator associated with an invocation of a test function for testing said software component.

12. The method of claim 3, wherein said first set of permissions is passed as an input to said test harness when executing in said verification mode.

13. The method of claim 1, wherein said software component executes in an environment including at least one overlapping permission.

14. The method of claim 1, wherein said software component executes in an environment which does not include any overlapping permissions.

15. A test harness for determining a minimum set of permissions for a software component, said test harness comprising computer executable instructions stored on a computer readable medium for performing the steps of:

receiving a first set of minimum permissions for proper execution of said software component, wherein said first set designates one or more permissions, said first set of minimum permissions being determined by executing a first set of processing steps;

executing a second set of processing steps when in a verification mode, said second set of processing steps including;

performing verification processing and determining a second set of minimum permissions; and

comparing said first set to said second set to determine whether said first set is equivalent to said second set.

16. The test harness of claim 15, further comprising:

executing said first set of processing steps when in an auto-detection mode, said first set of processing steps including;

determining said first set of minimum permissions for proper execution of said software component, wherein said first set designates one or more permissions, said determining including performing iterative testing to determine whether one or more user permissions are included in said first set by only disabling one of said user permissions on an iteration; and

wherein if said first set includes one or more user permissions, said second set of processing steps further comprises;

determining whether said software component successfully executes using said first set of permissions.

17. The test harness of claim 16, wherein said second set of processing steps further comprises:

if said software component does not successfully execute using said first set of permissions, reperforming processing associated with said auto-detection mode.

18. The test harness of claim 17, wherein said second set of processing steps further comprises:

performing iterative testing by disabling only one of said user permissions included in said first set on an iteration.

19. The test harness of claim 18, wherein said second set of processing steps further comprises:

if said software component does not execute properly when only said one user permission is disabled, determining that said one user permission is included in said second set.

20. A computer readable medium having computer executable instructions stored thereon for performing steps for determining a minimum set of permissions for executing a code component, the steps comprising:

determining a first set of minimum permissions for proper execution of said code component, wherein said first set designates one or more permissions, said determining including performing iterative testing to determine whether one or more user permissions are included in said first set by only disabling one of said user permissions on an iteration; and

performing verification processing using said first set of minimum permissions, said verification processing including;

determining a second set of minimum permissions; and

comparing said first set to said second set to determine whether said first set is equivalent to said second set.