Device protection using pre-execution command interception and evaluation

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured to implement the following steps:
• obtaining, by at least one software entity of an operating system kernel of at least one processing device comprising a processor coupled to a memory, one or more commands from a user prior to an execution of the one or more commands on the at least one processing device, wherein the obtaining comprises the at least one software entity of the operating system kernel intercepting the one or more commands on the at least one processing device, prior to the execution of the one or more commands, wherein the operating system kernel holds the intercepted one or more commands during an evaluation of the intercepted one or more commands;
• providing, by the at least one software entity of the operating system kernel, in response to the one or more commands, an approval request to at least one approval entity to evaluate whether to execute the one or more commands, wherein the approval request requests the at least one approval entity to approve the execution of the one or more commands on the at least one processing device;
• and
• initiating the execution of the one or more commands based at least in part on a result of the evaluation, by the at least one approval entity, of whether to execute the intercepted one or more commands, wherein the operating system kernel releases the hold of the intercepted one or more commands for execution in response to the at least one approval entity approving the execution of the one or more commands on the at least one processing device.

A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:

• obtaining, by at least one software entity of an operating system kernel of at least one processing device comprising a processor coupled to a memory, one or more commands from a user prior to an execution of the one or more commands on the at least one processing device, wherein the obtaining comprises the at least one software entity of the operating system kernel intercepting the one or more commands on the at least one processing device, prior to the execution of the one or more commands, wherein the operating system kernel holds the intercepted one or more commands during an evaluation of the intercepted one or more commands;
• providing, by the at least one software entity of the operating system kernel, in response to the one or more commands, an approval request to at least one approval entity to evaluate whether to execute the one or more commands, wherein the approval request requests the at least one approval entity to approve the execution of the one or more commands on the at least one processing device;
• and
• initiating the execution of the one or more commands based at least in part on a result of the evaluation, by the at least one approval entity, of whether to execute the intercepted one or more commands, wherein the operating system kernel releases the hold of the intercepted one or more commands for execution in response to the at least one approval entity approving the execution of the one or more commands on the at least one processing device.