Pervasive Package Identifiers

A system comprising:

• one or more processors;
• and
• one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to perform operations including:
• obtaining, at a computing device as part of installing one or more applications from a package on the computing device, a package identifier from the package;
• maintaining the package identifier in a protected manner such that the package identifier is accessible to an operating system of the device but not to other applications of the device;
• adding capabilities of one or more components included in the package to an access control list of a resource to create a capability security identifier;
• adding a package identifier security identifier to the access control list associated with the stored capabilities for the package;
• using the package identifier security identifier to gain access to the capability security identifier;
• and
• using the capability security identifier to access the resource.

A computing device comprising:

• one or more processors;
• and
• one or more computer-readable storage media comprising computer-readable instructions which, when executed, cause the computing device to implement a method comprising:
• obtaining, at a computing device as part of installing one or more applications from a package on the computing device, a package identifier from the package, the package identifier including a name of the package, a name of a publisher of the package, an identifier of an architecture of computing devices on which the application is designed to operate, an indication of a version of the package, and a value identifying a resource type of the package, the one or more applications being installed only if the publisher of the package included in the package identifier is verified to be the same as the publisher included in a digital certificate associated with the package;
• maintaining the package identifier in a protected manner such that the package identifier is accessible to an operating system of the device but not to other applications of the device;
• using a subset of elements of the package identifier to be a family identifier of the package, the subset of elements including the name of the package and the name of the publisher of the package;
• assigning the family identifier to each of one or more processes created for running the one or more applications by generating a security identifier based on the family identifier and adding the security identifier to a process token of each of the one or more processes;
• and
• responsive to the one or more processes spawning one or more other processes, causing the one or more other processes to inherit the same process token.