Propagating origin information for applications during application installation

A method implemented in a computing device, the method comprising:

• receiving a request to perform an action with regard to a file for an application installed on the computing device;
• accessing a policy applied to the computing device;
• determining whether, based on the policy, an origin of the application is trusted for the computing device, the origin being based at least in part on an origin claim of a process token of an executing application package used to install the application, the process token having received the origin claim from a policy enforcement module that is concurrently executing on the computing device;
• in response to determining that the origin of the application is trusted for the computing device, allowing the action to be performed;
• and
• in response to determining that the origin of the application is not trusted for the computing device, preventing the action from being performed on the computing device unless the policy otherwise indicates that the application can be performed on the computing device.

A computing device comprising:

• one or more processors;
• and
• a computer-readable storage medium having stored thereon multiple instructions that, responsive to execution of an application package by the one or more processors to install an application on the computing device, cause the one or more processors to:
• obtain origin information from a process token of the executing application package, the process token having received the origin information from a policy enforcement module that is concurrently executing on the computing device, the origin information indicating one of:
• a deployment source for the application package, or
• a source of trust for the application package;
• write a file associated with the application to a storage device of the computing device;
• and
• store a copy of the origin information as metadata associated with the file.