Privilege separation

In computer programming and computer security, privilege separation (privsep) is one software-based technique for implementing the principle of least privilege.^[1]^[2] With privilege separation, a program is divided into parts which are limited to the specific privileges they require in order to perform a specific task. This is used to mitigate the potential damage of a computer security vulnerability.

Implementation

A common method to implement privilege separation is to have a computer program fork into two processes. The main program drops privileges, and the smaller program keeps privileges in order to perform a certain task. The two halves then communicate via a socket pair. Thus, any successful attack against the larger program will gain minimal access, even though the pair of programs will be capable of performing privileged operations.

Privilege separation is traditionally accomplished by distinguishing a real user ID/group ID from the effective user ID/group ID, using the setuid(2)/setgid(2) and related system calls, which were specified by POSIX. If these are incorrectly positioned, gaps can allow widespread network penetration.

Many network service daemons have to do a specific privileged operation such as open a raw socket or an Internet socket in the well known ports range. Administrative utilities can require particular privileges at run-time as well. Such software tends to separate privileges by revoking them completely after the critical section is done, and change the user it runs under to some unprivileged account after so doing. This action is known as dropping root under Unix-like operating systems. The unprivileged part is usually run under the "nobody" user or an equivalent separate user account.

Privilege separation can also be done by splitting functionality of a single program into multiple smaller programs, and then assigning the extended privileges to particular parts using file system permissions. That way the different programs have to communicate with each other through the operating system, so the scope of the potential vulnerabilities is limited (since a crash in the less privileged part cannot be exploited to gain privileges, merely to cause a denial-of-service attack).

Examples

Dovecot

Another email server software designed with privilege separation and security in mind is Dovecot.^[3]

OpenBSD

Separation of privileges is one of the major OpenBSD security features.^[4]^[5]

OpenSSH

OpenSSH uses privilege separation to ensure pseudo terminal (pty) creation happens in a secure part of the process, away from per connection processes with network access.^[6]

Postfix

The implementation of Postfix was focused on implementing comprehensive privilege separation.^[7]^[8]

Solaris

Solaris implements a separate set of functions for privilege bracketing.^[9]

References

^ Provos, Niels; Friedl, Markus; Honeyman, Peter (August 4, 2003). "Preventing Privilege Escalation" (PDF). Archived (PDF) from the original on March 25, 2023.
^ "Privilege separation". QNX Software Development Platform. May 17, 2024. Archived from the original on April 14, 2024.
^ "System users used by Dovecot". doc.dovecot.org. August 14, 2024. Archived from the original on June 30, 2024.
^ Obser, Florian (February 19, 2023). "Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD". sha256.net. Archived from the original on June 6, 2024.
^ de Raadt, Theo (September 24, 2006). "Exploit Mitigation Techniques". OpenBSD. Archived from the original on May 15, 2024.
^ Provos, Niels (August 9, 2003). "Privilege Separated OpenSSH". Center for Information Technology Integration. Archived from the original on August 6, 2024.
^ "Postfix Architecture". 2024. Archived from the original on August 3, 2024.
^ "Privilege Separation". csail.mit.edu. 2022. Archived from the original on July 23, 2024.
^ "Bracketing Effective Privileges". Trusted Solaris Developer's Guide. 2010. Archived from the original on August 14, 2024.

[1] Provos, Niels; Friedl, Markus; Honeyman, Peter (August 4, 2003). "Preventing Privilege Escalation" (PDF). Archived (PDF) from the original on March 25, 2023.

[2] "Privilege separation". QNX Software Development Platform. May 17, 2024. Archived from the original on April 14, 2024.

[3] "System users used by Dovecot". doc.dovecot.org. August 14, 2024. Archived from the original on June 30, 2024.

[4] Obser, Florian (February 19, 2023). "Privilege drop, privilege separation, and restricted-service operating mode in OpenBSD". sha256.net. Archived from the original on June 6, 2024.

[5] Raadt, Theo (September 24, 2006). "Exploit Mitigation Techniques". OpenBSD. Archived from the original on May 15, 2024.

[6] Provos, Niels (August 9, 2003). "Privilege Separated OpenSSH". Center for Information Technology Integration. Archived from the original on August 6, 2024.

[7] "Postfix Architecture". 2024. Archived from the original on August 3, 2024.

[8] "Privilege Separation". csail.mit.edu. 2022. Archived from the original on July 23, 2024.

[9] "Bracketing Effective Privileges". Trusted Solaris Developer's Guide. 2010. Archived from the original on August 14, 2024.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

Privilege separation

Implementation

Examples

Dovecot

OpenBSD

OpenSSH

Postfix

Solaris

See also

References

Read other articles:

Crossplay

Centro del Lobo Ibérico de Castilla y León

Choe Hyon

Parareptilia

Noise rock

2013 GEICO 400

Arash Borhani

Vie nuove

Mazie Hirono

California Surf

Gare du Champ de Mars - Tour Eiffel

Società Sportiva Vis Pesaro 1978-1979

Samsung Galaxy S

Dylan O'Brien

Clove

Red Scare (podcast)

Bahasa Lak

Associazione Sportiva Lucchese Libertas 1995-1996

Six Days of Zürich

Emamzadeh District