Computer Device and Method for Managing Privilege Delegation

A method of managing privilege delegation to control execution of commands on files on a computer device, the method being implemented by hardware of the computer device including at least a processing circuit and a memory, the method comprising:

• intercepting a request in a user account of a logged-in user to execute a command therein on a file having first privileges assigned thereto, wherein the file is provided with an associated agent plugin;
• obtaining information related to the request and forwarding the information to an agent service cooperating with an operating system of the computer device;
• determining whether to execute the command on the file in the user account according to second privileges different from the first privileges;
• launching an agent proxy process having the second privileges assigned thereto by the agent service, responsive to determining to execute the command on the file in the user account according to the second privileges;
• and
• causing the command to be executed on the file in the user account according to the second privileges assigned to the agent proxy process.

A non-transitory computer-readable storage medium having instructions recorded thereon, which when implemented by processing circuitry of a computer device configured to manage privilege delegation to control execution of commands on files on the computer device, cause the computer device to:

• intercept a request in a user account of a logged-in user to execute a command therein on a file having first privileges assigned thereto, wherein the file is provided with an associated agent plugin;
• obtain information related to the request and forward the information to an agent service cooperating with an operating system of the computer device;
• determine whether to execute the command on the file in the user account according to second privileges different from the first privileges;
• launch an agent proxy process having the second privileges assigned thereto by the agent service, responsive to determining to execute the command on the file in the user account according to the second privileges;
• and
• cause the command to be executed on the file in the user account according to the second privileges assigned to the agent proxy process.