Method for attachment and recognition of external authorization policy on file system resources

A method for enforcing security policies over file system objects in a computer system using an external authorization program and comprising the steps of:

• associating a security policy to a protected file system object, where the said security policy capable of granting access to said protected file system object, by generating a file identifier corresponding to each protected file system object by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object and storing a record of each said file identifier and associated protected object name for each said file system object in a database, such that there is a file identifier to protected object name map for each file system object;
• upon an access request to a file system object, checking all protected file system objects using a file identifier to determine if the access request is to a protected object file;
• and
• generating an authorization decision for access to said file system object in response to said file system object access attempt, when the attempted access is to a protected file system object.

A computer program product in a computer readable medium for controlling access to file system resources in a computer system through the use of externally stored attributes comprising the steps of:

• instructions for generating a file identifier corresponding to each file system object that will have protected and controlled access by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object;
• instructions for storing a record of each said file identifier and associated full path name for each said file system object in a database;
• instructions for searching the database, at the initiation of a file system object access attempt to determine if the attempted access is to a protected file system object;
• and
• instructions for generating an authorization decision for access to said file system object in response to said file system object access attempt, when the determination is that the attempted access is to a protected file system object.