System and method for providing private session-based access to a redirected USB device or local device

A non-transitory machine-readable storage medium encoded with instructions executable by one or more processors to perform one or more operations, the one or more operations comprising:

• intercepting, at the server, a request to create a symbolic link;
• determining that the intercepted request corresponds to a device object associated with a device remote to the server by:
• traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object;
• and
• determining, based on the identified bus driver, that the device associated with the device object is remote to the server and connected locally to a client that is remote to the server;
• obtaining configuration data of the device;
• creating the symbolic link in an object manager namespace of the server based on the configuration data for the device;
• creating the symbolic link in a local namespace associated with a first user session if the configuration data of the device indicates that access to the device is to be restricted;
• receiving, at the server, a request including the created symbolic link from a second user session;
• determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace;
• and
• blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.

A hardware apparatus, comprising:

• a processor;
• and
• a memory encoded with instructions executable by the processor to perform one or more operations comprising:
• intercepting, at the server, a request to create a symbolic link;
• determining that the intercepted request corresponds to a device object associated with a device remote to the server by:
• traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object;
• and
• determining, based on the identified bus driver, that the device associated with the device object is remote to the server and connected locally to a client that is remote to the server;
• obtaining configuration data of the device;
• creating the symbolic link in an object manager namespace of the server based on the configuration data for the device;
• creating the symbolic link in a local namespace associated with a first user session if the configuration data of the device indicates that access to the device is to be restricted;
• receiving, at the server, a request including the created symbolic link from a second user session;
• determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace;
• and
• blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.