Runtime-tailored security policies for applications

Abstract

Techniques are described herein for function-level limiting of privileges for a target application. Privileges dependencies for different functions of an application are determined based on static evaluation of the code base. A call graph with nodes representing the application functions is established, and the nodes are associated with the determined privilege dependencies. The graph is modified using iterative backward dataflow analysis to associate the nodes in the graph with privileges that are reachable from each node. Transition-edges are identified within the graph, where a transition-edge connects nodes having different sets of privileges. Function calls implementing the identified transition-edges are replaced, in instructions for the application (e.g., bytecode or machine code), with calls to wrapper functions. Each wrapper function transfers control to a thread other than the caller thread, to which a security policy for the replaced function is applied, and uses the other thread to execute the replaced function.