Automated mechanism to analyze elevated authority usage and capability

A system for securing file access, the system comprising:

• one or more computer processors;
• a memory containing a program which, when executed by the one or more computer processors, performs an operation comprising:
• monitoring a set of file access requests to a file from an application to obtain permission and identity information related to the monitored requests, wherein monitoring the set of file access requests includes obtaining a runtime stack from the application based on a predefined call selected from a system object call and a microcode call;
• determining a set of user privileges available to a user, wherein the set of user privileges is available to the application when the user causes execution of the application;
• determining a set of elevated privileges available to the application when the set of user privileges is insufficient;
• determining, based on environment information in the runtime stack, whether the set of elevated privileges is different from the set of user privileges;
• storing, in a data file, the permission and identity information, information related to the sets of elevated and user privileges, and an indication of whether the set of elevated privileges is greater in scope than the set of user privileges;
• and
• upon determining that the set of user privileges rather than the set of elevated privileges is used to access the file, automatically adjusting the set of user privileges, including removing at least one user privilege from the set of user privileges, whereafter the set of elevated privileges is used to access the file.

A computer program product for securing file access, the computer program product comprising:

• a computer readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by one or more computer processors to perform an operation comprising:
• monitoring a set of file access requests to a file from an application to obtain permission and identity information related to the monitored requests, wherein monitoring the set of file access requests includes obtaining a runtime stack from the application based on a predefined call selected from a system object call and a microcode call;
• determining a set of user privileges available to a user, wherein the set of user privileges is available to the application when the user causes execution of the application;
• determining a set of elevated privileges available to the application when the set of user privileges is insufficient;
• determining, based on environment information in the runtime stack, whether the set of elevated privileges is different from the set of user privileges;
• storing, in a data file, the permission and identity information, information related to the sets of elevated and user privileges, and an indication of whether the set of elevated privileges is greater in scope than the set of user privileges;
• and
• upon determining that the set of user privileges rather than the set of elevated privileges is used to access the file, automatically adjusting the set of user privileges, including removing at least one user privilege from the set of user privileges, whereafter the set of elevated privileges is used to access the file.