System call interception

摘要

System call interception is activated for an application process. It is recorded that system call interception is active for the application process. Ongoing checking is performed to determine whether system call interception remains active.

主权项

1. A non-transitory computer readable medium storing computer readable code, the computer readable code comprising instructions for:
activating system call interception for an application process running under a user session on a device in order to prevent data leaks of sensitive documents having at least a smallest size; recording that system call interception is active for the application process; performing ongoing random or pseudo-random checking by varying an amount of elapsed time between checking to determine whether system call interception remains active for the application process to increase the likelihood of detecting tampering of the system call interception; and, reactivating system call interception for any application process where it is determined system call interception did not remain active and wherein the maximum amount of elapsed time is short enough to ensure sensitive documents having at least the smallest size are not leaked from the device.