Jump to content

Privilege revocation (computing)

Edit links
From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by 212.187.28.214 (talk) at 20:49, 16 August 2007 (→See also). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Privilege revocation is the act of an entity giving up some, or all of, the privileges they possess, or some authority taking those (privileged) rights away.

Information theory

Honoring the Principle of least privilege at a granularity provided by the base system such as sandboxing of (to that point successful) attacks to an unprivileged user account; helps in reliability of computing services provided by the system. As the chances of restarting such a process are better, and other services on the same machine aren't effected (or at least probably not as much as in the alternative case: i.e. a privileged process gone haywire instead).

Computer security

In computing security privilege revocation is a measure taken by a program to protect the system against misuse of itself.

Example

Network service daemons, or administrative utilities with setuid bits set, that have to do some privileged operation only at program loadtime (such as open a raw socket or an Internet socket in the well known ports range) are less of a security risk should they change users to some unprivileged account after so doing. An action otherwise known as dropping root under Unix-like operating systems.

Law terminology

In law the general term is often used when discussing some paper, such as a drivers licence, being voided after a (negative) condition is met by the holder.

References

See also

Retrieved from "https://en.wikipedia.org/w/index.php?title=Privilege_revocation_(computing)&oldid=151679552"